fleet/.github/workflows/pr-helm.yaml

name: pr-helm

on:
  pull_request:
    paths:
    - 'charts/**'
    - '.github/workflows/pr-helm.yaml'
    - '.github/scripts/helm-check-expected.sh'
    - 'tools/ci/helm-values/**'

# This allows a subsequently queued workflow run to interrupt previous runs
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
  cancel-in-progress: true

defaults:
  run:
    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
    shell: bash

permissions:
  contents: read

jobs:
  sanity-check:
    strategy:
      matrix:
        kube-version: [1.16.0, 1.17.0, 1.18.0] # kubeval is currently lagging behind the active schema versions, so these are the ones we can test against. see https://github.com/instrumenta/kubernetes-json-schema/issues/26
    runs-on: ubuntu-22.04
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: audit

    - name: checkout
      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      with:
        persist-credentials: false
    - name: create temp dir
      run: mkdir -p helm-temp
    - name: helm dependency build
      run: |
        helm repo add valkey https://valkey.io/valkey-helm/
        helm dependency build charts/fleet
    - name: helm template -- default values
      run: |
        helm template \
          --namespace fleet \
          --release-name fleet \
          --values charts/fleet/values.yaml \
          charts/fleet \
        > helm-temp/output-defaults.yaml
    - name: helm template -- other configurations
      run: |
        VALUES_FILES=$(find tools/ci/helm-values -type f)
        for FILE_PATH in ${VALUES_FILES}; do
          FILE=$(echo ${FILE_PATH} | rev | cut -d"/" -f1 | rev)
          REL_NAME=$(echo ${FILE} | cut -d"." -f1)
          helm template \
            --namespace ${REL_NAME} \
            --release-name ${REL_NAME} \
            --values ${FILE_PATH} \
            charts/fleet \
          > helm-temp/${FILE}
        done
    - name: kubeval sanity check
      uses: instrumenta/kubeval-action@5915e4adba5adccac07cb156b82e54c3fed74921 # master
      with:
        files: helm-temp
        version: ${{ matrix.kube-version }}
    - name: install yq
      env:
        YQ_VERSION: 4.4.1
      run: |
        curl -LO https://github.com/mikefarah/yq/releases/download/v$YQ_VERSION/yq_linux_amd64
        curl -LO https://github.com/mikefarah/yq/releases/download/v$YQ_VERSION/checksums
        echo "$(grep linux_amd64 checksums | awk '{print $19}') yq_linux_amd64" > sha256
        sha256sum --check sha256
        chmod +x yq_linux_amd64
        mkdir -p ${HOME}/.bin
        mv yq_linux_amd64 ${HOME}/.bin/yq
        echo PATH=${PATH}:${HOME}/.bin >> $GITHUB_ENV
    - name: check default values
      run: |
        .github/scripts/helm-check-expected.sh \
        "helm-temp/output-defaults.yaml" \
        'FLEET_FILESYSTEM_STATUS_LOG_FILE FLEET_FILESYSTEM_RESULT_LOG_FILE FLEET_FILESYSTEM_ENABLE_LOG_ROTATION FLEET_FILESYSTEM_ENABLE_LOG_COMPRESSION' \
        'fleet-tls osquery-logs'
    - name: check pubsub values
      run: |
        .github/scripts/helm-check-expected.sh \
        "helm-temp/logger-pubsub.yaml" \
        'FLEET_PUBSUB_PROJECT FLEET_PUBSUB_STATUS_TOPIC FLEET_PUBSUB_RESULT_TOPIC' \
        'fleet-tls'
    - name: check firehose accesskey values
      run: |
        .github/scripts/helm-check-expected.sh \
        "helm-temp/logger-firehose-accesssid.yaml" \
        'FLEET_FIREHOSE_REGION FLEET_FIREHOSE_STATUS_STREAM FLEET_FIREHOSE_RESULT_STREAM FLEET_FIREHOSE_ACCESS_KEY_ID FLEET_FIREHOSE_SECRET_ACCESS_KEY' \
        'fleet-tls'
    - name: check firehose sts values
      run: |
        .github/scripts/helm-check-expected.sh \
        "helm-temp/logger-firehose-sts.yaml" \
        'FLEET_FIREHOSE_REGION FLEET_FIREHOSE_STATUS_STREAM FLEET_FIREHOSE_RESULT_STREAM FLEET_FIREHOSE_STS_ASSUME_ROLE_ARN' \
        'fleet-tls'
    - name: check mysql tls enabled values
      run: |
        .github/scripts/helm-check-expected.sh \
        "helm-temp/enable-mysql-tls.yaml" \
        'FLEET_MYSQL_TLS_CA FLEET_MYSQL_TLS_CERT FLEET_MYSQL_TLS_KEY FLEET_MYSQL_TLS_CONFIG FLEET_MYSQL_TLS_SERVER_NAME' \
        'fleet-tls osquery-logs mysql-tls'
    - name: check scalar environment values and secret override
      run: |
        for KIND in Deployment CronJob; do
          FILE=helm-temp/environments-scalar-values.yaml
          if [ "${KIND}" = "Deployment" ]; then
            ENV_PATH='.spec.template.spec.containers[].env[]'
          else
            ENV_PATH='.spec.jobTemplate.spec.template.spec.containers[].env[]'
          fi
          PRIVATE_KEY_COUNT=$(yq eval-all "[select(.kind == \"${KIND}\") | ${ENV_PATH} | select(.name == \"FLEET_SERVER_PRIVATE_KEY\")] | length" "${FILE}")
          TEST_ZERO=$(yq eval-all "select(.kind == \"${KIND}\") | ${ENV_PATH} | select(.name == \"FLEET_TEST_ZERO\") | .value" "${FILE}")
          TEST_FALSE=$(yq eval-all "select(.kind == \"${KIND}\") | ${ENV_PATH} | select(.name == \"FLEET_TEST_FALSE\") | .value" "${FILE}")
          test "${PRIVATE_KEY_COUNT}" = "1"
          test "${TEST_ZERO}" = "0"
          test "${TEST_FALSE}" = "false"
        done