mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-12 02:15:01 +00:00
Add instructions for new helm unittest version (#68682)
* Add instructions for new helm unittest version * Corrected missing verify false flag * Added checksum verification for helm unittest plugin * Helm unittest checksum for entire tarball * Fixed globbing * Added intel mac just in case
This commit is contained in:
Adam Carheden
@@ -26,6 +26,7 @@ jobs:
|
||||
changed:
|
||||
- '.github/workflows/unit-tests-helm.yaml'
|
||||
- 'build.assets/helm-unittest.version'
|
||||
- 'build.assets/helm-unittest.sha256'
|
||||
- 'examples/chart/**'
|
||||
- 'Makefile'
|
||||
- 'docs/pages/reference/helm-reference/*'
|
||||
@@ -58,6 +59,18 @@ jobs:
|
||||
desired_version="${plugin_version#v}"
|
||||
current_version="$(helm plugin list | (grep -P '^unittest\t' || true) | cut -f2)"
|
||||
|
||||
plugin_arch="$(uname -m)"
|
||||
case "$plugin_arch" in
|
||||
x86_64) plugin_arch=amd64 ;;
|
||||
aarch64) plugin_arch=arm64 ;;
|
||||
*) echo "unsupported architecture: $plugin_arch" >&2; exit 1 ;;
|
||||
esac
|
||||
archive_name="helm-unittest-linux-${plugin_arch}-${desired_version}.tgz"
|
||||
if [ -z "$(grep "[[:space:]]${archive_name}$" build.assets/helm-unittest.sha256)" ]; then
|
||||
echo "Helm unittest plugin tarball '${archive_name}' missing from build.assets/helm-unittest.sha256" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Ensure we're running the correct unittest plugin, even if the
|
||||
# buildbox has a different version. Without this, plugin upgrades that
|
||||
# involve breaking changes are impossible -- upgrading the buildbox
|
||||
@@ -66,15 +79,24 @@ jobs:
|
||||
# buildbox doesn't yet have the new version. This solution uses the
|
||||
# buildbox version if it's already at the expected version but
|
||||
# downloads the expected version if it's not.
|
||||
if [ "$current_version" = "$desired_version" ] && [ -d "${HELM_PLUGINS}/helm-unittest" ]; then
|
||||
echo "helm-unittest ${plugin_version} already installed in ${HELM_PLUGINS}; skipping download"
|
||||
if [ "$current_version" = "$desired_version" ] && [ -x "${HELM_PLUGINS}/helm-unittest/untt" ]; then
|
||||
echo "helm-unittest ${plugin_version} already installed in ${HELM_PLUGINS}; skipping download" >&2
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Extract the release archive directly instead of using `helm plugin install`.
|
||||
# The Helm installer executes plugin-provided hooks, which duplicates setup and
|
||||
# would require separately verifying those scripts.
|
||||
mkdir -p "${HELM_PLUGINS}"
|
||||
rm -rf "${HELM_PLUGINS}/helm-unittest"
|
||||
rm -rf "${HELM_PLUGINS}/helm3-unittest"
|
||||
helm plugin install https://github.com/helm-unittest/helm-unittest --version "$plugin_version"
|
||||
mkdir -p "${HELM_PLUGINS}/helm-unittest"
|
||||
curl -fsSL -o "$archive_name" "https://github.com/helm-unittest/helm-unittest/releases/download/${plugin_version}/$archive_name"
|
||||
if ! grep "[[:space:]]${archive_name}$" build.assets/helm-unittest.sha256 | sha256sum -c -; then
|
||||
echo "Checksum verification failed for ${archive_name}. The downloaded archive does not match build.assets/helm-unittest.sha256." >&2
|
||||
exit 2
|
||||
fi
|
||||
tar -xz -f "$archive_name" -C "${HELM_PLUGINS}/helm-unittest"
|
||||
helm plugin list
|
||||
|
||||
- name: Lint helm
|
||||
|
||||
@@ -20,6 +20,11 @@ DOCKER_IMAGE ?= teleport
|
||||
# This directory will be the real path of the directory of the first Makefile in the list.
|
||||
MAKE_DIR := $(dir $(realpath $(firstword $(MAKEFILE_LIST))))
|
||||
HELM_UNITTEST_VERSION := $(shell cat $(MAKE_DIR)/build.assets/helm-unittest.version)
|
||||
HELM_UNITTEST_OS := $(shell if [ "$(shell uname -s)" = Darwin ]; then echo macos; elif [ "$(shell uname -s)" = Linux ]; then echo linux; else echo unsupported; fi)
|
||||
HELM_UNITTEST_ARCH := $(shell if [ "$(shell uname -m)" = x86_64 ]; then echo amd64; elif [ "$(shell uname -m)" = arm64 ] || [ "$(shell uname -m)" = aarch64 ]; then echo arm64; else echo unsupported; fi)
|
||||
HELM_UNITTEST_PLATFORM := $(HELM_UNITTEST_OS)-$(HELM_UNITTEST_ARCH)
|
||||
HELM_UNITTEST_ARCHIVE := helm-unittest-$(HELM_UNITTEST_PLATFORM)-$(HELM_UNITTEST_VERSION:v%=%).tgz
|
||||
HELM_UNITTEST_CHECKSUM_CMD := $(shell if command -v sha256sum >/dev/null 2>&1; then echo sha256sum; else echo 'shasum -a 256'; fi)
|
||||
|
||||
# If set to 1, webassets are not built.
|
||||
WEBASSETS_SKIP_BUILD ?= 0
|
||||
@@ -955,10 +960,43 @@ $(TEST_LOG_DIR):
|
||||
|
||||
.PHONY: helmunit/installed
|
||||
helmunit/installed:
|
||||
@if ! helm unittest -h >/dev/null; then \
|
||||
echo 'Helm unittest plugin is required to test Helm charts. Run `helm plugin install https://github.com/helm-unittest/helm-unittest --version $(HELM_UNITTEST_VERSION)` to install it'; \
|
||||
@if ! grep -q "[[:space:]]$(HELM_UNITTEST_ARCHIVE)$$" build.assets/helm-unittest.sha256; then \
|
||||
echo "No helm-unittest checksum is available for $(HELM_UNITTEST_OS)/$(HELM_UNITTEST_ARCH)." >&2; \
|
||||
exit 1; \
|
||||
fi
|
||||
@if ! command -v helm >/dev/null 2>&1; then \
|
||||
printf '%s\n' \
|
||||
'Helm is required to test Helm charts.' \
|
||||
'' \
|
||||
'Install with Homebrew:' \
|
||||
' brew install helm' \
|
||||
'' \
|
||||
'Or download a static binary (macOS Apple Silicon example):' \
|
||||
' curl -fsSL https://get.helm.sh/helm-v3.12.2-darwin-arm64.tar.gz | tar -xz' \
|
||||
' sudo mv darwin-arm64/helm /usr/local/bin/helm'; \
|
||||
exit 1; \
|
||||
fi
|
||||
@actual="$$(helm plugin list 2>/dev/null | awk '$$1 == "unittest" { print $$2; exit }')"; \
|
||||
required="$(HELM_UNITTEST_VERSION:v%=%)"; \
|
||||
if [ -z "$$actual" ]; then \
|
||||
printf '%s\n' \
|
||||
'Helm unittest plugin is required to test Helm charts. Run:'; \
|
||||
elif [ "$$(printf '%s\n' "$$actual" "$$required" | sort -V | head -n1)" != "$$required" ]; then \
|
||||
printf '%s\n' \
|
||||
"Helm unittest plugin $$actual is too old; version $(HELM_UNITTEST_VERSION) or newer is required." \
|
||||
'Run:'; \
|
||||
else \
|
||||
exit 0; \
|
||||
fi; \
|
||||
printf '%s\n' \
|
||||
'helm-unittest does not provide the plugin signature required for Helm plugin signature verification, so we verify the release archive ourselves when installing:' \
|
||||
' plugin_dir="$${HELM_PLUGINS:-$$HOME/.local/share/helm/plugins}/helm-unittest"' \
|
||||
' rm -rf "$$plugin_dir"' \
|
||||
' mkdir -p "$$plugin_dir"' \
|
||||
' curl -fsSL -o "$(HELM_UNITTEST_ARCHIVE)" https://github.com/helm-unittest/helm-unittest/releases/download/$(HELM_UNITTEST_VERSION)/$(HELM_UNITTEST_ARCHIVE)' \
|
||||
' grep "[[:space:]]$(HELM_UNITTEST_ARCHIVE)$$" build.assets/helm-unittest.sha256 | $(HELM_UNITTEST_CHECKSUM_CMD) -c -' \
|
||||
' tar -xz -f "$(HELM_UNITTEST_ARCHIVE)" -C "$$plugin_dir"'; \
|
||||
exit 1
|
||||
|
||||
# The CI environment is responsible for setting HELM_PLUGINS to a directory where
|
||||
# helm-unittest/helm-unittest is installed.
|
||||
|
||||
+22
-20
@@ -98,9 +98,11 @@ ENV LANGUAGE="en_US.UTF-8" \
|
||||
LC_CTYPE="en_US.UTF-8" \
|
||||
DEBIAN_FRONTEND="noninteractive"
|
||||
|
||||
# BUILDARCH is automatically set by DOCKER when building the image with Build Kit (MacOS by deafult).
|
||||
# https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
|
||||
# BUILDARCH and TARGETARCH are automatically set by Docker when building the
|
||||
# image with BuildKit. See:
|
||||
# https://docs.docker.com/reference/dockerfile/#automatic-platform-args-in-the-global-scope
|
||||
ARG BUILDARCH
|
||||
ARG TARGETARCH
|
||||
|
||||
# Install packages.
|
||||
# Latest git 2.18+ is required for GitHub actions.
|
||||
@@ -264,24 +266,24 @@ RUN mkdir -p helm-tarball && \
|
||||
curl -fsSL https://get.helm.sh/helm-v3.12.2-$(go env GOOS)-$(go env GOARCH).tar.gz | tar -C helm-tarball -xz && \
|
||||
cp helm-tarball/$(go env GOOS)-$(go env GOARCH)/helm /bin/ && \
|
||||
rm -r helm-tarball*
|
||||
COPY helm-unittest.version /tmp/helm-unittest.version
|
||||
# Install the helm-unittest plugin for the ci user. Both consumers --
|
||||
# `make test-helm` (via build.assets/Makefile) and the unit-tests-helm GitHub
|
||||
# workflow -- set HELM_PLUGINS=/home/ci/.local/share/helm/plugins.
|
||||
#
|
||||
# The workflow intentionally re-checks this same path and may reinstall the
|
||||
# pinned plugin version at runtime. Without that, plugin upgrades that involve
|
||||
# breaking changes are impossible -- upgrading the buildbox first fails because
|
||||
# our unittests would break with the new plugin version, but upgrading the
|
||||
# unittests first fails because the buildbox doesn't yet have the new version.
|
||||
# The workflow must therefore ensure the expected version. Installing it here
|
||||
# too means the workflow can short-circuit the download once the buildbox is
|
||||
# updated and republished.
|
||||
RUN helm plugin install https://github.com/helm-unittest/helm-unittest --version "$(cat /tmp/helm-unittest.version)" && \
|
||||
mkdir -p /home/ci/.local/share/helm && \
|
||||
cp -r /root/.local/share/helm/plugins /home/ci/.local/share/helm && \
|
||||
chown -R ci /home/ci/.local/share/helm && \
|
||||
HELM_PLUGINS=/home/ci/.local/share/helm/plugins helm plugin list
|
||||
COPY helm-unittest.sha256 /tmp/helm-unittest.sha256
|
||||
# Extract the release archive directly instead of using `helm plugin install`.
|
||||
# The Helm installer executes plugin-provided hooks, which duplicates setup and
|
||||
# would require separately verifying those scripts.
|
||||
RUN plugin_arch="${TARGETARCH:-$BUILDARCH}" && \
|
||||
archive_name="$(grep "helm-unittest-linux-${plugin_arch}-" /tmp/helm-unittest.sha256 | head -n 1 | awk '{print $2}')" && \
|
||||
test -n "$archive_name" && \
|
||||
plugin_version="${archive_name#helm-unittest-linux-${plugin_arch}-}" && \
|
||||
plugin_version="v${plugin_version%.tgz}" && \
|
||||
test -n "$plugin_version" && \
|
||||
plugin_dir=/home/ci/.local/share/helm/plugins/helm-unittest && \
|
||||
archive=/tmp/$archive_name && \
|
||||
mkdir -p "$plugin_dir" && \
|
||||
curl -fsSL -o "$archive" "https://github.com/helm-unittest/helm-unittest/releases/download/${plugin_version}/helm-unittest-linux-${plugin_arch}-${plugin_version#v}.tgz" && \
|
||||
(cd /tmp && grep "[[:space:]]$archive_name$" helm-unittest.sha256 | sha256sum -c -) && \
|
||||
tar -xz -f "$archive" -C "$plugin_dir" && \
|
||||
rm -f "$archive" && \
|
||||
chown -R ci /home/ci/.local/share/helm
|
||||
|
||||
# Install JS gRPC tools.
|
||||
ARG NODE_GRPC_TOOLS_VERSION # eg, "1.12.4"
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
9761f23d9509c98770c026e019e743b524b57010f4bc29175f78d2582ace0633 helm-unittest-linux-amd64-1.0.3.tgz
|
||||
1e645d96b36582cd8b9fbd53240110267f14d80aa01137341251c60438bbe6b0 helm-unittest-linux-arm64-1.0.3.tgz
|
||||
46413a86ded6bfc70cd704ebac16f8d4a0f36712ae399a5d24e32bc44f96985f helm-unittest-macos-amd64-1.0.3.tgz
|
||||
6a6b67b3f638f015e09c093b67c7609a07101b971a1a6d6a83d1a7f75861a4b2 helm-unittest-macos-arm64-1.0.3.tgz
|
||||
Executable
+36
@@ -0,0 +1,36 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(realpath "$(dirname -- "${BASH_SOURCE[0]}")")"
|
||||
VERSION="$(tr -d '\r\n' < "$SCRIPT_DIR/helm-unittest.version")"
|
||||
VERSION_NUMBER="${VERSION#v}"
|
||||
OUTPUT="$SCRIPT_DIR/helm-unittest.sha256"
|
||||
TEMP_DIR="$(mktemp -d)"
|
||||
trap 'rm -rf "$TEMP_DIR"' EXIT
|
||||
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
CHECKSUM_CMD=(sha256sum)
|
||||
elif command -v shasum >/dev/null 2>&1; then
|
||||
CHECKSUM_CMD=(shasum -a 256)
|
||||
else
|
||||
echo "Neither sha256sum nor shasum is available" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
download() {
|
||||
local platform="$1"
|
||||
local archive="helm-unittest-${platform}-${VERSION_NUMBER}.tgz"
|
||||
local path="$TEMP_DIR/$archive"
|
||||
|
||||
(set -x; curl -fsSL -o "$path" \
|
||||
"https://github.com/helm-unittest/helm-unittest/releases/download/${VERSION}/${archive}")
|
||||
|
||||
}
|
||||
|
||||
download linux-amd64
|
||||
download linux-arm64
|
||||
download macos-arm64
|
||||
download macos-amd64
|
||||
|
||||
cd "$TEMP_DIR"
|
||||
(set -x; "${CHECKSUM_CMD[@]}" -- *.tgz) > "${OUTPUT}"
|
||||
Reference in New Issue
Block a user