Skip to content

Commit 907d9a7

Browse files
svtebmartin-mat
svteb
authored and
martin-mat
committed
Feat: Introduce oci and private helm repository support
Refs: #2277 - Added support for oci repositories in cnf config (through fields outlined in documentation) and private helm repositories (requiring auth). - Introduced authentication and certificate support in cnf config through `auth_defaults` and override `auth` field. - Added ENV expansion to cnf config (jinja templates) - provided through the crinja shard. - Three new tests added to verify functionality (oci pull, private helm repo pull and certificate authentification) - tests utilize containers as repos. - Documentation update for new cnf config. Signed-off-by: svteb <slavo.valko@tietoevry.com>
1 parent 20e99ef commit 907d9a7

File tree

15 files changed

+831
-76
lines changed

15 files changed

+831
-76
lines changed

‎CNF_TESTSUITE_YML_USAGE.md‎

Lines changed: 123 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,23 @@ New releases may change the format of cnf-testsuite.yml. To update your older co
5959

6060
### Keys and Values
6161

62+
#### Environment variables (Jinja)
63+
64+
You can reference environment variables with Crinja syntax: {{ ENV.VAR_NAME }}. Rendering is applied only if the config contains {{ ENV. or {% … %}. Avoid mixing Helm/Go templates (e.g., {{ .Release.Namespace }}) with Crinja; quote them to keep them literal.
65+
66+
```yaml
67+
config_version: v2
68+
deployments:
69+
helm_charts:
70+
- name: private-chart
71+
helm_repo_name: corp
72+
helm_repo_url: "https://charts.example.com"
73+
helm_chart_name: awesome
74+
auth:
75+
username: "{{ ENV.REPO_USER }}"
76+
password: "{{ ENV.REPO_PASS }}"
77+
```
78+
6279
#### Config version
6380
6481
Current config version is `"v2"`
@@ -134,6 +151,58 @@ image_registry_fqdns:
134151

135152
Described below: [link](#5G-parameters)
136153

154+
155+
##### tls_profiles
156+
157+
Define reusable TLS bundles (CA/cert/key) that deployments can reference. Useful for private Helm repos and OCI registries.
158+
159+
```yaml
160+
config_version: v2
161+
common:
162+
tls_profiles:
163+
corp_ca:
164+
ca_file: /path/to/ca.crt
165+
cert_file: /path/to/client.crt
166+
key_file: /path/to/client.key
167+
deployments:
168+
helm_charts:
169+
- name: web-frontend
170+
tls_profile: corp_ca
171+
...
172+
```
173+
174+
##### auth_defaults
175+
176+
Optional default credentials for private repositories and registries. Keys are hosts; values are credentials. Per-chart auth can override these.
177+
178+
```yaml
179+
config_version: v2
180+
common:
181+
auth_defaults:
182+
oci_registries:
183+
"registry.example.com":
184+
token: "{{ ENV.OCI_TOKEN }}" # or username/password
185+
helm_repos:
186+
"charts.example.com":
187+
username: "my_username554"
188+
password: "{{ ENV.REPO_PASS }}"
189+
helm_charts:
190+
# Classic Helm repo – uses auth_defaults.
191+
- name: web-frontend
192+
helm_repo_name: corp
193+
helm_repo_url: "https://charts.example.com"
194+
helm_chart_name: web-frontend
195+
...
196+
- name: web-backend
197+
registry_url: "oci://registry.example.com/team/nginx"
198+
chart_version: 1.0.2
199+
auth:
200+
token: "{{ ENV.TOKEN_OVERRIDE }}
201+
202+
```
203+
204+
**Note:** If you pre-login (e.g., helm registry login … or helm repo add … with credentials), you don’t need to specify auth in the config.
205+
137206
#### Deployments
138207

139208
Deployments are defined as three arrays, each for different installation method. Each array element represents one deployment, and they are meant to represent a single CNF together.
@@ -171,23 +240,64 @@ deployments:
171240

172241
##### helm_charts
173242

174-
Deployment, defined by helm chart and helm repository.
175-
Helm repository name and url can be omitted if repository is already present locally.
176-
Explanations with example:
243+
Deployment from either a classic Helm repository or an OCI registry.
244+
245+
###### Classic Helm repositories
177246

178247
```yaml
179248
---
180249
config_version: "v2"
181250
deployments:
182251
helm_charts:
183-
- name: coredns # Name of the deployment
184-
helm_repo_name: stable # Name of the repository for the helm chart
185-
helm_repo_url: https://cncf.gitlab.io/stable # Repository URL
186-
helm_chart_name: coredns # Name of the helm chart in format repo_name/chart_name
187-
helm_values: --set myvalue=42 # Additional values that would be used for helm installation
188-
namespace: cnf-default # Namespace to which deployment would be installed (cnf-default is default)
252+
- name: coredns # Name of the deployment
253+
helm_repo_name: stable # Name of the repository for the helm chart
254+
helm_repo_url: https://cncf.gitlab.io/stable # Required if helm_repo_url is set
255+
helm_chart_name: coredns # Name of the helm chart in format repo_name/chart_name
256+
257+
# Optional keys
258+
chart_version: 10.2.1
259+
helm_values: --set myvalue=42 # Additional values that would be used for helm installation
260+
namespace: cnf-default # Defaults to cnf-default
261+
skip_tls_verify: false # Disable TLS verification
262+
pass_credentials: false # Pass creds on redirects
263+
auth: # Optional per-chart override
264+
username: "{{ ENV.REPO_USER }}"
265+
password: "{{ ENV.REPO_PASS }}"
189266
```
190267

268+
**Notes:**`
269+
- If the repo was already added locally, you may omit `helm_repo_url`.
270+
- `tls_profile` attaches `ca_file`/`cert_file`/`key_file` to Helm operations against that repo.
271+
- `skip_tls_verify` disables certificate verification (use with care).
272+
- `pass_credentials` forwards auth across redirects.
273+
- Auth may be a bearer token or username/password. If you already added the repo with `helm repo add`, you do not need to set auth.
274+
275+
###### OCI registries
276+
277+
```yaml
278+
---
279+
config_version: "v2"
280+
deployments:
281+
helm_charts:
282+
- name: nginx-oci # Name of the deployment
283+
registry_url: "oci://registry.example.com/team/nginx" # must start with oci://
284+
chart_version: "15.10.0" # required for OCI
285+
286+
# Optional keys
287+
helm_values: --set myvalue=42 # Additional values that would be used for helm installation
288+
namespace: cnf-default # Defaults to cnf-default
289+
skip_tls_verify: false # Disable TLS verification
290+
plain_http: false # optional: use HTTP instead of HTTPS
291+
auth: # optional per-chart override
292+
token: "{{ ENV.OCI_TOKEN }}"
293+
```
294+
295+
**Notes:**
296+
- For OCI, `chart_version` is required.
297+
- `registry_url` determines the chart name automatically (last path segment).
298+
- Set plain_http: true only if your registry is HTTP.
299+
- Auth may be a bearer token or username/password. If you already logged in with `helm registry login`, you do not need to set auth.
300+
191301
##### helm_dirs
192302

193303
Deployment, defined by directory with Chart.yaml file and all templates for resources.
@@ -197,10 +307,10 @@ Explanations with example:
197307
config_version: "v2"
198308
deployments:
199309
helm_dirs:
200-
- name: envoy # Name of the deployment
201-
helm_directory: chart # Path to the directory with Chart.yaml, relative to CNF configuration file
202-
helm_values: --set myvalue=42 # Additional values that would be used for helm installation
203-
namespace: cnf-default # Namespace to which deployment would be installed (cnf-default is default)
310+
- name: envoy # Name of the deployment
311+
helm_directory: chart # Path to the directory with Chart.yaml, relative to CNF configuration file
312+
helm_values: --set myvalue=42 # Additional values that would be used for helm installation
313+
namespace: cnf-default # Namespace to which deployment would be installed (cnf-default is default)
204314
```
205315

206316
##### manifests

‎sample-cnfs/sample_oci_repo/cnf-testsuite.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
config_version: v2
2+
common:
3+
auth_defaults:
4+
oci_registries:
5+
localhost:53123:
6+
username: "dummy"
7+
password: "secret"
8+
deployments:
9+
helm_charts:
10+
- name: nginx-oci
11+
namespace: cnf-default
12+
registry_url: "oci://localhost:53123/helm/nginx"
13+
chart_version: "15.10.0"
14+
plain_http: true

‎sample-cnfs/sample_private_repo/cnf-testsuite.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
config_version: v2
2+
common:
3+
auth_defaults:
4+
helm_repos:
5+
cm:
6+
username: "dummy"
7+
password: "secret"
8+
deployments:
9+
helm_charts:
10+
- name: nginx-private
11+
namespace: cnf-default
12+
helm_repo_name: cm
13+
helm_repo_url: "http://localhost:53124"
14+
helm_chart_name: "nginx"
15+
chart_version: "15.10.0"
16+
skip_tls_verify: true
17+
pass_credentials: true

‎sample-cnfs/sample_tls_repo/cnf-testsuite.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
config_version: v2
2+
common:
3+
tls_profiles:
4+
# certificates created programmatically in spec
5+
mtls:
6+
ca_file: "sample-cnfs/sample_tls_repo/tls/ca.crt"
7+
cert_file: "sample-cnfs/sample_tls_repo/tls/client.crt"
8+
key_file: "sample-cnfs/sample_tls_repo/tls/client.key"
9+
auth_defaults:
10+
oci_registries:
11+
127.0.0.1.nip.io:54125:
12+
username: "dummy"
13+
password: "secret"
14+
deployments:
15+
helm_charts:
16+
- name: nginx-oci-mtls
17+
namespace: cnf-default
18+
registry_url: "oci://127.0.0.1.nip.io:54125/helm/nginx"
19+
chart_version: "15.10.0"
20+
tls_profile: "mtls"
21+
plain_http: false

‎sample-cnfs/sample_tls_repo/config.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# registry config with clientcas (mTLS)
2+
version: 0.1
3+
log:
4+
level: info
5+
storage:
6+
filesystem:
7+
rootdirectory: /var/lib/registry
8+
http:
9+
addr: :5000
10+
tls:
11+
certificate: /certs/server.crt
12+
key: /certs/server.key
13+
clientcas:
14+
- /certs/ca.crt

‎shard.lock‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ shards:
44
git: https://github.com/mrrooijen/commander.git
55
version: 0.4.0
66

7+
crinja:
8+
git: https://github.com/straight-shoota/crinja.git
9+
version: 0.8.1
10+
711
halite:
812
git: https://github.com/icyleaf/halite.git
913
version: 0.12.1

‎shard.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ targets:
1313
crystal: '>= 1.6.0'
1414

1515
dependencies:
16+
crinja:
17+
github: straight-shoota/crinja
1618
sam:
1719
github: vulk/sam.cr
1820
commit: 4e3b271d31d7

0 commit comments

Comments
 (0)