diff --git a/.env.test b/.env.test
index 210897a..bc5167f 100644
--- a/.env.test
+++ b/.env.test
@@ -4,7 +4,7 @@ RUNBOAT_API_ADMIN_PASSWD="admin"
 RUNBOAT_BUILD_NAMESPACE=runboat-builds
 RUNBOAT_BUILD_DOMAIN=runboat.odoo-community.org
 RUNBOAT_BUILD_ENV={}
-RUNBOAT_BUILD_SECRET_ENV={}
+RUNBOAT_BUILD_SECRET_ENV={"PGPASSWORD": "thepgpassword"}
 RUNBOAT_GITHUB_TOKEN=
 RUNBOAT_LOG_CONFIG=log-config.yaml
 RUNBOAT_BUILD_IMAGES={"15.0": "ghcr.io/oca/oca-ci/py3.8-odoo15.0:latest"}
diff --git a/pyproject.toml b/pyproject.toml
index 1bdf869..3d15207 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -34,6 +34,7 @@ Home = "https://github.com/sbidoul/runboat"
 profile = 'black'
 
 [tool.pytest.ini_options]
+env_override_existing_values = 1
 env_files = [".env.test"]
 
 # flake8 config is in .flake8
diff --git a/src/runboat/kubefiles/kustomization.yaml.jinja b/src/runboat/kubefiles/kustomization.yaml.jinja
index 8d53708..ccdec8d 100644
--- a/src/runboat/kubefiles/kustomization.yaml.jinja
+++ b/src/runboat/kubefiles/kustomization.yaml.jinja
@@ -1,13 +1,13 @@
 resources:
-  {% if mode == 'deployment' -%}
+  {%- if mode == 'deployment' %}
   - deployment.yaml
   - service.yaml
   - ingress.yaml
-  {% elif mode == "initialize" -%}
+  {%- elif mode == "initialize" %}
   - initialize.yaml
-  {% elif mode == "cleanup" -%}
+  {%- elif mode == "cleanup" %}
   - cleanup.yaml
-  {% endif %}
+  {%- endif %}
 
 namespace: {{ namespace }}
 
@@ -50,11 +50,11 @@ configMapGenerator:
       - runboat-initialize.sh
       - runboat-cleanup.sh
       - runboat-start.sh
-  {% if mode == 'deployment' -%}
+  {%- if mode == 'deployment' %}
   - name: vars
     literals:
       - HOSTNAME={{ build_slug }}.{{ build_domain }}
-  {% endif %}
+  {%- endif %}
 
 generatorOptions:
   disableNameSuffixHash: true
diff --git a/tests/test_render_kubefiles.py b/tests/test_render_kubefiles.py
new file mode 100644
index 0000000..5e2c914
--- /dev/null
+++ b/tests/test_render_kubefiles.py
@@ -0,0 +1,78 @@
+from runboat.k8s import DeploymentMode, _render_kubefiles, make_deployment_vars
+
+EXPECTED = """\
+resources:
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+
+namespace: runboat-builds
+
+namePrefix: "build-name-"
+
+commonLabels:
+  runboat/build: "build-name"
+
+commonAnnotations:
+  runboat/repo: "oca/mis-builder"
+  runboat/target-branch: "15.0"
+  runboat/pr: ""
+  runboat/git-commit: "abcdef123456789"
+
+images:
+  - name: odoo
+    newName: "ghcr.io/oca/oca-ci"
+    newTag: "py3.8-odoo15.0"
+
+secretGenerator:
+  - name: odoosecretenv
+    literals:
+      - PGPASSWORD=thepgpassword
+
+configMapGenerator:
+  - name: odooenv
+    literals:
+      - PGDATABASE=build-name
+      - ADDONS_DIR=/build
+      - RUNBOAT_GIT_REPO=https://github.com/oca/mis-builder
+      - RUNBOAT_GIT_REF=abcdef123456789
+  - name: runboat-scripts
+    files:
+      - runboat-clone-and-install.sh
+      - runboat-initialize.sh
+      - runboat-cleanup.sh
+      - runboat-start.sh
+  - name: vars
+    literals:
+      - HOSTNAME=build-slug.runboat.odoo-community.org
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+vars:
+  - name: HOSTNAME
+    objref:
+      name: vars
+      kind: ConfigMap
+      apiVersion: v1
+    fieldref:
+      fieldpath: data.HOSTNAME
+"""
+
+
+def test_render_kubefiles():
+    deployment_vars = make_deployment_vars(
+        mode=DeploymentMode.deployment,
+        build_name="build-name",
+        slug="build-slug",
+        repo="oca/mis-builder",
+        target_branch="15.0",
+        pr=None,
+        git_commit="abcdef123456789",
+        image="ghcr.io/oca/oca-ci:py3.8-odoo15.0",
+    )
+    with _render_kubefiles(deployment_vars) as tmp_path:
+        assert (tmp_path / "kustomization.yaml").is_file()
+        assert (tmp_path / "deployment.yaml").is_file()
+        kustomization = (tmp_path / "kustomization.yaml").read_text()
+        assert kustomization == EXPECTED