tighten k8s tests

[atkrad]

Summary

Pod, component, and certificate helpers now have tests for the failures a caller can see: a missing object, an API error, a bad name, and a certificate that should be replaced. Job creation reports leftover objects when a rollback delete fails. Selector checks assert the selector string in the test. Watch tests run in parallel.

Production behavior is unchanged.

Testing principles covered:

• Failure paths: invalid input, API errors, cancellation, cleanup failure, version bounds, and certificate expiry
• Parallel tests: t.Parallel on the watch cases
• Assertions: ErrorIs for sentinels and context.Canceled, ErrorContains where the message is the contract
• Tables: selector cases keep the assertion in the test, with a name for each case
• Determinism: GetAvailableComponents walks a map, so the test checks membership

Test plan

• Unit tests added/updated
• go test -race -shuffle=on -count=1 ./internal/k8s/ passed, then passed again on a second shuffle
• golangci-lint run ./internal/k8s/ passed, and the pre-commit hook passed
• Scenario under scenarios/ (if behavior changes)
• Manual smoke (command + expected result), if user-facing

Remaining

GetAvailableComponents returns names in map iteration order. The test checks membership.

A running pod with no container statuses counts as ready. The ready-count test includes that pod.

The fake client ignores field selectors. Tests for running pods check that the list request asks for status.phase=Running.

Labels

• kind/chore
• skip-changelog (internal tests)

Checklist

• Title is short and imperative (matches commit style)
• Docs / CLI help left unchanged (no user-facing behavior change)
• No secrets or local-only paths in the diff

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!