Follow-up from review of #3270.
Two runtime contracts introduced/relied upon in that PR have no automated regression guard by nature — helm-unittest can only render, not exercise them:
- The endpoint derive-from-Secret path relies on helm
lookup, which returns nothing under helm-unittest — the unit tests exercise only the fallback (the suite's own NOTE admits this).
- The pre-upgrade hook's delete-if-pre-1.6 shell logic can't be exercised by helm-unittest (it only renders).
Both were verified live on a 1.5.2→1.6.0-rc.1 adoption (per the #3270 PR body) and are genuinely e2e-only contracts, consistent with the repo philosophy that the plugin↔cluster contract belongs in e2e, not in manifest-parsing unit tests.
Action: ensure the named 1.5→1.6 e2e upgrade job is actually wired into CI as the authoritative guard — it is the only thing standing behind both behaviors.
Non-blocking recommendation raised during the LGTM review of #3270.
Follow-up from review of #3270.
Two runtime contracts introduced/relied upon in that PR have no automated regression guard by nature — helm-unittest can only render, not exercise them:
lookup, which returns nothing under helm-unittest — the unit tests exercise only the fallback (the suite's own NOTE admits this).Both were verified live on a 1.5.2→1.6.0-rc.1 adoption (per the #3270 PR body) and are genuinely e2e-only contracts, consistent with the repo philosophy that the plugin↔cluster contract belongs in e2e, not in manifest-parsing unit tests.
Action: ensure the named 1.5→1.6 e2e upgrade job is actually wired into CI as the authoritative guard — it is the only thing standing behind both behaviors.
Non-blocking recommendation raised during the LGTM review of #3270.