panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use chart-testing ci/*-values.yaml for testing

Browse Source 
This also enables the refactor to have multiple root level charts.

Resolves #100

Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-07-19 22:48:19 +02:00
parent a4c1de7b30
commit 06ddb7cd3f
47 changed files with 133 additions and 465 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/kind/conf/kind-config.yaml
+1
View File
@@ -15,3 +15,4 @@ kubeadmConfigPatches:
# admission-control-config-file: /etc/kubernetes/pki/admctrl/admission-control.yaml
nodes:
- role: control-plane
- role: worker
.github/tests/charts.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' .github/tests/charts.json)
VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' .github/tests/charts.json)
eval "$REPOS"
eval "$VERSIONS"
.github/tests/upstream-authority-disk/create-cert.sh → .github/tests/create-cert.sh
View File
.github/tests/production-external-mysql/mysql-values.yaml → .github/tests/dependencies/mysql.yaml
+5
View File
@@ -5,3 +5,8 @@ primary:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
auth:
database: spire-server
username: spire
password: sp1ff3Test
rootPassword: sp1ff3TestPassword
.github/tests/production-external-postgresql/postgresql-values.yaml → .github/tests/dependencies/postgresql.yaml
+5
View File
@@ -6,3 +6,8 @@ primary:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
auth:
database: spire-server
username: spire
password: sp1ff3Test
postgresPassword: sp1ff3TestPassword
.github/tests/upstream-authority-disk/example-org.key → .github/tests/example-org.key
View File
.github/tests/upstream-authority-disk/example-org.pem → .github/tests/example-org.pem
View File
.github/tests/extras/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/extras/values.yaml
-61
View File
@@ -1,61 +0,0 @@
spire-agent:
initContainers:
- name: extra-init
image: cgr.dev/chainguard/busybox:latest-glibc
command:
- sh
- -xec
- |
echo 'hi there' > /extra/file
volumeMounts:
- name: extra
mountPath: /extra
extraContainers:
- name: extra
image: cgr.dev/chainguard/busybox:latest-glibc
command:
- sh
- -xec
- |
[ -f /extra/file ]
while true; do sleep 1000; done
volumeMounts:
- name: extra
mountPath: /extra
extraVolumeMounts:
- name: extra
mountPath: /extra
extraVolumes:
- name: extra
emptyDir: {}
spire-server:
initContainers:
- name: extra-init
image: cgr.dev/chainguard/busybox:latest-glibc
command:
- sh
- -xec
- |
echo 'hi there' > /extra/file
volumeMounts:
- name: extra
mountPath: /extra
extraContainers:
- name: extra
image: cgr.dev/chainguard/busybox:latest-glibc
command:
- sh
- -xec
- |
[ -f /extra/file ]
while true; do sleep 1000; done
volumeMounts:
- name: extra
mountPath: /extra
extraVolumeMounts:
- name: extra
mountPath: /extra
extraVolumes:
- name: extra
emptyDir: {}
.github/tests/federation-bundle-endpoint/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/federation-bundle-endpoint/values.yaml
-3
View File
@@ -1,3 +0,0 @@
spire-server:
federation:
enabled: true
.github/tests/namespace-override/post-install.sh
-19
View File
@@ -1,19 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-systen
fi
.github/tests/namespace-override/pre-install.sh
-4
View File
@@ -1,4 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace "spire-system"
kubectl create namespace "spire-server"
.github/tests/namespace-override/values.yaml
-27
View File
@@ -1,27 +0,0 @@
spiffe-oidc-discovery-provider:
enabled: true
namespaceOverride: spire-server
insecureScheme:
enabled: true
spire-server:
namespaceOverride: spire-server
nodeAttestor:
k8sPsat:
serviceAccountAllowList: ["spire-system:spire-agent"]
notifier:
k8sbundle:
namespace: spire-system
spiffe-csi-driver:
enabled: true
namespaceOverride: spire-system
spire-agent:
enabled: true
namespaceOverride: spire-system
serviceAccount:
# -- The name of the service account to use.
name: spire-agent
server:
namespaceOverride: spire-server
.github/tests/no-spire-controller-manager/values.yaml
-3
View File
@@ -1,3 +0,0 @@
spire-server:
controllerManager:
enabled: false
.github/tests/no-spire-controller-manager/post-install.sh → .github/tests/post-install.sh
Regular → Executable
+1 -6
View File
@@ -7,11 +7,6 @@ SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
source "${SCRIPTPATH}/common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/pre-install.sh
Executable
+53
View File
@@ -0,0 +1,53 @@
#!/usr/bin/env bash
set -xe
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
DEPS="${SCRIPTPATH}/dependencies"
# Set repo and version env variables
REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' "${SCRIPTPATH}/charts.json")
VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' "${SCRIPTPATH}/charts.json")
eval "$REPOS"
eval "$VERSIONS"
helm_install=(helm upgrade --install --create-namespace)
# namespace override
kubectl create namespace spire-system || true
kubectl create namespace spire-server || true
# nginx ingress
"${helm_install[@]}" ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" \
--namespace ingress-nginx \
--set controller.extraArgs.enable-ssl-passthrough='' \
--wait
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller
# prometheus
"${helm_install[@]}" kube-prometheus-stack kube-prometheus-stack \
--namespace prometheus \
--version "${VERSION_KUBE_PROMETHEUS_STACK}" \
--repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
--wait
# cert-manager
"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
--namespace cert-manager \
--set installCRDs=true \
--wait
# external database
# mysql
"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
--namespace mysql \
--values "${DEPS}/mysql.yaml" \
--wait
# postgres
"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
--namespace postgresql \
--values "${DEPS}/postgresql.yaml" \
--wait
.github/tests/production-example/install.sh
-13
View File
@@ -1,13 +0,0 @@
#!/usr/bin/env bash
set -xe
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
helm install \
--namespace spire-server \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
spire charts/spire --wait
helm test spire --namespace spire-server
.github/tests/production-example/post-install.sh
-18
View File
@@ -1,18 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/production-example/pre-install.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/production-external-mysql/install.sh
-44
View File
@@ -1,44 +0,0 @@
#!/usr/bin/env bash
set -xe
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
DB=spire
DBUSER=spire
DBPW=$(uuidgen)
DBROOTPW=$(uuidgen)
# Generate random settings to make sure things come up with random settings.
cat <<EOF > /tmp/$$-db-values.yaml
auth:
database: ${DB}
username: ${DBUSER}
password: ${DBPW}
rootPassword: ${DBROOTPW}
EOF
cat <<EOF > /tmp/$$-spire-values.yaml
spire-server:
dataStore:
sql:
databaseType: mysql
databaseName: ${DB}
username: ${DBUSER}
password: ${DBPW}
host: mysql
port: 3306
EOF
helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
--values "${SCRIPTPATH}/mysql-values.yaml" \
--values /tmp/$$-db-values.yaml --wait
helm install \
--namespace "spire-server" \
--values /tmp/$$-spire-values.yaml \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
spire charts/spire --wait
helm test spire --namespace "spire-server"
.github/tests/production-external-mysql/post-install.sh
-18
View File
@@ -1,18 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/production-external-mysql/pre-install.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/production-external-postgresql/install.sh
-46
View File
@@ -1,46 +0,0 @@
#!/usr/bin/env bash
set -xe
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
DB=$(uuidgen)
DBUSER=$(uuidgen)
DBPW=$(uuidgen)
DBPGPW=$(uuidgen)
# Generate random settings to make sure things come up with random settings.
cat > /tmp/$$-db-values.yaml <<EOF
auth:
database: ${DB}
username: ${DBUSER}
password: ${DBPW}
postgresPassword: ${DBPGPW}
EOF
cat > /tmp/$$-spire-values.yaml <<EOF
spire-server:
dataStore:
sql:
databaseType: postgres
databaseName: ${DB}
username: ${DBUSER}
password: ${DBPW}
host: postgresql
port: 5432
options:
- sslmode: disable
EOF
helm install postgresql postgresql --namespace "spire-server" --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
--values "${SCRIPTPATH}/postgresql-values.yaml" \
--values /tmp/$$-db-values.yaml --wait
helm install \
--namespace "spire-server" \
--values /tmp/$$-spire-values.yaml \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
spire charts/spire --wait
helm test spire --namespace "spire-server"
.github/tests/production-external-postgresql/post-install.sh
-18
View File
@@ -1,18 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/production-external-postgresql/pre-install.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/prometheus/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/prometheus/pre-install.sh
-11
View File
@@ -1,11 +0,0 @@
#!/usr/bin/env bash
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install kube-prometheus-stack kube-prometheus-stack \
--version "${VERSION_KUBE_PROMETHEUS_STACK}" \
--repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
-n "${scenario}" \
--wait
.github/tests/prometheus/values.yaml
-13
View File
@@ -1,13 +0,0 @@
global:
telemetry:
prometheus:
enabled: true
podMonitor:
enabled: true
labels:
release: kube-prometheus-stack
spiffe-oidc-discovery-provider:
enabled: true
insecureScheme:
enabled: true
.github/tests/spire-oidc-insecure/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [[ "$1" -ne 0 ]]; then
get_namespace_details "${scenario}"
fi
.github/tests/spire-oidc-insecure/pre-install.sh
-8
View File
@@ -1,8 +0,0 @@
#!/usr/bin/env bash
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller -n "$scenario"
.github/tests/spire-oidc-insecure/values.yaml
-41
View File
@@ -1,41 +0,0 @@
spire-server:
ingress:
enabled: true
className: "nginx"
annotations:
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
hosts:
- host: ingress-nginx-controller.spire-oidc-insecure
paths:
- path: /
pathType: Prefix
spire-agent:
server:
address: ingress-nginx-controller.spire-oidc-insecure
port: 443
spiffe-oidc-discovery-provider:
enabled: true
insecureScheme:
enabled: true
config:
additionalDomains:
- ingress-nginx-controller
acme:
tosAccepted: false
ingress:
enabled: true
className: nginx
hosts:
- host: ingress-nginx-controller
paths:
- path: /
pathType: Prefix
.github/tests/tornjak/install.sh
-13
View File
@@ -1,13 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH=$(dirname "$SCRIPT")
helm install \
--namespace spire-server \
--values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
--values "${SCRIPTPATH}/../../../examples/tornjak/values.yaml" \
spire charts/spire --wait
helm test spire -n spire-server
.github/tests/tornjak/post-install.sh
-23
View File
@@ -1,23 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status spire-server spire-system
kubectl rollout status --watch --timeout 180s --namespace spire-server deployments.apps spire-tornjak-frontend
kubectl -n spire-server get deploy spire-tornjak-frontend
kubectl -n spire-server get service spire-tornjak-frontend
if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server
get_namespace_details spire-system
fi
.github/tests/tornjak/pre-install.sh
-6
View File
@@ -1,6 +0,0 @@
#!/usr/bin/env bash
kubectl create namespace spire-system
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
kubectl create namespace spire-server
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted
.github/tests/upstream-authority-cert-manager/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [ "$1" != '0' ]; then
get_namespace_details "${scenario}"
fi
.github/tests/upstream-authority-cert-manager/pre-install.sh
-7
View File
@@ -1,7 +0,0 @@
#!/usr/bin/env bash
SCRIPT="$(readlink -f "$0")"
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait
.github/tests/upstream-authority-cert-manager/values.yaml
-6
View File
@@ -1,6 +0,0 @@
spire-server:
upstreamAuthority:
certManager:
enabled: true
ca:
create: true
.github/tests/upstream-authority-disk/post-install.sh
-17
View File
@@ -1,17 +0,0 @@
#!/usr/bin/env bash
set -x
SCRIPT=$(readlink -f "$0")
SCRIPTPATH="$(dirname "${SCRIPT}")"
scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
# shellcheck source=/dev/null
source "${SCRIPTPATH}/../common.sh"
print_helm_releases
print_spire_workload_status "${scenario}"
if [ "$1" != '0' ]; then
get_namespace_details "${scenario}"
fi
.github/tests/upstream-authority-disk/values.yaml
-58
View File
@@ -1,58 +0,0 @@
server:
config:
upstreamAuthority:
disk:
enabled: true
secret:
data:
# This cert is generated using create-cert.sh and should only be used for the test
certificate: |
-----BEGIN CERTIFICATE-----
MIIDBDCCAewCCQCK4mz8rTwvHDANBgkqhkiG9w0BAQsFADBEMQswCQYDVQQGEwJO
TDEPMA0GA1UECgwGU1BJRkZFMQ4wDAYDVQQLDAVTUElSRTEUMBIGA1UEAwwLZXhh
bXBsZS5vcmcwHhcNMjMwMjIwMTAwNTA5WhcNMjQwMjIwMTAwNTA5WjBEMQswCQYD
VQQGEwJOTDEPMA0GA1UECgwGU1BJRkZFMQ4wDAYDVQQLDAVTUElSRTEUMBIGA1UE
AwwLZXhhbXBsZS5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC4
1hcad074AFQlQiM9j54tuh1yCpRfO2pFPOwESqT/gYrnAMfl24nI28FaC/gZWmhD
5VZrThY8QlLesk7iyDmrvB6VMMs5di40C5XE11FLf+efS1CpD9atqLyBQ1tjB0yZ
zIPZFP97HRI4DQb7BXqgOmDEnJ5gk6IleBsomQlDwyu9TXgUd8c4SEFgrxHMjfyb
ZN3dKzw4jCB3SrEqouaSq7eelCe0q58y4Lq8fkD+Zc2GrRJ0K5y3eMoRzp5ByK8Q
YPm8AJgFVTS9kCs+HROqC+Y7WqracUiEHCDWY1HG5IbdC9GSNdPDu2GHUxFWtKhh
Pw+I7iuu3jF5LRikLtDpAgMBAAEwDQYJKoZIhvcNAQELBQADggEBACK0PQa7+2za
GOacBqbmeycEJmiSZYEi1sMbgjFjmROcW+wyzWZDvMlDSS2z22B6Cp7qS5ZY3T7H
ZMVbpRkkNMF9h+51cTFoUlppgFEEqIXRkE+Jejs5Fq2FvgSdx/2LJZkTzt4Rlo07
UiP4nlHhsEVPRNPuus/MfoA2RZYfGJt+4eLXqjS6TAcccfGqVcMmq/FjjZjzWY5w
gYXC5ID4NB54N7ag0iBltcZ+OnYWlhReTOxih9yZXq8lRzE2Ny5aA2ztM9YfDuYu
ATU9T+cfd9UTu8PPNPLuXLgVr1P+1JOApzq1EA0fjDq4L6FzMqgoumWFV3kXHwop
m27t/52Pu8U=
-----END CERTIFICATE-----
# This key is generated using create-cert.sh and should only be used for the test
key: |
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC41hcad074AFQl
QiM9j54tuh1yCpRfO2pFPOwESqT/gYrnAMfl24nI28FaC/gZWmhD5VZrThY8QlLe
sk7iyDmrvB6VMMs5di40C5XE11FLf+efS1CpD9atqLyBQ1tjB0yZzIPZFP97HRI4
DQb7BXqgOmDEnJ5gk6IleBsomQlDwyu9TXgUd8c4SEFgrxHMjfybZN3dKzw4jCB3
SrEqouaSq7eelCe0q58y4Lq8fkD+Zc2GrRJ0K5y3eMoRzp5ByK8QYPm8AJgFVTS9
kCs+HROqC+Y7WqracUiEHCDWY1HG5IbdC9GSNdPDu2GHUxFWtKhhPw+I7iuu3jF5
LRikLtDpAgMBAAECggEAQNS+98Z/SVd8LDFdgPs95RYRu+1gC2MgrDZpJjw0UXZT
jSDl/Iabdns1/2qRU/s09ROc0zhpbitpO7lZGAxYxhbOt0+NCJOeMx0ZJBjN5+hu
Cp51JUdr6i90JvbEOCDYSl3EpUDLN5iDymsvVp6eW1L+nBe/KWq/Bdtx0zSSXlSe
sdlQenZ6JcsLBqOwSzSkvG4DBH097pYhePzLOLyZ+watyaD5QoKUg1n2jtqCEBxG
2QV2D0UJVgkJrsytc9LRqIBVqKvwD3GkRtQcIlg4Cf3oWmFrwkVE0wYikLtnzfGt
GJ1dee1enHkexjwjD4RUd2Es1XDPmQNNZ9a2LrfynQKBgQDou2+8SdB60eyt2KwH
58Jeh+L/2nTt0VkiczsTp1RgXg+ZKWNuudmTlPR40Yg52uhDKec7Yb9XXfyuTXvL
v3lXYmsjFutj12u3pAEFWj63O7NpJ9R9vnyjwa1lwMQ3Ps9gp2pJmHtMy0alLMqt
H+yEYlbS0DexIclVOQMkcNkzpwKBgQDLUM2ddShG+SYZiC6eDtZU6DXjMdncdDp8
koTh+cJLL1tqqbmVRSBkWuhqlH6nenbnSLCZ+pbZ22bXJ8Jl/LXwmCpyUzt71wbQ
li+eGEvgGSZ4PV4JsqV7j70VD0BpxtJUFBT+6Zq2+Lns7ZgisHfvHyydRSai4+pp
4tCDvK6o7wKBgET/vSLPp5WiQ09PW8GEPqYUF4LPW7deR9Tk4PD0vRlNCcbY9HfR
deZBVTG0vXSZqB6xf7KlSjs2zEFJC5jejbUQor7mfqc9KNxrLTpPBSUB+DEG9ALL
xNwwAZ6XRhUy8/yt5d8n6/ZalflGjFhDjLW7Cg66WKiVYcF4g6v8IQklAoGBAKGS
MCRuQzjLrGRj3bAL2HYXJyPKrPhNgWEXyvQN2EKJettzz6B5E7nMqKByK4iKgM1h
7b4f7xtoCPz4grsrraZqNmkuDbpncen3QBYh9sI7GmA5XG7Wgj2ER93hhe3Ja8IX
R2wgVqwLUy2ezuTaWiU0H+9HUeHmv5WwAsZ9/ksPAoGBALmfyzS8J1jfkjMLhwvQ
vaS7UzPEufeJb/vg2WMd31TRc6fMcGZKwCvjE3z2xLewU+DwSynqjdRZn4mOt+sm
5LOMBdOTK6nEoVbGdCktYM8BpgxFSBaQ7oJDVRaHOOs7cauCOz7NCCd/e6q//S6L
wS6zVciWfFotxYTyTyj0WiiT
-----END PRIVATE KEY-----
.github/workflows/helm-chart-ci-ignore.yaml
-22
View File
@@ -24,28 +24,8 @@ jobs:
steps:
- run: 'echo "Skipping checks"'
build-matrix:
name: Build matrix
runs-on: ubuntu-22.04
steps:
- name: Checkout
uses: actions/[email protected]
- id: set-matrix
name: Collect all tests
run: |
tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
echo "tests=$tests_json" >> $GITHUB_OUTPUT
outputs:
tests: ${{ steps.set-matrix.outputs.tests }}
test:
runs-on: ubuntu-22.04
needs:
- build-matrix
strategy:
matrix:
@@ -53,8 +33,6 @@ jobs:
- v1.27.2
- v1.26.4
- v1.25.9
values:
- ${{ fromJson(needs.build-matrix.outputs.tests) }}
steps:
- run: 'echo "Skipping tests"'
.github/workflows/helm-chart-ci.yaml
+10 -51
View File
@@ -117,32 +117,11 @@ jobs:
outputs:
changed: ${{ steps.list-changed.outputs.changed }}
build-matrix:
name: Build matrix
runs-on: ubuntu-22.04
needs: [lint-chart]
steps:
- name: Checkout
uses: actions/[email protected]
- id: set-matrix
name: Collect all tests
run: |
tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
echo "tests=$tests_json" >> $GITHUB_OUTPUT
outputs:
tests: ${{ steps.set-matrix.outputs.tests }}
test:
runs-on: ubuntu-22.04
needs:
- lint-chart
- build-matrix
strategy:
fail-fast: false
@@ -155,8 +134,6 @@ jobs:
- v1.27.2
- v1.26.4
- v1.25.9
values:
- ${{ fromJson(needs.build-matrix.outputs.tests) }}
steps:
- name: Checkout
@@ -188,34 +165,16 @@ jobs:
config: .github/kind/conf/kind-config.yaml
verbosity: 1
- name: Setup Test dependencies
run: ./pre-install.sh
working-directory: .github/tests
- name: Run chart-testing (install)
run: |
post-install() {
[ -x "${TEST_DIR}/post-install.sh" ] && "${TEST_DIR}/post-install.sh" $1
exit $1
}
ct install --config ct.yaml \
--target-branch ${{ github.base_ref }} \
trap 'post-install $? $LINENO' EXIT
export scenario="$(basename "${TEST_DIR}")"
export EXTRA_HELM_ARGS=""
source .github/tests/charts.sh
[ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
[ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh"
[ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env"
if [ -x "${TEST_DIR}/install.sh" ]; then
"${TEST_DIR}/install.sh"
else
ct install --debug \
--charts "charts/spire" \
--namespace "${scenario}" \
--target-branch ${{ github.base_ref }} \
--exclude-deprecated \
--skip-clean-up \
${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=${TEST_DIR}/values.yaml ${EXTRA_HELM_ARGS}"') || '' }}
fi
env:
TEST_DIR: .github/tests/${{ matrix.values }}
- name: Test summary
if: always()
run: ./post-install.sh
working-directory: .github/tests