Add install-test stage to the PR pipeline (k3d)

New install-test job in validate-charts.yml: for exactly the charts a PR changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0, k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become Ready. Runs non-blocking (continue-on-error) during the stabilization phase. Fixtures live at the repo root under ci/ (not inside chart directories, so they neither trigger publishes on merge nor get packaged): a stub OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate seed job, static hostPath PVs where charts pin storage classes or need RWX), plus a shared ci/run-install-test.sh harness that also runs locally. Excluded with documented reasons (ci/excluded-charts.txt): satisfactory (multi-GB image), teamspeak-server (TS6 beta license expired, image crashes on start), template-chart (placeholder image). All 14 non-excluded charts verified locally in k3d using only the committed fixtures.
2026-08-21 23:12:38 +02:00
1 parent 9f258e2440
commit cc6084ca58
@@ -0,0 +1,193 @@
+# Fixtures for the paperless-ngx install-test: throwaway postgres + redis,
+# the secrets the 1Password operator would otherwise materialize (release
+# name: ci), and storage plumbing. The chart hardcodes storageClassName
+# "longhorn" (RWX for the consume PVC), which does not exist in k3d: a
+# no-provisioner StorageClass named "longhorn" plus pre-bound hostPath PVs
+# stand in for it. Paperless runs as uid 1000 with a read-only rootfs and
+# hostPath volumes do not support fsGroup, so a node-setup Job pre-creates
+# the exact subPath directories world-writable.
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn
+provisioner: kubernetes.io/no-provisioner
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: node-setup
+spec:
+  backoffLimit: 2
+  template:
+    spec:
+      restartPolicy: Never
+      containers:
+        - name: setup
+          image: public.ecr.aws/docker/library/busybox:1.36
+          command:
+            - sh
+            - -c
+            - >
+              mkdir -p /pv/paperless-ngx/data/data /pv/paperless-ngx/data/media
+              /pv/paperless-ngx/data/export /pv/paperless-ngx/consume &&
+              chmod -R 0777 /pv/paperless-ngx
+          volumeMounts:
+            - name: pv
+              mountPath: /pv
+      volumes:
+        - name: pv
+          hostPath:
+            path: /var/lib/ci-pv
+            type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: ci-paperless-data
+spec:
+  capacity:
+    storage: 20Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: longhorn
+  claimRef:
+    namespace: default
+    name: ci-paperless-ngx-volume-claim
+  hostPath:
+    path: /var/lib/ci-pv/paperless-ngx/data
+    type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: ci-paperless-consume
+spec:
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: longhorn
+  claimRef:
+    namespace: default
+    name: ci-paperless-ngx-consume-volume-claim
+  hostPath:
+    path: /var/lib/ci-pv/paperless-ngx/consume
+    type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-paperless-ngx-redis-secret
+stringData:
+  redis-connection-url: redis://:cipass@redis:6379
+  key-prefix: ci
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-paperless-ngx-db-secret
+stringData:
+  server: postgres
+  port: "5432"
+  database: paperless
+  username: ci
+  password: ci
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-paperless-ngx-secret
+stringData:
+  username: admin
+  password: ci-admin-password
+  paperless-secret-key: paperless-ci-secret-key-0123456789abcdef0123456789abcdef
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+  labels:
+    app: postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: public.ecr.aws/docker/library/postgres:16-alpine
+          env:
+            - name: POSTGRES_USER
+              value: ci
+            - name: POSTGRES_PASSWORD
+              value: ci
+            - name: POSTGRES_DB
+              value: paperless
+          ports:
+            - containerPort: 5432
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "ci"]
+            periodSeconds: 5
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+      volumes:
+        - name: data
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+spec:
+  selector:
+    app: postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  labels:
+    app: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: public.ecr.aws/docker/library/redis:7-alpine
+          args: ["redis-server", "--requirepass", "cipass"]
+          ports:
+            - containerPort: 6379
+          readinessProbe:
+            tcpSocket:
+              port: 6379
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+spec:
+  selector:
+    app: redis
+  ports:
+    - port: 6379
+      targetPort: 6379
@@ -0,0 +1,2 @@
+# Paperless runs database migrations and an index check on first start.
+INSTALL_TIMEOUT=600
@@ -0,0 +1,10 @@
+secrets:
+  redisRef: op://ci/paperless-redis
+  databaseRef: op://ci/paperless-db
+  paperlessRef: op://ci/paperless
+
+ingress:
+  domain: paperless.ci.local
+
+# smbConnection and oidc stay disabled (defaults): the SMB CSI driver and a
+# real OIDC login flow are out of scope for the CI install-test.