jklein
26be67f4cd
validate-charts.yml / Build ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }} (pull_request) Blocked by required conditions
validate-charts.yml / Trivy config ${{ fromJSON(needs.detect-changed-charts.outputs.scan-charts) }} (pull_request) Blocked by required conditions
Validate Helm Charts / Detect changed charts (pull_request) Successful in 3s
Validate Helm Charts / Resource quantities (pull_request) Successful in 10s
Validate Helm Charts / Build ${{ fromJSON(needs.detect-changed-charts.outputs.charts) }} (pull_request) Successful in 6s
Validate Helm Charts / Trivy config ${{ fromJSON(needs.detect-changed-charts.outputs.scan-charts) }} (pull_request) Successful in 22s
Validate Helm Charts / Install-test (pull_request) Successful in 2m22s
Install-test / Install-test stalwart (pull_request) Successful in 2m22s
Cluster-capable from the start, with roles rather than symmetry: one StatefulSet per entry of the "nodes" map, the key passed in STALWART_ROLE. Since v0.16 Stalwart keeps its whole configuration inside the data store and manages it over JMAP, so the chart's scope is deliberately narrow: it renders config.json (exactly the DataStore object), the workloads, the Services, the NetworkPolicies, the Ingress and a cert-manager Certificate. Listeners, blob store, in-memory store, TLS object and cluster roles are operator work in the WebUI, which is why NOTES.txt carries an eight-step first install. config.json stays secret-free: authSecret uses the EnvironmentVariable variant (verified against the serde definition of PostgreSqlStore at v0.16.24), so the password arrives through secretKeyRef and checksum/config stays meaningful. The username cannot follow it - authUsername is a plain String with no secret form - so it is a public value and says so. Services are per PORT, not per group: a NodePort is cluster-unique, so "full" and "mx" can only accept SMTP behind one Service, selected through a per-port pod label. The http port gets a per-group ClusterIP Service instead, so the Ingress reaches exactly ingress.nodeGroup. Four traps, documented rather than explained away: - The role lookup FAILS OPEN. A node whose ClusterRole is missing from the database enables every listener and every task while staying Running with a green probe, and the log line arrives after the listeners are bound. Hence mx at replicas 0, per-port Services, and a NetworkPolicy that is a ceiling independent of what was bound. - NET_BIND_SERVICE is a documented deviation needed to EXEC, not to bind. The image sets setcap cap_net_bind_service=+ep, which makes the kernel fail execve when the bounding set is empty. The values comment says both why it is there and that it is never used, because the second half is what stops the next hardening pass from removing it. - externalTrafficPolicy must be Cluster - no pod runs on a control-plane node while the HA proxy delivers to them, so Local would drop every packet - and the source address that costs is restored only by the HA proxy's PROXY v2 header. - /healthz is rate-limited to 100 requests/60s per source IP, which is a node IP for kubelet probes, so all pods on a node share one bucket. The probe intervals are calculated (6 req/min/pod, ~16 pods per node) and the sum is a comment in values.yaml. A first install needs bootstrap.enabled: true: the setup wizard appears only when config.json is ABSENT, and this chart always renders one, so recovery mode is upstream's documented path for a templated config.json. Second chart in the repo with a dependency - the Valkey project's own chart, off by default behind condition:, because Stalwart's cluster coordinator rides on the in-memory store connection. The render aborts when more than one pod runs with no in-memory store address anywhere. Also wired up: publish-stalwart.yml through the shared block in workflow-util/pipelines, the change-app-version.yml choice list, a Renovate customManagers block anchored on the v prefix (which excludes the moving latest / v0.16 / -alpine tags), CI fixtures, and the README and CLAUDE.md lines that claimed ytdlp-web-player was the only chart with a dependency. Verified locally: ci/helm-dependencies.sh, helm lint --strict (0 failed), helm package, helm template against chart defaults and against ci/stalwart/test-values.yaml, the rendered config.json parsed as JSON with the field types the serde definition requires, ci/run-quantity-render-test.sh (0 failed, both nodes.*.resources paths exercised), NOTES.txt rendered through a scratch ConfigMap, and the null-safety and fail paths (securityContext=null keeps NET_BIND_SERVICE; a cluster without an in-memory store, an unknown port name, a group without http and an unknown ingress.nodeGroup all abort with a named message; the schema rejects timeout, a string timeoutMs and a list-shaped nodes). NO runtime verification was possible - there is no k3d or Docker daemon in this workspace. Part of #65
105 lines
3.4 KiB
YAML
105 lines
3.4 KiB
YAML
# Fixtures for the stalwart install-test: a throwaway Postgres, the one Secret
|
|
# the 1Password operator would otherwise materialize, and a stub CRD for
|
|
# cert-manager's Certificate (release name: ci; the OnePasswordItem stub CRD
|
|
# comes from ci/common/).
|
|
#
|
|
# NO VALKEY HERE, DELIBERATELY. The in-memory store is an object in Stalwart's
|
|
# DATABASE, not a chart value, so a Valkey in this namespace would be reachable
|
|
# and unused - it would make the test look like it covered the clustering path
|
|
# while covering nothing of it. The test runs a single node (nodes.full
|
|
# replicas 1, nodes.mx replicas 0), which is the configuration that needs no
|
|
# in-memory store at all. The subchart path is covered by a local render only,
|
|
# named as a known gap in the PR that introduced this chart.
|
|
#
|
|
# A stub CRD for Certificate rather than certificate.enabled: false, because
|
|
# switching the Certificate off would also drop the volume and volumeMount that
|
|
# carry it - and the mount is on the risky side of readOnlyRootFilesystem. With
|
|
# the stub the object applies, the Secret it names never appears, and the
|
|
# optional: true on the volume is exercised for real: the pods must start
|
|
# without it. That is the behaviour an operator meets on every first install,
|
|
# before cert-manager has answered the challenge.
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
name: certificates.cert-manager.io
|
|
spec:
|
|
group: cert-manager.io
|
|
names:
|
|
kind: Certificate
|
|
listKind: CertificateList
|
|
plural: certificates
|
|
singular: certificate
|
|
scope: Namespaced
|
|
versions:
|
|
- name: v1
|
|
served: true
|
|
storage: true
|
|
schema:
|
|
openAPIV3Schema:
|
|
type: object
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-stalwart-datastore-secret
|
|
stringData:
|
|
# The ONLY field this chart reads from the data store item. config.json
|
|
# references it by variable name through
|
|
# "authSecret": {"@type":"EnvironmentVariable","variableName":"STALWART_DB_PASSWORD"}
|
|
# so this value has to match the throwaway Postgres below. A real password
|
|
# rather than an empty string on purpose: upstream's resolver treats an empty
|
|
# environment variable as "not found" and fails the store open, so an empty
|
|
# value here would fail the run for the right reason in the wrong place.
|
|
password: ci-stalwart-throwaway-password
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: postgres
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: public.ecr.aws/docker/library/postgres:16-alpine
|
|
env:
|
|
- name: POSTGRES_USER
|
|
value: stalwart
|
|
- name: POSTGRES_PASSWORD
|
|
value: ci-stalwart-throwaway-password
|
|
- name: POSTGRES_DB
|
|
value: stalwart
|
|
ports:
|
|
- containerPort: 5432
|
|
readinessProbe:
|
|
exec:
|
|
command: ["pg_isready", "-U", "stalwart"]
|
|
periodSeconds: 5
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/postgresql/data
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: postgres
|
|
spec:
|
|
selector:
|
|
app: postgres
|
|
ports:
|
|
- port: 5432
|
|
targetPort: 5432
|