test(llm-request-router): cover single-replica certificate render

[mikeyrcamp]

Why

Issue #838 requires explicit render coverage that a single-replica router's advertised hostname is covered by its Certificate DNS SAN. PR #909 added hostname/SAN validation and its multi-replica/default coverage, but did not assert this single-replica certificate path.

What changed

Added one targeted PKI render case for replicaCount=1. It enables the Certificate, asserts its DNS SAN is llm-request-router.nvcf.svc.cluster.local, and asserts the StatefulSet emits that exact advertised hostname template.

Customer Release Notes

Not customer visible.

Plan Summary

Not applicable.

Usage

Not applicable.

Testing

• make check-pki-render
• make check-multi-replica-render
• make lint
• make validate
• git diff --check

No additional QA is needed.

Notes

The underlying hostname/SAN validation was released in llm-request-router chart v1.7.2 by PR #909.

References

Closes #838

Related Pull Requests

• fix(llm-request-router): validate certificate hostname coverage #909

Dependencies

None.

Summary by CodeRabbit

• Tests
  • Added a validation test for single-replica deployments.
  • Verifies that certificate names and advertised hostnames use the configured stable service hostname when DNS discovery is disabled.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ab01cd06-cbd5-41f2-a197-114969661aa6

📥 Commits

Reviewing files that changed from the base of the PR and between 5599ea5 and 4e7f6cc.

📒 Files selected for processing (1)

• deploy/helm/llm-request-router/scripts/check-pki-render.sh

Included review availability: Your plan includes up to 12 reviews per rolling hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The PKI rendering script now tests a single-replica configuration with DNS discovery disabled and a stable service hostname. It verifies that the hostname appears in both the Certificate SAN and StatefulSet advertised-hostname argument.

Changes

PKI render validation

Layer / File(s)	Summary
Single-replica hostname validation deploy/helm/llm-request-router/scripts/check-pki-render.sh	The script renders a single-replica deployment and checks that the stable service hostname matches the Certificate SAN and StatefulSet advertised-hostname argument.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 4e7f6

This PR adds localized render coverage for the single-replica certificate path without changing production behavior; no actionable merge-blocking risk remains beyond normal checks.

Suggested reviewers: huaweic-nv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The change covers single-replica hostname and SAN matching but does not cover the other required cases in [#838].	Add coverage for multi-replica, custom templates, exact and wildcard SANs, invalid wildcard coverage, and uncovered hostname rejection.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits and accurately describes the added single-replica rendering test.
Out of Scope Changes check	✅ Passed	The change adds targeted test coverage directly related to the certificate SAN validation objective in [#838].
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/test/issue-838-single-replica

---

_{Comment @coderabbitai help to get the list of available commands.}

[balajinvda]

🎉 This PR is included in version helm-nvcf-llm-request-router-v1.8.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀