From 06ddb7cd3fab33b92f2e5a5a07331b7b175e4926 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 30 May 2023 11:14:44 +0200 Subject: [PATCH 1/9] Use chart-testing ci/*-values.yaml for testing This also enables the refactor to have multiple root level charts. Resolves #100 Signed-off-by: Marco Franssen --- .github/kind/conf/kind-config.yaml | 1 + .github/tests/charts.sh | 6 -- .../create-cert.sh | 0 .../mysql.yaml} | 5 ++ .../postgresql.yaml} | 5 ++ .../example-org.key | 0 .../example-org.pem | 0 .github/tests/extras/post-install.sh | 17 ------ .../post-install.sh | 17 ------ .../tests/namespace-override/post-install.sh | 19 ------ .../tests/namespace-override/pre-install.sh | 4 -- .../post-install.sh | 7 +-- .github/tests/pre-install.sh | 53 ++++++++++++++++ .github/tests/production-example/install.sh | 13 ---- .../tests/production-example/post-install.sh | 18 ------ .../tests/production-example/pre-install.sh | 6 -- .../production-external-mysql/install.sh | 44 ------------- .../production-external-mysql/post-install.sh | 18 ------ .../production-external-mysql/pre-install.sh | 6 -- .../production-external-postgresql/install.sh | 46 -------------- .../post-install.sh | 18 ------ .../pre-install.sh | 6 -- .github/tests/prometheus/post-install.sh | 17 ------ .github/tests/prometheus/pre-install.sh | 11 ---- .../tests/spire-oidc-insecure/post-install.sh | 17 ------ .../tests/spire-oidc-insecure/pre-install.sh | 8 --- .github/tests/tornjak/install.sh | 13 ---- .github/tests/tornjak/post-install.sh | 23 ------- .github/tests/tornjak/pre-install.sh | 6 -- .../post-install.sh | 17 ------ .../pre-install.sh | 7 --- .../upstream-authority-disk/post-install.sh | 17 ------ .github/workflows/helm-chart-ci-ignore.yaml | 22 ------- .github/workflows/helm-chart-ci.yaml | 61 +++---------------- Makefile | 25 ++++++-- .../templates/tests/test-connection.yaml | 2 +- charts/spire/ci/external-mysql-values.yaml | 11 ++++ charts/spire/ci/external-postgres-values.yaml | 11 ++++ .../spire/ci/extras-values.yaml | 0 .../ci/federation-bundle-endpoint-values.yaml | 0 .../spire/ci/namespace-override-values.yaml | 0 .../no-spire-controller-manager-values.yaml | 0 .../spire/ci/oidc-values.yaml | 15 ++--- .../spire/ci/prometheus-values.yaml | 0 charts/spire/ci/tornjak-values.yaml | 6 ++ ...pstream-authority-cert-manager-values.yaml | 0 .../ci/upstream-authority-disk-values.yaml | 0 47 files changed, 133 insertions(+), 465 deletions(-) delete mode 100644 .github/tests/charts.sh rename .github/tests/{upstream-authority-disk => }/create-cert.sh (100%) rename .github/tests/{production-external-mysql/mysql-values.yaml => dependencies/mysql.yaml} (59%) rename .github/tests/{production-external-postgresql/postgresql-values.yaml => dependencies/postgresql.yaml} (61%) rename .github/tests/{upstream-authority-disk => }/example-org.key (100%) rename .github/tests/{upstream-authority-disk => }/example-org.pem (100%) delete mode 100644 .github/tests/extras/post-install.sh delete mode 100644 .github/tests/federation-bundle-endpoint/post-install.sh delete mode 100755 .github/tests/namespace-override/post-install.sh delete mode 100755 .github/tests/namespace-override/pre-install.sh rename .github/tests/{no-spire-controller-manager => }/post-install.sh (57%) mode change 100644 => 100755 create mode 100755 .github/tests/pre-install.sh delete mode 100755 .github/tests/production-example/install.sh delete mode 100755 .github/tests/production-example/post-install.sh delete mode 100755 .github/tests/production-example/pre-install.sh delete mode 100755 .github/tests/production-external-mysql/install.sh delete mode 100755 .github/tests/production-external-mysql/post-install.sh delete mode 100755 .github/tests/production-external-mysql/pre-install.sh delete mode 100755 .github/tests/production-external-postgresql/install.sh delete mode 100755 .github/tests/production-external-postgresql/post-install.sh delete mode 100755 .github/tests/production-external-postgresql/pre-install.sh delete mode 100644 .github/tests/prometheus/post-install.sh delete mode 100755 .github/tests/prometheus/pre-install.sh delete mode 100644 .github/tests/spire-oidc-insecure/post-install.sh delete mode 100755 .github/tests/spire-oidc-insecure/pre-install.sh delete mode 100755 .github/tests/tornjak/install.sh delete mode 100755 .github/tests/tornjak/post-install.sh delete mode 100755 .github/tests/tornjak/pre-install.sh delete mode 100755 .github/tests/upstream-authority-cert-manager/post-install.sh delete mode 100755 .github/tests/upstream-authority-cert-manager/pre-install.sh delete mode 100755 .github/tests/upstream-authority-disk/post-install.sh create mode 100644 charts/spire/ci/external-mysql-values.yaml create mode 100644 charts/spire/ci/external-postgres-values.yaml rename .github/tests/extras/values.yaml => charts/spire/ci/extras-values.yaml (100%) rename .github/tests/federation-bundle-endpoint/values.yaml => charts/spire/ci/federation-bundle-endpoint-values.yaml (100%) rename .github/tests/namespace-override/values.yaml => charts/spire/ci/namespace-override-values.yaml (100%) rename .github/tests/no-spire-controller-manager/values.yaml => charts/spire/ci/no-spire-controller-manager-values.yaml (100%) rename .github/tests/spire-oidc-insecure/values.yaml => charts/spire/ci/oidc-values.yaml (64%) rename .github/tests/prometheus/values.yaml => charts/spire/ci/prometheus-values.yaml (100%) create mode 100644 charts/spire/ci/tornjak-values.yaml rename .github/tests/upstream-authority-cert-manager/values.yaml => charts/spire/ci/upstream-authority-cert-manager-values.yaml (100%) rename .github/tests/upstream-authority-disk/values.yaml => charts/spire/ci/upstream-authority-disk-values.yaml (100%) diff --git a/.github/kind/conf/kind-config.yaml b/.github/kind/conf/kind-config.yaml index 6c900fe..7c0cd3f 100644 --- a/.github/kind/conf/kind-config.yaml +++ b/.github/kind/conf/kind-config.yaml @@ -15,3 +15,4 @@ kubeadmConfigPatches: # admission-control-config-file: /etc/kubernetes/pki/admctrl/admission-control.yaml nodes: - role: control-plane + - role: worker diff --git a/.github/tests/charts.sh b/.github/tests/charts.sh deleted file mode 100644 index d83af09..0000000 --- a/.github/tests/charts.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash - -REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' .github/tests/charts.json) -VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' .github/tests/charts.json) -eval "$REPOS" -eval "$VERSIONS" diff --git a/.github/tests/upstream-authority-disk/create-cert.sh b/.github/tests/create-cert.sh similarity index 100% rename from .github/tests/upstream-authority-disk/create-cert.sh rename to .github/tests/create-cert.sh diff --git a/.github/tests/production-external-mysql/mysql-values.yaml b/.github/tests/dependencies/mysql.yaml similarity index 59% rename from .github/tests/production-external-mysql/mysql-values.yaml rename to .github/tests/dependencies/mysql.yaml index 62f27e2..bd5e621 100644 --- a/.github/tests/production-external-mysql/mysql-values.yaml +++ b/.github/tests/dependencies/mysql.yaml @@ -5,3 +5,8 @@ primary: drop: [ALL] seccompProfile: type: RuntimeDefault +auth: + database: spire-server + username: spire + password: sp1ff3Test + rootPassword: sp1ff3TestPassword diff --git a/.github/tests/production-external-postgresql/postgresql-values.yaml b/.github/tests/dependencies/postgresql.yaml similarity index 61% rename from .github/tests/production-external-postgresql/postgresql-values.yaml rename to .github/tests/dependencies/postgresql.yaml index ea34425..fb906c1 100644 --- a/.github/tests/production-external-postgresql/postgresql-values.yaml +++ b/.github/tests/dependencies/postgresql.yaml @@ -6,3 +6,8 @@ primary: drop: [ALL] seccompProfile: type: RuntimeDefault +auth: + database: spire-server + username: spire + password: sp1ff3Test + postgresPassword: sp1ff3TestPassword diff --git a/.github/tests/upstream-authority-disk/example-org.key b/.github/tests/example-org.key similarity index 100% rename from .github/tests/upstream-authority-disk/example-org.key rename to .github/tests/example-org.key diff --git a/.github/tests/upstream-authority-disk/example-org.pem b/.github/tests/example-org.pem similarity index 100% rename from .github/tests/upstream-authority-disk/example-org.pem rename to .github/tests/example-org.pem diff --git a/.github/tests/extras/post-install.sh b/.github/tests/extras/post-install.sh deleted file mode 100644 index 1278f29..0000000 --- a/.github/tests/extras/post-install.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status "${scenario}" - -if [[ "$1" -ne 0 ]]; then - get_namespace_details "${scenario}" -fi diff --git a/.github/tests/federation-bundle-endpoint/post-install.sh b/.github/tests/federation-bundle-endpoint/post-install.sh deleted file mode 100644 index 1278f29..0000000 --- a/.github/tests/federation-bundle-endpoint/post-install.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status "${scenario}" - -if [[ "$1" -ne 0 ]]; then - get_namespace_details "${scenario}" -fi diff --git a/.github/tests/namespace-override/post-install.sh b/.github/tests/namespace-override/post-install.sh deleted file mode 100755 index 7fbaf11..0000000 --- a/.github/tests/namespace-override/post-install.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status spire-server spire-system - -if [[ "$1" -ne 0 ]]; then - get_namespace_details spire-server - get_namespace_details spire-systen -fi - diff --git a/.github/tests/namespace-override/pre-install.sh b/.github/tests/namespace-override/pre-install.sh deleted file mode 100755 index 3d778a6..0000000 --- a/.github/tests/namespace-override/pre-install.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/env bash - -kubectl create namespace "spire-system" -kubectl create namespace "spire-server" diff --git a/.github/tests/no-spire-controller-manager/post-install.sh b/.github/tests/post-install.sh old mode 100644 new mode 100755 similarity index 57% rename from .github/tests/no-spire-controller-manager/post-install.sh rename to .github/tests/post-install.sh index 1278f29..cfa1516 --- a/.github/tests/no-spire-controller-manager/post-install.sh +++ b/.github/tests/post-install.sh @@ -7,11 +7,6 @@ SCRIPTPATH="$(dirname "${SCRIPT}")" scenario="${scenario:-$(basename "${SCRIPTPATH}")}" # shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" +source "${SCRIPTPATH}/common.sh" print_helm_releases -print_spire_workload_status "${scenario}" - -if [[ "$1" -ne 0 ]]; then - get_namespace_details "${scenario}" -fi diff --git a/.github/tests/pre-install.sh b/.github/tests/pre-install.sh new file mode 100755 index 0000000..34d0ae5 --- /dev/null +++ b/.github/tests/pre-install.sh @@ -0,0 +1,53 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +DEPS="${SCRIPTPATH}/dependencies" + +# Set repo and version env variables +REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' "${SCRIPTPATH}/charts.json") +VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' "${SCRIPTPATH}/charts.json") +eval "$REPOS" +eval "$VERSIONS" + +helm_install=(helm upgrade --install --create-namespace) + +# namespace override +kubectl create namespace spire-system || true +kubectl create namespace spire-server || true + +# nginx ingress +"${helm_install[@]}" ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" \ + --namespace ingress-nginx \ + --set controller.extraArgs.enable-ssl-passthrough='' \ + --wait +kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller + +# prometheus +"${helm_install[@]}" kube-prometheus-stack kube-prometheus-stack \ + --namespace prometheus \ + --version "${VERSION_KUBE_PROMETHEUS_STACK}" \ + --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \ + --wait + +# cert-manager +"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \ + --namespace cert-manager \ + --set installCRDs=true \ + --wait + +# external database + +# mysql +"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ + --namespace mysql \ + --values "${DEPS}/mysql.yaml" \ + --wait + +# postgres +"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \ + --namespace postgresql \ + --values "${DEPS}/postgresql.yaml" \ + --wait diff --git a/.github/tests/production-example/install.sh b/.github/tests/production-example/install.sh deleted file mode 100755 index c2b5cfe..0000000 --- a/.github/tests/production-example/install.sh +++ /dev/null @@ -1,13 +0,0 @@ -#!/usr/bin/env bash - -set -xe - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" - -helm install \ - --namespace spire-server \ - --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \ - spire charts/spire --wait - -helm test spire --namespace spire-server diff --git a/.github/tests/production-example/post-install.sh b/.github/tests/production-example/post-install.sh deleted file mode 100755 index 29335e6..0000000 --- a/.github/tests/production-example/post-install.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status spire-server spire-system - -if [[ "$1" -ne 0 ]]; then - get_namespace_details spire-server - get_namespace_details spire-system -fi diff --git a/.github/tests/production-example/pre-install.sh b/.github/tests/production-example/pre-install.sh deleted file mode 100755 index b33d1ed..0000000 --- a/.github/tests/production-example/pre-install.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash - -kubectl create namespace spire-system -kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged -kubectl create namespace spire-server -kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted diff --git a/.github/tests/production-external-mysql/install.sh b/.github/tests/production-external-mysql/install.sh deleted file mode 100755 index 7bb5d63..0000000 --- a/.github/tests/production-external-mysql/install.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env bash - -set -xe - -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "$SCRIPT") - -DB=spire -DBUSER=spire -DBPW=$(uuidgen) -DBROOTPW=$(uuidgen) - -# Generate random settings to make sure things come up with random settings. -cat < /tmp/$$-db-values.yaml -auth: - database: ${DB} - username: ${DBUSER} - password: ${DBPW} - rootPassword: ${DBROOTPW} -EOF - -cat < /tmp/$$-spire-values.yaml -spire-server: - dataStore: - sql: - databaseType: mysql - databaseName: ${DB} - username: ${DBUSER} - password: ${DBPW} - host: mysql - port: 3306 -EOF - -helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ - --values "${SCRIPTPATH}/mysql-values.yaml" \ - --values /tmp/$$-db-values.yaml --wait - -helm install \ - --namespace "spire-server" \ - --values /tmp/$$-spire-values.yaml \ - --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \ - spire charts/spire --wait - -helm test spire --namespace "spire-server" diff --git a/.github/tests/production-external-mysql/post-install.sh b/.github/tests/production-external-mysql/post-install.sh deleted file mode 100755 index 29335e6..0000000 --- a/.github/tests/production-external-mysql/post-install.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/usr/bin/env bash - -set -x - -SCRIPT="$(readlink -f "$0")" -SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" - -# shellcheck source=/dev/null -source "${SCRIPTPATH}/../common.sh" - -print_helm_releases -print_spire_workload_status spire-server spire-system - -if [[ "$1" -ne 0 ]]; then - get_namespace_details spire-server - get_namespace_details spire-system -fi diff --git a/.github/tests/production-external-mysql/pre-install.sh b/.github/tests/production-external-mysql/pre-install.sh deleted file mode 100755 index b33d1ed..0000000 --- a/.github/tests/production-external-mysql/pre-install.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env bash - -kubectl create namespace spire-system -kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged -kubectl create namespace spire-server -kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted diff --git a/.github/tests/production-external-postgresql/install.sh b/.github/tests/production-external-postgresql/install.sh deleted file mode 100755 index 38b56c4..0000000 --- a/.github/tests/production-external-postgresql/install.sh +++ /dev/null @@ -1,46 +0,0 @@ -#!/usr/bin/env bash - -set -xe - -SCRIPT=$(readlink -f "$0") -SCRIPTPATH=$(dirname "$SCRIPT") - -DB=$(uuidgen) -DBUSER=$(uuidgen) -DBPW=$(uuidgen) -DBPGPW=$(uuidgen) - -# Generate random settings to make sure things come up with random settings. -cat > /tmp/$$-db-values.yaml < /tmp/$$-spire-values.yaml <> $GITHUB_OUTPUT - - outputs: - tests: ${{ steps.set-matrix.outputs.tests }} - test: runs-on: ubuntu-22.04 - needs: - - build-matrix strategy: matrix: @@ -53,8 +33,6 @@ jobs: - v1.27.2 - v1.26.4 - v1.25.9 - values: - - ${{ fromJson(needs.build-matrix.outputs.tests) }} steps: - run: 'echo "Skipping tests"' diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 98ff85b..45dc683 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -117,32 +117,11 @@ jobs: outputs: changed: ${{ steps.list-changed.outputs.changed }} - build-matrix: - name: Build matrix - runs-on: ubuntu-22.04 - - needs: [lint-chart] - - steps: - - name: Checkout - uses: actions/checkout@v3.5.3 - - - id: set-matrix - name: Collect all tests - run: | - tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")" - tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')" - echo "tests=$tests_json" >> $GITHUB_OUTPUT - - outputs: - tests: ${{ steps.set-matrix.outputs.tests }} - test: runs-on: ubuntu-22.04 needs: - lint-chart - - build-matrix strategy: fail-fast: false @@ -155,8 +134,6 @@ jobs: - v1.27.2 - v1.26.4 - v1.25.9 - values: - - ${{ fromJson(needs.build-matrix.outputs.tests) }} steps: - name: Checkout @@ -188,34 +165,16 @@ jobs: config: .github/kind/conf/kind-config.yaml verbosity: 1 + - name: Setup Test dependencies + run: ./pre-install.sh + working-directory: .github/tests + - name: Run chart-testing (install) run: | - post-install() { - [ -x "${TEST_DIR}/post-install.sh" ] && "${TEST_DIR}/post-install.sh" $1 - exit $1 - } + ct install --config ct.yaml \ + --target-branch ${{ github.base_ref }} \ - trap 'post-install $? $LINENO' EXIT - - export scenario="$(basename "${TEST_DIR}")" - export EXTRA_HELM_ARGS="" - - source .github/tests/charts.sh - - [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}" - [ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh" - [ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env" - - if [ -x "${TEST_DIR}/install.sh" ]; then - "${TEST_DIR}/install.sh" - else - ct install --debug \ - --charts "charts/spire" \ - --namespace "${scenario}" \ - --target-branch ${{ github.base_ref }} \ - --exclude-deprecated \ - --skip-clean-up \ - ${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=${TEST_DIR}/values.yaml ${EXTRA_HELM_ARGS}"') || '' }} - fi - env: - TEST_DIR: .github/tests/${{ matrix.values }} + - name: Test summary + if: always() + run: ./post-install.sh + working-directory: .github/tests diff --git a/Makefile b/Makefile index 6b550d5..c6e17ed 100644 --- a/Makefile +++ b/Makefile @@ -2,7 +2,6 @@ TARGET_BRANCH ?= main .PHONY: help help: ## Display this help. - @$(MAKE) help @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) ##@ Linting: @@ -31,7 +30,25 @@ clean-lingering-resources: &>/dev/null || true .PHONY: test -test: ## Run tests using Helm chart-testing (ensure to run on dedicated test cluster) +test: install-test-dependencies ## Run tests using Helm chart-testing (ensure to run on dedicated test cluster) @echo Running tests… - @ct install --debug \ - --charts charts/spire + @ct install --config ct.yaml + +.PHONY: install-test-dependencies +install-test-dependencies: ## Install test dependency resources + @echo Installing test dependencies… + @.github/tests/pre-install.sh + +.PHONY: cleanup-test-dependencies +cleanup-test-dependencies: ## Cleans up all test dependencies resources + @echo Uninstalling test dependencies… + @helm uninstall -n cert-manager cert-manager 2>/dev/null || true + @kubectl delete ns cert-manager 2>/dev/null || true + @helm uninstall -n prometheus kube-prometheus-stack 2>/dev/null || true + @kubectl delete ns prometheus 2>/dev/null || true + @helm uninstall -n mysql mysql 2>/dev/null|| true + @kubectl delete ns mysql 2>/dev/null || true + @helm uninstall -n postgresql postgresql 2>/dev/null || true + @kubectl delete ns postgresql 2>/dev/null || true + @helm uninstall -n ingress-nginx ingress-nginx 2>/dev/null || true + @kubectl delete ns ingress-nginx 2>/dev/null || true diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index 7bad95f..393cafe 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -33,7 +33,7 @@ spec: - name: curl-ingress image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }} command: ['curl'] - args: ['-s', '-f', 'http://{{ index .Values.config.additionalDomains 0 }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} {{- end }} diff --git a/charts/spire/ci/external-mysql-values.yaml b/charts/spire/ci/external-mysql-values.yaml new file mode 100644 index 0000000..adc5c25 --- /dev/null +++ b/charts/spire/ci/external-mysql-values.yaml @@ -0,0 +1,11 @@ +spire-server: + dataStore: + sql: + databaseType: mysql + databaseName: spire-server + username: spire + password: sp1ff3Test + host: mysql.mysql + port: 3306 + options: + - parseTime: true diff --git a/charts/spire/ci/external-postgres-values.yaml b/charts/spire/ci/external-postgres-values.yaml new file mode 100644 index 0000000..f8a7068 --- /dev/null +++ b/charts/spire/ci/external-postgres-values.yaml @@ -0,0 +1,11 @@ +spire-server: + dataStore: + sql: + databaseType: postgres + databaseName: spire-server + username: spire + password: sp1ff3Test + host: postgresql.postgresql + port: 5432 + options: + - sslmode: disable diff --git a/.github/tests/extras/values.yaml b/charts/spire/ci/extras-values.yaml similarity index 100% rename from .github/tests/extras/values.yaml rename to charts/spire/ci/extras-values.yaml diff --git a/.github/tests/federation-bundle-endpoint/values.yaml b/charts/spire/ci/federation-bundle-endpoint-values.yaml similarity index 100% rename from .github/tests/federation-bundle-endpoint/values.yaml rename to charts/spire/ci/federation-bundle-endpoint-values.yaml diff --git a/.github/tests/namespace-override/values.yaml b/charts/spire/ci/namespace-override-values.yaml similarity index 100% rename from .github/tests/namespace-override/values.yaml rename to charts/spire/ci/namespace-override-values.yaml diff --git a/.github/tests/no-spire-controller-manager/values.yaml b/charts/spire/ci/no-spire-controller-manager-values.yaml similarity index 100% rename from .github/tests/no-spire-controller-manager/values.yaml rename to charts/spire/ci/no-spire-controller-manager-values.yaml diff --git a/.github/tests/spire-oidc-insecure/values.yaml b/charts/spire/ci/oidc-values.yaml similarity index 64% rename from .github/tests/spire-oidc-insecure/values.yaml rename to charts/spire/ci/oidc-values.yaml index d521e69..8164ef2 100644 --- a/.github/tests/spire-oidc-insecure/values.yaml +++ b/charts/spire/ci/oidc-values.yaml @@ -8,14 +8,14 @@ spire-server: nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/force-ssl-redirect: "true" hosts: - - host: ingress-nginx-controller.spire-oidc-insecure + - host: ingress-nginx-controller.ingress-nginx paths: - path: / pathType: Prefix spire-agent: server: - address: ingress-nginx-controller.spire-oidc-insecure + address: ingress-nginx-controller.ingress-nginx port: 443 spiffe-oidc-discovery-provider: @@ -26,7 +26,8 @@ spiffe-oidc-discovery-provider: config: additionalDomains: - - ingress-nginx-controller + - ingress-nginx-controller.ingress-nginx + - ingress-nginx-controller.ingress-nginx.svc.cluster.local acme: tosAccepted: false @@ -35,7 +36,7 @@ spiffe-oidc-discovery-provider: enabled: true className: nginx hosts: - - host: ingress-nginx-controller - paths: - - path: / - pathType: Prefix + - host: ingress-nginx-controller.ingress-nginx.svc.cluster.local + paths: + - path: / + pathType: Prefix diff --git a/.github/tests/prometheus/values.yaml b/charts/spire/ci/prometheus-values.yaml similarity index 100% rename from .github/tests/prometheus/values.yaml rename to charts/spire/ci/prometheus-values.yaml diff --git a/charts/spire/ci/tornjak-values.yaml b/charts/spire/ci/tornjak-values.yaml new file mode 100644 index 0000000..5991a5d --- /dev/null +++ b/charts/spire/ci/tornjak-values.yaml @@ -0,0 +1,6 @@ +spire-server: + tornjak: + enabled: true + +tornjak-frontend: + enabled: true diff --git a/.github/tests/upstream-authority-cert-manager/values.yaml b/charts/spire/ci/upstream-authority-cert-manager-values.yaml similarity index 100% rename from .github/tests/upstream-authority-cert-manager/values.yaml rename to charts/spire/ci/upstream-authority-cert-manager-values.yaml diff --git a/.github/tests/upstream-authority-disk/values.yaml b/charts/spire/ci/upstream-authority-disk-values.yaml similarity index 100% rename from .github/tests/upstream-authority-disk/values.yaml rename to charts/spire/ci/upstream-authority-disk-values.yaml From 380979c71c5fd27713a144fffcae12cb2333db3a Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 1 Jun 2023 13:10:57 +0200 Subject: [PATCH 2/9] Prevent ci folder ending up in Helm package Signed-off-by: Marco Franssen --- charts/spire/.helmignore | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/spire/.helmignore b/charts/spire/.helmignore index 0e8a0eb..5bdaa3e 100644 --- a/charts/spire/.helmignore +++ b/charts/spire/.helmignore @@ -21,3 +21,4 @@ .idea/ *.tmproj .vscode/ +ci/ From 4b4cef1eae36dbdc25a1eb7e4dcf35953af11811 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 2 Jun 2023 16:16:54 +0200 Subject: [PATCH 3/9] Skip namespace-override test because of #330 Signed-off-by: Marco Franssen --- ...e-override-values.yaml => namespace-override-values-skip.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename charts/spire/ci/{namespace-override-values.yaml => namespace-override-values-skip.yaml} (100%) diff --git a/charts/spire/ci/namespace-override-values.yaml b/charts/spire/ci/namespace-override-values-skip.yaml similarity index 100% rename from charts/spire/ci/namespace-override-values.yaml rename to charts/spire/ci/namespace-override-values-skip.yaml From 54ed71f969dc3a492086a36c431ece69e78b4790 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 30 May 2023 20:03:07 +0200 Subject: [PATCH 4/9] Add back tests for examples Signed-off-by: Marco Franssen --- .github/scripts/parse-versions.sh | 9 ++++ .github/tests/post-install.sh | 1 - .github/tests/pre-install.sh | 10 ++-- .github/workflows/helm-chart-ci.yaml | 64 ++++++++++++++++++++++- Makefile | 8 +++ examples/external-mysql/run-tests.sh | 42 +++++++++++++++ examples/external-mysql/values.yaml | 5 +- examples/external-postgresql/run-tests.sh | 42 +++++++++++++++ examples/external-postgresql/values.yaml | 5 +- examples/production/run-tests.sh | 36 +++++++++++++ examples/tornjak/run-tests.sh | 30 +++++++++++ 11 files changed, 238 insertions(+), 14 deletions(-) create mode 100644 .github/scripts/parse-versions.sh create mode 100755 examples/external-mysql/run-tests.sh create mode 100755 examples/external-postgresql/run-tests.sh create mode 100755 examples/production/run-tests.sh create mode 100755 examples/tornjak/run-tests.sh diff --git a/.github/scripts/parse-versions.sh b/.github/scripts/parse-versions.sh new file mode 100644 index 0000000..eca9881 --- /dev/null +++ b/.github/scripts/parse-versions.sh @@ -0,0 +1,9 @@ +#!/usr/bin/env bash + +TESTS_PATH="$(dirname "${BASH_SOURCE[0]}")/../tests" + +# Set repo and version env variables +REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' "${TESTS_PATH}/charts.json") +VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' "${TESTS_PATH}/charts.json") +eval "$REPOS" +eval "$VERSIONS" diff --git a/.github/tests/post-install.sh b/.github/tests/post-install.sh index cfa1516..1981868 100755 --- a/.github/tests/post-install.sh +++ b/.github/tests/post-install.sh @@ -4,7 +4,6 @@ set -x SCRIPT="$(readlink -f "$0")" SCRIPTPATH="$(dirname "${SCRIPT}")" -scenario="${scenario:-$(basename "${SCRIPTPATH}")}" # shellcheck source=/dev/null source "${SCRIPTPATH}/common.sh" diff --git a/.github/tests/pre-install.sh b/.github/tests/pre-install.sh index 34d0ae5..a82e767 100755 --- a/.github/tests/pre-install.sh +++ b/.github/tests/pre-install.sh @@ -6,11 +6,8 @@ SCRIPT="$(readlink -f "$0")" SCRIPTPATH="$(dirname "${SCRIPT}")" DEPS="${SCRIPTPATH}/dependencies" -# Set repo and version env variables -REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' "${SCRIPTPATH}/charts.json") -VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' "${SCRIPTPATH}/charts.json") -eval "$REPOS" -eval "$VERSIONS" +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../scripts/parse-versions.sh" helm_install=(helm upgrade --install --create-namespace) @@ -21,8 +18,7 @@ kubectl create namespace spire-server || true # nginx ingress "${helm_install[@]}" ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" \ --namespace ingress-nginx \ - --set controller.extraArgs.enable-ssl-passthrough='' \ - --wait + --set controller.extraArgs.enable-ssl-passthrough= kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller # prometheus diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 45dc683..e7352ff 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -12,6 +12,7 @@ on: - '.github/tests/**/*.sh' - '.github/tests/**/*.json' - 'examples/**/*.yaml' + - 'examples/**/*.sh' - 'tests/**/*' - 'helm-docs.sh' @@ -22,6 +23,7 @@ concurrency: env: HELM_VERSION: v3.12.0 PYTHON_VERSION: 3.11.3 + KIND_VERSION: v0.19.0 CHART_TESTING_VERSION: v3.8.0 jobs: @@ -160,7 +162,7 @@ jobs: uses: helm/kind-action@v1.8.0 # Only build a kind cluster if there are chart changes to test. with: - version: v0.19.0 + version: ${{ env.KIND_VERSION }} node_image: kindest/node:${{ matrix.k8s }} config: .github/kind/conf/kind-config.yaml verbosity: 1 @@ -172,9 +174,67 @@ jobs: - name: Run chart-testing (install) run: | ct install --config ct.yaml \ - --target-branch ${{ github.base_ref }} \ + --target-branch ${{ github.base_ref }} - name: Test summary if: always() run: ./post-install.sh working-directory: .github/tests + + build-matrix: + name: Build matrix + runs-on: ubuntu-22.04 + + steps: + - name: Checkout + uses: actions/checkout@v3.5.2 + + - id: set-matrix + name: Collect all examples + run: | + examples="$(find examples -maxdepth 2 -type f -name run-tests.sh | xargs -I % dirname %)" + examples_json="$(echo "$examples" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')" + echo "${examples_json}" + echo "examples=$examples_json" >>"$GITHUB_OUTPUT" + + outputs: + examples: ${{ steps.set-matrix.outputs.examples }} + + example-test: + runs-on: ubuntu-22.04 + + needs: + - lint-chart + - build-matrix + + strategy: + fail-fast: false + matrix: + example: + - ${{ fromJson(needs.build-matrix.outputs.examples) }} + + steps: + - name: Checkout + uses: actions/checkout@v3.5.2 + + - name: Set up Helm + uses: azure/setup-helm@v3.5 + with: + version: ${{ env.HELM_VERSION }} + + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: ${{ env.PYTHON_VERSION }} + + - name: Create kind cluster + uses: helm/kind-action@v1.7.0 + # Only build a kind cluster if there are chart changes to test. + with: + version: ${{ env.KIND_VERSION }} + node_image: kindest/node:v1.26.4 + config: .github/kind/conf/kind-config.yaml + verbosity: 1 + + - name: Install and test example + run: ${{ matrix.example }}/run-tests.sh diff --git a/Makefile b/Makefile index c6e17ed..7b4705e 100644 --- a/Makefile +++ b/Makefile @@ -52,3 +52,11 @@ cleanup-test-dependencies: ## Cleans up all test dependencies resources @kubectl delete ns postgresql 2>/dev/null || true @helm uninstall -n ingress-nginx ingress-nginx 2>/dev/null || true @kubectl delete ns ingress-nginx 2>/dev/null || true + +test-example-%: + @echo Running tests for $* example… + @examples/$*/run-tests.sh + @echo + +.PHONY: test-examples +test-examples: $(patsubst examples/%/values.yaml,test-example-%,$(wildcard examples/*/values.yaml)) ## Run helm install for and helm test for all the examples diff --git a/examples/external-mysql/run-tests.sh b/examples/external-mysql/run-tests.sh new file mode 100755 index 0000000..b6b5ee5 --- /dev/null +++ b/examples/external-mysql/run-tests.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" +DEPS="${TESTDIR}/dependencies" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +helm_install=(helm upgrade --install --create-namespace) +ns=spire-system + +teardown() { + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true + + helm uninstall --namespace mysql mysql 2>/dev/null || true + kubectl delete ns mysql 2>/dev/null || true +} + +trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT + +"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ + --namespace mysql \ + --values "${DEPS}/mysql.yaml" \ + --wait + +"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \ + --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire +helm test --namespace "${ns}" spire + +print_helm_releases +print_spire_workload_status "${ns}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${ns}" +fi diff --git a/examples/external-mysql/values.yaml b/examples/external-mysql/values.yaml index c0a8fff..129ee27 100644 --- a/examples/external-mysql/values.yaml +++ b/examples/external-mysql/values.yaml @@ -2,7 +2,8 @@ spire-server: dataStore: sql: databaseType: mysql - databaseName: spire - host: mysql + databaseName: spire-server + host: mysql.mysql port: 3306 username: spire + # password: CHANGE_ME diff --git a/examples/external-postgresql/run-tests.sh b/examples/external-postgresql/run-tests.sh new file mode 100755 index 0000000..1ffe1f6 --- /dev/null +++ b/examples/external-postgresql/run-tests.sh @@ -0,0 +1,42 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" +DEPS="${TESTDIR}/dependencies" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +helm_install=(helm upgrade --install --create-namespace) +ns=spire-system + +teardown() { + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true + + helm uninstall --namespace postgresql postgresql 2>/dev/null || true + kubectl delete ns postgresql 2>/dev/null || true +} + +trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT + +"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \ + --namespace postgresql \ + --values "${DEPS}/postgresql.yaml" \ + --wait + +"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \ + --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire +helm test --namespace "${ns}" spire + +print_helm_releases +print_spire_workload_status "${ns}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${ns}" +fi diff --git a/examples/external-postgresql/values.yaml b/examples/external-postgresql/values.yaml index 5f1fcfa..8972e87 100644 --- a/examples/external-postgresql/values.yaml +++ b/examples/external-postgresql/values.yaml @@ -2,9 +2,10 @@ spire-server: dataStore: sql: databaseType: postgres - databaseName: spire - host: postgresql + databaseName: spire-server + host: postgresql.postgresql port: 5432 username: spire + # password: CHANGE_ME options: - sslmode: disable diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh new file mode 100755 index 0000000..f64f6c2 --- /dev/null +++ b/examples/production/run-tests.sh @@ -0,0 +1,36 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" + +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +helm_install=(helm upgrade --install --create-namespace) +ns=spire-server + +teardown() { + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true +} + +trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT + +kubectl create namespace spire-system 2>/dev/null || true +kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true +kubectl create namespace "${ns}" 2>/dev/null || true +kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true + +"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire +helm test --namespace "${ns}" spire + +print_helm_releases +print_spire_workload_status "${ns}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${ns}" +fi diff --git a/examples/tornjak/run-tests.sh b/examples/tornjak/run-tests.sh new file mode 100755 index 0000000..e4449cd --- /dev/null +++ b/examples/tornjak/run-tests.sh @@ -0,0 +1,30 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" + +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +helm_install=(helm upgrade --install --create-namespace) +ns=spire-system + +teardown() { + helm uninstall --namespace "${ns}" spire 2>/dev/null || true + kubectl delete ns "${ns}" 2>/dev/null || true +} + +trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT + +"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire +helm test --namespace "${ns}" spire + +print_helm_releases +print_spire_workload_status "${ns}" + +if [[ "$1" -ne 0 ]]; then + get_namespace_details "${ns}" +fi From db0603825c5c0d86e507d953a1a7d8913c3fb9c4 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 13 Jun 2023 20:43:22 +0200 Subject: [PATCH 5/9] Increase some timeouts, trying to fix the tests Signed-off-by: Marco Franssen --- .github/tests/pre-install.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/tests/pre-install.sh b/.github/tests/pre-install.sh index a82e767..bed4f1d 100755 --- a/.github/tests/pre-install.sh +++ b/.github/tests/pre-install.sh @@ -19,7 +19,7 @@ kubectl create namespace spire-server || true "${helm_install[@]}" ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" \ --namespace ingress-nginx \ --set controller.extraArgs.enable-ssl-passthrough= -kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller +kubectl wait --namespace ingress-nginx --for=condition=ready --timeout 60s pod --selector=app.kubernetes.io/component=controller # prometheus "${helm_install[@]}" kube-prometheus-stack kube-prometheus-stack \ From 4848c48b1f8d64356a32a5425a8a40ba51e6685a Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 23 Jun 2023 11:22:11 +0200 Subject: [PATCH 6/9] Improve Makefile help and implementation This allows more granular tasks and composition. Also improved the documentation. Signed-off-by: Marco Franssen --- Makefile | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/Makefile b/Makefile index 7b4705e..c3ad2d6 100644 --- a/Makefile +++ b/Makefile @@ -2,7 +2,7 @@ TARGET_BRANCH ?= main .PHONY: help help: ## Display this help. - @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) + @awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-20s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST) ##@ Linting: @@ -15,10 +15,10 @@ lint-release: ## Lint the charts using chart-testing for release @echo Linting charts… @ct lint --config ct.yaml --target-branch $(TARGET_BRANCH) -##@ Testing: +##@ Testing: (ensure to run on dedicated test cluster) -.PHONY: clean-lingering-resources -clean-lingering-resources: +.PHONY: clean-test-leftovers +clean-test-leftovers: ## Cleans up any lingering resources in case tests fail massively @echo Cleanup potential leftovers… @-kubectl delete csidrivers.storage.k8s.io csi.spiffe.io \ &>/dev/null || true @@ -30,17 +30,20 @@ clean-lingering-resources: &>/dev/null || true .PHONY: test -test: install-test-dependencies ## Run tests using Helm chart-testing (ensure to run on dedicated test cluster) - @echo Running tests… - @ct install --config ct.yaml +test: install-test-deps test-charts test-examples ## Run all chart tests and example tests -.PHONY: install-test-dependencies -install-test-dependencies: ## Install test dependency resources +.PHONY: install-test-deps +install-test-deps: ## Install test dependency resources @echo Installing test dependencies… @.github/tests/pre-install.sh -.PHONY: cleanup-test-dependencies -cleanup-test-dependencies: ## Cleans up all test dependencies resources +.PHONY: test-charts +test-charts: ## Run tests on charts using Helm chart-testing + @echo Running tests… + @ct install --config ct.yaml + +.PHONY: cleanup-test-deps +cleanup-test-deps: ## Cleans up all test dependencies resources @echo Uninstalling test dependencies… @helm uninstall -n cert-manager cert-manager 2>/dev/null || true @kubectl delete ns cert-manager 2>/dev/null || true @@ -59,4 +62,4 @@ test-example-%: @echo .PHONY: test-examples -test-examples: $(patsubst examples/%/values.yaml,test-example-%,$(wildcard examples/*/values.yaml)) ## Run helm install for and helm test for all the examples +test-examples: $(patsubst examples/%/values.yaml,test-example-%,$(wildcard examples/*/values.yaml)) ## Run `helm install` and `helm test` for all the examples containing `run-tests.sh` From 42086bd66aa5fea3f3dac3cdad580cf28efa6569 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 3 Jul 2023 22:35:38 +0200 Subject: [PATCH 7/9] Run example tests also on all k8s versions Signed-off-by: Marco Franssen --- .github/workflows/helm-chart-ci.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index e7352ff..f573bc9 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -116,9 +116,6 @@ jobs: - name: Run chart-testing (lint) run: TARGET_BRANCH=${{ github.base_ref }} make lint${{ github.base_ref == 'release' && '-release' || '' }} - outputs: - changed: ${{ steps.list-changed.outputs.changed }} - test: runs-on: ubuntu-22.04 @@ -210,6 +207,10 @@ jobs: strategy: fail-fast: false matrix: + k8s: + - v1.27.2 + - v1.26.4 + - v1.25.9 example: - ${{ fromJson(needs.build-matrix.outputs.examples) }} From 09b466466a49ed620ccda586ba1c08637793fc68 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 11 Jul 2023 13:13:10 +0200 Subject: [PATCH 8/9] Utilize ct install --github-groups in ci workflow https://github.com/helm/chart-testing/pull/556 Signed-off-by: Marco Franssen --- .github/workflows/helm-chart-ci.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index f573bc9..94dbed9 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -24,7 +24,7 @@ env: HELM_VERSION: v3.12.0 PYTHON_VERSION: 3.11.3 KIND_VERSION: v0.19.0 - CHART_TESTING_VERSION: v3.8.0 + CHART_TESTING_VERSION: v3.9.0 jobs: checks: @@ -171,6 +171,7 @@ jobs: - name: Run chart-testing (install) run: | ct install --config ct.yaml \ + --github-groups \ --target-branch ${{ github.base_ref }} - name: Test summary From e426bc06e930d725902de072d5b9ae9c0b7a3429 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 19 Jul 2023 20:08:49 +0200 Subject: [PATCH 9/9] Downgrade chart-testing tool to 3.8.0 Unfortunatily it fails on linting Signed-off-by: Marco Franssen --- .github/workflows/helm-chart-ci.yaml | 3 +-- charts/spire/Chart.lock | 18 ++++++++++++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) create mode 100644 charts/spire/Chart.lock diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index 94dbed9..f573bc9 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -24,7 +24,7 @@ env: HELM_VERSION: v3.12.0 PYTHON_VERSION: 3.11.3 KIND_VERSION: v0.19.0 - CHART_TESTING_VERSION: v3.9.0 + CHART_TESTING_VERSION: v3.8.0 jobs: checks: @@ -171,7 +171,6 @@ jobs: - name: Run chart-testing (install) run: | ct install --config ct.yaml \ - --github-groups \ --target-branch ${{ github.base_ref }} - name: Test summary diff --git a/charts/spire/Chart.lock b/charts/spire/Chart.lock new file mode 100644 index 0000000..88436fe --- /dev/null +++ b/charts/spire/Chart.lock @@ -0,0 +1,18 @@ +dependencies: +- name: spire-server + repository: file://./charts/spire-server + version: 0.1.0 +- name: spire-agent + repository: file://./charts/spire-agent + version: 0.1.0 +- name: spiffe-csi-driver + repository: file://./charts/spiffe-csi-driver + version: 0.1.0 +- name: spiffe-oidc-discovery-provider + repository: file://./charts/spiffe-oidc-discovery-provider + version: 0.1.0 +- name: tornjak-frontend + repository: file://./charts/tornjak-frontend + version: 0.1.0 +digest: sha256:0119361a3dd54d1cf088f299ce9adbee55a96c832cb675f57e5e115acf7b17c7 +generated: "2023-07-19T19:13:59.722106+02:00"