mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Dhiraj Bokde
cc4ded2088
* feat(helm): split gateway and workspace charts Signed-off-by: Dhiraj Bokde <dbokde@nvidia.com> * fix(helm): preserve split chart upgrade compatibility Keep workspace manifests valid after value validation and default legacy reused values to the combined resource topology. * fix(ci): preserve VM runtime for E2E The Rust cache restores target/ after VM runtime artifacts are staged, overwriting target/vm-runtime-compressed before openshell-driver-vm is built. Stage the compressed runtime outside target and pass that location through OPENSHELL_VM_RUNTIME_COMPRESSED_DIR so build.rs can embed the supervisor. Also locate the Helm split-ownership test repository root from the script path rather than git rev-parse. The test runs in a container where the GitHub checkout can be owned by a different UID and rejected as dubious ownership. Signed-off-by: Dhiraj Bokde <dbokde@nvidia.com> * fix(ci): install yq for Helm ownership test The split-chart ownership regression uses yq to inspect rendered YAML, but the Helm CI container installs only tools declared in mise. Declare and lock yq so mise install --locked provides the test dependency. Signed-off-by: Dhiraj Bokde <dbokde@nvidia.com> --------- Signed-off-by: Dhiraj Bokde <dbokde@nvidia.com>
67 lines
2.4 KiB
Bash
Executable File
67 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
set -euo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
|
|
work_dir="$(mktemp -d)"
|
|
trap 'rm -rf "${work_dir}"' EXIT
|
|
|
|
helm template openshell "${repo_root}/deploy/helm/openshell" \
|
|
--namespace openshell \
|
|
--set agentSandbox.preflight.enabled=false \
|
|
--set workspaceResources.enabled=false \
|
|
>"${work_dir}/gateway.yaml"
|
|
|
|
if yq ea -e \
|
|
'select(.kind == "Role" and .metadata.name == "openshell-sandbox")' \
|
|
"${work_dir}/gateway.yaml" >/dev/null 2>&1; then
|
|
echo "gateway chart rendered workspace resources despite workspaceResources.enabled=false" >&2
|
|
exit 1
|
|
fi
|
|
|
|
helm template openshell-workspace "${repo_root}/deploy/helm/openshell-workspace" \
|
|
--namespace app-a \
|
|
--set gateway.serviceAccount.name=openshell \
|
|
--set gateway.serviceAccount.namespace=openshell \
|
|
>"${work_dir}/workspace.yaml"
|
|
|
|
invalid_workspace_docs="$(
|
|
yq ea -N -r \
|
|
'select(. != null and (.apiVersion == null or .kind == null)) | document_index' \
|
|
"${work_dir}/workspace.yaml"
|
|
)"
|
|
if [[ -n "${invalid_workspace_docs}" ]]; then
|
|
echo "workspace chart rendered documents without apiVersion or kind: ${invalid_workspace_docs}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
helm template openshell "${repo_root}/deploy/helm/openshell" \
|
|
--namespace openshell \
|
|
--set agentSandbox.preflight.enabled=false \
|
|
--set-json workspaceResources=null \
|
|
>"${work_dir}/legacy-reuse-values.yaml"
|
|
|
|
yq ea -e \
|
|
'select(.kind == "Role" and .metadata.name == "openshell-sandbox") |
|
|
.apiVersion == "rbac.authorization.k8s.io/v1"' \
|
|
"${work_dir}/legacy-reuse-values.yaml" >/dev/null
|
|
|
|
yq ea -N -r \
|
|
'select(.kind != null) | [.apiVersion, .kind, (.metadata.namespace // "openshell"), .metadata.name] | @tsv' \
|
|
"${work_dir}/gateway.yaml" | sort -u >"${work_dir}/gateway.objects"
|
|
yq ea -N -r \
|
|
'select(.kind != null) | [.apiVersion, .kind, (.metadata.namespace // "app-a"), .metadata.name] | @tsv' \
|
|
"${work_dir}/workspace.yaml" | sort -u >"${work_dir}/workspace.objects"
|
|
|
|
comm -12 "${work_dir}/gateway.objects" "${work_dir}/workspace.objects" \
|
|
>"${work_dir}/overlap.objects"
|
|
if [[ -s "${work_dir}/overlap.objects" ]]; then
|
|
echo "gateway and workspace charts claim the same Kubernetes objects:" >&2
|
|
cat "${work_dir}/overlap.objects" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "gateway and workspace chart object ownership is disjoint"
|