jklein
cc6084ca58
New install-test job in validate-charts.yml: for exactly the charts a PR changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0, k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become Ready. Runs non-blocking (continue-on-error) during the stabilization phase. Fixtures live at the repo root under ci/ (not inside chart directories, so they neither trigger publishes on merge nor get packaged): a stub OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate seed job, static hostPath PVs where charts pin storage classes or need RWX), plus a shared ci/run-install-test.sh harness that also runs locally. Excluded with documented reasons (ci/excluded-charts.txt): satisfactory (multi-GB image), teamspeak-server (TS6 beta license expired, image crashes on start), template-chart (placeholder image). All 14 non-excluded charts verified locally in k3d using only the committed fixtures.
194 lines
4.3 KiB
YAML
194 lines
4.3 KiB
YAML
# Fixtures for the paperless-ngx install-test: throwaway postgres + redis,
|
|
# the secrets the 1Password operator would otherwise materialize (release
|
|
# name: ci), and storage plumbing. The chart hardcodes storageClassName
|
|
# "longhorn" (RWX for the consume PVC), which does not exist in k3d: a
|
|
# no-provisioner StorageClass named "longhorn" plus pre-bound hostPath PVs
|
|
# stand in for it. Paperless runs as uid 1000 with a read-only rootfs and
|
|
# hostPath volumes do not support fsGroup, so a node-setup Job pre-creates
|
|
# the exact subPath directories world-writable.
|
|
apiVersion: storage.k8s.io/v1
|
|
kind: StorageClass
|
|
metadata:
|
|
name: longhorn
|
|
provisioner: kubernetes.io/no-provisioner
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: node-setup
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: setup
|
|
image: public.ecr.aws/docker/library/busybox:1.36
|
|
command:
|
|
- sh
|
|
- -c
|
|
- >
|
|
mkdir -p /pv/paperless-ngx/data/data /pv/paperless-ngx/data/media
|
|
/pv/paperless-ngx/data/export /pv/paperless-ngx/consume &&
|
|
chmod -R 0777 /pv/paperless-ngx
|
|
volumeMounts:
|
|
- name: pv
|
|
mountPath: /pv
|
|
volumes:
|
|
- name: pv
|
|
hostPath:
|
|
path: /var/lib/ci-pv
|
|
type: DirectoryOrCreate
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolume
|
|
metadata:
|
|
name: ci-paperless-data
|
|
spec:
|
|
capacity:
|
|
storage: 20Gi
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
persistentVolumeReclaimPolicy: Retain
|
|
storageClassName: longhorn
|
|
claimRef:
|
|
namespace: default
|
|
name: ci-paperless-ngx-volume-claim
|
|
hostPath:
|
|
path: /var/lib/ci-pv/paperless-ngx/data
|
|
type: DirectoryOrCreate
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolume
|
|
metadata:
|
|
name: ci-paperless-consume
|
|
spec:
|
|
capacity:
|
|
storage: 1Gi
|
|
accessModes:
|
|
- ReadWriteMany
|
|
persistentVolumeReclaimPolicy: Retain
|
|
storageClassName: longhorn
|
|
claimRef:
|
|
namespace: default
|
|
name: ci-paperless-ngx-consume-volume-claim
|
|
hostPath:
|
|
path: /var/lib/ci-pv/paperless-ngx/consume
|
|
type: DirectoryOrCreate
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-paperless-ngx-redis-secret
|
|
stringData:
|
|
redis-connection-url: redis://:cipass@redis:6379
|
|
key-prefix: ci
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-paperless-ngx-db-secret
|
|
stringData:
|
|
server: postgres
|
|
port: "5432"
|
|
database: paperless
|
|
username: ci
|
|
password: ci
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-paperless-ngx-secret
|
|
stringData:
|
|
username: admin
|
|
password: ci-admin-password
|
|
paperless-secret-key: paperless-ci-secret-key-0123456789abcdef0123456789abcdef
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: postgres
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: public.ecr.aws/docker/library/postgres:16-alpine
|
|
env:
|
|
- name: POSTGRES_USER
|
|
value: ci
|
|
- name: POSTGRES_PASSWORD
|
|
value: ci
|
|
- name: POSTGRES_DB
|
|
value: paperless
|
|
ports:
|
|
- containerPort: 5432
|
|
readinessProbe:
|
|
exec:
|
|
command: ["pg_isready", "-U", "ci"]
|
|
periodSeconds: 5
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/postgresql/data
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: postgres
|
|
spec:
|
|
selector:
|
|
app: postgres
|
|
ports:
|
|
- port: 5432
|
|
targetPort: 5432
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: redis
|
|
labels:
|
|
app: redis
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: redis
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: redis
|
|
spec:
|
|
containers:
|
|
- name: redis
|
|
image: public.ecr.aws/docker/library/redis:7-alpine
|
|
args: ["redis-server", "--requirepass", "cipass"]
|
|
ports:
|
|
- containerPort: 6379
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 6379
|
|
periodSeconds: 5
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: redis
|
|
spec:
|
|
selector:
|
|
app: redis
|
|
ports:
|
|
- port: 6379
|
|
targetPort: 6379
|