Skip to content

Commit 82f9730

Browse files
TaylorMutchTaylorMutch
committed
test(e2e): Add a Helm specific e2e harness and linting workflow
1 parent 5116cc2 commit 82f9730

11 files changed

Lines changed: 408 additions & 22 deletions

File tree

‎.agents/skills/helm-dev-environment/SKILL.md‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ The gateway Service uses ClusterIP. Access is via Envoy Gateway (port `8080`) or
6363

6464
### TLS behaviour
6565

66-
`values-skaffold.yaml` sets `server.disableTls: true`, so Skaffold-based deploys run
66+
`ci/values-skaffold.yaml` sets `server.disableTls: true`, so Skaffold-based deploys run
6767
plaintext by default. To test with TLS enabled, comment out that line and redeploy.
6868

6969
| Mode | `server.disableTls` | Gateway scheme |
@@ -160,7 +160,7 @@ imports the openshell realm from `scripts/keycloak-realm.json`, and prints a por
160160
command for acquiring tokens from the CLI.
161161

162162
Then activate OIDC in the OpenShell Helm chart:
163-
1. Uncomment `#- values-keycloak.yaml` in `skaffold.yaml`
163+
1. Uncomment `#- ci/values-keycloak.yaml` in `skaffold.yaml`
164164
2. Redeploy: `mise run helm:skaffold:run`
165165

166166
To remove Keycloak:
@@ -191,10 +191,12 @@ mise run helm:k3s:status
191191
|------|---------|
192192
| `deploy/helm/openshell/skaffold.yaml` | Skaffold config — images, Helm releases, values overlays |
193193
| `deploy/helm/openshell/values.yaml` | Default Helm values |
194-
| `deploy/helm/openshell/values-skaffold.yaml` | Dev overrides (image pull policy, local image names) |
195-
| `deploy/helm/openshell/values-cert-manager.yaml` | cert-manager TLS overlay (opt-in; disables pkiInitJob) |
196-
| `deploy/helm/openshell/values-gateway.yaml` | Envoy Gateway GRPCRoute + Gateway overlay |
197-
| `deploy/helm/openshell/values-keycloak.yaml` | Keycloak OIDC overlay |
194+
| `deploy/helm/openshell/ci/values-skaffold.yaml` | Dev overrides (image pull policy, TLS disabled for local Skaffold) |
195+
| `deploy/helm/openshell/ci/values-cert-manager.yaml` | cert-manager PKI overlay (opt-in; disables pkiInitJob) |
196+
| `deploy/helm/openshell/ci/values-gateway.yaml` | Envoy Gateway GRPCRoute + Gateway overlay |
197+
| `deploy/helm/openshell/ci/values-keycloak.yaml` | Keycloak OIDC overlay |
198+
| `deploy/helm/openshell/ci/values-tls-disabled.yaml` | Lint-only: TLS + auth disabled (reverse-proxy edge termination) |
198199
| `deploy/kube/manifests/envoy-gateway-openshell.yaml` | GatewayClass for Envoy Gateway (`mise run helm:gateway:apply`) |
199200
| `tasks/scripts/helm-k3s-local.sh` | k3d cluster create/delete/start/stop/status |
201+
| `tasks/scripts/helm-e2e.sh` | Bootstrap k3d cluster and run Rust + Python e2e via Helm |
200202
| `tasks/scripts/keycloak-k8s-setup.sh` | Keycloak deploy + realm import |

‎.github/workflows/helm-lint.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
name: Helm Lint
5+
6+
on:
7+
push:
8+
branches:
9+
- "pull-request/[0-9]+"
10+
paths:
11+
- "deploy/helm/**"
12+
workflow_dispatch:
13+
14+
env:
15+
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
16+
17+
permissions:
18+
contents: read
19+
packages: read
20+
21+
concurrency:
22+
group: ${{ github.workflow }}-${{ github.ref }}
23+
cancel-in-progress: true
24+
25+
jobs:
26+
pr_metadata:
27+
name: Resolve PR metadata
28+
runs-on: ubuntu-latest
29+
permissions:
30+
contents: read
31+
pull-requests: read
32+
outputs:
33+
should_run: ${{ steps.gate.outputs.should_run }}
34+
steps:
35+
- uses: actions/checkout@v6
36+
37+
- id: gate
38+
uses: ./.github/actions/pr-gate
39+
40+
helm-lint:
41+
name: Helm Lint
42+
needs: pr_metadata
43+
if: needs.pr_metadata.outputs.should_run == 'true'
44+
runs-on: linux-amd64-cpu8
45+
container:
46+
image: ghcr.io/nvidia/openshell/ci:latest
47+
credentials:
48+
username: ${{ github.actor }}
49+
password: ${{ secrets.GITHUB_TOKEN }}
50+
steps:
51+
- uses: actions/checkout@v6
52+
53+
- name: Install tools
54+
run: mise install --locked
55+
56+
- name: Lint Helm chart
57+
run: mise run helm:lint

‎deploy/helm/openshell/.helmignore‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,4 @@
1919

2020
# Ignore development files
2121
skaffold.yaml
22-
values-keycloak.yaml
23-
values-ingress.yaml
24-
values-gateway.yaml
25-
values-cert-manager.yaml
26-
values-skaffold.yaml
22+
ci/

deploy/helm/openshell/values-cert-manager.yaml renamed to deploy/helm/openshell/ci/values-cert-manager.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# SPDX-License-Identifier: Apache-2.0
33

44
# Merge after values.yaml when cert-manager CRDs are installed, e.g.:
5-
# helm install ... -f values.yaml -f values-cert-manager.yaml
5+
# helm install ... -f values.yaml -f ci/values-cert-manager.yaml
66
# Or add this file to skaffold manifests.helm.releases[].valuesFiles.
77
server:
88
disableTls: false

deploy/helm/openshell/values-gateway.yaml renamed to deploy/helm/openshell/ci/values-gateway.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
#
66
# Requires Envoy Gateway in the cluster (installed via skaffold.yaml).
77
# Add this file to the openshell release valuesFiles to activate:
8-
# uncomment values-gateway.yaml in deploy/helm/openshell/skaffold.yaml
8+
# uncomment ci/values-gateway.yaml in deploy/helm/openshell/skaffold.yaml
99
#
1010
# Envoy Gateway will create an Envoy proxy Deployment and a LoadBalancer
1111
# Service (named envoy-<namespace>-<gateway-name>-*) in the openshell namespace.

deploy/helm/openshell/values-keycloak.yaml renamed to deploy/helm/openshell/ci/values-keycloak.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
#
99
# Then layer this file on top of values.yaml when deploying:
1010
# helm upgrade --install openshell . \
11-
# -f values.yaml -f values-skaffold.yaml -f values-keycloak.yaml
11+
# -f values.yaml -f ci/values-skaffold.yaml -f ci/values-keycloak.yaml
1212
#
1313
# Or add this file to skaffold.yaml valuesFiles for iterative dev.
1414
#

deploy/helm/openshell/values-skaffold.yaml renamed to deploy/helm/openshell/ci/values-skaffold.yaml

File renamed without changes.

‎deploy/helm/openshell/ci/values-tls-disabled.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
# CI lint target: TLS disabled (plaintext HTTP, no client cert requirement).
5+
# Typical when a reverse proxy or tunnel terminates TLS at the edge.
6+
server:
7+
disableTls: true
8+
disableGatewayAuth: true
9+
pkiInitJob:
10+
enabled: false

‎deploy/helm/openshell/skaffold.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -87,16 +87,16 @@ deploy:
8787
createNamespace: true
8888
valuesFiles:
8989
- values.yaml
90-
- values-skaffold.yaml
91-
# Add values-cert-manager.yaml here (and uncomment the cert-manager
90+
- ci/values-skaffold.yaml
91+
# Add ci/values-cert-manager.yaml here (and uncomment the cert-manager
9292
# release above) to switch from pkiInitJob to cert-manager for PKI.
93-
#- values-cert-manager.yaml
93+
#- ci/values-cert-manager.yaml
9494
# To enable OIDC with a local Keycloak instance, run the one-time
9595
# setup task first, then uncomment the line below:
9696
# mise run keycloak:k8s:setup
97-
#- values-keycloak.yaml
97+
#- ci/values-keycloak.yaml
9898
# To enable the Gateway API HTTPRoute (requires Envoy Gateway above):
99-
#- values-gateway.yaml
99+
#- ci/values-gateway.yaml
100100
setValueTemplates:
101101
image.repository: '{{.IMAGE_REPO_openshell_gateway}}'
102102
image.tag: '{{.IMAGE_TAG_openshell_gateway}}'

‎tasks/helm.toml‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,18 @@
44
# Helm chart tasks
55

66
["helm:lint"]
7-
description = "Lint the openshell helm chart"
8-
run = "helm lint deploy/helm/openshell"
9-
hide = true
7+
description = "Lint the openshell Helm chart (defaults + all CI configuration variants)"
8+
run = """
9+
set -e
10+
echo "--- helm lint: defaults ---"
11+
helm lint deploy/helm/openshell
12+
for f in deploy/helm/openshell/ci/values-*.yaml; do
13+
variant=$(basename "$f" .yaml | sed 's/values-//')
14+
echo "--- helm lint: $variant ---"
15+
helm lint deploy/helm/openshell -f "$f"
16+
done
17+
echo "All variants passed."
18+
"""
1019

1120
["helm:skaffold:dev"]
1221
description = "Run skaffold dev for deploy/helm/openshell (iterative deploy)"
@@ -59,3 +68,24 @@ hide = true
5968
["helm:gateway:apply"]
6069
description = "Apply the Envoy GatewayClass manifest (run after helm:skaffold:run when gateway routing is enabled)"
6170
run = "kubectl apply -f deploy/kube/manifests/envoy-gateway-openshell.yaml"
71+
72+
# Helm e2e — boots a k3d cluster via the Helm path and runs the Rust + Python suites
73+
74+
["e2e:helm"]
75+
description = "Bootstrap Helm k3d cluster and run Rust + Python e2e suites"
76+
run = "tasks/scripts/helm-e2e.sh"
77+
78+
["e2e:helm:rust"]
79+
description = "Bootstrap Helm k3d cluster and run Rust e2e only"
80+
env = { HELM_E2E_SUITE = "rust" }
81+
run = "tasks/scripts/helm-e2e.sh"
82+
83+
["e2e:helm:python"]
84+
description = "Bootstrap Helm k3d cluster and run Python e2e only"
85+
env = { HELM_E2E_SUITE = "python" }
86+
run = "tasks/scripts/helm-e2e.sh"
87+
88+
["e2e:helm:cert-manager"]
89+
description = "Bootstrap Helm k3d cluster with cert-manager PKI and run full e2e"
90+
env = { HELM_E2E_PKI = "cert-manager" }
91+
run = "tasks/scripts/helm-e2e.sh"

0 commit comments

Comments
 (0)