Prepare v6.2.1 emergency patch release #140
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Helm CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "deploy/helm/**" | |
| - ".github/workflows/helm-ci.yml" | |
| - "docs/KUBERNETES.md" | |
| - "README.md" | |
| pull_request: | |
| paths: | |
| - "deploy/helm/**" | |
| - ".github/workflows/helm-ci.yml" | |
| - "docs/KUBERNETES.md" | |
| - "README.md" | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| name: Lint and Render Chart | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0 | |
| with: | |
| version: v3.15.2 | |
| - name: Helm lint (strict) | |
| run: helm lint deploy/helm/pulse --strict | |
| - name: Render default manifests | |
| run: helm template pulse deploy/helm/pulse > /tmp/pulse-rendered.yaml | |
| - name: Render agent-enabled manifests | |
| run: | | |
| helm template pulse deploy/helm/pulse \ | |
| --set agent.enabled=true \ | |
| --set agent.kind=Deployment \ | |
| --set agent.secretEnv.create=true \ | |
| --set agent.secretEnv.data.PULSE_TOKEN=dummy-token \ | |
| --set server.secretEnv.create=true \ | |
| --set server.secretEnv.data.API_TOKENS=dummy-token \ | |
| --set persistence.enabled=false \ | |
| > /tmp/pulse-agent-rendered.yaml | |
| - name: Render and verify the OpenShift profile | |
| run: | | |
| helm template pulse deploy/helm/pulse \ | |
| --namespace pulse \ | |
| --set openShift.enabled=true \ | |
| --set openShift.kubernetesAgent.enabled=true \ | |
| --set agent.secretEnv.create=true \ | |
| --set agent.secretEnv.data.PULSE_TOKEN=dummy-token \ | |
| --set persistence.enabled=false \ | |
| --show-only templates/deployment.yaml \ | |
| --show-only templates/agent.yaml \ | |
| --show-only templates/agent-serviceaccount.yaml \ | |
| --show-only templates/agent-rbac.yaml \ | |
| > /tmp/pulse-openshift-rendered.yaml | |
| grep -q -- "--enable-kubernetes" /tmp/pulse-openshift-rendered.yaml | |
| grep -q "PULSE_AGENT_ID" /tmp/pulse-openshift-rendered.yaml | |
| grep -q "kind: ClusterRole" /tmp/pulse-openshift-rendered.yaml | |
| grep -q "kind: ClusterRoleBinding" /tmp/pulse-openshift-rendered.yaml | |
| grep -q "runAsNonRoot: true" /tmp/pulse-openshift-rendered.yaml | |
| if grep -q "/var/run/docker.sock" /tmp/pulse-openshift-rendered.yaml; then | |
| echo "OpenShift profile must not mount the Docker socket" >&2 | |
| exit 1 | |
| fi | |
| if grep -Eq "runAs(User|Group):|fsGroup:" /tmp/pulse-openshift-rendered.yaml; then | |
| echo "OpenShift profile must let the SCC assign UID/GID/fsGroup" >&2 | |
| exit 1 | |
| fi |