From 18a15468856fbd9a2997adffc719b01ebaaf3725 Mon Sep 17 00:00:00 2001
From: Nick MacCarthy <nicholas.maccarthy.-nd@disney.com>
Date: Wed, 17 Jun 2026 08:31:30 -0400
Subject: [PATCH 1/4] test: add helm-unittest suites and CI for kafka-ui chart

Introduce helm-unittest as a fast, cluster-free unit-testing harness for
the kafka-ui chart, plus a CI job that runs it on every chart PR.

Suites cover the core templates:
  - ingress.yaml    API version selection, TLS, ingressClassName, templated host
  - service.yaml    type/port, NodePort/LoadBalancer specifics, selector labels
  - deployment.yaml replicas vs. autoscaling, image reference, probes, env wiring
  - NOTES.txt       ClusterIP port-forward fallback

A tests/README.md documents how to run the suites and the pattern for
adding tests when new templates or features land.

The new `unit-test` job in .github/workflows/helm.yaml installs the
plugin and runs `helm unittest charts/kafka-ui`.
---
 .github/workflows/helm.yaml                |  13 ++
 charts/kafka-ui/Chart.yaml                 |   2 +-
 charts/kafka-ui/tests/README.md            |  57 +++++++
 charts/kafka-ui/tests/deployment_test.yaml | 172 +++++++++++++++++++++
 charts/kafka-ui/tests/ingress_test.yaml    | 146 +++++++++++++++++
 charts/kafka-ui/tests/notes_test.yaml      |  10 ++
 charts/kafka-ui/tests/service_test.yaml    |  80 ++++++++++
 7 files changed, 479 insertions(+), 1 deletion(-)
 create mode 100644 charts/kafka-ui/tests/README.md
 create mode 100644 charts/kafka-ui/tests/deployment_test.yaml
 create mode 100644 charts/kafka-ui/tests/ingress_test.yaml
 create mode 100644 charts/kafka-ui/tests/notes_test.yaml
 create mode 100644 charts/kafka-ui/tests/service_test.yaml

diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml
index 2dbdd77..8269ddc 100644
--- a/.github/workflows/helm.yaml
+++ b/.github/workflows/helm.yaml
@@ -7,6 +7,19 @@ on:
   paths:
    - "charts/**"
 jobs:
+  unit-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Helm tool installer
+        uses: Azure/setup-helm@v3
+
+      - name: Install helm-unittest plugin
+        run: helm plugin install https://github.com/helm-unittest/helm-unittest
+
+      - name: Run helm unit tests
+        run: helm unittest charts/kafka-ui
+
   build-and-test:
     runs-on: ubuntu-latest
     steps:
diff --git a/charts/kafka-ui/Chart.yaml b/charts/kafka-ui/Chart.yaml
index 13a1a6c..58939ff 100644
--- a/charts/kafka-ui/Chart.yaml
+++ b/charts/kafka-ui/Chart.yaml
@@ -2,6 +2,6 @@ apiVersion: v2
 name: kafka-ui
 description: A Helm chart for kafka-UI
 type: application
-version: 1.6.4
+version: 1.6.6
 appVersion: v1.5.0
 icon: https://raw.githubusercontent.com/kafbat/kafka-ui/main/documentation/images/logo_new.png
diff --git a/charts/kafka-ui/tests/README.md b/charts/kafka-ui/tests/README.md
new file mode 100644
index 0000000..6e26dac
--- /dev/null
+++ b/charts/kafka-ui/tests/README.md
@@ -0,0 +1,57 @@
+# Chart unit tests
+
+These suites use [`helm-unittest`](https://github.com/helm-unittest/helm-unittest)
+to render the chart's templates and assert on the resulting manifests. They run
+in milliseconds, need no Kubernetes cluster, and catch template regressions
+(missing fields, broken conditionals, failed `fail`/`required` guards) before a
+change is ever applied.
+
+## Running locally
+
+Install the plugin once:
+
+```bash
+helm plugin install https://github.com/helm-unittest/helm-unittest
+```
+
+Then run the suites from the repository root:
+
+```bash
+helm unittest charts/kafka-ui
+```
+
+## Layout
+
+One suite per template, named `<template>_test.yaml`:
+
+| Suite | Template under test | Highlights |
+|-------|---------------------|------------|
+| `ingress_test.yaml`    | `ingress.yaml`    | API version selection, TLS, ingressClassName, templated host |
+| `service_test.yaml`    | `service.yaml`    | type/port, NodePort/LoadBalancer specifics, selector labels |
+| `deployment_test.yaml` | `deployment.yaml` | replicas vs. autoscaling, image reference, probes, env wiring |
+| `notes_test.yaml`      | `NOTES.txt`       | ClusterIP port-forward fallback |
+
+## Adding tests for a new feature
+
+When you add or change a template, add or update the matching `*_test.yaml`
+suite in the same PR. A good suite covers:
+
+1. **Does not render when disabled** — the feature's `enabled: false` path.
+2. **Renders correctly when enabled** — kind, apiVersion, name, namespace.
+3. **Each configurable knob** — one assertion per value that changes output.
+4. **Guards** — every `fail`/`required` is exercised with `failedTemplate`
+   so a misconfiguration is a red test, not a red CI render.
+
+### Notes for templates that `include` siblings
+
+`deployment.yaml` builds checksum annotations by `include`-ing `configmap.yaml`,
+`configmap_fromValues.yaml` and `secret.yaml`. Those templates must be listed
+under `templates:` so the includes resolve, and each test uses a
+`documentSelector` with `skipEmptyTemplates: true` to assert against the
+Deployment document while ignoring the (often empty) configmap/secret renders.
+
+### Notes for `NOTES.txt`
+
+`NOTES.txt` is plain text, not a manifest, so use the raw assertions
+(`matchRegexRaw`, `equalRaw`) which operate on the rendered text directly
+instead of a YAML `path`.
diff --git a/charts/kafka-ui/tests/deployment_test.yaml b/charts/kafka-ui/tests/deployment_test.yaml
new file mode 100644
index 0000000..febc5b9
--- /dev/null
+++ b/charts/kafka-ui/tests/deployment_test.yaml
@@ -0,0 +1,172 @@
+suite: Deployment
+
+# deployment.yaml computes checksum annotations by include-ing configmap.yaml,
+# configmap_fromValues.yaml and secret.yaml, so those templates must be loaded
+# for the suite to render. Those three emit no documents under most of these
+# cases, so each test selects the Deployment document and skips empty templates.
+templates:
+  - deployment.yaml
+  - configmap.yaml
+  - configmap_fromValues.yaml
+  - secret.yaml
+
+tests:
+  - it: renders a Deployment with the fullname and release namespace
+    release:
+      name: kafka-ui
+      namespace: kafka
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - isKind:
+          of: Deployment
+      - isAPIVersion:
+          of: apps/v1
+      - equal:
+          path: metadata.name
+          value: kafka-ui
+      - equal:
+          path: metadata.namespace
+          value: kafka
+
+  - it: sets replicas from replicaCount when autoscaling is disabled
+    set:
+      replicaCount: 3
+      autoscaling:
+        enabled: false
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 3
+
+  - it: omits replicas when autoscaling is enabled
+    set:
+      autoscaling:
+        enabled: true
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - notExists:
+          path: spec.replicas
+
+  - it: builds the image reference from registry, repository and appVersion
+    chart:
+      appVersion: v1.5.0
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: ghcr.io/kafbat/kafka-ui:v1.5.0
+
+  - it: allows the image tag to be overridden
+    set:
+      image:
+        tag: v1.4.0
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: ghcr.io/kafbat/kafka-ui:v1.4.0
+
+  - it: honours a global imageRegistry override
+    set:
+      global:
+        imageRegistry: my-mirror.example.com
+      image:
+        tag: v1.5.0
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: my-mirror.example.com/kafbat/kafka-ui:v1.5.0
+
+  - it: exposes the http container port 8080
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].ports[0].name
+          value: http
+      - equal:
+          path: spec.template.spec.containers[0].ports[0].containerPort
+          value: 8080
+
+  - it: wires the service account name
+    release:
+      name: kafka-ui
+    set:
+      serviceAccount:
+        create: true
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: kafka-ui
+
+  - it: defines liveness, readiness and startup probes
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - exists:
+          path: spec.template.spec.containers[0].livenessProbe
+      - exists:
+          path: spec.template.spec.containers[0].readinessProbe
+      - exists:
+          path: spec.template.spec.containers[0].startupProbe
+
+  - it: renders env entries supplied via env
+    set:
+      env:
+        - name: MY_VAR
+          value: my-value
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: MY_VAR
+            value: my-value
+
+  - it: sets the config additional-location env when yamlApplicationConfig is set
+    set:
+      yamlApplicationConfig:
+        kafka:
+          clusters:
+            - name: local
+    documentSelector:
+      path: kind
+      value: Deployment
+      skipEmptyTemplates: true
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SPRING_CONFIG_ADDITIONAL-LOCATION
+            value: /kafka-ui/config.yml
diff --git a/charts/kafka-ui/tests/ingress_test.yaml b/charts/kafka-ui/tests/ingress_test.yaml
new file mode 100644
index 0000000..011a123
--- /dev/null
+++ b/charts/kafka-ui/tests/ingress_test.yaml
@@ -0,0 +1,146 @@
+suite: Ingress
+
+templates:
+  - ingress.yaml
+
+tests:
+  - it: does not render when ingress is disabled
+    set:
+      ingress:
+        enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders a networking.k8s.io/v1 Ingress on modern clusters
+    capabilities:
+      majorVersion: 1
+      minorVersion: 21
+      apiVersions:
+        - networking.k8s.io/v1
+    release:
+      name: kafka-ui
+      namespace: kafka
+    set:
+      ingress:
+        enabled: true
+        host: kafka-ui.local
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Ingress
+      - isAPIVersion:
+          of: networking.k8s.io/v1
+      - equal:
+          path: metadata.name
+          value: kafka-ui
+      - equal:
+          path: metadata.namespace
+          value: kafka
+
+  - it: routes the default path to the kafka-ui service
+    capabilities:
+      majorVersion: 1
+      minorVersion: 21
+      apiVersions:
+        - networking.k8s.io/v1
+    release:
+      name: kafka-ui
+    set:
+      service:
+        port: 8080
+      ingress:
+        enabled: true
+        host: kafka-ui.local
+        path: /
+        pathType: Prefix
+    asserts:
+      - equal:
+          path: spec.rules[0].host
+          value: kafka-ui.local
+      - equal:
+          path: spec.rules[0].http.paths[0].backend.service.name
+          value: kafka-ui
+      - equal:
+          path: spec.rules[0].http.paths[0].backend.service.port.number
+          value: 8080
+      - equal:
+          path: spec.rules[0].http.paths[0].pathType
+          value: Prefix
+
+  - it: sets the ingressClassName when provided
+    capabilities:
+      majorVersion: 1
+      minorVersion: 21
+      apiVersions:
+        - networking.k8s.io/v1
+    set:
+      ingress:
+        enabled: true
+        host: kafka-ui.local
+        ingressClassName: nginx
+    asserts:
+      - equal:
+          path: spec.ingressClassName
+          value: nginx
+
+  - it: renders a TLS block when tls is enabled
+    capabilities:
+      majorVersion: 1
+      minorVersion: 21
+      apiVersions:
+        - networking.k8s.io/v1
+    set:
+      ingress:
+        enabled: true
+        host: kafka-ui.local
+        tls:
+          enabled: true
+          secretName: kafka-ui-tls
+    asserts:
+      - equal:
+          path: spec.tls[0].hosts[0]
+          value: kafka-ui.local
+      - equal:
+          path: spec.tls[0].secretName
+          value: kafka-ui-tls
+
+  - it: templates the host value
+    capabilities:
+      majorVersion: 1
+      minorVersion: 21
+      apiVersions:
+        - networking.k8s.io/v1
+    release:
+      name: kafka-ui
+    set:
+      ingress:
+        enabled: true
+        host: "{{ .Release.Name }}.example.com"
+    asserts:
+      - equal:
+          path: spec.rules[0].host
+          value: kafka-ui.example.com
+
+  - it: renders additional labels and annotations
+    capabilities:
+      majorVersion: 1
+      minorVersion: 21
+      apiVersions:
+        - networking.k8s.io/v1
+    set:
+      ingress:
+        enabled: true
+        host: kafka-ui.local
+        labels:
+          custom-label: custom-value
+        annotations:
+          nginx.ingress.kubernetes.io/rewrite-target: /
+    asserts:
+      - equal:
+          path: metadata.labels.custom-label
+          value: custom-value
+      - equal:
+          path: metadata.annotations["nginx.ingress.kubernetes.io/rewrite-target"]
+          value: /
diff --git a/charts/kafka-ui/tests/notes_test.yaml b/charts/kafka-ui/tests/notes_test.yaml
new file mode 100644
index 0000000..e1f997f
--- /dev/null
+++ b/charts/kafka-ui/tests/notes_test.yaml
@@ -0,0 +1,10 @@
+suite: NOTES
+
+templates:
+  - NOTES.txt
+
+tests:
+  - it: falls back to the ClusterIP port-forward note by default
+    asserts:
+      - matchRegexRaw:
+          pattern: "port-forward"
diff --git a/charts/kafka-ui/tests/service_test.yaml b/charts/kafka-ui/tests/service_test.yaml
new file mode 100644
index 0000000..5a7ea03
--- /dev/null
+++ b/charts/kafka-ui/tests/service_test.yaml
@@ -0,0 +1,80 @@
+suite: Service
+
+templates:
+  - service.yaml
+
+tests:
+  - it: renders a Service with the fullname and release namespace
+    release:
+      name: kafka-ui
+      namespace: kafka
+    asserts:
+      - hasDocuments:
+          count: 1
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.name
+          value: kafka-ui
+      - equal:
+          path: metadata.namespace
+          value: kafka
+
+  - it: defaults to ClusterIP on port 80 named http
+    asserts:
+      - equal:
+          path: spec.type
+          value: ClusterIP
+      - equal:
+          path: spec.ports[0].port
+          value: 80
+      - equal:
+          path: spec.ports[0].name
+          value: http
+      - equal:
+          path: spec.ports[0].targetPort
+          value: http
+
+  - it: honours a custom service type and port
+    set:
+      service:
+        type: LoadBalancer
+        port: 8080
+    asserts:
+      - equal:
+          path: spec.type
+          value: LoadBalancer
+      - equal:
+          path: spec.ports[0].port
+          value: 8080
+
+  - it: sets nodePort only for NodePort services
+    set:
+      service:
+        type: NodePort
+        nodePort: 30080
+    asserts:
+      - equal:
+          path: spec.ports[0].nodePort
+          value: 30080
+
+  - it: sets loadBalancerIP only for LoadBalancer services
+    set:
+      service:
+        type: LoadBalancer
+        loadBalancerIP: 10.0.0.10
+    asserts:
+      - equal:
+          path: spec.loadBalancerIP
+          value: 10.0.0.10
+
+  - it: uses the selector labels for the pod selector
+    release:
+      name: kafka-ui
+    asserts:
+      - equal:
+          path: spec.selector["app.kubernetes.io/name"]
+          value: kafka-ui
+      - equal:
+          path: spec.selector["app.kubernetes.io/instance"]
+          value: kafka-ui

From e7737f1512f8cb10059fa3fba2147890f320f2e6 Mon Sep 17 00:00:00 2001
From: Nick MacCarthy <nicholas.maccarthy.-nd@disney.com>
Date: Wed, 17 Jun 2026 08:38:47 -0400
Subject: [PATCH 2/4] chore: add pre-commit config mirroring chart CI

Add .pre-commit-config.yaml so contributors can run the same checks CI
enforces before pushing:

  - helm-unittest          runs the chart's unit tests (matches the
                           unit-test workflow job)
  - readme-generator       regenerates CONFIGURATION.md from values.yaml
                           @param metadata (matches the update-config-docs
                           workflow, which otherwise auto-commits it)
  - hygiene                trailing-whitespace, end-of-file, merge-conflict,
                           large-file and yaml checks (Helm templates excluded)

The readme-generator hook also brings CONFIGURATION.md back in sync: the
startup-probe parameters added in #64 had not been regenerated.

Install with: pre-commit install
---
 .pre-commit-config.yaml          | 48 ++++++++++++++++++++++++++++++++
 charts/kafka-ui/CONFIGURATION.md |  3 ++
 2 files changed, 51 insertions(+)
 create mode 100644 .pre-commit-config.yaml

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..a93ecad
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,48 @@
+# Pre-commit hooks for kafbat/helm-charts
+#
+# Install once:   pre-commit install
+# Run on demand:  pre-commit run --all-files
+#
+# These mirror what CI enforces (see .github/workflows/), so contributors
+# catch issues locally before pushing. During a normal `git commit` the hooks
+# only run against the files you staged, so they won't churn unrelated files.
+repos:
+  # Render the chart templates and assert on the output. Mirrors the
+  # `unit-test` job in .github/workflows/helm.yaml. Requires the plugin:
+  #   helm plugin install https://github.com/helm-unittest/helm-unittest
+  - repo: local
+    hooks:
+      - id: helm-unittest
+        name: helm unittest (kafka-ui)
+        entry: helm unittest charts/kafka-ui
+        language: system
+        files: '^charts/kafka-ui/(templates/.*|values\.yaml|Chart\.yaml|tests/.*\.yaml)$'
+        pass_filenames: false
+        verbose: true
+
+  # Keep CONFIGURATION.md in sync with the @param metadata in values.yaml.
+  # Mirrors the "Update README from values.yaml metadata" workflow, which
+  # otherwise auto-commits this on the PR.
+  - repo: local
+    hooks:
+      - id: readme-generator-for-helm
+        name: regenerate CONFIGURATION.md from values.yaml
+        entry: npx --yes @bitnami/readme-generator-for-helm --values charts/kafka-ui/values.yaml --readme charts/kafka-ui/CONFIGURATION.md
+        language: system
+        files: '^charts/kafka-ui/(values\.yaml|CONFIGURATION\.md)$'
+        pass_filenames: false
+
+  # General hygiene. These act only on staged files during a normal commit.
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+        # Helm templates rely on significant whitespace in places; leave them.
+        exclude: '^charts/.*/templates/.*$'
+      - id: end-of-file-fixer
+        exclude: '^charts/.*/templates/.*$'
+      - id: check-merge-conflict
+      - id: check-added-large-files
+      - id: check-yaml
+        # Helm templates are Go templates, not plain YAML — skip them.
+        exclude: '^charts/.*/templates/.*$'
diff --git a/charts/kafka-ui/CONFIGURATION.md b/charts/kafka-ui/CONFIGURATION.md
index 7a4d3bd..5f4aca5 100644
--- a/charts/kafka-ui/CONFIGURATION.md
+++ b/charts/kafka-ui/CONFIGURATION.md
@@ -58,6 +58,9 @@
 | `probes.readiness.initialDelaySeconds` | Initial delay seconds for readiness probe                 | `10`    |
 | `probes.readiness.periodSeconds`       | Period seconds for readiness probe                        | `30`    |
 | `probes.readiness.timeoutSeconds`      | Timeout seconds for readiness probe                       | `10`    |
+| `probes.startup.failureThreshold`      | Failure threshold for startup probe                       | `5`     |
+| `probes.startup.periodSeconds`         | Period seconds for startup probe                          | `40`    |
+| `probes.startup.timeoutSeconds`        | Timeout seconds for startup probe                         | `10`    |
 
 ### Security Context
 

From 8779c36c0787ec16e051a45a7a155cdbfbaf5091 Mon Sep 17 00:00:00 2001
From: Nick MacCarthy <nicholas.maccarthy.-nd@disney.com>
Date: Wed, 17 Jun 2026 09:32:48 -0400
Subject: [PATCH 3/4] ci: harden unit-test job (checkout@v4, least-privilege
 permissions)

Address CodeRabbit feedback on the new unit-test job:
  - bump actions/checkout to v4 (v3 runner is deprecated)
  - add an explicit `permissions: contents: read` block

Scoped to the new job only; the pre-existing jobs are left untouched
to keep this PR additive.
---
 .github/workflows/helm.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml
index 8269ddc..9c18114 100644
--- a/.github/workflows/helm.yaml
+++ b/.github/workflows/helm.yaml
@@ -9,8 +9,10 @@ on:
 jobs:
   unit-test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Helm tool installer
         uses: Azure/setup-helm@v3
 

From a6e110e2d159166d3b0801c9303c7c31d11c487b Mon Sep 17 00:00:00 2001
From: Nick MacCarthy <nicholas.maccarthy.-nd@disney.com>
Date: Wed, 17 Jun 2026 15:20:33 -0400
Subject: [PATCH 4/4] ci: pin helm-unittest plugin to v1.1.1

Per maintainer request: pin the plugin install to a fixed version
instead of pulling the default branch, for reproducible CI runs.
---
 .github/workflows/helm.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/helm.yaml b/.github/workflows/helm.yaml
index 9c18114..7f18822 100644
--- a/.github/workflows/helm.yaml
+++ b/.github/workflows/helm.yaml
@@ -17,7 +17,7 @@ jobs:
         uses: Azure/setup-helm@v3
 
       - name: Install helm-unittest plugin
-        run: helm plugin install https://github.com/helm-unittest/helm-unittest
+        run: helm plugin install https://github.com/helm-unittest/helm-unittest --version v1.1.1
 
       - name: Run helm unit tests
         run: helm unittest charts/kafka-ui