-
Notifications
You must be signed in to change notification settings - Fork 376
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
CI: Improved K8s Kubeconformance validation
- Improved Helm chart validation by using Kubeconformance with enabled CR validation. - Added JSON schemas for the Tetragon CRDs as we might need them in the future to validate CRs from the Helm chart (TPs, etc.). Signed-off-by: Philip Schmid <[email protected]>
- Loading branch information
1 parent
a3da4f6
commit dd509f2
Showing
8 changed files
with
6,356 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,8 +2,8 @@ name: Lint helm chart | |
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| - v* | ||
| - main | ||
| - v* | ||
| paths: | ||
| - 'install/kubernetes/**' | ||
| - 'pkg/k8s/apis/cilium.io/client/crds/v1alpha1/*.yaml' | ||
|
|
@@ -14,12 +14,33 @@ on: | |
| - 'pkg/k8s/apis/cilium.io/client/crds/v1alpha1/*.yaml' | ||
| - '.github/workflows/lint-helm.yaml' | ||
|
|
||
| env: | ||
| MIN_K8S_VERSION: "1.23.0" | ||
|
|
||
| jobs: | ||
| generated-files: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | ||
| - name: Run install/kubernetes | ||
| - name: Check if vendored openapi2jsonschema.py script is up to date | ||
| run: | | ||
| make -C install/kubernetes openapi2jsonschema.py | ||
| test -z "$(git status --porcelain)" | ||
| if [ $? != 0 ]; then | ||
| git status --porcelain | ||
| echo "Vendored openapi2jsonschema.py script is out of date." | ||
| echo "Please run 'make -C install/kubernetes openapi2jsonschema.py' and submit your changes."; exit 1 | ||
| fi | ||
| - name: Check if vendored CRD JSON schemas are up to date | ||
| run: | | ||
| make -C install/kubernetes generate-jsonschemas | ||
| test -z "$(git status --porcelain)" | ||
| if [ $? != 0 ]; then | ||
| git status --porcelain | ||
| echo "Vendored CRD JSON schemas are out of date." | ||
| echo "Please run 'make -C install/kubernetes generate-jsonschemas' or 'make -C install/kubernetes generate-jsonschemas-local' and submit your changes."; exit 1 | ||
| fi | ||
| - name: Generate Helm chart | ||
| run: | | ||
| make -C install/kubernetes | ||
| - name: Validate generated files | ||
|
|
@@ -29,3 +50,80 @@ jobs: | |
| git status --porcelain | ||
| echo "Please run 'make -C install/kubernetes' and submit your changes."; exit 1 | ||
| fi | ||
| - name: Set up go # Required for kubeconform | ||
| uses: actions/setup-go@v5 | ||
| - name: Install latest kubeconform version # We don't want to vendor a binary. Also, latest is good enough. | ||
| run: | | ||
| go install github.com/yannh/kubeconform/cmd/kubeconform@latest | ||
| - name: Install Helm CLI | ||
| uses: azure/[email protected] | ||
| - name: Run Kubeconform with minimum supported K8s version | ||
| id: kubeconform_min_k8s_version | ||
| uses: mathiasvr/[email protected] | ||
| with: | ||
| shell: bash | ||
| run: | | ||
| for chart in tetragon enterprise; | ||
| do | ||
| echo "## Testing Helm chart: \"$chart\"" | ||
| helm template $chart-ee install/kubernetes/$chart \ | ||
| -f install/kubernetes/$chart/values.yaml \ | ||
| --set crds.installMethod=helm \ | ||
| --set tracingPolicies.default.enabled=true |\ | ||
| kubeconform \ | ||
| -summary \ | ||
| -verbose \ | ||
| -schema-location default \ | ||
| -schema-location 'install/kubernetes/schemas/{{ .ResourceKind }}-{{ .Group }}.json' \ | ||
| -skip CustomResourceDefinition \ | ||
| -strict \ | ||
| -kubernetes-version $MIN_K8S_VERSION | ||
| echo "" | ||
| done | ||
| - name: Run Kubeconform with latest K8s version | ||
| id: kubeconform_latest_k8s_version | ||
| uses: mathiasvr/[email protected] | ||
| with: | ||
| shell: bash | ||
| run: | | ||
| for chart in tetragon enterprise; | ||
| do | ||
| echo "## Testing Helm chart: \"$chart\"" | ||
| helm template $chart-ee install/kubernetes/$chart \ | ||
| -f install/kubernetes/$chart/values.yaml \ | ||
| --set crds.installMethod=helm \ | ||
| --set tracingPolicies.default.enabled=true |\ | ||
| kubeconform \ | ||
| -summary \ | ||
| -verbose \ | ||
| -schema-location default \ | ||
| -schema-location 'install/kubernetes/schemas/{{ .ResourceKind }}-{{ .Group }}.json' \ | ||
| -skip CustomResourceDefinition \ | ||
| -strict | ||
| echo "" | ||
| done | ||
| - name: Comment Kubeconform Output | ||
| if: failure() && (steps.kubeconform_min_k8s_version.outcome != 'success' || steps.kubeconform_latest_k8s_version.outcome != 'success') | ||
| uses: marocchino/sticky-pull-request-comment@v2 | ||
| with: | ||
| hide_and_recreate: true | ||
| skip_unchanged: true | ||
| message: | | ||
| ## Kubeconform with minimum supported K8s version ${{ env.MIN_K8S_VERSION }} | ||
| STDOUT: | ||
| ``` | ||
| ${{ steps.kubeconform_min_k8s_version.outputs.stdout }} | ||
| ``` | ||
| STDERR: | ||
| ``` | ||
| ${{ steps.kubeconform_min_k8s_version.outputs.stderr }} | ||
| ``` | ||
| ## Kubeconform with latest K8s version | ||
| STDOUT: | ||
| ``` | ||
| ${{ steps.kubeconform_latest_k8s_version.outputs.stdout }} | ||
| ``` | ||
| STDERR: | ||
| ``` | ||
| ${{ steps.kubeconform_latest_k8s_version.outputs.stderr }} | ||
| ``` | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| [[source]] | ||
| url = "https://pypi.org/simple" | ||
| verify_ssl = true | ||
| name = "pypi" | ||
|
|
||
| [packages] | ||
| pyyaml = "*" | ||
|
|
||
| [dev-packages] | ||
|
|
||
| [requires] | ||
| python_version = "3.12" |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Oops, something went wrong.