From 8ffc88ba2853173cb1f4655216122e795a168c4e Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 5 Jun 2025 03:28:04 +0800 Subject: [PATCH 1/4] misc: add verification check for secret operator --- .../workflows/release-k8-operator-helm.yml | 70 ++++++++++++++----- .../run-helm-chart-tests-secret-operator.yml | 38 ++++++++++ ct.yaml | 12 ++++ 3 files changed, 101 insertions(+), 19 deletions(-) create mode 100644 .github/workflows/run-helm-chart-tests-secret-operator.yml create mode 100644 ct.yaml diff --git a/.github/workflows/release-k8-operator-helm.yml b/.github/workflows/release-k8-operator-helm.yml index f3731fb46..7a9d867dd 100644 --- a/.github/workflows/release-k8-operator-helm.yml +++ b/.github/workflows/release-k8-operator-helm.yml @@ -1,27 +1,59 @@ name: Release K8 Operator Helm Chart on: - workflow_dispatch: + workflow_dispatch: jobs: - release-helm: - name: Release Helm Chart - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v2 + test-helm: + name: Test Helm Chart + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + fetch-depth: 0 - - name: Install Helm - uses: azure/setup-helm@v3 - with: - version: v3.10.0 + - name: Set up Helm + uses: azure/setup-helm@v4.2.0 + with: + version: v3.17.0 - - name: Install python - uses: actions/setup-python@v4 + - uses: actions/setup-python@v5.3.0 + with: + python-version: "3.x" + check-latest: true - - name: Install Cloudsmith CLI - run: pip install --upgrade cloudsmith-cli + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.7.0 - - name: Build and push helm package to CloudSmith - run: cd helm-charts && sh upload-k8s-operator-cloudsmith.sh - env: - CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} + - name: Run chart-testing (lint) + run: ct lint --config ct.yaml --charts helm-charts/secrets-operator + + - name: Create kind cluster + uses: helm/kind-action@v1.12.0 + + - name: Run chart-testing (install) + run: ct install --config ct.yaml --charts helm-charts/secrets-operator + + release-helm: + name: Release Helm Chart + needs: test-helm + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v2 + + - name: Install Helm + uses: azure/setup-helm@v3 + with: + version: v3.10.0 + + - name: Install python + uses: actions/setup-python@v4 + + - name: Install Cloudsmith CLI + run: pip install --upgrade cloudsmith-cli + + - name: Build and push helm package to CloudSmith + run: cd helm-charts && sh upload-k8s-operator-cloudsmith.sh + env: + CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} diff --git a/.github/workflows/run-helm-chart-tests-secret-operator.yml b/.github/workflows/run-helm-chart-tests-secret-operator.yml new file mode 100644 index 000000000..15bb38956 --- /dev/null +++ b/.github/workflows/run-helm-chart-tests-secret-operator.yml @@ -0,0 +1,38 @@ +name: Run Helm Chart Tests for Secret Operator +on: + pull_request: + paths: + - "helm-charts/secrets-operator/**" + - ".github/workflows/run-helm-chart-tests-secret-operator.yml" + +jobs: + test-helm: + name: Test Helm Chart + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + fetch-depth: 0 + + - name: Set up Helm + uses: azure/setup-helm@v4.2.0 + with: + version: v3.17.0 + + - uses: actions/setup-python@v5.3.0 + with: + python-version: "3.x" + check-latest: true + + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.7.0 + + - name: Run chart-testing (lint) + run: ct lint --config ct.yaml --charts helm-charts/secrets-operator + + - name: Create kind cluster + uses: helm/kind-action@v1.12.0 + + - name: Run chart-testing (install) + run: ct install --config ct.yaml --charts helm-charts/secrets-operator diff --git a/ct.yaml b/ct.yaml new file mode 100644 index 000000000..4c834ae03 --- /dev/null +++ b/ct.yaml @@ -0,0 +1,12 @@ +# Chart testing configuration +chart-dirs: + - helm-charts + +# Test against these Kubernetes versions +kube-versions: + - v1.30.0 + - v1.31.0 + - v1.32.0 + - v1.33.0 + +validate-maintainers: false From 8fa6af9ba47185c720130476c17d2fc6316f5f1b Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 5 Jun 2025 21:26:53 +0800 Subject: [PATCH 2/4] misc: added checks for infisical standalone helm --- .../workflows/helm-release-infisical-core.yml | 57 ++++++++++++++++- ...rt-tests-infisical-standalone-postgres.yml | 61 +++++++++++++++++++ .infisicalignore | 4 ++ ct.yaml | 2 + .../infisical-standalone-postgres/values.yaml | 8 ++- 5 files changed, 128 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml diff --git a/.github/workflows/helm-release-infisical-core.yml b/.github/workflows/helm-release-infisical-core.yml index 0588d5d0d..ebce7cbe0 100644 --- a/.github/workflows/helm-release-infisical-core.yml +++ b/.github/workflows/helm-release-infisical-core.yml @@ -3,7 +3,62 @@ name: Release Infisical Core Helm chart on: [workflow_dispatch] jobs: + test-helm: + name: Test Helm Chart + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + fetch-depth: 0 + + - name: Set up Helm + uses: azure/setup-helm@v4.2.0 + with: + version: v3.17.0 + + - uses: actions/setup-python@v5.3.0 + with: + python-version: "3.x" + check-latest: true + + - name: Add Helm repositories + run: | + helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx + helm repo add bitnami https://charts.bitnami.com/bitnami + helm repo update + + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.7.0 + + - name: Run chart-testing (lint) + run: ct lint --config ct.yaml --charts helm-charts/infisical-standalone-postgres + + - name: Create kind cluster + uses: helm/kind-action@v1.12.0 + + - name: Create namespace + run: kubectl create namespace infisical-standalone-postgres + + - name: Create Infisical secrets + run: | + kubectl create secret generic infisical-secrets \ + --namespace infisical-standalone-postgres \ + --from-literal=AUTH_SECRET=6c1fe4e407b8911c104518103505b218 \ + --from-literal=ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218 \ + --from-literal=SITE_URL=http://localhost:8080 + + - name: Run chart-testing (install) + run: | + ct install \ + --config ct.yaml \ + --charts helm-charts/infisical-standalone-postgres \ + --helm-extra-args="--timeout=300s" \ + --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres" \ + --namespace infisical-standalone-postgres + release: + needs: test-helm runs-on: ubuntu-latest steps: - name: Checkout @@ -19,4 +74,4 @@ jobs: - name: Build and push helm package to Cloudsmith run: cd helm-charts && sh upload-infisical-core-helm-cloudsmith.sh env: - CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} \ No newline at end of file + CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} diff --git a/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml new file mode 100644 index 000000000..fcf519720 --- /dev/null +++ b/.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml @@ -0,0 +1,61 @@ +name: Run Helm Chart Tests for Infisical Standalone Postgres +on: + pull_request: + paths: + - "helm-charts/infisical-standalone-postgres/**" + - ".github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml" + +jobs: + test-helm: + name: Test Helm Chart + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + fetch-depth: 0 + + - name: Set up Helm + uses: azure/setup-helm@v4.2.0 + with: + version: v3.17.0 + + - uses: actions/setup-python@v5.3.0 + with: + python-version: "3.x" + check-latest: true + + - name: Add Helm repositories + run: | + helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx + helm repo add bitnami https://charts.bitnami.com/bitnami + helm repo update + + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.7.0 + + - name: Run chart-testing (lint) + run: ct lint --config ct.yaml --charts helm-charts/infisical-standalone-postgres + + - name: Create kind cluster + uses: helm/kind-action@v1.12.0 + + - name: Create namespace + run: kubectl create namespace infisical-standalone-postgres + + - name: Create Infisical secrets + run: | + kubectl create secret generic infisical-secrets \ + --namespace infisical-standalone-postgres \ + --from-literal=AUTH_SECRET=6c1fe4e407b8911c104518103505b218 \ + --from-literal=ENCRYPTION_KEY=6c1fe4e407b8911c104518103505b218 \ + --from-literal=SITE_URL=http://localhost:8080 + + - name: Run chart-testing (install) + run: | + ct install \ + --config ct.yaml \ + --charts helm-charts/infisical-standalone-postgres \ + --helm-extra-args="--timeout=300s" \ + --helm-extra-set-args="--set ingress.nginx.enabled=false --set infisical.autoDatabaseSchemaMigration=false --set infisical.replicaCount=1 --set infisical.image.tag=v0.132.2-postgres" \ + --namespace infisical-standalone-postgres diff --git a/.infisicalignore b/.infisicalignore index 02cdd4f0e..546c67118 100644 --- a/.infisicalignore +++ b/.infisicalignore @@ -40,3 +40,7 @@ cli/detect/config/gitleaks.toml:gcp-api-key:578 cli/detect/config/gitleaks.toml:gcp-api-key:579 cli/detect/config/gitleaks.toml:gcp-api-key:581 cli/detect/config/gitleaks.toml:gcp-api-key:582 +.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml:generic-api-key:51 +.github/workflows/run-helm-chart-tests-infisical-standalone-postgres.yml:generic-api-key:50 +.github/workflows/helm-release-infisical-core.yml:generic-api-key:48 +.github/workflows/helm-release-infisical-core.yml:generic-api-key:47 diff --git a/ct.yaml b/ct.yaml index 4c834ae03..cbc673111 100644 --- a/ct.yaml +++ b/ct.yaml @@ -10,3 +10,5 @@ kube-versions: - v1.33.0 validate-maintainers: false + +kubectl-timeout: 300s diff --git a/helm-charts/infisical-standalone-postgres/values.yaml b/helm-charts/infisical-standalone-postgres/values.yaml index 2bcd0e283..d617a1389 100644 --- a/helm-charts/infisical-standalone-postgres/values.yaml +++ b/helm-charts/infisical-standalone-postgres/values.yaml @@ -5,8 +5,10 @@ nameOverride: "" fullnameOverride: "" infisical: - enabled: true # -- Enable Infisical chart deployment - name: infisical # -- Sets the name of the deployment within this chart + # -- Enable Infisical chart deployment + enabled: true + # -- Sets the name of the deployment within this chart + name: infisical # -- Automatically migrates new database schema when deploying autoDatabaseSchemaMigration: true @@ -67,7 +69,7 @@ infisical: resources: limits: # -- Memory limit for Infisical container - memory: 600Mi + memory: 1000Mi requests: # -- CPU request for Infisical container cpu: 350m From ab78a79415b159e34f48ea54653619a3a4c21663 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 5 Jun 2025 22:25:24 +0800 Subject: [PATCH 3/4] misc: add test workflow for gateway helm --- .github/workflows/release_helm_gateway.yaml | 81 ++++++++++++++++----- 1 file changed, 62 insertions(+), 19 deletions(-) diff --git a/.github/workflows/release_helm_gateway.yaml b/.github/workflows/release_helm_gateway.yaml index 1b067bd73..85f61c4c6 100644 --- a/.github/workflows/release_helm_gateway.yaml +++ b/.github/workflows/release_helm_gateway.yaml @@ -1,27 +1,70 @@ name: Release Gateway Helm Chart on: - workflow_dispatch: + workflow_dispatch: jobs: - release-helm: - name: Release Helm Chart - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 + test-helm: + name: Test Helm Chart + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + fetch-depth: 0 - - name: Install Helm - uses: azure/setup-helm@v3 - with: - version: v3.10.0 + - name: Set up Helm + uses: azure/setup-helm@v4.2.0 + with: + version: v3.17.0 - - name: Install python - uses: actions/setup-python@v4 + - uses: actions/setup-python@v5.3.0 + with: + python-version: "3.x" + check-latest: true - - name: Install Cloudsmith CLI - run: pip install --upgrade cloudsmith-cli + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.7.0 - - name: Build and push helm package to CloudSmith - run: cd helm-charts && sh upload-gateway-cloudsmith.sh - env: - CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} + - name: Run chart-testing (lint) + run: ct lint --config ct.yaml --charts helm-charts/infisical-gateway + + - name: Create kind cluster + uses: helm/kind-action@v1.12.0 + + - name: Create namespace + run: kubectl create namespace infisical-gateway + + - name: Create gateway secret + run: kubectl create secret generic infisical-gateway-environment --from-literal=TOKEN=my-test-token -n infisical-gateway + + - name: Run chart-testing (install) + run: | + ct install \ + --config ct.yaml \ + --charts helm-charts/infisical-gateway \ + --helm-extra-args="--timeout=300s" \ + --namespace infisical-gateway + + release-helm: + name: Release Helm Chart + needs: test-helm + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Install Helm + uses: azure/setup-helm@v3 + with: + version: v3.10.0 + + - name: Install python + uses: actions/setup-python@v4 + + - name: Install Cloudsmith CLI + run: pip install --upgrade cloudsmith-cli + + - name: Build and push helm package to CloudSmith + run: cd helm-charts && sh upload-gateway-cloudsmith.sh + env: + CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }} From 141d0ede2d3a3ab2f253de64023cdbe2b748882c Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Thu, 5 Jun 2025 22:29:54 +0800 Subject: [PATCH 4/4] misc: add pr checks for gateway --- ...run-helm-chart-tests-infisical-gateway.yml | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 .github/workflows/run-helm-chart-tests-infisical-gateway.yml diff --git a/.github/workflows/run-helm-chart-tests-infisical-gateway.yml b/.github/workflows/run-helm-chart-tests-infisical-gateway.yml new file mode 100644 index 000000000..eff42506e --- /dev/null +++ b/.github/workflows/run-helm-chart-tests-infisical-gateway.yml @@ -0,0 +1,49 @@ +name: Run Helm Chart Tests for Gateway +on: + pull_request: + paths: + - "helm-charts/infisical-gateway/**" + - ".github/workflows/run-helm-chart-tests-infisical-gateway.yml" + +jobs: + test-helm: + name: Test Helm Chart + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + fetch-depth: 0 + + - name: Set up Helm + uses: azure/setup-helm@v4.2.0 + with: + version: v3.17.0 + + - uses: actions/setup-python@v5.3.0 + with: + python-version: "3.x" + check-latest: true + + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.7.0 + + - name: Run chart-testing (lint) + run: ct lint --config ct.yaml --charts helm-charts/infisical-gateway + + - name: Create kind cluster + uses: helm/kind-action@v1.12.0 + + - name: Create namespace + run: kubectl create namespace infisical-gateway + + - name: Create gateway secret + run: kubectl create secret generic infisical-gateway-environment --from-literal=TOKEN=my-test-token -n infisical-gateway + + - name: Run chart-testing (install) + run: | + ct install \ + --config ct.yaml \ + --charts helm-charts/infisical-gateway \ + --helm-extra-args="--timeout=300s" \ + --namespace infisical-gateway