Use chart-testing ci/*-values.yaml for testing

This also enables the refactor to have multiple root level charts.

Resolves #100

Signed-off-by: Marco Franssen <[email protected]>

.github/kind/conf/kind-config.yaml

@@ -15,3 +15,4 @@ kubeadmConfigPatches:
         # admission-control-config-file: /etc/kubernetes/pki/admctrl/admission-control.yaml
 nodes:
   - role: control-plane
+  - role: worker

.github/tests/charts.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' .github/tests/charts.json)
-VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' .github/tests/charts.json)
-eval "$REPOS"
-eval "$VERSIONS"

.github/tests/dependencies/mysql.yaml

@@ -5,3 +5,8 @@ primary:
       drop: [ALL]
     seccompProfile:
       type: RuntimeDefault
+auth:
+  database: spire-server
+  username: spire
+  password: sp1ff3Test
+  rootPassword: sp1ff3TestPassword

.github/tests/dependencies/postgresql.yaml

@@ -6,3 +6,8 @@ primary:
       drop: [ALL]
     seccompProfile:
       type: RuntimeDefault
+auth:
+  database: spire-server
+  username: spire
+  password: sp1ff3Test
+  postgresPassword: sp1ff3TestPassword

.github/tests/extras/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/federation-bundle-endpoint/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/namespace-override/post-install.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-systen
-fi
-

.github/tests/namespace-override/pre-install.sh

@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace "spire-system"
-kubectl create namespace "spire-server"

.github/tests/post-install.sh

@@ -7,11 +7,6 @@ SCRIPTPATH="$(dirname "${SCRIPT}")"
 scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
 
 # shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
+source "${SCRIPTPATH}/common.sh"
 
 print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/pre-install.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+DEPS="${SCRIPTPATH}/dependencies"
+
+# Set repo and version env variables
+REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' "${SCRIPTPATH}/charts.json")
+VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' "${SCRIPTPATH}/charts.json")
+eval "$REPOS"
+eval "$VERSIONS"
+
+helm_install=(helm upgrade --install --create-namespace)
+
+# namespace override
+kubectl create namespace spire-system || true
+kubectl create namespace spire-server || true
+
+# nginx ingress
+"${helm_install[@]}" ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" \
+  --namespace ingress-nginx \
+  --set controller.extraArgs.enable-ssl-passthrough='' \
+  --wait
+kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller
+
+# prometheus
+"${helm_install[@]}" kube-prometheus-stack kube-prometheus-stack \
+  --namespace prometheus \
+  --version "${VERSION_KUBE_PROMETHEUS_STACK}" \
+  --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
+  --wait
+
+# cert-manager
+"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
+  --namespace cert-manager \
+  --set installCRDs=true \
+  --wait
+
+# external database
+
+# mysql
+"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
+  --namespace mysql \
+  --values "${DEPS}/mysql.yaml" \
+  --wait
+
+# postgres
+"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
+  --namespace postgresql \
+  --values "${DEPS}/postgresql.yaml" \
+  --wait

.github/tests/production-example/install.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-
-set -xe
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-
-helm install \
-  --namespace spire-server \
-  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
-  spire charts/spire --wait
-
-helm test spire --namespace spire-server

.github/tests/production-example/post-install.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-system
-fi

.github/tests/production-example/pre-install.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace spire-system
-kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace spire-server
-kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/tests/production-external-mysql/install.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-
-set -xe
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
-
-DB=spire
-DBUSER=spire
-DBPW=$(uuidgen)
-DBROOTPW=$(uuidgen)
-
-# Generate random settings to make sure things come up with random settings.
-cat <<EOF > /tmp/$$-db-values.yaml
-auth:
-  database: ${DB}
-  username: ${DBUSER}
-  password: ${DBPW}
-  rootPassword: ${DBROOTPW}
-EOF
-
-cat <<EOF > /tmp/$$-spire-values.yaml
-spire-server:
-  dataStore:
-    sql:
-      databaseType: mysql
-      databaseName: ${DB}
-      username: ${DBUSER}
-      password: ${DBPW}
-      host: mysql
-      port: 3306
-EOF
-
-helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
-  --values "${SCRIPTPATH}/mysql-values.yaml" \
-  --values /tmp/$$-db-values.yaml --wait
-
-helm install \
-  --namespace "spire-server" \
-  --values /tmp/$$-spire-values.yaml \
-  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
-  spire charts/spire --wait
-
-helm test spire --namespace "spire-server"

.github/tests/production-external-mysql/post-install.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-system
-fi

.github/tests/production-external-mysql/pre-install.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace spire-system
-kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace spire-server
-kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/tests/production-external-postgresql/install.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-
-set -xe
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
-
-DB=$(uuidgen)
-DBUSER=$(uuidgen)
-DBPW=$(uuidgen)
-DBPGPW=$(uuidgen)
-
-# Generate random settings to make sure things come up with random settings.
-cat > /tmp/$$-db-values.yaml <<EOF
-auth:
-  database: ${DB}
-  username: ${DBUSER}
-  password: ${DBPW}
-  postgresPassword: ${DBPGPW}
-EOF
-
-cat > /tmp/$$-spire-values.yaml <<EOF
-spire-server:
-  dataStore:
-    sql:
-      databaseType: postgres
-      databaseName: ${DB}
-      username: ${DBUSER}
-      password: ${DBPW}
-      host: postgresql
-      port: 5432
-      options:
-      - sslmode: disable
-EOF
-
-helm install postgresql postgresql --namespace "spire-server" --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
-  --values "${SCRIPTPATH}/postgresql-values.yaml" \
-  --values /tmp/$$-db-values.yaml --wait
-
-helm install \
-  --namespace "spire-server" \
-  --values /tmp/$$-spire-values.yaml \
-  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
-  spire charts/spire --wait
-
-helm test spire --namespace "spire-server"

.github/tests/production-external-postgresql/post-install.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-system
-fi

.github/tests/production-external-postgresql/pre-install.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace spire-system
-kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace spire-server
-kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/tests/prometheus/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/prometheus/pre-install.sh

@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-helm install kube-prometheus-stack kube-prometheus-stack \
-  --version "${VERSION_KUBE_PROMETHEUS_STACK}" \
-  --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
-  -n "${scenario}" \
-  --wait

.github/tests/spire-oidc-insecure/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/spire-oidc-insecure/pre-install.sh

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
-kubectl wait --namespace ingress-nginx   --for=condition=ready pod   --selector=app.kubernetes.io/component=controller -n "$scenario"

.github/tests/tornjak/install.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
-
-helm install \
-  --namespace spire-server \
-  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
-  --values "${SCRIPTPATH}/../../../examples/tornjak/values.yaml" \
-  spire charts/spire --wait
-helm test spire -n spire-server

.github/tests/tornjak/post-install.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-kubectl rollout status --watch --timeout 180s --namespace spire-server deployments.apps spire-tornjak-frontend
-kubectl -n spire-server get deploy spire-tornjak-frontend
-kubectl -n spire-server get service spire-tornjak-frontend
-
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-system
-fi

.github/tests/tornjak/pre-install.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace spire-system
-kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace spire-server
-kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/tests/upstream-authority-cert-manager/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [ "$1" != '0' ]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/upstream-authority-cert-manager/pre-install.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait

.github/tests/upstream-authority-disk/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [ "$1" != '0' ]; then
-  get_namespace_details "${scenario}"
-fi

.github/workflows/helm-chart-ci-ignore.yaml

@@ -24,28 +24,8 @@ jobs:
     steps:
       - run: 'echo "Skipping checks"'
 
-  build-matrix:
-    name: Build matrix
-    runs-on: ubuntu-22.04
-
-    steps:
-      - name: Checkout
-        uses: actions/[email protected]
-
-      - id: set-matrix
-        name: Collect all tests
-        run: |
-          tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
-          tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
-          echo "tests=$tests_json" >> $GITHUB_OUTPUT
-
-    outputs:
-      tests: ${{ steps.set-matrix.outputs.tests }}
-
   test:
     runs-on: ubuntu-22.04
-    needs:
-      - build-matrix
 
     strategy:
       matrix:
@@ -53,8 +33,6 @@ jobs:
           - v1.27.2
           - v1.26.4
           - v1.25.9
-        values:
-          - ${{ fromJson(needs.build-matrix.outputs.tests) }}
 
     steps:
       - run: 'echo "Skipping tests"'

.github/workflows/helm-chart-ci.yaml

@@ -117,32 +117,11 @@ jobs:
     outputs:
       changed: ${{ steps.list-changed.outputs.changed }}
 
-  build-matrix:
-    name: Build matrix
-    runs-on: ubuntu-22.04
-
-    needs: [lint-chart]
-
-    steps:
-      - name: Checkout
-        uses: actions/[email protected]
-
-      - id: set-matrix
-        name: Collect all tests
-        run: |
-          tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
-          tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
-          echo "tests=$tests_json" >> $GITHUB_OUTPUT
-
-    outputs:
-      tests: ${{ steps.set-matrix.outputs.tests }}
-
   test:
     runs-on: ubuntu-22.04
 
     needs:
       - lint-chart
-      - build-matrix
 
     strategy:
       fail-fast: false
@@ -155,8 +134,6 @@ jobs:
           - v1.27.2
           - v1.26.4
           - v1.25.9
-        values:
-          - ${{ fromJson(needs.build-matrix.outputs.tests) }}
 
     steps:
       - name: Checkout
@@ -188,34 +165,16 @@ jobs:
           config: .github/kind/conf/kind-config.yaml
           verbosity: 1
 
+      - name: Setup Test dependencies
+        run: ./pre-install.sh
+        working-directory: .github/tests
+
       - name: Run chart-testing (install)
         run: |
-          post-install() {
+          ct install --config ct.yaml \
-            [ -x "${TEST_DIR}/post-install.sh" ] && "${TEST_DIR}/post-install.sh" $1
+            --target-branch ${{ github.base_ref }} \
-            exit $1
-          }
 
-          trap 'post-install $? $LINENO' EXIT
+      - name: Test summary
-
+        if: always()
-          export scenario="$(basename "${TEST_DIR}")"
+        run: ./post-install.sh
-          export EXTRA_HELM_ARGS=""
+        working-directory: .github/tests
-
-          source .github/tests/charts.sh
-
-          [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
-          [ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh"
-          [ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env"
-
-          if [ -x "${TEST_DIR}/install.sh" ]; then
-            "${TEST_DIR}/install.sh"
-          else
-            ct install --debug \
-              --charts "charts/spire" \
-              --namespace "${scenario}" \
-              --target-branch ${{ github.base_ref }} \
-              --exclude-deprecated \
-              --skip-clean-up \
-              ${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=${TEST_DIR}/values.yaml ${EXTRA_HELM_ARGS}"') || '' }}
-          fi
-        env:
-          TEST_DIR: .github/tests/${{ matrix.values }}

Makefile

@@ -2,7 +2,6 @@ TARGET_BRANCH ?= main
 
 .PHONY: help
 help: ## Display this help.
-	@$(MAKE) help
 	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
 
 ##@ Linting:
@@ -31,7 +30,25 @@ clean-lingering-resources:
 		&>/dev/null || true
 
 .PHONY: test
-test: ## Run tests using Helm chart-testing (ensure to run on dedicated test cluster)
+test: install-test-dependencies ## Run tests using Helm chart-testing (ensure to run on dedicated test cluster)
 	@echo Running tests…
-	@ct install --debug \
+	@ct install --config ct.yaml
-		--charts charts/spire
+
+.PHONY: install-test-dependencies
+install-test-dependencies: ## Install test dependency resources
+	@echo Installing test dependencies…
+	@.github/tests/pre-install.sh
+
+.PHONY: cleanup-test-dependencies
+cleanup-test-dependencies: ## Cleans up all test dependencies resources
+	@echo Uninstalling test dependencies…
+	@helm uninstall -n cert-manager cert-manager 2>/dev/null || true
+	@kubectl delete ns cert-manager 2>/dev/null || true
+	@helm uninstall -n prometheus kube-prometheus-stack 2>/dev/null || true
+	@kubectl delete ns prometheus 2>/dev/null || true
+	@helm uninstall -n mysql mysql 2>/dev/null|| true
+	@kubectl delete ns mysql 2>/dev/null || true
+	@helm uninstall -n postgresql postgresql 2>/dev/null || true
+	@kubectl delete ns postgresql 2>/dev/null || true
+	@helm uninstall -n ingress-nginx ingress-nginx 2>/dev/null || true
+	@kubectl delete ns ingress-nginx 2>/dev/null || true

charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml

@@ -33,7 +33,7 @@ spec:
     - name: curl-ingress
       image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
       command: ['curl']
-      args: ['-s', '-f', 'http://{{ index .Values.config.additionalDomains 0 }}/.well-known/openid-configuration']
+      args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- end }}

charts/spire/ci/external-mysql-values.yaml

@@ -0,0 +1,11 @@
+spire-server:
+  dataStore:
+    sql:
+      databaseType: mysql
+      databaseName: spire-server
+      username: spire
+      password: sp1ff3Test
+      host: mysql.mysql
+      port: 3306
+      options:
+      - parseTime: true

charts/spire/ci/external-postgres-values.yaml

@@ -0,0 +1,11 @@
+spire-server:
+  dataStore:
+    sql:
+      databaseType: postgres
+      databaseName: spire-server
+      username: spire
+      password: sp1ff3Test
+      host: postgresql.postgresql
+      port: 5432
+      options:
+      - sslmode: disable

charts/spire/ci/oidc-values.yaml

@@ -8,14 +8,14 @@ spire-server:
       nginx.ingress.kubernetes.io/ssl-redirect: "true"
       nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
     hosts:
-    - host: ingress-nginx-controller.spire-oidc-insecure
+    - host: ingress-nginx-controller.ingress-nginx
       paths:
         - path: /
           pathType: Prefix
 
 spire-agent:
   server:
-    address: ingress-nginx-controller.spire-oidc-insecure
+    address: ingress-nginx-controller.ingress-nginx
     port: 443
 
 spiffe-oidc-discovery-provider:
@@ -26,7 +26,8 @@ spiffe-oidc-discovery-provider:
 
   config:
     additionalDomains:
-      - ingress-nginx-controller
+      - ingress-nginx-controller.ingress-nginx
+      - ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     acme:
       tosAccepted: false
@@ -35,7 +36,7 @@ spiffe-oidc-discovery-provider:
     enabled: true
     className: nginx
     hosts:
-    - host: ingress-nginx-controller
+      - host: ingress-nginx-controller.ingress-nginx.svc.cluster.local
-      paths:
+        paths:
-        - path: /
+          - path: /
-          pathType: Prefix
+            pathType: Prefix

charts/spire/ci/tornjak-values.yaml

@@ -0,0 +1,6 @@
+spire-server:
+  tornjak:
+    enabled: true
+
+tornjak-frontend:
+  enabled: true