jklein
69a280399c
freesailarr was excluded from the install-test because gluetun never becomes healthy without a real Wireguard key and no app container behind its kill switch can become Ready. The green "Install-test freesailarr pass" was a 25-second SKIP on the most complex chart in the repo - a signal that proved nothing. With a CI-only Mullvad key in 1Password the reason is gone: - ci/run-install-test.sh learns a general rule: ci/<chart>/fixtures.env.yaml is rendered with envsubst before it is applied, restricted to the variable names a chart declares in REQUIRED_ENV. A missing or empty declared variable fails the run loudly and names the variable - it never skips the chart. - The install-test job loads the key from 1Password Connect for freesailarr only, following the pattern publish-helm-chart.yml documents: values via steps.<id>.outputs.*, mapped into the step's own env, quoted, with ":?" guards that name the missing op:// field before a cluster is created. - Fixtures for freesailarr: three media claims, the gluetun secret template with variable names only, firewallOutboundSubnets so the kill switch does not block cluster DNS, and INSTALL_TIMEOUT=900 for nine containers. freesailarr/Chart.yaml goes 3.0.0+up1.0.0 -> 3.0.1+up1.0.0. That bump is deliberately empty of content: the install-test matrix follows changed chart directories, and without it this PR could not run the test it adds.
40 lines
1.8 KiB
YAML
40 lines
1.8 KiB
YAML
# freesailarr: the whole stack in one pod - gluetun plus eight app containers
|
|
# that share its network namespace and sit behind its kill switch. Nothing here
|
|
# is a shortcut around that: the install-test brings up a real Wireguard tunnel
|
|
# with a CI-only Mullvad key (see ci/freesailarr/fixtures.env.yaml), because a
|
|
# gluetun without a handshake keeps every app container from becoming Ready.
|
|
#
|
|
# Release name is ci, so the chart looks for the gluetun credentials in the
|
|
# Secret ci-freesailarr-gluetun-secret, which the fixtures create. The chart's
|
|
# own OnePasswordItem CR applies against the stub CRD and stays unreconciled -
|
|
# there is no 1Password operator in the CI cluster.
|
|
secrets:
|
|
# Required by the chart. Only the CR's itemPath, never resolved in CI.
|
|
gluetunSecretRef: op://ci/freesailarr-gluetun
|
|
|
|
media:
|
|
# The three media claims are pre-created in fixtures.yaml (one claim per
|
|
# category, no subPath - the shared-claim layout is a values question, not a
|
|
# startup question). local-path hands out its directories mode 0777, so the
|
|
# claim roots are writable for PUID/PGID as the chart requires.
|
|
downloads:
|
|
existingClaim: ci-freesailarr-downloads
|
|
movies:
|
|
existingClaim: ci-freesailarr-movies
|
|
tv:
|
|
existingClaim: ci-freesailarr-tv
|
|
|
|
gluetun:
|
|
vpn:
|
|
# Without this the kill switch drops cluster-internal egress as well, and
|
|
# the very first DNS lookup against cluster DNS fails. k3s defaults:
|
|
# 10.42.0.0/16 pods, 10.43.0.0/16 services.
|
|
firewallOutboundSubnets: "10.42.0.0/16,10.43.0.0/16"
|
|
|
|
ingress:
|
|
# Shared-domain mode with a placeholder host: the Ingress objects only have to
|
|
# be accepted by the API server. There is no ingress-nginx and no cert-manager
|
|
# in the CI cluster, and the install-test checks readiness, not routing.
|
|
host: freesailarr.example.com
|
|
clusterIssuer: ci
|