Skip to content

Commit c499762

Browse files
sd109sd109
authored
Add Helm lint CI workflow (#291)
Based on azimuth-cloud/cluster-api-janitor-openstack#192 Won't be tested in CI until merged to main due to pull_request_target workflow trigger but have tested each workflow step locally for now.
1 parent 6f4cfda commit c499762

File tree

6 files changed

+262
-1
lines changed

6 files changed

+262
-1
lines changed

‎.github/workflows/helm-lint.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# NOTE: This workflow can be run locally using https://github.com/nektos/act with:
2+
# act -W .github/workflows/helm-lint.yaml workflow_call -s GITHUB_TOKEN=$(gh auth token)
3+
name: Helm Lint
4+
on:
5+
workflow_call:
6+
inputs:
7+
ref:
8+
type: string
9+
description: The Git ref under test.
10+
required: true
11+
12+
jobs:
13+
lint:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v4
18+
with:
19+
ref: ${{ inputs.ref }}
20+
fetch-depth: 0
21+
22+
- name: Set up Helm
23+
uses: azure/setup-helm@v4
24+
with:
25+
version: v3.15.3
26+
27+
- name: Set up chart-testing
28+
uses: helm/chart-testing-action@v2
29+
30+
- name: Run chart-testing (lint)
31+
run: |-
32+
ct lint \
33+
--target-branch ${{ github.event.repository.default_branch }} \
34+
--charts chart/ \
35+
--validate-maintainers=false
36+
37+
- name: Run template validation
38+
run: |-
39+
helm template foo chart \
40+
| docker run -i --rm ghcr.io/yannh/kubeconform:latest \
41+
--strict --summary
42+
43+
- name: Run manifest snapshot test
44+
run: docker run -i --rm -v $(pwd):/apps helmunittest/helm-unittest chart

‎.github/workflows/test-pr.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,22 @@ jobs:
3131
with:
3232
ref: ${{ github.event.pull_request.head.sha }}
3333

34+
# Run the chart linting on every PR, even from external repos
35+
helm_lint:
36+
uses: ./.github/workflows/helm-lint.yaml
37+
with:
38+
ref: ${{ github.event.pull_request.head.sha }}
39+
3440
# This job exists so that PRs from outside the main repo are rejected
3541
fail_on_remote:
42+
needs: [unit_tests, helm_lint]
3643
runs-on: ubuntu-latest
3744
steps:
3845
- name: PR must be from a branch in the azimuth-cloud/cluster-api-addon-provider repo
3946
run: exit ${{ github.event.pull_request.head.repo.full_name == 'azimuth-cloud/cluster-api-addon-provider' && '0' || '1' }}
4047

4148
publish_artifacts:
42-
needs: [unit_tests,fail_on_remote]
49+
needs: [fail_on_remote]
4350
uses: ./.github/workflows/build-push-artifacts.yaml
4451
with:
4552
ref: ${{ github.event.pull_request.head.sha }}

‎CONTRIBUTING.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Contributing
2+
3+
We welcome contributions and suggestions for improvements to this code base.
4+
Please check for relevant issues and PRs before opening a new one of your own.
5+
6+
## Making a contribution
7+
8+
### Helm template snapshots
9+
10+
The CI in this repository uses the Helm
11+
[unittest](https://github.com/helm-unittest/helm-unittest) plugin's
12+
snapshotting functionality to check PRs for changes to the templated manifests.
13+
Therefore, if your PR makes changes to the manifest templates or values, you
14+
will need to update the saved snapshots to allow your changes to pass the
15+
automated tests. The easiest way to do this is to run the `helm unittest` command
16+
inside a docker container from the repo root.
17+
18+
```
19+
docker run -i --rm -v $(pwd):/apps helmunittest/helm-unittest chart -u
20+
```
21+
22+
where the `-u` option is used to update the existing snapshots.

‎chart/.helmignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,5 @@
2121
.idea/
2222
*.tmproj
2323
.vscode/
24+
# Helm unit test files
25+
tests/

‎chart/tests/__snapshot__/snapshot_test.yaml.snap‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
templated manifests should match snapshot:
2+
1: |
3+
apiVersion: rbac.authorization.k8s.io/v1
4+
kind: ClusterRole
5+
metadata:
6+
labels:
7+
app.kubernetes.io/instance: RELEASE-NAME
8+
app.kubernetes.io/managed-by: Helm
9+
app.kubernetes.io/name: cluster-api-addon-provider
10+
app.kubernetes.io/version: main
11+
helm.sh/chart: cluster-api-addon-provider-0.1.0
12+
name: RELEASE-NAME-cluster-api-addon-provider
13+
rules:
14+
- apiGroups:
15+
- apiextensions.k8s.io
16+
resources:
17+
- customresourcedefinitions
18+
verbs:
19+
- list
20+
- get
21+
- watch
22+
- create
23+
- apiGroups:
24+
- apiextensions.k8s.io
25+
resourceNames:
26+
- helmreleases.addons.stackhpc.com
27+
- manifests.addons.stackhpc.com
28+
resources:
29+
- customresourcedefinitions
30+
verbs:
31+
- update
32+
- patch
33+
- apiGroups:
34+
- ""
35+
resources:
36+
- namespaces
37+
verbs:
38+
- list
39+
- watch
40+
- apiGroups:
41+
- ""
42+
- events.k8s.io
43+
resources:
44+
- events
45+
verbs:
46+
- create
47+
- apiGroups:
48+
- addons.stackhpc.com
49+
resources:
50+
- '*'
51+
verbs:
52+
- '*'
53+
- apiGroups:
54+
- cluster.x-k8s.io
55+
resources:
56+
- clusters
57+
verbs:
58+
- list
59+
- watch
60+
- get
61+
- apiGroups:
62+
- infrastructure.cluster.x-k8s.io
63+
resources:
64+
- '*'
65+
verbs:
66+
- list
67+
- watch
68+
- get
69+
- apiGroups:
70+
- ""
71+
resources:
72+
- configmaps
73+
- secrets
74+
verbs:
75+
- list
76+
- watch
77+
- get
78+
- patch
79+
2: |
80+
apiVersion: rbac.authorization.k8s.io/v1
81+
kind: ClusterRoleBinding
82+
metadata:
83+
labels:
84+
app.kubernetes.io/instance: RELEASE-NAME
85+
app.kubernetes.io/managed-by: Helm
86+
app.kubernetes.io/name: cluster-api-addon-provider
87+
app.kubernetes.io/version: main
88+
helm.sh/chart: cluster-api-addon-provider-0.1.0
89+
name: RELEASE-NAME-cluster-api-addon-provider
90+
roleRef:
91+
apiGroup: rbac.authorization.k8s.io
92+
kind: ClusterRole
93+
name: RELEASE-NAME-cluster-api-addon-provider
94+
subjects:
95+
- kind: ServiceAccount
96+
name: RELEASE-NAME-cluster-api-addon-provider
97+
namespace: NAMESPACE
98+
3: |
99+
apiVersion: v1
100+
data:
101+
config.yaml: |
102+
!include "/etc/capi-addon-provider/defaults.yaml,/etc/capi-addon-provider/user-config.yaml"
103+
defaults.yaml: |
104+
easykubeFieldManager: RELEASE-NAME-cluster-api-addon-provider
105+
user-config.yaml: |
106+
{}
107+
kind: ConfigMap
108+
metadata:
109+
labels:
110+
app.kubernetes.io/instance: RELEASE-NAME
111+
app.kubernetes.io/managed-by: Helm
112+
app.kubernetes.io/name: cluster-api-addon-provider
113+
app.kubernetes.io/version: main
114+
helm.sh/chart: cluster-api-addon-provider-0.1.0
115+
name: RELEASE-NAME-cluster-api-addon-provider
116+
4: |
117+
apiVersion: apps/v1
118+
kind: Deployment
119+
metadata:
120+
labels:
121+
app.kubernetes.io/instance: RELEASE-NAME
122+
app.kubernetes.io/managed-by: Helm
123+
app.kubernetes.io/name: cluster-api-addon-provider
124+
app.kubernetes.io/version: main
125+
helm.sh/chart: cluster-api-addon-provider-0.1.0
126+
name: RELEASE-NAME-cluster-api-addon-provider
127+
spec:
128+
replicas: 1
129+
selector:
130+
matchLabels:
131+
app.kubernetes.io/instance: RELEASE-NAME
132+
app.kubernetes.io/name: cluster-api-addon-provider
133+
strategy:
134+
type: Recreate
135+
template:
136+
metadata:
137+
annotations:
138+
addons.stackhpc.com/config-hash: ae07aeabb7cd21042b32369ecbc49a27c81ef80948939f1676d4ac9530ab60e4
139+
labels:
140+
app.kubernetes.io/instance: RELEASE-NAME
141+
app.kubernetes.io/name: cluster-api-addon-provider
142+
spec:
143+
containers:
144+
- image: ghcr.io/azimuth-cloud/cluster-api-addon-provider:main
145+
imagePullPolicy: IfNotPresent
146+
name: cluster-api-addon-provider
147+
resources: {}
148+
securityContext:
149+
allowPrivilegeEscalation: false
150+
capabilities:
151+
drop:
152+
- ALL
153+
readOnlyRootFilesystem: true
154+
volumeMounts:
155+
- mountPath: /etc/capi-addon-provider
156+
name: etc-capi-addon-provider
157+
readOnly: true
158+
- mountPath: /tmp
159+
name: tmp
160+
securityContext:
161+
runAsNonRoot: true
162+
serviceAccountName: RELEASE-NAME-cluster-api-addon-provider
163+
volumes:
164+
- configMap:
165+
name: RELEASE-NAME-cluster-api-addon-provider
166+
name: etc-capi-addon-provider
167+
- emptyDir: {}
168+
name: tmp
169+
5: |
170+
apiVersion: v1
171+
kind: ServiceAccount
172+
metadata:
173+
labels:
174+
app.kubernetes.io/instance: RELEASE-NAME
175+
app.kubernetes.io/managed-by: Helm
176+
app.kubernetes.io/name: cluster-api-addon-provider
177+
app.kubernetes.io/version: main
178+
helm.sh/chart: cluster-api-addon-provider-0.1.0
179+
name: RELEASE-NAME-cluster-api-addon-provider

‎chart/tests/snapshot_test.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# To update manifest snapshots run helm unittest plugin with -u option:
2+
# docker run -i --rm -v $(pwd):/apps helmunittest/helm-unittest -u chart
3+
suite: Manifest snapshot tests
4+
tests:
5+
- it: templated manifests should match snapshot
6+
asserts:
7+
- matchSnapshot: {}

0 commit comments

Comments
 (0)