deploy/.github/workflows/helm-ci.yml at 869a79ef1b1ae64bf1c6207aaabc5067f2b0d181 · disentangle-network/deploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
name: Helm CI

on:
  push:
    branches: [main, develop]
    paths:
      - 'helm/**'
      - 'gitops/**'
      - 'tests/**'
      - '.github/workflows/helm-ci.yml'
  pull_request:
    branches: [main, develop]
    paths:
      - 'helm/**'
      - 'gitops/**'
      - 'tests/**'
      - '.github/workflows/helm-ci.yml'

jobs:
  helm-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.14.0
      - run: helm lint helm/disentangle/

  helm-template:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.14.0
      - name: Template with default values
        run: helm template test helm/disentangle/ > /dev/null
      - name: Template 3-node minimal
        run: helm template test helm/disentangle/ --set nodes.count=3 > /dev/null
      - name: Template 10-node with traffic
        run: |
          helm template test helm/disentangle/ \
            --set nodes.count=10 \
            --set traffic.enabled=true \
            --set dashboard.enabled=true > /dev/null

  monitoring-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.14.0
      - name: Add VictoriaMetrics Helm repo
        run: helm repo add vm https://victoriametrics.github.io/helm-charts/ && helm repo update
      - name: Build dependencies
        run: helm dependency build helm/monitoring/
      - name: Lint monitoring chart
        run: helm lint helm/monitoring/
      - name: Template monitoring chart
        run: helm template monitoring helm/monitoring/ > /dev/null

  tunnel-lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.14.0
      - name: Lint tunnel chart
        run: helm lint helm/cloudflare-tunnel/
      - name: Template tunnel chart
        run: helm template tunnel helm/cloudflare-tunnel/ --set tunnel.token=dummy-token > /dev/null

  kubeconform:
    runs-on: ubuntu-latest
    needs: helm-template
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.14.0
      - name: Install kubeconform
        run: |
          curl -sL https://github.com/yannh/kubeconform/releases/download/v0.6.4/kubeconform-linux-amd64.tar.gz | \
            tar xz -C /usr/local/bin
      - name: Validate Kubernetes manifests
        run: |
          helm template test helm/disentangle/ | \
            kubeconform -strict -summary \
              -ignore-missing-schemas \
              -kubernetes-version 1.29.0

  kustomize-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate all overlays
        run: |
          for overlay in gitops/overlays/*/; do
            echo "=== Building $overlay ==="
            kubectl kustomize "$overlay"  > /dev/null
            echo "OK"
          done

  yamllint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install yamllint
        run: pip install yamllint
      - name: Lint YAML files
        run: |
          yamllint -d relaxed helm/disentangle/Chart.yaml helm/disentangle/values.yaml helm/disentangle/values.schema.json helm/monitoring/Chart.yaml helm/monitoring/values.yaml helm/cloudflare-tunnel/Chart.yaml helm/cloudflare-tunnel/values.yaml gitops/

  helm-unittest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.14.0
      - name: Install helm-unittest
        run: helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.5.2
      - name: Run unit tests
        run: helm unittest helm/disentangle/

  golden-files:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.14.0
      - name: Verify golden files
        run: ./tests/golden/verify.sh

  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.14.0
      - name: Install conftest
        run: |
          curl -sL https://github.com/open-policy-agent/conftest/releases/download/v0.52.0/conftest_0.52.0_Linux_x86_64.tar.gz | \
            tar xz -C /usr/local/bin
      - name: Run OPA policy tests
        run: ./tests/policies/run-conftest.sh

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: helm-template
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
        with:
          version: v3.14.0
      - name: Install kube-linter
        run: |
          curl -sL https://github.com/stackrox/kube-linter/releases/download/v0.6.8/kube-linter-linux.tar.gz | \
            tar xz -C /usr/local/bin
      - name: Render templates
        run: helm template test-release helm/disentangle/ > /tmp/rendered.yaml
      - name: Run kube-linter
        run: kube-linter lint --config .kube-linter.yaml /tmp/rendered.yaml