---
id: w7/m2/t006
title: "Test coverage — meaningful tests for securityContext defaults + build-Job limits"
worker: worker7
status: done
estimate: 30m
depends_on: [w7/m2/t004]
---

## Objective

Add meaningful tests for the behavior this milestone shipped: the operator's Deployment builder emits the hardened pod spec (no SA token automount, RuntimeDefault seccomp, dropped caps, no privilege escalation, **no** `runAsNonRoot`), and build Jobs carry resource limits. Tests must assert real behavior and failure modes, never tautologies.

## Context

- Standing closing task (`.claude/commands/pm.md`).
- `lego/operator/internal/build/build_test.go` already asserts the rootless/no-privileged invariants — extend the same style for `Resources`.
- Envtest home: `lego/operator/internal/controller/` (`make test` from `lego/operator/`).

## Steps

1. Envtest: reconcile an App, assert the pod-template securityContext + automount fields; assert an App with a low port keeps working with the chosen capability set.
2. Extend `build_test.go` for requests/limits presence.
3. Run `make test`.

## Files

- `lego/operator/internal/controller/` tests
- `lego/operator/internal/build/build_test.go`

## Acceptance criteria

- [ ] Tests fail if any hardening field is dropped from the Deployment builder or build Job
- [ ] A test guards *against* `runAsNonRoot` being introduced (the deliberate compatibility line)
- [ ] `make test` passes

## Out of scope

- Admission/PSS behavior (kube-side, covered live by t004's script)
