snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-docker/helm/twenty/tests/app_user_test.yaml

@@ -0,0 +1,43 @@
+suite: app user and database initialization
+templates:
+  - templates/secret-db-url.yaml
+  - templates/deployment-server.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: db-url secret includes app password
+    template: templates/secret-db-url.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db-url
+      - isNotEmpty:
+          path: stringData.appPassword
+
+  - it: server init container creates app user with proper permissions
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: test_user
+      db.internal.database: testdb
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: CREATE USER
+
+  - it: db url uses app user not superuser
+    template: templates/secret-db-url.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: my_app
+      db.internal.database: mydb
+    asserts:
+      - matchRegex:
+          path: stringData.url
+          pattern: ^postgres://my_app:.*@my-twenty-twenty-db

packages/twenty-docker/helm/twenty/tests/env_mapping_test.yaml

@@ -0,0 +1,58 @@
+suite: env mapping
+templates:
+  - templates/deployment-server.yaml
+  - templates/deployment-worker.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: renders server extraEnv with plain value
+    template: templates/deployment-server.yaml
+    set:
+      server.extraEnv:
+        - name: FEATURE_X_ENABLED
+          value: "true"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: FEATURE_X_ENABLED
+            value: "true"
+
+  - it: renders server extraEnv with valueFrom
+    template: templates/deployment-server.yaml
+    set:
+      server.extraEnv:
+        - name: SMTP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: smtp-creds
+              key: password
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: SMTP_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: smtp-creds
+                key: password
+
+  - it: renders worker extraEnv with valueFrom
+    template: templates/deployment-worker.yaml
+    set:
+      worker.extraEnv:
+        - name: CUSTOM_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: my-secret
+              key: custom
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: CUSTOM_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: my-secret
+                key: custom

packages/twenty-docker/helm/twenty/tests/ingress_test.yaml

@@ -0,0 +1,120 @@
+suite: ingress rendering
+templates:
+  - templates/ingress.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: renders with host and paths
+    set:
+      server.ingress.enabled: true
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+      server.ingress.tls:
+        - hosts:
+            - twenty.example.com
+          secretName: twenty-tls
+    asserts:
+      - equal:
+          path: spec.rules[0].host
+          value: twenty.example.com
+      - equal:
+          path: spec.rules[0].http.paths[0].path
+          value: /
+      - equal:
+          path: spec.rules[0].http.paths[0].pathType
+          value: Prefix
+      - equal:
+          path: spec.tls[0].hosts[0]
+          value: twenty.example.com
+      - equal:
+          path: spec.tls[0].secretName
+          value: twenty-tls
+
+  - it: adds cert-manager annotation when acme is true
+    set:
+      server.ingress.enabled: true
+      server.ingress.acme: true
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - equal:
+          path: metadata.annotations["cert-manager.io/cluster-issuer"]
+          value: letsencrypt-prod
+
+  - it: supports multiple hosts with different paths
+    set:
+      server.ingress.enabled: true
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+        - host: crm.example.com
+          paths:
+            - path: /api
+              pathType: Prefix
+            - path: /graphql
+              pathType: Exact
+    asserts:
+      - equal:
+          path: spec.rules[0].host
+          value: twenty.example.com
+      - equal:
+          path: spec.rules[1].host
+          value: crm.example.com
+      - equal:
+          path: spec.rules[1].http.paths[0].path
+          value: /api
+      - equal:
+          path: spec.rules[1].http.paths[1].path
+          value: /graphql
+      - equal:
+          path: spec.rules[1].http.paths[1].pathType
+          value: Exact
+
+  - it: does not render when ingress disabled
+    set:
+      server.ingress.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: supports custom annotations
+    set:
+      server.ingress.enabled: true
+      server.ingress.annotations:
+        nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+        custom.annotation/key: "value"
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - equal:
+          path: metadata.annotations["nginx.ingress.kubernetes.io/proxy-body-size"]
+          value: "50m"
+      - equal:
+          path: metadata.annotations["custom.annotation/key"]
+          value: "value"
+
+  - it: supports custom className
+    set:
+      server.ingress.enabled: true
+      server.ingress.className: nginx
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+    asserts:
+      - equal:
+          path: spec.ingressClassName
+          value: nginx

packages/twenty-docker/helm/twenty/tests/pvc_test.yaml

@@ -0,0 +1,106 @@
+suite: pvc configuration
+templates:
+  - templates/pvc-server.yaml
+  - templates/pvc-db-internal.yaml
+  - templates/pvc-docker-data.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: server pvc renders when persistence enabled
+    template: templates/pvc-server.yaml
+    set:
+      server.persistence.enabled: true
+      server.persistence.size: 10Gi
+    asserts:
+      - isKind:
+          of: PersistentVolumeClaim
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-server
+      - equal:
+          path: spec.resources.requests.storage
+          value: 10Gi
+      - contains:
+          path: spec.accessModes
+          content: ReadWriteOnce
+
+  - it: server pvc does not render when persistence disabled
+    template: templates/pvc-server.yaml
+    set:
+      server.persistence.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: server pvc renders with correct defaults
+    template: templates/pvc-server.yaml
+    set:
+      server.persistence.enabled: true
+    asserts:
+      - isKind:
+          of: PersistentVolumeClaim
+
+  - it: server pvc omits storageClassName when set to hyphen
+    template: templates/pvc-server.yaml
+    set:
+      server.persistence.enabled: true
+      server.persistence.storageClass: ""
+    asserts:
+      - isNull:
+          path: spec.storageClassName
+
+  - it: db-internal pvc renders with correct size
+    template: templates/pvc-db-internal.yaml
+    set:
+      db.enabled: true
+      db.internal.persistence.enabled: true
+      db.internal.persistence.size: 20Gi
+    asserts:
+      - isKind:
+          of: PersistentVolumeClaim
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db
+      - isKind:
+          of: PersistentVolumeClaim
+
+  - it: db-internal pvc does not render when disabled
+    template: templates/pvc-db-internal.yaml
+    set:
+      db.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: db-internal pvc renders when enabled
+    template: templates/pvc-db-internal.yaml
+    set:
+      db.enabled: true
+      db.internal.persistence.enabled: true
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: docker-data pvc renders when enabled
+    template: templates/pvc-docker-data.yaml
+    set:
+      server.enabled: true
+      server.dockerDataPersistence.enabled: true
+      server.dockerDataPersistence.size: 5Gi
+    asserts:
+      - isKind:
+          of: PersistentVolumeClaim
+
+  - it: all pvcs use ReadWriteOnce access mode
+    templates:
+      - templates/pvc-server.yaml
+      - templates/pvc-db-internal.yaml
+    set:
+      server.persistence.enabled: true
+      db.enabled: true
+      db.internal.persistence.enabled: true
+    asserts:
+      - contains:
+          path: spec.accessModes
+          content: ReadWriteOnce

packages/twenty-docker/helm/twenty/tests/redis_auth_test.yaml

@@ -0,0 +1,89 @@
+suite: redis external authentication
+templates:
+  - templates/deployment-server.yaml
+  - templates/deployment-worker.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: injects REDIS_PASSWORD from external secret into server
+    template: templates/deployment-server.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.secretName: redis-creds
+      redis.external.passwordKey: password
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: redis-creds
+                key: password
+
+  - it: injects REDIS_PASSWORD from external secret into worker
+    template: templates/deployment-worker.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.secretName: redis-creds
+      redis.external.passwordKey: password
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: redis-creds
+                key: password
+
+  - it: injects plaintext REDIS_PASSWORD when password set directly in server
+    template: templates/deployment-server.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.password: "s3cr3t"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            value: "s3cr3t"
+
+  - it: injects plaintext REDIS_PASSWORD when password set directly in worker
+    template: templates/deployment-worker.yaml
+    set:
+      redisInternal.enabled: false
+      redis.external.host: redis.example.com
+      redis.external.password: "s3cr3t"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+            value: "s3cr3t"
+
+  - it: does not inject REDIS_PASSWORD into server when using internal redis
+    template: templates/deployment-server.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+          any: true
+
+  - it: does not inject REDIS_PASSWORD into worker when using internal redis
+    template: templates/deployment-worker.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: REDIS_PASSWORD
+          any: true

packages/twenty-docker/helm/twenty/tests/redis_db_switching_test.yaml

@@ -0,0 +1,91 @@
+suite: redis and database switching
+templates:
+  - templates/deployment-redis-internal.yaml
+  - templates/service-redis-internal.yaml
+  - templates/deployment-db-internal.yaml
+  - templates/service-db-internal.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: internal redis deployment renders when enabled
+    template: templates/deployment-redis-internal.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-redis
+
+  - it: internal redis does not render when disabled
+    template: templates/deployment-redis-internal.yaml
+    set:
+      redisInternal.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: redis service renders when internal redis enabled
+    template: templates/service-redis-internal.yaml
+    set:
+      redisInternal.enabled: true
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-redis
+
+  - it: redis uses args for port configuration
+    template: templates/deployment-redis-internal.yaml
+    set:
+      redisInternal.enabled: true
+      redisInternal.service.port: 6379
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --port
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "6379"
+
+  - it: internal db deployment renders when enabled
+    template: templates/deployment-db-internal.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db
+
+  - it: internal db does not render when disabled
+    template: templates/deployment-db-internal.yaml
+    set:
+      db.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: internal db uses Recreate strategy for PVC
+    template: templates/deployment-db-internal.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+
+  - it: db service renders when internal db enabled
+    template: templates/service-db-internal.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - isKind:
+          of: Service
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db

packages/twenty-docker/helm/twenty/tests/schema_permissions_test.yaml

@@ -0,0 +1,107 @@
+suite: schema permissions (core for app tables, public for extensions)
+templates:
+  - templates/deployment-server.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  # Core Schema Tests
+  # ================
+  # Twenty uses a dedicated 'core' schema for all application tables and the TypeORM
+  # migrations tracking table. This provides namespace isolation and clarity.
+
+  - it: ensure-database-exists creates core schema
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: CREATE SCHEMA IF NOT EXISTS core
+
+  - it: app user gets all privileges on core schema
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: GRANT ALL PRIVILEGES ON SCHEMA core
+
+  - it: app user gets all privileges on core tables
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA core
+
+  - it: default privileges set for future core tables
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: ALTER DEFAULT PRIVILEGES IN SCHEMA core GRANT ALL ON TABLES
+
+  - it: default privileges set for future core sequences
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: ALTER DEFAULT PRIVILEGES IN SCHEMA core GRANT ALL ON SEQUENCES
+
+  # Public Schema Tests
+  # ==================
+  # PostgreSQL extensions (like unaccent for accent-insensitive text search) are
+  # created in the 'public' schema. Twenty's migrations create these functions, so
+  # the app user needs full privileges on the public schema as well.
+
+  - it: app user gets all privileges on public schema
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: GRANT ALL PRIVILEGES ON SCHEMA public
+
+  - it: app user gets all privileges on public tables
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public
+
+  - it: default privileges set for future public tables
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES
+
+  - it: default privileges set for future public sequences
+    template: templates/deployment-server.yaml
+    set:
+      db.enabled: true
+      db.internal.appUser: twenty_app_user
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.initContainers[?(@.name=="ensure-database-exists")].command[2]
+          pattern: ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES
+

packages/twenty-docker/helm/twenty/tests/secret_generation_test.yaml

@@ -0,0 +1,52 @@
+suite: secret generation
+templates:
+  - templates/secret-tokens.yaml
+  - templates/secret-db-superuser.yaml
+  - templates/secret-db-url.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: generates tokens
+    template: templates/secret-tokens.yaml
+    set:
+      secrets.tokens.create: true
+    asserts:
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: tokens
+
+  # db-user secret removed; chart no longer manages app user credentials
+
+  - it: db-superuser secret generates password for internal DB
+    template: templates/secret-db-superuser.yaml
+    set:
+      db.enabled: true
+    asserts:
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db-superuser
+
+  - it: db-superuser secret does not render when internal DB disabled
+    template: templates/secret-db-superuser.yaml
+    set:
+      db.enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: db-url secret renders for internal database
+    template: templates/secret-db-url.yaml
+    set:
+      db.enabled: true
+      db.internal.database: appdb
+    asserts:
+      - isKind:
+          of: Secret
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-db-url

packages/twenty-docker/helm/twenty/tests/server_url_test.yaml

@@ -0,0 +1,72 @@
+suite: server url
+templates:
+  - templates/deployment-server.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: derives from ingress with paths
+    set:
+      server.ingress.enabled: true
+      server.ingress.hosts:
+        - host: crm.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+      server.ingress.tls:
+        - secretName: example-tls
+          hosts:
+            - crm.example.com
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name=="SERVER_URL")].value
+          value: "https://crm.example.com:443"
+  - it: falls back to service when ingress disabled
+    set:
+      server.ingress.enabled: false
+      server.service.port: 3000
+      server.env.SERVER_URL: ""
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].env[?(@.name=="SERVER_URL")].value
+          pattern: ^http://my-twenty-twenty-server\.default\.svc\.cluster\.local:3000$
+---
+suite: ingress configuration
+templates:
+  - templates/ingress.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: renders with host and paths
+    set:
+      server.ingress.hosts:
+        - host: twenty.example.com
+          paths:
+            - path: /
+              pathType: Prefix
+      server.ingress.tls:
+        - hosts:
+            - twenty.example.com
+          secretName: twenty-tls
+    asserts:
+      - equal:
+          path: spec.rules[0].host
+          value: twenty.example.com
+      - equal:
+          path: spec.rules[0].http.paths[0].path
+          value: /
+      - equal:
+          path: spec.tls[0].hosts[0]
+          value: twenty.example.com
+      - equal:
+          path: spec.tls[0].secretName
+          value: twenty-tls
+  - it: adds cert-manager annotation when acme true
+    set:
+      server.ingress.acme: true
+    asserts:
+      - isSubset:
+          path: metadata.annotations
+          content:
+            cert-manager.io/cluster-issuer: letsencrypt-prod

packages/twenty-docker/helm/twenty/tests/storage_env_test.yaml

@@ -0,0 +1,46 @@
+suite: storage env s3
+templates:
+  - templates/deployment-server.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: injects S3 env vars when storage.type is s3
+    set:
+      storage.type: s3
+      storage.s3.bucket: my-bucket
+      storage.s3.region: us-east-1
+      storage.s3.endpoint: https://s3.amazonaws.com
+      storage.s3.accessKeyId: AKIA
+      storage.s3.secretAccessKey: secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_TYPE
+            value: s3
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_NAME
+            value: my-bucket
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_REGION
+            value: us-east-1
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_ENDPOINT
+            value: https://s3.amazonaws.com
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_ACCESS_KEY_ID
+            value: AKIA
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: STORAGE_S3_SECRET_ACCESS_KEY
+            value: secret

packages/twenty-docker/helm/twenty/tests/worker_deployment_test.yaml

@@ -0,0 +1,76 @@
+suite: worker deployment
+templates:
+  - templates/deployment-worker.yaml
+release:
+  name: my-twenty
+  namespace: default
+tests:
+  - it: renders with correct name and labels
+    asserts:
+      - isKind:
+          of: Deployment
+      - equal:
+          path: metadata.name
+          value: my-twenty-twenty-worker
+      - equal:
+          path: metadata.labels["app.kubernetes.io/name"]
+          value: twenty
+      - equal:
+          path: metadata.labels["app.kubernetes.io/component"]
+          value: worker
+
+  - it: uses db-url secret for database connection
+    set:
+      db.enabled: true
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name=="PG_DATABASE_URL")].valueFrom.secretKeyRef.name
+          value: my-twenty-twenty-db-url
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name=="PG_DATABASE_URL")].valueFrom.secretKeyRef.key
+          value: url
+
+  - it: does not mount storage by default
+    asserts:
+      - isNull:
+          path: spec.template.spec.volumes
+
+  - it: uses correct command for worker process
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: yarn
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: worker:prod
+
+  - it: sets replica count to 1 by default
+    asserts:
+      - equal:
+          path: spec.replicas
+          value: 1
+
+  - it: supports local storage configuration
+    set:
+      storage.type: local
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[?(@.name=="STORAGE_TYPE")].value
+          value: local
+
+  - it: uses custom image when specified
+    set:
+      worker.image.repository: custom/twenty
+      worker.image.tag: v2.0.0
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: "^custom/twenty:v2.0.0$"
+
+  - it: falls back to Chart.AppVersion when tag not specified
+    set:
+      worker.image.tag: ""
+    asserts:
+      - matchRegex:
+          path: spec.template.spec.containers[0].image
+          pattern: ":v1.14.0$"