mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
Saurabh Agarwal
5007042e79
* feat(helm): add optional PostgreSQL backing store with Secret-based credentials - Add postgres.enabled and postgres.deploy values to control database backend (SQLite vs PostgreSQL) and subchart deployment independently. - Introduce db-secret.yaml template for Opaque Secret with assembled postgresql:// connection string injected via OPENSHELL_DB_URL env var. - Add Bitnami PostgreSQL as optional subchart dependency keyed on postgres.deploy to prevent subchart deployment in external mode. - Externalize JWT signing key file mode via sandboxJwt.secretDefaultMode with 0400 default matching upstream. - Add validation guard for postgres.deploy=true without postgres.enabled. - Add helm unit tests covering internal, external, URL-override, special character encoding, and misconfiguration error paths. - Update README with Kubernetes and OpenShift install examples for bundled and external PostgreSQL configurations. - Add helm dependency build to lint and unittest tasks. * fix(helm): add database backend docs to README.md.gotmpl and regenerate The helm-docs CI check failed because the Database backend section was added directly to README.md instead of README.md.gotmpl. Move the content to the template and regenerate so the check passes. * fix(helm): use Secret-based DB credentials and support existingSecret Replace the inline db-url stringData pattern with a proper Secret containing individual fields plus a uri key. When postgres.deploy=true the Bitnami service-binding secret is referenced directly; when deploy=false users can supply postgres.external.existingSecret to bring their own Secret, or let the chart generate one from the external field values. Also restructures the README database section for clarity, adds helm-unittest coverage for the new secret resolution paths, and fixes a markdown lint issue in the root README. * refactor(helm): move OpenShift e2e script to e2e/rust/ and add mise task Move test-openshift-scenarios.sh from deploy/helm/openshell/ci/ to e2e/rust/e2e-openshift.sh, matching the existing e2e script naming convention. Register it as `e2e:openshift` in tasks/test.toml — not wired into the `test` or `e2e` aggregates so it only runs on explicit invocation against a live OpenShift cluster. * feat(e2e): add database backend scenarios to Kubernetes e2e Extend with-kube-gateway.sh with an optional multi-scenario loop gated by OPENSHELL_E2E_KUBE_DB_SCENARIOS=1. When enabled, the script installs the Helm chart three times — SQLite (default), bundled PostgreSQL, and external PostgreSQL with existingSecret — running the full test suite against each backend. When unset, existing single-install behavior is unchanged. Also adds helm dependency build before helm install, fixing CI failures caused by the missing PostgreSQL subchart dependency. * refactor(helm): simplify PostgreSQL config to two orthogonal controls Replace postgres.deploy and postgres.external.* with two simple controls: - postgres.enabled: deploy the bundled Bitnami PostgreSQL subchart - server.externalDbSecret: name of a pre-existing Secret with a uri key Delete db-secret.yaml — the chart no longer generates Secrets from individual credential fields. Users either get the Bitnami service-binding secret (bundled) or bring their own via server.externalDbSecret. Add validation that postgres.serviceBindings.enabled must stay true when using bundled PostgreSQL, preventing a confusing runtime failure.
105 lines
3.4 KiB
TOML
105 lines
3.4 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Helm chart tasks
|
|
|
|
["helm:docs"]
|
|
description = "Generate the openshell Helm chart README from Chart.yaml, values.yaml, and README.md.gotmpl"
|
|
run = "helm-docs --chart-search-root deploy/helm/openshell"
|
|
|
|
["helm:docs:check"]
|
|
description = "Verify the openshell Helm chart README is generated and up to date"
|
|
run = """
|
|
set -e
|
|
tmp="$(mktemp)"
|
|
trap 'rm -f "$tmp"' EXIT
|
|
|
|
helm-docs --chart-search-root deploy/helm/openshell --dry-run > "$tmp"
|
|
if ! diff -u deploy/helm/openshell/README.md "$tmp"; then
|
|
echo "Helm chart README is out of sync. Run: mise run helm:docs" >&2
|
|
exit 1
|
|
fi
|
|
"""
|
|
hide = true
|
|
|
|
["helm:lint"]
|
|
description = "Lint the openshell Helm chart (defaults + all CI configuration variants)"
|
|
run = """
|
|
set -e
|
|
helm dependency build deploy/helm/openshell
|
|
echo "--- helm lint: defaults ---"
|
|
echo "values files: deploy/helm/openshell/values.yaml"
|
|
helm lint deploy/helm/openshell
|
|
for f in deploy/helm/openshell/ci/values-*.yaml; do
|
|
variant=$(basename "$f" .yaml | sed 's/values-//')
|
|
echo "--- helm lint: $variant ---"
|
|
echo "values files: deploy/helm/openshell/values.yaml, $f"
|
|
helm lint deploy/helm/openshell -f "$f"
|
|
done
|
|
echo "All variants passed."
|
|
"""
|
|
|
|
["helm:test"]
|
|
description = "Run Helm chart unit tests"
|
|
run = """
|
|
set -e
|
|
if ! helm plugin list | grep -q unittest; then
|
|
helm plugin install https://github.com/helm-unittest/helm-unittest --verify=false
|
|
fi
|
|
helm dependency build deploy/helm/openshell
|
|
helm unittest deploy/helm/openshell
|
|
"""
|
|
|
|
["helm:skaffold:dev"]
|
|
description = "Run skaffold dev for deploy/helm/openshell (iterative deploy)"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold dev"
|
|
|
|
["helm:skaffold:run"]
|
|
description = "Run skaffold run for deploy/helm/openshell (one-shot deploy)"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold run"
|
|
|
|
["helm:skaffold:delete"]
|
|
description = "Run skaffold delete for deploy/helm/openshell"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold delete"
|
|
|
|
["helm:skaffold:diagnose"]
|
|
description = "Run skaffold diagnose for deploy/helm/openshell"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold diagnose"
|
|
hide = true
|
|
|
|
# Local k3s via k3d (Docker required). macOS gets k3d from mise; Linux users
|
|
# should install k3d explicitly or point workflows at an existing/kind cluster.
|
|
|
|
["helm:k3s:create"]
|
|
description = "Create a local k3s cluster with k3d and merge kubeconfig (macOS via mise; Linux requires explicit k3d install; use with helm:skaffold:dev)"
|
|
run = "tasks/scripts/helm-k3s-local.sh create"
|
|
|
|
["helm:k3s:delete"]
|
|
description = "Delete the local k3d cluster created by helm:k3s:create"
|
|
run = "tasks/scripts/helm-k3s-local.sh delete"
|
|
|
|
["helm:k3s:start"]
|
|
description = "Start the local k3d cluster (after helm:k3s:stop)"
|
|
run = "tasks/scripts/helm-k3s-local.sh start"
|
|
hide = true
|
|
|
|
["helm:k3s:stop"]
|
|
description = "Stop the local k3d cluster without deleting it"
|
|
run = "tasks/scripts/helm-k3s-local.sh stop"
|
|
hide = true
|
|
|
|
["helm:k3s:status"]
|
|
description = "List local k3d clusters"
|
|
run = "tasks/scripts/helm-k3s-local.sh status"
|
|
hide = true
|
|
|
|
# Install Envoy Gateway's GatewayClass into the cluster
|
|
|
|
["helm:gateway:apply"]
|
|
description = "Apply the Envoy GatewayClass manifest (run after helm:skaffold:run when gateway routing is enabled)"
|
|
run = "kubectl apply -f deploy/kube/manifests/envoy-gateway-openshell.yaml"
|