jklein
69a280399c
freesailarr was excluded from the install-test because gluetun never becomes healthy without a real Wireguard key and no app container behind its kill switch can become Ready. The green "Install-test freesailarr pass" was a 25-second SKIP on the most complex chart in the repo - a signal that proved nothing. With a CI-only Mullvad key in 1Password the reason is gone: - ci/run-install-test.sh learns a general rule: ci/<chart>/fixtures.env.yaml is rendered with envsubst before it is applied, restricted to the variable names a chart declares in REQUIRED_ENV. A missing or empty declared variable fails the run loudly and names the variable - it never skips the chart. - The install-test job loads the key from 1Password Connect for freesailarr only, following the pattern publish-helm-chart.yml documents: values via steps.<id>.outputs.*, mapped into the step's own env, quoted, with ":?" guards that name the missing op:// field before a cluster is created. - Fixtures for freesailarr: three media claims, the gluetun secret template with variable names only, firewallOutboundSubnets so the kill switch does not block cluster DNS, and INSTALL_TIMEOUT=900 for nine containers. freesailarr/Chart.yaml goes 3.0.0+up1.0.0 -> 3.0.1+up1.0.0. That bump is deliberately empty of content: the install-test matrix follows changed chart directories, and without it this PR could not run the test it adds.
23 lines
1.0 KiB
YAML
23 lines
1.0 KiB
YAML
# The gluetun credentials Secret the 1Password operator materializes on the
|
|
# real cluster - here as a template with variable NAMES only. This file must
|
|
# never contain a value; ci/run-install-test.sh renders it with envsubst,
|
|
# restricted to the names declared in ci/freesailarr/settings.env
|
|
# (REQUIRED_ENV), and pipes the result straight into kubectl.
|
|
#
|
|
# The values come from a 1Password item holding a CI-only Mullvad key, loaded in
|
|
# the install-test job of .github/workflows/validate-charts.yml. A CI-only key
|
|
# on purpose: Mullvad ties an address to a key and sends the tunnel to the
|
|
# endpoint it saw last, so a shared key would let every pull request pull the
|
|
# tunnel out from under the running stack.
|
|
#
|
|
# Name and keys follow the chart: <release>-<chart>-gluetun-secret with the
|
|
# fields the StatefulSet reads via secretKeyRef. Release name is ci.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-freesailarr-gluetun-secret
|
|
type: Opaque
|
|
stringData:
|
|
wireguard-private-key: "${FREESAILARR_WG_KEY}"
|
|
wireguard-addresses: "${FREESAILARR_WG_ADDRESSES}"
|