jklein
45b2d2ea4e
Validate Helm Charts / Detect changed charts (pull_request) Successful in 4s
Validate Helm Charts / Resource quantities (pull_request) Successful in 17s
Validate Helm Charts / Selector match (pull_request) Successful in 14s
Validate Helm Charts / HTTPRoute match (pull_request) Successful in 15s
Validate Helm Charts / Build rss-bridge (pull_request) Successful in 8s
Validate Helm Charts / Trivy config rss-bridge (pull_request) Successful in 24s
Install-test / Install-test rss-bridge (pull_request) Successful in 1m10s
Validate Helm Charts / Install-test (pull_request) Successful in 1m10s
rss-bridge was the twenty-second and last chart of the Gateway-API sweep: 22 charts carried an Ingress template, 21 an HTTPRoute template, and the difference was exactly this one. It had been held back as frozen by #51 - a runner defect, not a property of the chart - and that freeze is lifted. One HTTPRoute carrying ALL THREE hostnames, because nothing differs per host: every name serves the same Service at "/", measured on the live Ingress. spec.hostnames is a list, so one object is the whole answer and a second would repeat one rule. (Unlike homeassistant, whose paths differ per host, or matrix-synapse, whose two routes want different backends.) httpRoute.hostnames is its own MANDATORY value, which is a third shape for this repository and follows from the values rather than from taste. Most charts fall back to ingress.domain; freesailarr and homeassistant reject a hostnames key outright, because a chart-global list could not say which app or host entry it belonged to. This chart has no ingress.domain either, but its names are unambiguous - and the ingress.hosts list it would otherwise reuse carries per-host tlsSecretName values that address nothing once TLS sits on the Gateway's listener. Reusing it would drag a structure whose other half is meaningless into the new mode. rss-bridge.tlsGroups is therefore INERT in Gateway mode, and that is named as a simplification rather than quietly translated: the helper exists only to group hosts by TLS secret name, and there is nothing left to group. The required() on ingress.hosts needed no change to become conditional - it already sits inside the Ingress template behind ingress.enabled - so what is new is that values.yaml and the schema now say so. The ingress.enabled-derived-value screen that caught sure, freesailarr and ytdlp-web-player was run here and came back CLEAN: outside the Ingress template the only readers of an ingress value are NOTES.txt, which knows its own mode, and tlsGroups, called only from behind the switch. The app takes no base URL in its environment, so no "published" helper is needed. First chart of the sweep whose Gateway branch has NO loss to explain, and it was measured rather than assumed (read-only kubectl against the live object): the running Ingress carries the cert-manager annotation plus Helm and Rancher/Fleet bookkeeping, and not one nginx.ingress.kubernetes.io annotation. The group-3 screen came back empty, so NOTES.txt says so positively instead of copying a loss paragraph from another chart. Also corrects the last occurrence in the repository of the outdated sentence "charts in this repo deliberately have no dependencies" (rss-bridge/templates/_helpers.tpl) - dependencies are admissible but expensive since #214, and ytdlp-web-player, stalwart and paperless-ngx use subcharts. The reason the helper is duplicated is unchanged, only its content: sharing it would mean a library chart, a second artefact to publish, version and pull for about one change a year. Minor, not major: additive, defaults unchanged, and relaxing a required is not a tightening. Proven with an EMPTY helm template diff against origin/main for the defaults (229 lines, byte-identical); the Gateway mode with its overlay renders the HTTPRoute in place of the Ingress and nothing else changes. appVersion untouched - 2026-09-30 is the newest date tag the registry has, everything newer is sha-* and latest. ci/run-httproute-match-test.sh goes from 56 assertions over 21 charts to 58 over 22. The overlay at ci/httproute/rss-bridge.yaml has to SUPPLY hostnames, the second in the repository that does (homeassistant's was the first, for a different reason), because this chart has no fallback. NOT PROVEN, and stated in the PR as well: that traffic flows. No Gateway controller runs in CI and no HTTPRoute reaches "Accepted: True" there. For this chart there is additionally NO successful install-test at all - it fails on the Gitea runner in either mode (#51, reproduced on two images while the same chart and image run healthy in the cluster). The chart is deliberately NOT added to ci/excluded-charts.txt: an exclusion would silence the signal, and the day the runner is fixed the test goes green by itself. So the only red contexts expected here are "Install-test / Install-test rss-bridge" and the collective "Validate Helm Charts / Install-test". Fixes #114 Fixes #40
64 lines
3.4 KiB
YAML
64 lines
3.4 KiB
YAML
# Render-only overlay for ci/run-httproute-match-test.sh, applied LAST.
|
|
#
|
|
# Its one job is to put this chart into Gateway mode, because the convention
|
|
# ships with httpRoute.enabled: false and the test would otherwise be green
|
|
# over nothing. A chart that has an overlay here and still renders no
|
|
# HTTPRoute FAILS the test - that is the whole point of the file existing.
|
|
#
|
|
# An overlay and not a change to ci/rss-bridge/test-values.yaml, and for this
|
|
# chart the reason is sharper than for its siblings. The install-test runs
|
|
# exactly ONE configuration per chart and the two modes are mutually exclusive,
|
|
# so switching the fixture would trade this chart's Ingress away - and that
|
|
# fixture's Ingress is the only thing that exercises rss-bridge.tlsGroups, the
|
|
# secret-grouping helper that keeps the three grown certificates of the real
|
|
# installation on their existing names. That helper is inert in Gateway mode
|
|
# (nothing to group once TLS sits on the listener), so a fixture switched to
|
|
# this mode would stop covering it entirely. The CRD schema check the pilot
|
|
# paid for is already performed by cyberchef's fixture against the real
|
|
# Gateway-API CRDs; what is missing without this file is the render-level
|
|
# assurance, and that is what this overlay buys.
|
|
#
|
|
# A caveat that applies to this chart and to no other in the sweep: its
|
|
# install-test does not pass at all. php-fpm cannot read /app/index.php on the
|
|
# Gitea runner, the startup probe 403s through its whole budget and the pod
|
|
# never becomes Ready (Gitea #51 - reproduced on two different images, while
|
|
# the same chart and image run healthy in the cluster, so the defect is the
|
|
# runner's). The chart is deliberately NOT in ci/excluded-charts.txt: an
|
|
# exclusion would silence the signal, and the day the runner is fixed this test
|
|
# goes green by itself and that is how anyone will find out. So for this chart
|
|
# the render-level assurances below are the ONLY automated coverage its Gateway
|
|
# mode has.
|
|
#
|
|
# ingress.enabled: false is not optional here - the chart ships it as TRUE and
|
|
# aborts its own render when both modes are on.
|
|
#
|
|
# httpRoute.hostnames MUST be supplied, and this overlay is the second in the
|
|
# repository that has to (homeassistant's was the first). The other charts let
|
|
# an empty hostnames list fall back to ingress.domain; this chart has no
|
|
# ingress.domain, and it deliberately does not reuse ingress.hosts from the
|
|
# fixture, because those entries carry tlsSecretName values that address
|
|
# nothing once the certificate sits on the Gateway's listener. The render
|
|
# aborts on an empty list rather than publishing a route that matches every
|
|
# request reaching its listener.
|
|
#
|
|
# THREE hostnames on ONE object, which is the shape this chart's production
|
|
# installation has (three hosts, all serving the same Service at "/"). It is
|
|
# also the shape the test should see: one HTTPRoute, one rule, one backendRef,
|
|
# several hostnames - as opposed to homeassistant's one-object-per-host or
|
|
# matrix-synapse's two objects with different paths and backends. The three
|
|
# names are kept recognisably parallel to ci/rss-bridge/test-values.yaml so the
|
|
# two modes can be read side by side, but they are NOT the same values: these
|
|
# are the route's hostnames, and the fixture's are the Ingress's hosts.
|
|
ingress:
|
|
enabled: false
|
|
httpRoute:
|
|
enabled: true
|
|
parentRefs:
|
|
- name: public
|
|
namespace: gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- rss-bridge.ci.local
|
|
- rssbridge.ci.local
|
|
- rss-bridge.ci.example
|