test: harden group load verification

2026-09-28 00:58:24 +08:00
parent 622fc50418
commit cb2210aa3e
17 changed files with 491 additions and 38 deletions
@@ -9,12 +9,25 @@ patches:
  - path: statefulset-performance-patch.yaml
 ```

+Also include `backend-debug-metrics-rbac.yaml` as a resource in the test
+overlay. It grants the existing `argocd/backend-debug` service account
+namespaced read access to Pod metrics so the load-test collector can run
+`kubectl top pods -n im-server-system`:
+
+```yaml
+resources:
+  - backend-debug-metrics-rbac.yaml
+```
+
 After ArgoCD sync, verify the effective configuration:

 ```bash
 kubectl -n im-server-system get statefulset im-server -o jsonpath='{.spec.template.spec.containers[0].resources}'
 kubectl -n im-server-system get statefulset im-server -o jsonpath='{.spec.template.spec.containers[0].livenessProbe.httpGet.path}'
 kubectl -n im-server-system get statefulset im-server -o jsonpath='{.spec.template.spec.containers[0].env}'
+kubectl auth can-i list pods.metrics.k8s.io \
+  --as=system:serviceaccount:argocd:backend-debug \
+  -n im-server-system
 ```

 Expected values are requests `1 CPU / 512Mi`, limits `2 CPU / 1Gi`, and