jklein
cc6084ca58
New install-test job in validate-charts.yml: for exactly the charts a PR changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0, k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become Ready. Runs non-blocking (continue-on-error) during the stabilization phase. Fixtures live at the repo root under ci/ (not inside chart directories, so they neither trigger publishes on merge nor get packaged): a stub OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate seed job, static hostPath PVs where charts pin storage classes or need RWX), plus a shared ci/run-install-test.sh harness that also runs locally. Excluded with documented reasons (ci/excluded-charts.txt): satisfactory (multi-GB image), teamspeak-server (TS6 beta license expired, image crashes on start), template-chart (placeholder image). All 14 non-excluded charts verified locally in k3d using only the committed fixtures.
189 lines
3.9 KiB
YAML
189 lines
3.9 KiB
YAML
# Fixtures for the voucher-vault install-test: throwaway postgres + redis
|
|
# (Celery broker), a dex OIDC provider and the secrets the 1Password
|
|
# operator would otherwise materialize (release name: ci).
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-voucher-vault-secret
|
|
stringData:
|
|
secretKey: voucher-vault-ci-django-secret-0123456789abcdef0123456789abcdef
|
|
redis-url: redis://:cipass@redis:6379/0
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-voucher-vault-db-secret
|
|
stringData:
|
|
host: postgres
|
|
port: "5432"
|
|
user: ci
|
|
password: ci
|
|
database: vouchervault
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-voucher-vault-oidc-secret
|
|
stringData:
|
|
oidc-jwks-endpoint: http://dex.default.svc.cluster.local:5556/dex/keys
|
|
client-id: ci-client
|
|
client-secret: ci-client-secret
|
|
authorization-endpoint: http://dex.default.svc.cluster.local:5556/dex/auth
|
|
token-endpoint: http://dex.default.svc.cluster.local:5556/dex/token
|
|
user-endpoint: http://dex.default.svc.cluster.local:5556/dex/userinfo
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: postgres
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: public.ecr.aws/docker/library/postgres:16-alpine
|
|
env:
|
|
- name: POSTGRES_USER
|
|
value: ci
|
|
- name: POSTGRES_PASSWORD
|
|
value: ci
|
|
- name: POSTGRES_DB
|
|
value: vouchervault
|
|
ports:
|
|
- containerPort: 5432
|
|
readinessProbe:
|
|
exec:
|
|
command: ["pg_isready", "-U", "ci"]
|
|
periodSeconds: 5
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/postgresql/data
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: postgres
|
|
spec:
|
|
selector:
|
|
app: postgres
|
|
ports:
|
|
- port: 5432
|
|
targetPort: 5432
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: redis
|
|
labels:
|
|
app: redis
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: redis
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: redis
|
|
spec:
|
|
containers:
|
|
- name: redis
|
|
image: public.ecr.aws/docker/library/redis:7-alpine
|
|
args: ["redis-server", "--requirepass", "cipass"]
|
|
ports:
|
|
- containerPort: 6379
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 6379
|
|
periodSeconds: 5
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: redis
|
|
spec:
|
|
selector:
|
|
app: redis
|
|
ports:
|
|
- port: 6379
|
|
targetPort: 6379
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: dex-config
|
|
data:
|
|
config.yaml: |
|
|
issuer: http://dex.default.svc.cluster.local:5556/dex
|
|
storage:
|
|
type: memory
|
|
web:
|
|
http: 0.0.0.0:5556
|
|
oauth2:
|
|
skipApprovalScreen: true
|
|
staticClients:
|
|
- id: ci-client
|
|
secret: ci-client-secret
|
|
name: CI Client
|
|
redirectURIs:
|
|
- https://vv.ci.local/oidc/callback
|
|
enablePasswordDB: true
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: dex
|
|
labels:
|
|
app: dex
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: dex
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: dex
|
|
spec:
|
|
containers:
|
|
- name: dex
|
|
image: ghcr.io/dexidp/dex:v2.41.1
|
|
command: ["dex", "serve", "/etc/dex/cfg/config.yaml"]
|
|
ports:
|
|
- containerPort: 5556
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /dex/healthz
|
|
port: 5556
|
|
periodSeconds: 5
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/dex/cfg
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: dex-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: dex
|
|
spec:
|
|
selector:
|
|
app: dex
|
|
ports:
|
|
- port: 5556
|
|
targetPort: 5556
|