feat: label the CRD with its managing installation and guard duplicat… #132
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Helm | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - release-* | |
| paths: | |
| - 'api/**' | |
| - 'charts/**' | |
| - 'config/crd/**' | |
| - '.github/workflows/helm.yaml' | |
| - '.github/ci/ct.yaml' | |
| - 'hack/verify-chart-drift.sh' | |
| - 'Makefile' | |
| pull_request: | |
| paths: | |
| - 'api/**' | |
| - 'charts/**' | |
| - 'config/crd/**' | |
| - '.github/workflows/helm.yaml' | |
| - '.github/ci/ct.yaml' | |
| - 'hack/verify-chart-drift.sh' | |
| - 'Makefile' | |
| jobs: | |
| lint-and-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0 | |
| with: | |
| version: v3.15.1 | |
| - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1 | |
| with: | |
| python-version: 3.12 | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Run chart drift check | |
| run: | | |
| hack/verify-chart-drift.sh | |
| - name: Set up chart-testing | |
| uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0 | |
| with: | |
| version: v3.11.0 | |
| - name: Install Helm Unit Test Plugin | |
| run: | | |
| helm plugin install --version 1.0.3 https://github.com/helm-unittest/helm-unittest | |
| - name: Run Helm Unit Tests | |
| run: | | |
| helm unittest charts/node-readiness-controller --strict -d | |
| - name: Run chart-testing (list-changed) | |
| id: list-changed | |
| run: | | |
| changed=$(ct list-changed --config=.github/ci/ct.yaml) | |
| if [[ -n "$changed" ]]; then | |
| echo "changed=true" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Run chart-testing (lint) | |
| run: ct lint --config=.github/ci/ct.yaml --validate-maintainers=false | |
| # Need a multi node cluster so controller can run with leadership | |
| - name: Create multi node Kind cluster | |
| run: make kind-multi-node | |
| - name: Run chart-testing (install) | |
| run: ct install --config=.github/ci/ct.yaml | |
| # The pre-install guard calls Helm's lookup, which returns nothing during | |
| # `helm template` and `--dry-run`, so the chart unit tests cannot cover it. | |
| # Exercise it against the live kind cluster instead. | |
| # | |
| # The signal is the controller Deployment, not the CRD: Helm applies crds/ | |
| # before rendering, so keying on the CRD would refuse every first install. | |
| - name: Verify the duplicate-install pre-install check | |
| run: | | |
| set -euo pipefail | |
| CHART=charts/node-readiness-controller | |
| echo "::group::a fresh install into an empty cluster succeeds with the guard ON" | |
| # This is the path the CRD-based guard broke: crds/ is applied before the | |
| # templates render, so the check must not trip on this install's own CRD. | |
| helm install nrc-guard "$CHART" \ | |
| --namespace nrc-guard --create-namespace --wait --timeout 5m | |
| echo "::endgroup::" | |
| echo "::group::a second install is refused while the first is running" | |
| if helm install nrc-guard-2 "$CHART" \ | |
| --namespace nrc-guard-2 --create-namespace 2>guard.err; then | |
| echo "expected the second install to be refused, but it succeeded" | |
| exit 1 | |
| fi | |
| cat guard.err | |
| grep -q "already installed in this cluster" guard.err | |
| echo "::endgroup::" | |
| echo "::group::escape hatch allows a second install anyway" | |
| helm install nrc-guard-2 "$CHART" \ | |
| --namespace nrc-guard-2 --create-namespace \ | |
| --set crds.preInstallCheck=false --wait --timeout 5m | |
| echo "::endgroup::" | |
| echo "::group::upgrade of the first release is not blocked, with the guard enabled" | |
| helm upgrade nrc-guard "$CHART" \ | |
| --namespace nrc-guard --wait --timeout 5m | |
| echo "::endgroup::" | |
| helm uninstall nrc-guard-2 --namespace nrc-guard-2 | |
| helm uninstall nrc-guard --namespace nrc-guard | |
| kubectl delete namespace nrc-guard nrc-guard-2 |