-
Notifications
You must be signed in to change notification settings - Fork 376
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
CI: Improved K8s Kubeconformance validation
- Improved Helm chart validation by using Kubeconformance with enabled CR validation. - Added JSON schemas for the Tetragon CRDs as we might need them in the future to validate CRs from the Helm chart (TPs, etc.). Signed-off-by: Philip Schmid <[email protected]>
- Loading branch information
1 parent
c2f3dbd
commit e47ffcd
Showing
8 changed files
with
6,369 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,8 +2,8 @@ name: Lint helm chart | |
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| - v* | ||
| - main | ||
| - v* | ||
| paths: | ||
| - 'install/kubernetes/**' | ||
| - 'pkg/k8s/apis/cilium.io/client/crds/v1alpha1/*.yaml' | ||
|
|
@@ -14,12 +14,70 @@ on: | |
| - 'pkg/k8s/apis/cilium.io/client/crds/v1alpha1/*.yaml' | ||
| - '.github/workflows/lint-helm.yaml' | ||
|
|
||
| env: | ||
| MIN_K8S_VERSION: "1.23.0" | ||
| # renovate: datasource=python-version | ||
| PYTHON_VERSION: "3.12" | ||
|
|
||
| jobs: | ||
| generated-files: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| # Get source | ||
| - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | ||
| - name: Run install/kubernetes | ||
|
|
||
| # Check / install dependencies | ||
| - name: Check if vendored openapi2jsonschema.py script is up to date | ||
| run: | | ||
| make -C install/kubernetes openapi2jsonschema.py | ||
| test -z "$(git status --porcelain)" | ||
| if [ $? != 0 ]; then | ||
| git status --porcelain | ||
| echo "Vendored openapi2jsonschema.py script is out of date." | ||
| echo "Please run 'make -C install/kubernetes openapi2jsonschema.py' and submit your changes."; exit 1 | ||
| fi | ||
| - name: Setup Python | ||
| id: setup-python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: ${{ env.PYTHON_VERSION }} | ||
| - name: Install pipenv | ||
| id: install-pipenv | ||
| shell: bash | ||
| run: | | ||
| python -m pip install --upgrade --no-cache-dir pip | ||
| python -m pip install --no-cache-dir pipenv | ||
| - name: Cache Pipfile | ||
| id: cache-pipfile | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: ~/.local/share/virtualenvs | ||
| key: ${{ runner.os }}-python-${{ steps.setup-python.outputs.python-version }}-pipenv-${{ hashFiles('Pipfile.lock') }} | ||
| - name: Sync Pipfile | ||
| id: sync-pipfile | ||
| shell: bash | ||
| working-directory: install/kubernetes | ||
| run: | | ||
| pipenv sync --dev --python ${{ env.PYTHON_VERSION }} | ||
| - name: Check if vendored CRD JSON schemas are up to date | ||
| run: | | ||
| make -C install/kubernetes generate-jsonschemas | ||
| test -z "$(git status --porcelain)" | ||
| if [ $? != 0 ]; then | ||
| git status --porcelain | ||
| echo "Vendored CRD JSON schemas are out of date." | ||
| echo "Please run 'make -C install/kubernetes generate-jsonschemas' and submit your changes."; exit 1 | ||
| fi | ||
| - name: Set up go # Required for kubeconform | ||
| uses: actions/setup-go@v5 | ||
| - name: Install Helm CLI # Required for the Helm chart templating | ||
| uses: azure/[email protected] | ||
| - name: Install latest kubeconform version # We don't want to vendor a binary. Also, latest is good enough. | ||
| run: | | ||
| go install github.com/yannh/kubeconform/cmd/kubeconform@latest | ||
| # Validate Helm chart | ||
| - name: Generate Helm chart | ||
| run: | | ||
| make -C install/kubernetes | ||
| - name: Validate generated files | ||
|
|
@@ -29,3 +87,46 @@ jobs: | |
| git status --porcelain | ||
| echo "Please run 'make -C install/kubernetes' and submit your changes."; exit 1 | ||
| fi | ||
| # (Re-)run Kubeconform checks explicitly once again to catch specific errors in that regard (to get the STDOUT/STDERR) | ||
| - name: Run Kubeconform with minimum supported K8s version | ||
| id: kubeconform_min_k8s_version | ||
| uses: mathiasvr/[email protected] | ||
| with: | ||
| shell: bash | ||
| run: | | ||
| make -C install/kubernetes kubeconform K8S_VERSION=${{ env.MIN_K8S_VERSION }} | ||
| - name: Run Kubeconform with latest K8s version | ||
| id: kubeconform_latest_k8s_version | ||
| uses: mathiasvr/[email protected] | ||
| with: | ||
| shell: bash | ||
| run: | | ||
| make -C install/kubernetes kubeconform | ||
| # Post Kubeconform issues as comment on the GH PR, if there are any | ||
| - name: Comment Kubeconform Output | ||
| if: failure() && (steps.kubeconform_min_k8s_version.outcome != 'success' || steps.kubeconform_latest_k8s_version.outcome != 'success') | ||
| uses: marocchino/sticky-pull-request-comment@v2 | ||
| with: | ||
| hide_and_recreate: true | ||
| skip_unchanged: true | ||
| message: | | ||
| ## Kubeconform with minimum supported K8s version ${{ env.MIN_K8S_VERSION }} | ||
| STDOUT: | ||
| ``` | ||
| ${{ steps.kubeconform_min_k8s_version.outputs.stdout }} | ||
| ``` | ||
| STDERR: | ||
| ``` | ||
| ${{ steps.kubeconform_min_k8s_version.outputs.stderr }} | ||
| ``` | ||
| ## Kubeconform with latest K8s version | ||
| STDOUT: | ||
| ``` | ||
| ${{ steps.kubeconform_latest_k8s_version.outputs.stdout }} | ||
| ``` | ||
| STDERR: | ||
| ``` | ||
| ${{ steps.kubeconform_latest_k8s_version.outputs.stderr }} | ||
| ``` | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| [[source]] | ||
| url = "https://pypi.org/simple" | ||
| verify_ssl = true | ||
| name = "pypi" | ||
|
|
||
| [packages] | ||
| pyyaml = "*" | ||
|
|
||
| [dev-packages] | ||
|
|
||
| [requires] | ||
| python_version = "3.12" |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Oops, something went wrong.