1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
name: Helm chart
# helm/rws: lint, schema-check the rendered manifests (kubeconform), and
# install the packaged chart into a kind cluster with TLS off and on — the
# pods must pass their probes and answer through the Service.
on:
push:
branches:
paths:
pull_request:
paths:
workflow_dispatch:
jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install kubeconform
run: |
curl -sSfL https://github.com/yannh/kubeconform/releases/download/v0.7.0/kubeconform-linux-amd64.tar.gz | tar xz -C /usr/local/bin kubeconform
- name: Lint and validate
run: |
crds='https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json'
check() {
echo "== $*"
helm lint --strict helm/rws "$@"
helm template ci helm/rws "$@" | kubeconform -strict -summary -schema-location default -schema-location "$crds"
}
check
check --set tls.enabled=false --set quic.enabled=false
check --set gatewayAPI.enabled=true --set tls.enabled=false
check --set ingress.enabled=true --set metrics.serviceMonitor.enabled=true \
--set autoscaling.enabled=true --set autoscaling.customMetric.enabled=true
check --set tls.enabled=false --set ingress.enabled=true --set ingress.className=nginx \
--set 'ingress.tls[0].secretName=x' --set 'ingress.tls[0].hosts[0]=rws.example.com'
install:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: helm/kind-action@v1
with:
cluster_name: rws
- name: Package
run: helm package helm/rws -d dist
# A release bump moves appVersion before the tag publishes that image:
# until then, install the newest published one (this job tests the chart).
- name: Pick the image
run: |
app=$(awk '/^appVersion:/ {gsub(/"/, "", $2); print $2}' helm/rws/Chart.yaml)
if docker manifest inspect "ghcr.io/bohdaq/rws:$app" >/dev/null 2>&1; then
echo "IMAGE_TAG=$app" >> "$GITHUB_ENV"; exit 0
fi
for tag in $(git ls-remote --tags --refs origin | awk -F/ '{print $3}' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | sort -t. -k1,1nr -k2,2nr -k3,3nr | head -5); do
if docker manifest inspect "ghcr.io/bohdaq/rws:$tag" >/dev/null 2>&1; then
echo "ghcr.io/bohdaq/rws:$app isn't published yet; installing $tag"
echo "IMAGE_TAG=$tag" >> "$GITHUB_ENV"; exit 0
fi
done
echo "no published image found"; exit 1
- name: Install with TLS
run: |
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -days 1 \
-subj /CN=localhost -keyout tls.key -out tls.crt
kubectl create secret tls rws-tls --cert=tls.crt --key=tls.key
helm install tls dist/rws-*.tgz --set replicaCount=1 --set podDisruptionBudget.enabled=false \
--set image.tag="$IMAGE_TAG" --wait --timeout 5m
kubectl port-forward svc/tls-rws 8443:443 & sleep 3
curl -sSfk https://localhost:8443/healthz
curl -sSfk https://localhost:8443/metrics | grep '^rws_requests_total'
kill %1
- name: Install without TLS
run: |
helm install plain dist/rws-*.tgz --set replicaCount=1 --set podDisruptionBudget.enabled=false \
--set image.tag="$IMAGE_TAG" --set tls.enabled=false --set quic.enabled=false --wait --timeout 5m
kubectl port-forward svc/plain-rws 8080:80 & sleep 3
curl -sSf http://localhost:8080/healthz
kill %1
- name: Diagnostics
if: failure()
run: |
kubectl get pods -o wide
kubectl describe pods
kubectl logs -l app.kubernetes.io/name=rws --tail=50 --all-containers