Merge pull request #324 from spiffe/enable-testing-multiple-charts

.github/kind/conf/kind-config.yaml

@@ -15,3 +15,4 @@ kubeadmConfigPatches:
         # admission-control-config-file: /etc/kubernetes/pki/admctrl/admission-control.yaml
 nodes:
   - role: control-plane
+  - role: worker

.github/scripts/parse-versions.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+TESTS_PATH="$(dirname "${BASH_SOURCE[0]}")/../tests"
+
+# Set repo and version env variables
+REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' "${TESTS_PATH}/charts.json")
+VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' "${TESTS_PATH}/charts.json")
+eval "$REPOS"
+eval "$VERSIONS"

.github/tests/charts.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-REPOS=$(jq -r '.[] | "export " + ("HELM_REPO_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .repo' .github/tests/charts.json)
-VERSIONS=$(jq -r '.[] | "export " + ("VERSION_" + .name | ascii_upcase | gsub("-";"_")) + "=" + .version' .github/tests/charts.json)
-eval "$REPOS"
-eval "$VERSIONS"

.github/tests/dependencies/mysql.yaml

@@ -5,3 +5,8 @@ primary:
       drop: [ALL]
     seccompProfile:
       type: RuntimeDefault
+auth:
+  database: spire-server
+  username: spire
+  password: sp1ff3Test
+  rootPassword: sp1ff3TestPassword

.github/tests/dependencies/postgresql.yaml

@@ -6,3 +6,8 @@ primary:
       drop: [ALL]
     seccompProfile:
       type: RuntimeDefault
+auth:
+  database: spire-server
+  username: spire
+  password: sp1ff3Test
+  postgresPassword: sp1ff3TestPassword

.github/tests/extras/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/federation-bundle-endpoint/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/namespace-override/post-install.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-systen
-fi
-

.github/tests/namespace-override/pre-install.sh

@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace "spire-system"
-kubectl create namespace "spire-server"

.github/tests/no-spire-controller-manager/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/post-install.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+set -x
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/common.sh"
+
+print_helm_releases

.github/tests/pre-install.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+DEPS="${SCRIPTPATH}/dependencies"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../scripts/parse-versions.sh"
+
+helm_install=(helm upgrade --install --create-namespace)
+
+# namespace override
+kubectl create namespace spire-system || true
+kubectl create namespace spire-server || true
+
+# nginx ingress
+"${helm_install[@]}" ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" \
+  --namespace ingress-nginx \
+  --set controller.extraArgs.enable-ssl-passthrough=
+kubectl wait --namespace ingress-nginx --for=condition=ready --timeout 60s pod --selector=app.kubernetes.io/component=controller
+
+# prometheus
+"${helm_install[@]}" kube-prometheus-stack kube-prometheus-stack \
+  --namespace prometheus \
+  --version "${VERSION_KUBE_PROMETHEUS_STACK}" \
+  --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
+  --wait
+
+# cert-manager
+"${helm_install[@]}" cert-manager cert-manager --version "$VERSION_CERT_MANAGER" --repo "$HELM_REPO_CERT_MANAGER" \
+  --namespace cert-manager \
+  --set installCRDs=true \
+  --wait
+
+# external database
+
+# mysql
+"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
+  --namespace mysql \
+  --values "${DEPS}/mysql.yaml" \
+  --wait
+
+# postgres
+"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
+  --namespace postgresql \
+  --values "${DEPS}/postgresql.yaml" \
+  --wait

.github/tests/production-example/install.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-
-set -xe
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-
-helm install \
-  --namespace spire-server \
-  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
-  spire charts/spire --wait
-
-helm test spire --namespace spire-server

.github/tests/production-example/post-install.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-system
-fi

.github/tests/production-example/pre-install.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace spire-system
-kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace spire-server
-kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/tests/production-external-mysql/install.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-
-set -xe
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
-
-DB=spire
-DBUSER=spire
-DBPW=$(uuidgen)
-DBROOTPW=$(uuidgen)
-
-# Generate random settings to make sure things come up with random settings.
-cat <<EOF > /tmp/$$-db-values.yaml
-auth:
-  database: ${DB}
-  username: ${DBUSER}
-  password: ${DBPW}
-  rootPassword: ${DBROOTPW}
-EOF
-
-cat <<EOF > /tmp/$$-spire-values.yaml
-spire-server:
-  dataStore:
-    sql:
-      databaseType: mysql
-      databaseName: ${DB}
-      username: ${DBUSER}
-      password: ${DBPW}
-      host: mysql
-      port: 3306
-EOF
-
-helm install mysql mysql --namespace "spire-server" --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
-  --values "${SCRIPTPATH}/mysql-values.yaml" \
-  --values /tmp/$$-db-values.yaml --wait
-
-helm install \
-  --namespace "spire-server" \
-  --values /tmp/$$-spire-values.yaml \
-  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
-  spire charts/spire --wait
-
-helm test spire --namespace "spire-server"

.github/tests/production-external-mysql/post-install.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-system
-fi

.github/tests/production-external-mysql/pre-install.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace spire-system
-kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace spire-server
-kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/tests/production-external-postgresql/install.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-
-set -xe
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
-
-DB=$(uuidgen)
-DBUSER=$(uuidgen)
-DBPW=$(uuidgen)
-DBPGPW=$(uuidgen)
-
-# Generate random settings to make sure things come up with random settings.
-cat > /tmp/$$-db-values.yaml <<EOF
-auth:
-  database: ${DB}
-  username: ${DBUSER}
-  password: ${DBPW}
-  postgresPassword: ${DBPGPW}
-EOF
-
-cat > /tmp/$$-spire-values.yaml <<EOF
-spire-server:
-  dataStore:
-    sql:
-      databaseType: postgres
-      databaseName: ${DB}
-      username: ${DBUSER}
-      password: ${DBPW}
-      host: postgresql
-      port: 5432
-      options:
-      - sslmode: disable
-EOF
-
-helm install postgresql postgresql --namespace "spire-server" --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
-  --values "${SCRIPTPATH}/postgresql-values.yaml" \
-  --values /tmp/$$-db-values.yaml --wait
-
-helm install \
-  --namespace "spire-server" \
-  --values /tmp/$$-spire-values.yaml \
-  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
-  spire charts/spire --wait
-
-helm test spire --namespace "spire-server"

.github/tests/production-external-postgresql/post-install.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-system
-fi

.github/tests/production-external-postgresql/pre-install.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace spire-system
-kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace spire-server
-kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/tests/prometheus/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/prometheus/pre-install.sh

@@ -1,11 +0,0 @@
-#!/usr/bin/env bash
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-helm install kube-prometheus-stack kube-prometheus-stack \
-  --version "${VERSION_KUBE_PROMETHEUS_STACK}" \
-  --repo "${HELM_REPO_KUBE_PROMETHEUS_STACK}" \
-  -n "${scenario}" \
-  --wait

.github/tests/spire-oidc-insecure/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/spire-oidc-insecure/pre-install.sh

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-helm install ingress-nginx ingress-nginx --version "${VERSION_INGRESS_NGINX}" --repo "${HELM_REPO_INGRESS_NGINX}" -n "$scenario" --set controller.extraArgs.enable-ssl-passthrough=
-kubectl wait --namespace ingress-nginx   --for=condition=ready pod   --selector=app.kubernetes.io/component=controller -n "$scenario"

.github/tests/tornjak/install.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH=$(dirname "$SCRIPT")
-
-helm install \
-  --namespace spire-server \
-  --values "${SCRIPTPATH}/../../../examples/production/values.yaml" \
-  --values "${SCRIPTPATH}/../../../examples/tornjak/values.yaml" \
-  spire charts/spire --wait
-helm test spire -n spire-server

.github/tests/tornjak/post-install.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status spire-server spire-system
-
-kubectl rollout status --watch --timeout 180s --namespace spire-server deployments.apps spire-tornjak-frontend
-kubectl -n spire-server get deploy spire-tornjak-frontend
-kubectl -n spire-server get service spire-tornjak-frontend
-
-
-if [[ "$1" -ne 0 ]]; then
-  get_namespace_details spire-server
-  get_namespace_details spire-system
-fi

.github/tests/tornjak/pre-install.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-
-kubectl create namespace spire-system
-kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged
-kubectl create namespace spire-server
-kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted

.github/tests/upstream-authority-cert-manager/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [ "$1" != '0' ]; then
-  get_namespace_details "${scenario}"
-fi

.github/tests/upstream-authority-cert-manager/pre-install.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-
-SCRIPT="$(readlink -f "$0")"
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-helm install cert-manager cert-manager --namespace cert-manager --create-namespace --version "$VERSION_CERT_MANAGER" --set installCRDs=true --repo "$HELM_REPO_CERT_MANAGER" --wait

.github/tests/upstream-authority-disk/post-install.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-set -x
-
-SCRIPT=$(readlink -f "$0")
-SCRIPTPATH="$(dirname "${SCRIPT}")"
-scenario="${scenario:-$(basename "${SCRIPTPATH}")}"
-
-# shellcheck source=/dev/null
-source "${SCRIPTPATH}/../common.sh"
-
-print_helm_releases
-print_spire_workload_status "${scenario}"
-
-if [ "$1" != '0' ]; then
-  get_namespace_details "${scenario}"
-fi

.github/workflows/helm-chart-ci-ignore.yaml

@@ -24,28 +24,8 @@ jobs:
     steps:
       - run: 'echo "Skipping checks"'
 
-  build-matrix:
-    name: Build matrix
-    runs-on: ubuntu-22.04
-
-    steps:
-      - name: Checkout
-        uses: actions/[email protected]
-
-      - id: set-matrix
-        name: Collect all tests
-        run: |
-          tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
-          tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
-          echo "tests=$tests_json" >> $GITHUB_OUTPUT
-
-    outputs:
-      tests: ${{ steps.set-matrix.outputs.tests }}
-
   test:
     runs-on: ubuntu-22.04
-    needs:
-      - build-matrix
 
     strategy:
       matrix:
@@ -53,8 +33,6 @@ jobs:
           - v1.27.2
           - v1.26.4
           - v1.25.9
-        values:
-          - ${{ fromJson(needs.build-matrix.outputs.tests) }}
 
     steps:
       - run: 'echo "Skipping tests"'

.github/workflows/helm-chart-ci.yaml

@@ -12,6 +12,7 @@ on:
       - '.github/tests/**/*.sh'
       - '.github/tests/**/*.json'
       - 'examples/**/*.yaml'
+      - 'examples/**/*.sh'
       - 'tests/**/*'
       - 'helm-docs.sh'
 
@@ -22,6 +23,7 @@ concurrency:
 env:
   HELM_VERSION: v3.12.0
   PYTHON_VERSION: 3.11.3
+  KIND_VERSION: v0.19.0
   CHART_TESTING_VERSION: v3.8.0
 
 jobs:
@@ -114,35 +116,11 @@ jobs:
       - name: Run chart-testing (lint)
         run: TARGET_BRANCH=${{ github.base_ref }} make lint${{ github.base_ref == 'release' && '-release' || '' }}
 
-    outputs:
-      changed: ${{ steps.list-changed.outputs.changed }}
-
-  build-matrix:
-    name: Build matrix
-    runs-on: ubuntu-22.04
-
-    needs: [lint-chart]
-
-    steps:
-      - name: Checkout
-        uses: actions/[email protected]
-
-      - id: set-matrix
-        name: Collect all tests
-        run: |
-          tests="$(echo -e "default\n$(find .github/tests -maxdepth 1 -type d | grep -Ev 'tests$' | xargs -I % basename % | sort | uniq)")"
-          tests_json="$(echo "$tests" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
-          echo "tests=$tests_json" >> $GITHUB_OUTPUT
-
-    outputs:
-      tests: ${{ steps.set-matrix.outputs.tests }}
-
   test:
     runs-on: ubuntu-22.04
 
     needs:
       - lint-chart
-      - build-matrix
 
     strategy:
       fail-fast: false
@@ -155,8 +133,6 @@ jobs:
           - v1.27.2
           - v1.26.4
           - v1.25.9
-        values:
-          - ${{ fromJson(needs.build-matrix.outputs.tests) }}
 
     steps:
       - name: Checkout
@@ -183,39 +159,83 @@ jobs:
         uses: helm/[email protected]
         # Only build a kind cluster if there are chart changes to test.
         with:
-          version: v0.19.0
+          version: ${{ env.KIND_VERSION }}
           node_image: kindest/node:${{ matrix.k8s }}
           config: .github/kind/conf/kind-config.yaml
           verbosity: 1
 
+      - name: Setup Test dependencies
+        run: ./pre-install.sh
+        working-directory: .github/tests
+
       - name: Run chart-testing (install)
         run: |
-          post-install() {
+          ct install --config ct.yaml \
-            [ -x "${TEST_DIR}/post-install.sh" ] && "${TEST_DIR}/post-install.sh" $1
+            --target-branch ${{ github.base_ref }}
-            exit $1
-          }
 
-          trap 'post-install $? $LINENO' EXIT
+      - name: Test summary
+        if: always()
+        run: ./post-install.sh
+        working-directory: .github/tests
 
-          export scenario="$(basename "${TEST_DIR}")"
+  build-matrix:
-          export EXTRA_HELM_ARGS=""
+    name: Build matrix
+    runs-on: ubuntu-22.04
 
-          source .github/tests/charts.sh
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]
 
-          [ "${scenario}" != "default" ] && kubectl create namespace "${scenario}"
+      - id: set-matrix
-          [ -x "${TEST_DIR}/pre-install.sh" ] && "${TEST_DIR}/pre-install.sh"
+        name: Collect all examples
-          [ -f "${TEST_DIR}/.env" ] && source "${TEST_DIR}/.env"
+        run: |
+          examples="$(find examples -maxdepth 2 -type f -name run-tests.sh | xargs -I % dirname %)"
+          examples_json="$(echo "$examples" | jq -c --slurp --raw-input 'split("\n") | map(select(. != ""))')"
+          echo "${examples_json}"
+          echo "examples=$examples_json" >>"$GITHUB_OUTPUT"
 
-          if [ -x "${TEST_DIR}/install.sh" ]; then
+    outputs:
-            "${TEST_DIR}/install.sh"
+      examples: ${{ steps.set-matrix.outputs.examples }}
-          else
+
-            ct install --debug \
+  example-test:
-              --charts "charts/spire" \
+    runs-on: ubuntu-22.04
-              --namespace "${scenario}" \
+
-              --target-branch ${{ github.base_ref }} \
+    needs:
-              --exclude-deprecated \
+      - lint-chart
-              --skip-clean-up \
+      - build-matrix
-              ${{ (matrix.values != 'default' && '--helm-extra-set-args "--values=${TEST_DIR}/values.yaml ${EXTRA_HELM_ARGS}"') || '' }}
+
-          fi
+    strategy:
-        env:
+      fail-fast: false
-          TEST_DIR: .github/tests/${{ matrix.values }}
+      matrix:
+        k8s:
+          - v1.27.2
+          - v1.26.4
+          - v1.25.9
+        example:
+          - ${{ fromJson(needs.build-matrix.outputs.examples) }}
+
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]
+
+      - name: Set up Helm
+        uses: azure/[email protected]
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Create kind cluster
+        uses: helm/[email protected]
+        # Only build a kind cluster if there are chart changes to test.
+        with:
+          version: ${{ env.KIND_VERSION }}
+          node_image: kindest/node:v1.26.4
+          config: .github/kind/conf/kind-config.yaml
+          verbosity: 1
+
+      - name: Install and test example
+        run: ${{ matrix.example }}/run-tests.sh

Makefile

@@ -2,8 +2,7 @@ TARGET_BRANCH ?= main
 
 .PHONY: help
 help: ## Display this help.
-	@$(MAKE) help
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
-	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
 
 ##@ Linting:
 
@@ -16,10 +15,10 @@ lint-release: ## Lint the charts using chart-testing for release
 	@echo Linting charts…
 	@ct lint --config ct.yaml --target-branch $(TARGET_BRANCH)
 
-##@ Testing:
+##@ Testing: (ensure to run on dedicated test cluster)
 
-.PHONY: clean-lingering-resources
+.PHONY: clean-test-leftovers
-clean-lingering-resources:
+clean-test-leftovers: ## Cleans up any lingering resources in case tests fail massively
 	@echo Cleanup potential leftovers…
 	@-kubectl delete csidrivers.storage.k8s.io csi.spiffe.io \
 		&>/dev/null || true
@@ -31,7 +30,36 @@ clean-lingering-resources:
 		&>/dev/null || true
 
 .PHONY: test
-test: ## Run tests using Helm chart-testing (ensure to run on dedicated test cluster)
+test: install-test-deps test-charts test-examples ## Run all chart tests and example tests
+
+.PHONY: install-test-deps
+install-test-deps: ## Install test dependency resources
+	@echo Installing test dependencies…
+	@.github/tests/pre-install.sh
+
+.PHONY: test-charts
+test-charts: ## Run tests on charts using Helm chart-testing
 	@echo Running tests…
-	@ct install --debug \
+	@ct install --config ct.yaml
-		--charts charts/spire
+
+.PHONY: cleanup-test-deps
+cleanup-test-deps: ## Cleans up all test dependencies resources
+	@echo Uninstalling test dependencies…
+	@helm uninstall -n cert-manager cert-manager 2>/dev/null || true
+	@kubectl delete ns cert-manager 2>/dev/null || true
+	@helm uninstall -n prometheus kube-prometheus-stack 2>/dev/null || true
+	@kubectl delete ns prometheus 2>/dev/null || true
+	@helm uninstall -n mysql mysql 2>/dev/null|| true
+	@kubectl delete ns mysql 2>/dev/null || true
+	@helm uninstall -n postgresql postgresql 2>/dev/null || true
+	@kubectl delete ns postgresql 2>/dev/null || true
+	@helm uninstall -n ingress-nginx ingress-nginx 2>/dev/null || true
+	@kubectl delete ns ingress-nginx 2>/dev/null || true
+
+test-example-%:
+	@echo Running tests for $* example…
+	@examples/$*/run-tests.sh
+	@echo
+
+.PHONY: test-examples
+test-examples: $(patsubst examples/%/values.yaml,test-example-%,$(wildcard examples/*/values.yaml)) ## Run `helm install` and `helm test` for all the examples containing `run-tests.sh`

charts/spire/.helmignore

@@ -21,3 +21,4 @@
 .idea/
 *.tmproj
 .vscode/
+ci/

charts/spire/Chart.lock

@@ -0,0 +1,18 @@
+dependencies:
+- name: spire-server
+  repository: file://./charts/spire-server
+  version: 0.1.0
+- name: spire-agent
+  repository: file://./charts/spire-agent
+  version: 0.1.0
+- name: spiffe-csi-driver
+  repository: file://./charts/spiffe-csi-driver
+  version: 0.1.0
+- name: spiffe-oidc-discovery-provider
+  repository: file://./charts/spiffe-oidc-discovery-provider
+  version: 0.1.0
+- name: tornjak-frontend
+  repository: file://./charts/tornjak-frontend
+  version: 0.1.0
+digest: sha256:0119361a3dd54d1cf088f299ce9adbee55a96c832cb675f57e5e115acf7b17c7
+generated: "2023-07-19T19:13:59.722106+02:00"

charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml

@@ -33,7 +33,7 @@ spec:
     - name: curl-ingress
       image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
       command: ['curl']
-      args: ['-s', '-f', 'http://{{ index .Values.config.additionalDomains 0 }}/.well-known/openid-configuration']
+      args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- end }}

charts/spire/ci/external-mysql-values.yaml

@@ -0,0 +1,11 @@
+spire-server:
+  dataStore:
+    sql:
+      databaseType: mysql
+      databaseName: spire-server
+      username: spire
+      password: sp1ff3Test
+      host: mysql.mysql
+      port: 3306
+      options:
+      - parseTime: true

charts/spire/ci/external-postgres-values.yaml

@@ -0,0 +1,11 @@
+spire-server:
+  dataStore:
+    sql:
+      databaseType: postgres
+      databaseName: spire-server
+      username: spire
+      password: sp1ff3Test
+      host: postgresql.postgresql
+      port: 5432
+      options:
+      - sslmode: disable

charts/spire/ci/oidc-values.yaml

@@ -8,14 +8,14 @@ spire-server:
       nginx.ingress.kubernetes.io/ssl-redirect: "true"
       nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
     hosts:
-    - host: ingress-nginx-controller.spire-oidc-insecure
+    - host: ingress-nginx-controller.ingress-nginx
       paths:
         - path: /
           pathType: Prefix
 
 spire-agent:
   server:
-    address: ingress-nginx-controller.spire-oidc-insecure
+    address: ingress-nginx-controller.ingress-nginx
     port: 443
 
 spiffe-oidc-discovery-provider:
@@ -26,7 +26,8 @@ spiffe-oidc-discovery-provider:
 
   config:
     additionalDomains:
-      - ingress-nginx-controller
+      - ingress-nginx-controller.ingress-nginx
+      - ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     acme:
       tosAccepted: false
@@ -35,7 +36,7 @@ spiffe-oidc-discovery-provider:
     enabled: true
     className: nginx
     hosts:
-    - host: ingress-nginx-controller
+      - host: ingress-nginx-controller.ingress-nginx.svc.cluster.local
-      paths:
+        paths:
-        - path: /
+          - path: /
-          pathType: Prefix
+            pathType: Prefix

charts/spire/ci/tornjak-values.yaml

@@ -0,0 +1,6 @@
+spire-server:
+  tornjak:
+    enabled: true
+
+tornjak-frontend:
+  enabled: true

examples/external-mysql/run-tests.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+TESTDIR="${SCRIPTPATH}/../../.github/tests"
+DEPS="${TESTDIR}/dependencies"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
+# shellcheck source=/dev/null
+source "${TESTDIR}/common.sh"
+
+helm_install=(helm upgrade --install --create-namespace)
+ns=spire-system
+
+teardown() {
+  helm uninstall --namespace "${ns}" spire 2>/dev/null || true
+  kubectl delete ns "${ns}" 2>/dev/null || true
+
+  helm uninstall --namespace mysql mysql 2>/dev/null || true
+  kubectl delete ns mysql 2>/dev/null || true
+}
+
+trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
+
+"${helm_install[@]}" mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
+  --namespace mysql \
+  --values "${DEPS}/mysql.yaml" \
+  --wait
+
+"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \
+  --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
+helm test --namespace "${ns}" spire
+
+print_helm_releases
+print_spire_workload_status "${ns}"
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details "${ns}"
+fi

examples/external-mysql/values.yaml

@@ -2,7 +2,8 @@ spire-server:
   dataStore:
     sql:
       databaseType: mysql
-      databaseName: spire
+      databaseName: spire-server
-      host: mysql
+      host: mysql.mysql
       port: 3306
       username: spire
+      # password: CHANGE_ME

examples/external-postgresql/run-tests.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+TESTDIR="${SCRIPTPATH}/../../.github/tests"
+DEPS="${TESTDIR}/dependencies"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
+# shellcheck source=/dev/null
+source "${TESTDIR}/common.sh"
+
+helm_install=(helm upgrade --install --create-namespace)
+ns=spire-system
+
+teardown() {
+  helm uninstall --namespace "${ns}" spire 2>/dev/null || true
+  kubectl delete ns "${ns}" 2>/dev/null || true
+
+  helm uninstall --namespace postgresql postgresql 2>/dev/null || true
+  kubectl delete ns postgresql 2>/dev/null || true
+}
+
+trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
+
+"${helm_install[@]}" postgresql postgresql --version "$VERSION_POSTGRESQL" --repo "$HELM_REPO_POSTGRESQL" \
+  --namespace postgresql \
+  --values "${DEPS}/postgresql.yaml" \
+  --wait
+
+"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" \
+  --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
+helm test --namespace "${ns}" spire
+
+print_helm_releases
+print_spire_workload_status "${ns}"
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details "${ns}"
+fi

examples/external-postgresql/values.yaml

@@ -2,9 +2,10 @@ spire-server:
   dataStore:
     sql:
       databaseType: postgres
-      databaseName: spire
+      databaseName: spire-server
-      host: postgresql
+      host: postgresql.postgresql
       port: 5432
       username: spire
+      # password: CHANGE_ME
       options:
         - sslmode: disable

examples/production/run-tests.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+TESTDIR="${SCRIPTPATH}/../../.github/tests"
+
+# shellcheck source=/dev/null
+source "${TESTDIR}/common.sh"
+
+helm_install=(helm upgrade --install --create-namespace)
+ns=spire-server
+
+teardown() {
+  helm uninstall --namespace "${ns}" spire 2>/dev/null || true
+  kubectl delete ns "${ns}" 2>/dev/null || true
+  kubectl delete ns spire-system 2>/dev/null || true
+}
+
+trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
+
+kubectl create namespace spire-system 2>/dev/null || true
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
+kubectl create namespace "${ns}" 2>/dev/null || true
+kubectl label namespace "${ns}" pod-security.kubernetes.io/enforce=restricted || true
+
+"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire
+helm test --namespace "${ns}" spire
+
+print_helm_releases
+print_spire_workload_status "${ns}"
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details "${ns}"
+fi

examples/tornjak/run-tests.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+TESTDIR="${SCRIPTPATH}/../../.github/tests"
+
+# shellcheck source=/dev/null
+source "${TESTDIR}/common.sh"
+
+helm_install=(helm upgrade --install --create-namespace)
+ns=spire-system
+
+teardown() {
+  helm uninstall --namespace "${ns}" spire 2>/dev/null || true
+  kubectl delete ns "${ns}" 2>/dev/null || true
+}
+
+trap 'trap - SIGTERM && teardown' SIGINT SIGTERM EXIT
+
+"${helm_install[@]}" --namespace "${ns}" --values "${SCRIPTPATH}/values.yaml" --wait spire charts/spire
+helm test --namespace "${ns}" spire
+
+print_helm_releases
+print_spire_workload_status "${ns}"
+
+if [[ "$1" -ne 0 ]]; then
+  get_namespace_details "${ns}"
+fi