jklein
5ec60e86b6
Validate Helm Charts / Resource quantities (pull_request) Successful in 20s
Validate Helm Charts / Selector match (pull_request) Successful in 14s
Validate Helm Charts / Detect changed charts (pull_request) Successful in 1m20s
Validate Helm Charts / Build stalwart (pull_request) Successful in 21s
Validate Helm Charts / Trivy config stalwart (pull_request) Successful in 42s
Install-test / Install-test stalwart (pull_request) Successful in 4m31s
Validate Helm Charts / Install-test (pull_request) Successful in 4m55s
A two-replica node group was redundancy on paper: nothing kept both pods off one node, and no PodDisruptionBudget kept a drain from taking both at once. Both objects are now rendered per node group, gated on that group's COMPUTED replica count being >= 2. The distribution is a promise, not an effort: maxSkew 1 on kubernetes.io/hostname with whenUnsatisfiable DoNotSchedule, selecting only this group's own pods, so an "mx" and a "full" pod may share a node. The selector comes from the chart (stalwart.groupLabels), never from the operator - a spread constraint whose selector matches no pod is trivially satisfied, distributes nothing and reports nothing. nodeAffinityPolicy: Ignore is set explicitly, and that is the load-bearing detail. Its API default is Honor, under which a narrowing nodeSelector shrinks the set of counted domains until both replicas fit into one: skew 0, both pods co-located, no Pending, no event, and a selector that is correct - so no check can see it. With Ignore the same narrowing gives skew 2 and the second pod is Pending. A render abort was the alternative and would also have forbidden a nodeSelector spanning five nodes, which is legal. A user entry colliding with the chart's own on (topologyKey, whenUnsatisfiable) aborts the render naming both values, because the API rejects the duplicate with a message about a list index and an apply-based path merges the two over patchMergeKey: topologyKey silently, dropping one selector. Minor rather than major, proved with a diff rather than argued: with the shipped defaults (full: 1, mx: 0) and with ci/stalwart/test-values.yaml, helm template renders byte-for-byte what 1.0.1+upv0.16.24 rendered - both diffs empty. New in CI, over every chart on every PR: ci/run-selector-match-test.sh holds every rendered PodDisruptionBudget selector and every topologySpreadConstraints labelSelector against the labels of the pod templates in the same render. Helm itself is the YAML parser (ci/yaml2json), because the runners have neither pyyaml nor yq and a hand-written parser could read nothing and report nothing. podAffinity/podAntiAffinity are out of scope; matchExpressions-only selectors are reported as not checked rather than counted as passing. Two anti-vacuum guards: a chart with an overlay under ci/selector-match/ that renders no selector fails, and a run that checks no selector at all fails. Fixes #96
25 lines
1.3 KiB
YAML
25 lines
1.3 KiB
YAML
apiVersion: v2
|
|
# NOT A CHART THIS REPOSITORY PUBLISHES. It is a YAML parser, and Helm is the
|
|
# only one the runners have.
|
|
#
|
|
# ci/run-selector-match-test.sh has to read label selectors out of rendered
|
|
# manifests, and the runners carry neither pyyaml nor yq - measured, and the
|
|
# same constraint ci/run-trivy-config.sh and ci/run-quantity-render-test.sh
|
|
# work under. The alternative to this chart is a YAML parser written in awk or
|
|
# sed, and the failure mode of that is the one this repository removes rather
|
|
# than adds: a parser that quietly reads nothing finds no selector, reports no
|
|
# mismatch, and the test is green for a chart it never looked at.
|
|
#
|
|
# So the manifest fragment is handed to Helm as a VALUES FILE, and the one
|
|
# template below prints it back as JSON, which python3 reads with its standard
|
|
# library. A fragment Helm cannot parse makes helm exit 1, which is loud.
|
|
#
|
|
# It lives under ci/ and therefore has no publish workflow, no version-bump
|
|
# requirement and no entry in change-app-version.yml: the chart-discovery loops
|
|
# in this repository look for a Chart.yaml one level below the repo root, and
|
|
# "ci" has none. The version below is meaningless for the same reason.
|
|
name: yaml2json
|
|
description: Internal CI helper - reprints a values file as JSON so python3 can read YAML without pyyaml
|
|
type: application
|
|
version: 0.0.0
|