CI substrate parity: chainsaw cluster = live recipe (Cilium/GW-API/Rollouts), un-skip 9 suites - #7
Closed
konih wants to merge 7 commits into
Closed
CI substrate parity: chainsaw cluster = live recipe (Cilium/GW-API/Rollouts), un-skip 9 suites#7konih wants to merge 7 commits into
konih wants to merge 7 commits into
Conversation
…uster (Cilium+GW-API+local-CA), un-skip 9 suites (TEST-9, SEC-5)
- chainsaw.yaml now creates the kind cluster via hack/cluster/kind-up.sh (the
LIVE substrate recipe: disableDefaultCNI + kubeProxyMode:none, Cilium
1.18.11 + Gateway API v1.2.1 CRDs + LB-IPAM, cert-manager v1.18.2 +
kaddy-local-ca — all versions.env pins). helm/kind-action removed.
- Installs Argo Rollouts (vendored v1.9.0) + the Gateway API trafficRouting
plugin: the pinned v0.16.0 asset arch-rewritten linux-arm64→linux-amd64 at
apply time (runner arch); the live deploy/rollouts/config.yaml stays
byte-identical.
- Applies deploy/gateway/ + clubhouse + clubhouse-tls Certificate +
deploy/workloads/mulligan/ + the default-deny network baseline
(deploy/policies/network/{gateway,monitoring,argocd}).
- Un-skips: gateway (2), security netpol (3), rollouts (3, serialized —
shared mulligan objects), tls/certificate-renewal. Honest-skip annotations
updated (crossplane now blocked ONLY on the Crossplane engine).
- TEST-9: monitoring.yaml (promtool) runs on push to main too.
- SEC-5: ALL workflow action refs pinned to full commit SHAs with version
comments (Renovate-compatible).
… — upstream manifest is namespace-less (Argo CD destination supplies it live)
…lphabetical apply order) + multi-arch showcase image - chainsaw.yaml: kubectl apply -f <dir> walks files alphabetically, so namespace.yaml landed AFTER the namespaced resources -> NotFound. Apply the namespace manifest explicitly first (gateway + mulligan). - showcase-image.yaml: published images (main + v*) build linux/amd64 AND linux/arm64 via QEMU — the live kind node is Apple-silicon arm64 and the amd64-only image failed with 'no match for platform in manifest'. PR builds stay amd64-only (no push). cosign continues to sign the manifest-list digest, covering both arches.
…scovery only loads chainsaw-test.yaml files Latent gap found while un-skipping: 'chainsaw test tests/chainsaw' discovers only files literally named chainsaw-test.yaml, so every per-scenario suite (gateway/security/monitoring/rollouts/tls/crossplane) was silently never executed — in CI or anywhere — even when its skip flag was off. The workflow now runs each Test-bearing file explicitly (same invocation the suites' live-verification annotations document), sequentially. Taskfile follow-up wanted: fold per-scenario discovery into test:chainsaw.
…ions with jmespath in never-executed suites loki-ready, stack-ready and cert-manager-ready asserted a bare status.conditions ARRAY with one element; chainsaw (kyverno-json) compares arrays length-strictly, so any object carrying more than one condition fails with 'lengths of slices don't match' — proven by the first real CI execution (the pod WAS Ready). These tests had never run anywhere (the discovery gap fixed in the previous commit), so the broken idiom was never caught. Fixed to the jmespath filter idiom the repo already uses (root-path-200, labeling): (conditions[?type=='X'].status | [0]): "True" — identical semantics to the tests' stated intent, no assertion weakened. certificate-renewal and clusterissuer-staging keep the bare array: their objects carry exactly one condition (verified live).
…30s default too tight for green pod availability on the loaded CI node
…tor assert — unquoted dashes parse as JMESPath arithmetic, expression could never be true
Contributor
Author
|
Merged to main via ref-push (local-merge workflow); PR was the CI harness — all 5 checks green. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI harness PR only — coordinator merges via ref-push; will be closed after CI is green.
What
hack/cluster/kind-up.sh(the live kaddy-dev recipe: Cilium + Gateway API CRDs + LB-IPAM + cert-manager + kaddy-local-ca, versions.env pins). No hack/cluster changes were needed — the scripts' podman/rootful/loopback guards no-op on the docker Linux runner.Local gates: task verify ✅ · task test:meta:e1e ✅ · actionlint ✅ · shellcheck hack/cluster ✅ · yaml parse ✅