From c41ecad2a4cb8db9673ebb0779a34f94138f6d8e Mon Sep 17 00:00:00 2001
From: Evan Tepsic <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 15:52:13 -0400
Subject: [PATCH 01/18] fix(chart): add trailing newline to Chart.yaml

---
 charts/graylog/Chart.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/graylog/Chart.yaml b/charts/graylog/Chart.yaml
index 2f301d3..052f68d 100644
--- a/charts/graylog/Chart.yaml
+++ b/charts/graylog/Chart.yaml
@@ -65,4 +65,4 @@ annotations:
 # This is the chart version.
 version: 1.0.0
 # This is the version number of the Graylog application bundled with this chart.
-appVersion: "7.0"
\ No newline at end of file
+appVersion: "7.0"

From 4e2e4f8501a09fa03acfdde554370b2124410f3b Mon Sep 17 00:00:00 2001
From: Evan Tepsic <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 15:53:25 -0400
Subject: [PATCH 02/18] fix(values): add trailing newline to values.yaml

---
 charts/graylog/values.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/charts/graylog/values.yaml b/charts/graylog/values.yaml
index 958eb5a..821c6d6 100644
--- a/charts/graylog/values.yaml
+++ b/charts/graylog/values.yaml
@@ -348,4 +348,4 @@ mongodb:
         - apiGroups: [ "" ]
           resources: [ "pods" ]
           resourceNames: [ ]
-          verbs: [ "get", "patch", "delete" ]
\ No newline at end of file
+          verbs: [ "get", "patch", "delete" ]

From ad6d4957d401a729a5819fba383e7af972f55d2f Mon Sep 17 00:00:00 2001
From: Evan Tepsic <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 15:53:41 -0400
Subject: [PATCH 03/18] style(values): remove inner spaces in RBAC role-rules
 brackets

---
 charts/graylog/values.yaml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/charts/graylog/values.yaml b/charts/graylog/values.yaml
index 821c6d6..ea388b4 100644
--- a/charts/graylog/values.yaml
+++ b/charts/graylog/values.yaml
@@ -341,11 +341,11 @@ mongodb:
     role:
       create: true
       rules:
-        - apiGroups: [ "" ]
-          resources: [ "secrets" ]
-          resourceNames: [ ]
-          verbs: [ "get" ]
-        - apiGroups: [ "" ]
-          resources: [ "pods" ]
-          resourceNames: [ ]
-          verbs: [ "get", "patch", "delete" ]
+        - apiGroups: [""]
+          resources: ["secrets"]
+          resourceNames: []
+          verbs: ["get"]
+        - apiGroups: [""]
+          resources: ["pods"]
+          resourceNames: []
+          verbs: ["get", "patch", "delete"]

From 60cbefee6f380cfac0ceb0fe91513c4d5e93d084 Mon Sep 17 00:00:00 2001
From: Evan Tepsic <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 15:53:48 -0400
Subject: [PATCH 04/18] ci(gha): add chart-testing config (.github/ct.yaml)

---
 .github/ct.yaml | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 .github/ct.yaml

diff --git a/.github/ct.yaml b/.github/ct.yaml
new file mode 100644
index 0000000..098f039
--- /dev/null
+++ b/.github/ct.yaml
@@ -0,0 +1,11 @@
+# Configuration for chart-testing (ct), used by .github/workflows/lint-and-test.yaml
+# Full reference: https://github.com/helm/chart-testing
+
+chart-dirs:
+  - charts
+
+target-branch: main
+
+# Chart.yaml does not declare a maintainers list today; enabling this would
+# block linting. Revisit if a maintainers list is added.
+validate-maintainers: false

From 55d7c11aa3975a5d54e9f9b1c0926cfc77f58be4 Mon Sep 17 00:00:00 2001
From: Evan Tepsic <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 15:53:52 -0400
Subject: [PATCH 05/18] ci(gha): replace bare helm lint with
 chart-testing-action

---
 .github/workflows/lint-and-test.yaml | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index a79a3eb..d7333e1 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -10,5 +10,24 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - run: helm lint charts/graylog
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.16.4
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.8.0
+
+      - name: Run ct lint
+        run: ct lint --config .github/ct.yaml --all

From aeacced414fdd2fc3b57aa540130a32913f01a98 Mon Sep 17 00:00:00 2001
From: Evan Tepsic <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 16:02:46 -0400
Subject: [PATCH 06/18] ci(gha): refine workflow per first-run annotations
 (drop redundant setup-python, bump checkout/setup-helm, drop deprecated
 token)

---
 .github/workflows/lint-and-test.yaml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index d7333e1..acb173f 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -11,20 +11,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@v5
         with:
           version: v3.16.4
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.x'
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@v2.8.0

From 4fd5db816f801c60ef8584d930bf15c8c5620ddf Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 20:16:23 -0400
Subject: [PATCH 07/18] feat(ci): add minimal-resource overlay for ct install

---
 charts/graylog/ci/ci-values.yaml | 33 ++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 charts/graylog/ci/ci-values.yaml

diff --git a/charts/graylog/ci/ci-values.yaml b/charts/graylog/ci/ci-values.yaml
new file mode 100644
index 0000000..303ebf8
--- /dev/null
+++ b/charts/graylog/ci/ci-values.yaml
@@ -0,0 +1,33 @@
+# CI overlay used by `ct install` (auto-discovered via charts/graylog/ci/*-values.yaml).
+# Minimal-resource configuration tuned to fit a default GitHub-hosted runner
+# (~7 GB RAM, 4 vCPU). Not intended for production-like validation.
+
+graylog:
+  replicas: 1
+  config:
+    serverJavaOpts: "-Xms512m -Xmx768m"
+  resources:
+    requests:
+      cpu: "250m"
+      memory: "768Mi"
+    limits:
+      cpu: "1"
+      memory: "1500Mi"
+
+datanode:
+  replicas: 1
+  config:
+    opensearchHeap: "1g"
+    javaOpts: "-Xms512m -Xmx512m"
+  resources:
+    requests:
+      cpu: "250m"
+      memory: "1Gi"
+    limits:
+      cpu: "1"
+      memory: "2Gi"
+
+mongodb:
+  replicas: 1
+  arbiters: 0
+  version: "8.0.23"

From 648bcff6226bce29f7b97765ce53676e99331da8 Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 20:20:56 -0400
Subject: [PATCH 08/18] ci(gha): add install job with kind cluster and MongoDB
 Operator

---
 .github/ct.yaml                      |  4 ++++
 .github/workflows/lint-and-test.yaml | 34 ++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/.github/ct.yaml b/.github/ct.yaml
index 098f039..c7dee88 100644
--- a/.github/ct.yaml
+++ b/.github/ct.yaml
@@ -9,3 +9,7 @@ target-branch: main
 # Chart.yaml does not declare a maintainers list today; enabling this would
 # block linting. Revisit if a maintainers list is added.
 validate-maintainers: false
+
+# Passed through to `helm install` during `ct install`. 15-minute timeout
+# accommodates Graylog's startup time on minimal-resource CI runners.
+helm-extra-args: --timeout=900s
diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index acb173f..86df8fc 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -25,3 +25,37 @@ jobs:
 
       - name: Run ct lint
         run: ct lint --config .github/ct.yaml --all
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v5
+        with:
+          version: v3.16.4
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.8.0
+
+      - name: Create kind cluster
+        uses: helm/kind-action@v1.14.0
+
+      - name: Install MongoDB Kubernetes Operator
+        run: |
+          helm upgrade --install mongodb-kubernetes-operator mongodb-kubernetes \
+            --repo https://mongodb.github.io/helm-charts \
+            --version "1.6.1" \
+            --set operator.watchNamespace="*" \
+            --namespace operators \
+            --create-namespace \
+            --wait \
+            --timeout 5m
+
+      - name: Run ct install
+        run: ct install --config .github/ct.yaml --all

From ac9c008f4346114ee123b2d8ec26e1cc8ebe3dc3 Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 20:49:37 -0400
Subject: [PATCH 09/18] ci(gha): rename jobs to helm-ct-lint and
 helm-ct-install

---
 .github/workflows/lint-and-test.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index 86df8fc..89459ab 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -7,7 +7,7 @@ on:
     branches: ["main"]
 
 jobs:
-  lint:
+  helm-ct-lint:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -26,9 +26,9 @@ jobs:
       - name: Run ct lint
         run: ct lint --config .github/ct.yaml --all
 
-  test:
+  helm-ct-install:
     runs-on: ubuntu-latest
-    needs: lint
+    needs: helm-ct-lint
     steps:
       - name: Checkout
         uses: actions/checkout@v6

From ee10b16ba06b52497ca934a2acf01da121ed645d Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 20:49:49 -0400
Subject: [PATCH 10/18] ci(gha): generate ephemeral rootPassword and mask in
 workflow logs

---
 .github/workflows/lint-and-test.yaml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index 89459ab..78f4921 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -57,5 +57,14 @@ jobs:
             --wait \
             --timeout 5m
 
+      - name: Generate ephemeral CI rootPassword and mask in workflow logs
+        id: ci-root-password
+        run: |
+          password=$(openssl rand -hex 16)
+          echo "::add-mask::${password}"
+          echo "value=${password}" >> "$GITHUB_OUTPUT"
+
       - name: Run ct install
-        run: ct install --config .github/ct.yaml --all
+        run: |
+          ct install --config .github/ct.yaml --all \
+            --helm-extra-set-args "--set graylog.config.rootPassword=${{ steps.ci-root-password.outputs.value }}"

From 313cc34c5b275e2922231ebf231ccb6dfa975886 Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 21:18:57 -0400
Subject: [PATCH 11/18] ci(gha): make ct.yaml validation knobs explicit and
 enable upgrade testing

---
 .github/ct.yaml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/ct.yaml b/.github/ct.yaml
index c7dee88..4fcd256 100644
--- a/.github/ct.yaml
+++ b/.github/ct.yaml
@@ -10,6 +10,18 @@ target-branch: main
 # block linting. Revisit if a maintainers list is added.
 validate-maintainers: false
 
+# Defaults below are made explicit to document the chart's CI policy
+# rather than relying on ct's built-in defaults.
+check-version-increment: true
+validate-chart-schema: true
+validate-yaml: true
+
+# Enable in-place upgrade testing. ct will install the chart's previous
+# revision and upgrade to the current, but only when the chart version
+# differs between target-branch and the PR. Safeguards against breaking
+# upgrade paths for existing users.
+upgrade: true
+
 # Passed through to `helm install` during `ct install`. 15-minute timeout
 # accommodates Graylog's startup time on minimal-resource CI runners.
 helm-extra-args: --timeout=900s

From 895b67c4f764458cc87dab8d67ffb08a49efce6d Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 22:32:03 -0400
Subject: [PATCH 12/18] ci(gha): add Kubernetes version matrix (v1.32.11,
 v1.33.7, v1.34.3) to helm-ct-install

---
 .github/workflows/lint-and-test.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index 78f4921..c64add7 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -29,6 +29,13 @@ jobs:
   helm-ct-install:
     runs-on: ubuntu-latest
     needs: helm-ct-lint
+    strategy:
+      fail-fast: false
+      matrix:
+        k8s-version:
+          - v1.32.11
+          - v1.33.7
+          - v1.34.3
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -45,6 +52,8 @@ jobs:
 
       - name: Create kind cluster
         uses: helm/kind-action@v1.14.0
+        with:
+          node_image: kindest/node:${{ matrix.k8s-version }}
 
       - name: Install MongoDB Kubernetes Operator
         run: |

From 04d58f5016330aa91e3a975f9cfed9eed5093d0f Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 22:35:13 -0400
Subject: [PATCH 13/18] ci(gha): disable ct upgrade testing

---
 .github/ct.yaml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/ct.yaml b/.github/ct.yaml
index 4fcd256..7e33cf3 100644
--- a/.github/ct.yaml
+++ b/.github/ct.yaml
@@ -16,11 +16,13 @@ check-version-increment: true
 validate-chart-schema: true
 validate-yaml: true
 
-# Enable in-place upgrade testing. ct will install the chart's previous
-# revision and upgrade to the current, but only when the chart version
-# differs between target-branch and the PR. Safeguards against breaking
-# upgrade paths for existing users.
-upgrade: true
+# In-place upgrade testing (disabled). ct's `--upgrade` doesn't exercise
+# `helm upgrade` against an existing deployed release the way users would
+# expect; it installs the previous revision into an ephemeral namespace,
+# upgrades to current, then tears down. Combined with the ~2x CI runtime
+# cost, not worth enabling right now. Revisit if ct's upgrade semantics
+# change or maintainers want to opt in.
+upgrade: false
 
 # Passed through to `helm install` during `ct install`. 15-minute timeout
 # accommodates Graylog's startup time on minimal-resource CI runners.

From be86e37ac52a0a09b83772e8690264dd467702ec Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 23:47:36 -0400
Subject: [PATCH 14/18] ci(gha): add Helm version matrix (v3.16.4 + v4.2.0) to
 helm-ct-lint

---
 .github/workflows/lint-and-test.yaml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index c64add7..30d91b9 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -9,6 +9,12 @@ on:
 jobs:
   helm-ct-lint:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        helm-version:
+          - v3.16.4
+          - v4.2.0
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -18,7 +24,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v5
         with:
-          version: v3.16.4
+          version: ${{ matrix.helm-version }}
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@v2.8.0

From cf78cd5335613c06dd404b685845e23a579d5dec Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 23:47:51 -0400
Subject: [PATCH 15/18] =?UTF-8?q?ci(gha):=20expand=20helm-ct-install=20to?=
 =?UTF-8?q?=20asymmetric=20K8s=20=C3=97=20Helm=20matrix=20(3=20Helm=203=20?=
 =?UTF-8?q?+=201=20Helm=204)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/lint-and-test.yaml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index 30d91b9..d1b1ee7 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -37,11 +37,19 @@ jobs:
     needs: helm-ct-lint
     strategy:
       fail-fast: false
+      # Asymmetric K8s × Helm matrix: full K8s coverage on Helm 3 (the chart's
+      # stated minimum per docs/TESTING.md), with Helm 4 added as bonus coverage
+      # on the most recent K8s version. Expand by adding more `include:` entries.
       matrix:
-        k8s-version:
-          - v1.32.11
-          - v1.33.7
-          - v1.34.3
+        include:
+          - k8s-version: v1.32.11
+            helm-version: v3.16.4
+          - k8s-version: v1.33.7
+            helm-version: v3.16.4
+          - k8s-version: v1.34.3
+            helm-version: v3.16.4
+          - k8s-version: v1.34.3
+            helm-version: v4.2.0
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -51,7 +59,7 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v5
         with:
-          version: v3.16.4
+          version: ${{ matrix.helm-version }}
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@v2.8.0

From 4284d7d5816ca2545b3288c8c02e18976b1d2511 Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 23:54:18 -0400
Subject: [PATCH 16/18] ci(gha): reorder helm-ct-install matrix keys to display
 helm-version first

---
 .github/workflows/lint-and-test.yaml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index d1b1ee7..18b937c 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -42,14 +42,14 @@ jobs:
       # on the most recent K8s version. Expand by adding more `include:` entries.
       matrix:
         include:
-          - k8s-version: v1.32.11
-            helm-version: v3.16.4
-          - k8s-version: v1.33.7
-            helm-version: v3.16.4
-          - k8s-version: v1.34.3
-            helm-version: v3.16.4
-          - k8s-version: v1.34.3
-            helm-version: v4.2.0
+          - helm-version: v3.16.4
+            k8s-version: v1.32.11
+          - helm-version: v3.16.4
+            k8s-version: v1.33.7
+          - helm-version: v3.16.4
+            k8s-version: v1.34.3
+          - helm-version: v4.2.0
+            k8s-version: v1.34.3
     steps:
       - name: Checkout
         uses: actions/checkout@v6

From 9a99f8b506a286ea40643c49ea668a822f870b08 Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 23:08:53 -0400
Subject: [PATCH 17/18] ci(gha): add helm-unittest job to lint-and-test
 workflow

---
 .github/workflows/lint-and-test.yaml | 37 +++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index 18b937c..5f3d714 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -32,9 +32,44 @@ jobs:
       - name: Run ct lint
         run: ct lint --config .github/ct.yaml --all
 
+  helm-unittest:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        helm-version:
+          - v3.16.4
+          - v4.2.0
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v5
+        with:
+          version: ${{ matrix.helm-version }}
+
+      - name: Install helm-unittest plugin
+        # `helm plugin install --version` does NOT pin to a git tag — it
+        # clones the default branch. Clone the v1.0.3 tag explicitly and
+        # install from local path. v1.0.3 is the latest helm-unittest
+        # release whose plugin.yaml does NOT use the `platformHooks` field;
+        # v1.1.0+ adds that field, which Helm 3.16.4 rejects during
+        # plugin.yaml parsing. Pinning to v1.0.3 keeps both matrix variants
+        # (Helm 3 and Helm 4) compatible.
+        # Local-path install also sidesteps Helm 4's signature verification.
+        run: |
+          git clone --depth 1 --branch v1.0.3 https://github.com/helm-unittest/helm-unittest /tmp/helm-unittest
+          helm plugin install /tmp/helm-unittest
+
+      - name: Run helm unittest
+        run: helm unittest charts/graylog
+
   helm-ct-install:
     runs-on: ubuntu-latest
-    needs: helm-ct-lint
+    needs: [helm-ct-lint, helm-unittest]
     strategy:
       fail-fast: false
       # Asymmetric K8s × Helm matrix: full K8s coverage on Helm 3 (the chart's

From efe3586cff54333f67a07b6e3e8d1a6bcae894ee Mon Sep 17 00:00:00 2001
From: etgraylog <evan.tepsic@graylog.com>
Date: Sun, 31 May 2026 23:09:05 -0400
Subject: [PATCH 18/18] test(unit): add starter helm-unittest suites (service,
 statefulset, init-graylog, mongodb, ingress)

---
 .../tests/graylog_statefulset_test.yaml       |  79 ++++++++++++
 charts/graylog/tests/ingress_test.yaml        | 112 ++++++++++++++++++
 charts/graylog/tests/init_graylog_test.yaml   |  66 +++++++++++
 charts/graylog/tests/mongodb_test.yaml        |  86 ++++++++++++++
 charts/graylog/tests/service_test.yaml        |  89 ++++++++++++++
 5 files changed, 432 insertions(+)
 create mode 100644 charts/graylog/tests/graylog_statefulset_test.yaml
 create mode 100644 charts/graylog/tests/ingress_test.yaml
 create mode 100644 charts/graylog/tests/init_graylog_test.yaml
 create mode 100644 charts/graylog/tests/mongodb_test.yaml
 create mode 100644 charts/graylog/tests/service_test.yaml

diff --git a/charts/graylog/tests/graylog_statefulset_test.yaml b/charts/graylog/tests/graylog_statefulset_test.yaml
new file mode 100644
index 0000000..7eb2b14
--- /dev/null
+++ b/charts/graylog/tests/graylog_statefulset_test.yaml
@@ -0,0 +1,79 @@
+suite: graylog StatefulSet
+templates:
+  # The StatefulSet's pod-spec annotations reference two checksum helpers that
+  # `include` other templates by path. helm-unittest's `templates:` filter must
+  # list those dependencies so the includes resolve. Assertions below use the
+  # `template:` field to scope each assert to the StatefulSet specifically.
+  - workload/statefulsets/graylog.yaml
+  - config/graylog.yaml         # checksum/config dependency
+  - config/secret/secrets.yaml  # checksum/secret dependency
+release:
+  name: graylog
+  namespace: graylog
+tests:
+  - it: respects graylog.replicas value
+    set:
+      graylog.replicas: 3
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 3
+        template: workload/statefulsets/graylog.yaml
+
+  - it: mounts tls-creds volume when graylog.config.tls.enabled is true
+    set:
+      graylog.config.tls.enabled: true
+      graylog.config.tls.secretName: my-tls-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: tls-creds
+            secret:
+              secretName: "my-tls-secret"
+        template: workload/statefulsets/graylog.yaml
+
+  - it: mounts tls-creds at /usr/share/graylog/tls when TLS enabled
+    set:
+      graylog.config.tls.enabled: true
+      graylog.config.tls.secretName: my-tls-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: tls-creds
+            mountPath: /usr/share/graylog/tls
+        template: workload/statefulsets/graylog.yaml
+
+  - it: does NOT mount tls-creds when graylog.config.tls.enabled is false
+    set:
+      graylog.config.tls.enabled: false
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: tls-creds
+            mountPath: /usr/share/graylog/tls
+        template: workload/statefulsets/graylog.yaml
+
+  - it: adds init-plugins emptyDir volume when graylog.config.plugins.enabled is true
+    set:
+      graylog.config.plugins.enabled: true
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: init-plugins
+            emptyDir: {}
+        template: workload/statefulsets/graylog.yaml
+
+  - it: does NOT add init-plugins volume when graylog.config.plugins.enabled is false
+    set:
+      graylog.config.plugins.enabled: false
+    asserts:
+      - notContains:
+          path: spec.template.spec.volumes
+          content:
+            name: init-plugins
+            emptyDir: {}
+        template: workload/statefulsets/graylog.yaml
diff --git a/charts/graylog/tests/ingress_test.yaml b/charts/graylog/tests/ingress_test.yaml
new file mode 100644
index 0000000..20f9a85
--- /dev/null
+++ b/charts/graylog/tests/ingress_test.yaml
@@ -0,0 +1,112 @@
+suite: graylog web Ingress
+templates:
+  - service/ingress/graylog.yaml
+release:
+  name: graylog
+  namespace: graylog
+tests:
+  - it: does not render when ingress.enabled is false
+    set:
+      ingress.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: does not render when ingress.web.enabled is false
+    set:
+      ingress.enabled: true
+      ingress.web.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders when ingress.enabled and ingress.web.enabled are both true
+    set:
+      ingress.enabled: true
+      ingress.web.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: Ingress
+      - equal:
+          path: apiVersion
+          value: networking.k8s.io/v1
+
+  - it: sets ingressClassName from values
+    set:
+      ingress.enabled: true
+      ingress.web.enabled: true
+      ingress.web.className: nginx
+    asserts:
+      - equal:
+          path: spec.ingressClassName
+          value: nginx
+
+  - it: renders TLS section when ingress.web.tls is provided
+    set:
+      ingress.enabled: true
+      ingress.web.enabled: true
+      ingress.web.tls:
+        - secretName: graylog-tls
+          hosts:
+            - graylog.example.com
+    asserts:
+      - equal:
+          path: spec.tls[0].secretName
+          value: graylog-tls
+      - equal:
+          path: spec.tls[0].hosts[0]
+          value: graylog.example.com
+
+  - it: omits TLS section when ingress.web.tls is empty
+    set:
+      ingress.enabled: true
+      ingress.web.enabled: true
+      ingress.web.tls: []
+    asserts:
+      - notExists:
+          path: spec.tls
+
+  - it: adds cert-manager cluster-issuer annotation when configured
+    set:
+      ingress.enabled: true
+      ingress.web.enabled: true
+      ingress.web.tls:
+        - secretName: graylog-tls
+          hosts:
+            - graylog.example.com
+      ingress.config.tls.clusterIssuer.existingName: letsencrypt-prod
+    asserts:
+      - equal:
+          path: metadata.annotations["cert-manager.io/cluster-issuer"]
+          value: letsencrypt-prod
+
+  - it: adds cert-manager issuer annotation when existingName is configured
+    set:
+      ingress.enabled: true
+      ingress.web.enabled: true
+      ingress.web.tls:
+        - secretName: graylog-tls
+          hosts:
+            - graylog.example.com
+      ingress.config.tls.issuer.existingName: my-issuer
+    asserts:
+      - equal:
+          path: metadata.annotations["cert-manager.io/issuer"]
+          value: my-issuer
+
+  - it: does NOT add cert-manager annotation when no issuer is configured
+    set:
+      ingress.enabled: true
+      ingress.web.enabled: true
+      ingress.web.tls:
+        - secretName: graylog-tls
+          hosts:
+            - graylog.example.com
+    asserts:
+      - notExists:
+          path: metadata.annotations["cert-manager.io/cluster-issuer"]
+      - notExists:
+          path: metadata.annotations["cert-manager.io/issuer"]
diff --git a/charts/graylog/tests/init_graylog_test.yaml b/charts/graylog/tests/init_graylog_test.yaml
new file mode 100644
index 0000000..02b88cf
--- /dev/null
+++ b/charts/graylog/tests/init_graylog_test.yaml
@@ -0,0 +1,66 @@
+suite: graylog init-script ConfigMap
+templates:
+  - config/init-graylog.yaml
+release:
+  name: graylog
+  namespace: graylog
+tests:
+  - it: does not render when graylog.enabled is false
+    set:
+      graylog.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: renders the init-script.sh data key
+    asserts:
+      - exists:
+          path: data["init-script.sh"]
+
+  - it: always includes the MongoDB credentials check
+    asserts:
+      - matchRegex:
+          path: data["init-script.sh"]
+          pattern: 'env \| grep GRAYLOG_MONGODB_URI \| grep -q "@"'
+
+  - it: includes truststore-import logic when TLS is enabled with updateKeyStore
+    set:
+      graylog.config.tls.enabled: true
+      graylog.config.tls.updateKeyStore: true
+    asserts:
+      - matchRegex:
+          path: data["init-script.sh"]
+          pattern: 'keytool -importcert'
+
+  - it: skips truststore-import logic when TLS is enabled but updateKeyStore is false
+    set:
+      graylog.config.tls.enabled: true
+      graylog.config.tls.updateKeyStore: false
+    asserts:
+      - notMatchRegex:
+          path: data["init-script.sh"]
+          pattern: 'keytool -importcert'
+
+  - it: skips TLS setup entirely when TLS is disabled
+    set:
+      graylog.config.tls.enabled: false
+    asserts:
+      - notMatchRegex:
+          path: data["init-script.sh"]
+          pattern: '/mnt/tls/tls.crt'
+
+  - it: includes plugin-copy logic when plugins are enabled
+    set:
+      graylog.config.plugins.enabled: true
+    asserts:
+      - matchRegex:
+          path: data["init-script.sh"]
+          pattern: 'find /mnt/shared/plugins/'
+
+  - it: skips plugin logic when plugins are disabled
+    set:
+      graylog.config.plugins.enabled: false
+    asserts:
+      - notMatchRegex:
+          path: data["init-script.sh"]
+          pattern: 'find /mnt/shared/plugins/'
diff --git a/charts/graylog/tests/mongodb_test.yaml b/charts/graylog/tests/mongodb_test.yaml
new file mode 100644
index 0000000..85fca9c
--- /dev/null
+++ b/charts/graylog/tests/mongodb_test.yaml
@@ -0,0 +1,86 @@
+suite: MongoDB Community Custom Resource
+templates:
+  - custom/mongo-rs.yaml
+release:
+  name: graylog
+  namespace: graylog
+tests:
+  - it: renders the MongoDBCommunity CR when communityResource.enabled is true
+    set:
+      mongodb.communityResource.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: kind
+          value: MongoDBCommunity
+      - equal:
+          path: apiVersion
+          value: mongodbcommunity.mongodb.com/v1
+
+  - it: does NOT render the MongoDBCommunity CR when communityResource.enabled is false
+    set:
+      mongodb.communityResource.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: uses configured mongodb.version
+    set:
+      mongodb.communityResource.enabled: true
+      mongodb.version: "8.0.23"
+    asserts:
+      - equal:
+          path: spec.version
+          value: "8.0.23"
+
+  - it: configures members count from mongodb.replicas
+    set:
+      mongodb.communityResource.enabled: true
+      mongodb.replicas: 3
+      mongodb.arbiters: 0
+    asserts:
+      - equal:
+          path: spec.members
+          value: 3
+
+  - it: includes arbiters when mongodb.arbiters > 0
+    set:
+      mongodb.communityResource.enabled: true
+      mongodb.replicas: 3
+      mongodb.arbiters: 1
+    asserts:
+      - equal:
+          path: spec.arbiters
+          value: 1
+
+  - it: omits arbiters key when mongodb.arbiters is 0
+    set:
+      mongodb.communityResource.enabled: true
+      mongodb.replicas: 3
+      mongodb.arbiters: 0
+    asserts:
+      - notExists:
+          path: spec.arbiters
+
+  - it: fails when arbiters >= replicas
+    set:
+      mongodb.communityResource.enabled: true
+      mongodb.replicas: 2
+      mongodb.arbiters: 2
+    asserts:
+      - failedTemplate:
+          errorPattern: "Number of MongoDB arbiters must be less than the number of replicas"
+
+  - it: sets persistence size from values
+    set:
+      mongodb.communityResource.enabled: true
+      mongodb.persistence.size.data: "20G"
+      mongodb.persistence.size.logs: "5G"
+    asserts:
+      - equal:
+          path: spec.statefulSet.spec.volumeClaimTemplates[0].spec.resources.requests.storage
+          value: "20G"
+      - equal:
+          path: spec.statefulSet.spec.volumeClaimTemplates[1].spec.resources.requests.storage
+          value: "5G"
diff --git a/charts/graylog/tests/service_test.yaml b/charts/graylog/tests/service_test.yaml
new file mode 100644
index 0000000..fc63371
--- /dev/null
+++ b/charts/graylog/tests/service_test.yaml
@@ -0,0 +1,89 @@
+suite: graylog Service
+templates:
+  - service/graylog.yaml
+release:
+  name: graylog
+  namespace: graylog
+tests:
+  - it: does not render when graylog.enabled is false
+    set:
+      graylog.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: defaults to ClusterIP service type
+    asserts:
+      - equal:
+          path: spec.type
+          value: ClusterIP
+
+  - it: respects graylog.service.type override
+    set:
+      graylog.service.type: LoadBalancer
+    asserts:
+      - equal:
+          path: spec.type
+          value: LoadBalancer
+
+  - it: includes metrics port when graylog.service.metrics.enabled is true
+    set:
+      graylog.service.metrics.enabled: true
+      graylog.service.ports.metrics: 9833
+    asserts:
+      - contains:
+          path: spec.ports
+          content:
+            name: metrics
+            port: 9833
+            targetPort: metrics
+            protocol: TCP
+
+  - it: skips metrics port when graylog.service.metrics.enabled is false
+    set:
+      graylog.service.metrics.enabled: false
+    asserts:
+      - notContains:
+          path: spec.ports
+          content:
+            name: metrics
+            port: 9833
+            targetPort: metrics
+            protocol: TCP
+
+  - it: renders one port per graylog.inputs entry
+    set:
+      graylog.inputs:
+        - name: input-gelf
+          port: 12201
+          targetPort: 12201
+          protocol: TCP
+        - name: input-syslog
+          port: 514
+          targetPort: 514
+          protocol: UDP
+    asserts:
+      - contains:
+          path: spec.ports
+          content:
+            name: input-gelf
+            port: 12201
+            targetPort: 12201
+            protocol: TCP
+      - contains:
+          path: spec.ports
+          content:
+            name: input-syslog
+            port: 514
+            targetPort: 514
+            protocol: UDP
+
+  - it: always includes input-fwd-conf port
+    asserts:
+      - contains:
+          path: spec.ports
+          content:
+            name: input-fwd-conf
+            port: 13302
+            targetPort: 13302
+            protocol: TCP