Introduce experimental chart release (#4373)

charts/gha-runner-scale-set-controller-experimental/tests/controller_deployment_args_test.yaml

@@ -0,0 +1,75 @@
+suite: "Controller Deployment args"
+templates:
+  - deployment.yaml
+tests:
+  - it: should include metrics-disabled flags by default
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--metrics-addr=0"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--listener-metrics-addr=0"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--listener-metrics-endpoint="
+
+  - it: should include watch-single-namespace flag when configured
+    set:
+      controller:
+        manager:
+          config:
+            watchSingleNamespace: "demo"
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--watch-single-namespace=demo"
+
+  - it: should include exclude-label-propagation-prefix flags when configured
+    set:
+      controller:
+        manager:
+          config:
+            excludeLabelPropagationPrefixes:
+              - "prefix.com/"
+              - "complete.io/label"
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--exclude-label-propagation-prefix=prefix.com/"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--exclude-label-propagation-prefix=complete.io/label"
+
+  - it: should render metrics port when metrics are enabled
+    set:
+      controller:
+        metrics:
+          controllerManagerAddr: ":8080"
+          listenerAddr: ":8081"
+          listenerEndpoint: "/metrics"
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].ports[0].containerPort
+          value: 8080
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--metrics-addr=:8080"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--listener-metrics-addr=:8081"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--listener-metrics-endpoint=/metrics"

charts/gha-runner-scale-set-controller-experimental/tests/controller_deployment_env_test.yaml

@@ -0,0 +1,46 @@
+suite: "Controller Deployment env"
+templates:
+  - deployment.yaml
+tests:
+  - it: should not render envFrom in manager container
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - notExists:
+          path: spec.template.spec.containers[0].envFrom
+      - notExists:
+          path: spec.template.spec.containers[0].ports
+
+  - it: should include extra env entries from values
+    set:
+      controller:
+        manager:
+          container:
+            env:
+              - name: "FOO"
+                value: "bar"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: "FOO"
+            value: "bar"
+
+  - it: should enable leader election when replicaCount > 1
+    set:
+      controller:
+        replicaCount: 2
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--enable-leader-election"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--leader-election-id=test-name-gha-rs-controller"

charts/gha-runner-scale-set-controller-experimental/tests/controller_deployment_extra_containers_test.yaml

@@ -0,0 +1,55 @@
+suite: "Controller Deployment extra containers"
+templates:
+  - deployment.yaml
+tests:
+  - it: should render manager container first and then extra containers
+    set:
+      controller:
+        pod:
+          spec:
+            containers:
+              - name: "sidecar"
+                image: "busybox:1.36"
+                command:
+                  - "sh"
+                  - "-c"
+                args:
+                  - "echo hello && sleep 3600"
+              - name: "another"
+                image: "alpine:3.19"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].name
+          value: "manager"
+      - equal:
+          path: spec.template.spec.containers[1].name
+          value: "sidecar"
+      - equal:
+          path: spec.template.spec.containers[1].image
+          value: "busybox:1.36"
+      - equal:
+          path: spec.template.spec.containers[1].command[0]
+          value: "sh"
+      - equal:
+          path: spec.template.spec.containers[1].args[0]
+          value: "echo hello && sleep 3600"
+      - equal:
+          path: spec.template.spec.containers[2].name
+          value: "another"
+      - equal:
+          path: spec.template.spec.containers[2].image
+          value: "alpine:3.19"
+
+  - it: should not fail when extra containers are unset
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].name
+          value: "manager"
+      - notExists:
+          path: spec.template.spec.containers[1]

charts/gha-runner-scale-set-controller-experimental/tests/controller_deployment_imagepullsecrets_test.yaml

@@ -0,0 +1,33 @@
+suite: "Controller Deployment imagePullSecrets"
+templates:
+  - deployment.yaml
+tests:
+  - it: should not render imagePullSecrets by default
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - notExists:
+          path: spec.template.spec.imagePullSecrets
+
+  - it: should render imagePullSecrets and forward them as args when configured
+    set:
+      imagePullSecrets:
+        - name: regcred
+        - name: another
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: spec.template.spec.imagePullSecrets[0].name
+          value: regcred
+      - equal:
+          path: spec.template.spec.imagePullSecrets[1].name
+          value: another
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--auto-scaler-image-pull-secrets=regcred"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--auto-scaler-image-pull-secrets=another"

charts/gha-runner-scale-set-controller-experimental/tests/controller_deployment_pod_extra_fields_test.yaml

@@ -0,0 +1,54 @@
+suite: "Controller Deployment pod extra fields"
+templates:
+  - deployment.yaml
+tests:
+  - it: should render extra pod spec fields from controller.pod
+    set:
+      controller:
+        pod:
+          spec:
+            nodeSelector:
+              kubernetes.io/os: linux
+            tolerations:
+              - key: "dedicated"
+                operator: "Equal"
+                value: "arc"
+                effect: "NoSchedule"
+            hostNetwork: true
+            dnsPolicy: "ClusterFirstWithHostNet"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: spec.template.spec.nodeSelector["kubernetes.io/os"]
+          value: "linux"
+      - equal:
+          path: spec.template.spec.tolerations[0].key
+          value: "dedicated"
+      - equal:
+          path: spec.template.spec.tolerations[0].value
+          value: "arc"
+      - equal:
+          path: spec.template.spec.hostNetwork
+          value: true
+      - equal:
+          path: spec.template.spec.dnsPolicy
+          value: "ClusterFirstWithHostNet"
+
+  - it: should not allow overriding serviceAccountName via controller.pod
+    set:
+      controller:
+        pod:
+          spec:
+            serviceAccountName: "hacker-sa"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: "test-name-gha-rs-controller"
+      - notEqual:
+          path: spec.template.spec.serviceAccountName
+          value: "hacker-sa"

charts/gha-runner-scale-set-controller-experimental/tests/controller_deployment_smoke_test.yaml

@@ -0,0 +1,27 @@
+suite: "Controller Deployment smoke"
+templates:
+  - deployment.yaml
+tests:
+  - it: should render deployment basics
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: apiVersion
+          value: "apps/v1"
+      - equal:
+          path: kind
+          value: "Deployment"
+      - equal:
+          path: metadata.name
+          value: "test-name-gha-rs-controller"
+      - equal:
+          path: metadata.namespace
+          value: "test-namespace"
+      - equal:
+          path: spec.template.spec.containers[0].name
+          value: "manager"
+      - contains:
+          path: spec.template.spec.containers[0].command
+          content: "/manager"

charts/gha-runner-scale-set-controller-experimental/tests/controller_deployment_volume_mounts_test.yaml

@@ -0,0 +1,25 @@
+suite: "Controller Deployment volume mounts"
+templates:
+  - deployment.yaml
+tests:
+  - it: should append controller.pod.volumeMounts to manager container
+    set:
+      controller:
+        manager:
+          container:
+            image: "ghcr.io/actions/gha-runner-scale-set-controller:latest"
+        pod:
+          volumeMounts:
+            - name: my-config
+              mountPath: /etc/my-config
+              readOnly: true
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].volumeMounts
+          content:
+            name: my-config
+            mountPath: /etc/my-config
+            readOnly: true

charts/gha-runner-scale-set-controller-experimental/tests/controller_deployment_volumes_test.yaml

@@ -0,0 +1,26 @@
+suite: "Controller Deployment volumes"
+templates:
+  - deployment.yaml
+tests:
+  - it: should append controller.pod.spec.volumes to pod spec volumes
+    set:
+      controller:
+        manager:
+          container:
+            image: "ghcr.io/actions/gha-runner-scale-set-controller:latest"
+        pod:
+          spec:
+            volumes:
+              - name: my-config
+                configMap:
+                  name: my-config
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - contains:
+          path: spec.template.spec.volumes
+          content:
+            name: my-config
+            configMap:
+              name: my-config

charts/gha-runner-scale-set-controller-experimental/tests/controller_manager_clusterrolebinding_test.yaml

@@ -0,0 +1,37 @@
+suite: "Controller Manager ClusterRoleBinding"
+templates:
+  - manager_cluster_role_binding.yaml
+tests:
+  - it: should render when watchSingleNamespace is empty
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: apiVersion
+          value: "rbac.authorization.k8s.io/v1"
+      - equal:
+          path: kind
+          value: "ClusterRoleBinding"
+      - equal:
+          path: subjects[0].kind
+          value: "ServiceAccount"
+      - equal:
+          path: subjects[0].name
+          value: "test-name-gha-rs-controller"
+      - equal:
+          path: subjects[0].namespace
+          value: "test-namespace"
+
+  - it: should not render when watchSingleNamespace is set
+    set:
+      controller:
+        manager:
+          config:
+            watchSingleNamespace: "my-ns"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - hasDocuments:
+          count: 0

charts/gha-runner-scale-set-controller-experimental/tests/controller_namespace_override_test.yaml

@@ -0,0 +1,24 @@
+suite: "Controller namespaceOverride"
+templates:
+  - deployment.yaml
+  - serviceaccount.yaml
+tests:
+  - it: should apply namespaceOverride to deployment and serviceaccount
+    set:
+      namespaceOverride: "override-ns"
+    release:
+      name: "test-name"
+      namespace: "release-ns"
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "override-ns"
+        template: deployment.yaml
+      - equal:
+          path: metadata.labels["actions.github.com/controller-service-account-namespace"]
+          value: "override-ns"
+        template: deployment.yaml
+      - equal:
+          path: metadata.namespace
+          value: "override-ns"
+        template: serviceaccount.yaml

charts/gha-runner-scale-set-controller-experimental/tests/controller_rbac_clusterrole_test.yaml

@@ -0,0 +1,38 @@
+suite: "Controller RBAC cluster"
+templates:
+  - manager_cluster_role.yaml
+tests:
+  - it: should render manager ClusterRole when watchSingleNamespace is empty
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - equal:
+          path: kind
+          value: "ClusterRole"
+      - equal:
+          path: metadata.name
+          value: "test-arc-gha-rs-controller"
+      - contains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
+              - pods
+            verbs:
+              - list
+              - watch
+
+  - it: should not render manager ClusterRole when watchSingleNamespace is set
+    set:
+      controller:
+        manager:
+          config:
+            watchSingleNamespace: "demo"
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - hasDocuments:
+          count: 0

charts/gha-runner-scale-set-controller-experimental/tests/controller_rbac_leader_election_test.yaml

@@ -0,0 +1,52 @@
+suite: "Controller RBAC leader election"
+templates:
+  - leader_election_role.yaml
+  - leader_election_role_binding.yaml
+tests:
+  - it: should not render leader election resources when replicaCount is 1
+    set:
+      controller:
+        replicaCount: 1
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - hasDocuments:
+          count: 0
+        template: leader_election_role.yaml
+      - hasDocuments:
+          count: 0
+        template: leader_election_role_binding.yaml
+
+  - it: should render leader election resources when replicaCount > 1
+    set:
+      controller:
+        replicaCount: 2
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - equal:
+          path: kind
+          value: "Role"
+        template: leader_election_role.yaml
+      - equal:
+          path: metadata.name
+          value: "test-arc-gha-rs-controller-leader-election"
+        template: leader_election_role.yaml
+      - equal:
+          path: metadata.namespace
+          value: "test-ns"
+        template: leader_election_role.yaml
+      - equal:
+          path: kind
+          value: "RoleBinding"
+        template: leader_election_role_binding.yaml
+      - equal:
+          path: roleRef.name
+          value: "test-arc-gha-rs-controller-leader-election"
+        template: leader_election_role_binding.yaml
+      - equal:
+          path: subjects[0].name
+          value: "test-arc-gha-rs-controller"
+        template: leader_election_role_binding.yaml

charts/gha-runner-scale-set-controller-experimental/tests/controller_rbac_listener_role_test.yaml

@@ -0,0 +1,68 @@
+suite: "Controller RBAC listener"
+templates:
+  - manager_listener_role.yaml
+  - manager_listener_role_binding.yaml
+tests:
+  - it: should render listener role with expected rules
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - equal:
+          path: kind
+          value: "Role"
+        template: manager_listener_role.yaml
+      - equal:
+          path: metadata.name
+          value: "test-arc-gha-rs-controller-listener"
+        template: manager_listener_role.yaml
+      - equal:
+          path: metadata.namespace
+          value: "test-ns"
+        template: manager_listener_role.yaml
+      - equal:
+          path: rules[0].resources[0]
+          value: "pods"
+        template: manager_listener_role.yaml
+      - equal:
+          path: rules[1].resources[0]
+          value: "pods/status"
+        template: manager_listener_role.yaml
+      - equal:
+          path: rules[2].resources[0]
+          value: "secrets"
+        template: manager_listener_role.yaml
+      - equal:
+          path: rules[3].resources[0]
+          value: "serviceaccounts"
+        template: manager_listener_role.yaml
+
+  - it: should bind listener role to controller serviceaccount
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - equal:
+          path: kind
+          value: "RoleBinding"
+        template: manager_listener_role_binding.yaml
+      - equal:
+          path: metadata.name
+          value: "test-arc-gha-rs-controller-listener"
+        template: manager_listener_role_binding.yaml
+      - equal:
+          path: metadata.namespace
+          value: "test-ns"
+        template: manager_listener_role_binding.yaml
+      - equal:
+          path: roleRef.name
+          value: "test-arc-gha-rs-controller-listener"
+        template: manager_listener_role_binding.yaml
+      - equal:
+          path: subjects[0].name
+          value: "test-arc-gha-rs-controller"
+        template: manager_listener_role_binding.yaml
+      - equal:
+          path: subjects[0].namespace
+          value: "test-ns"
+        template: manager_listener_role_binding.yaml

charts/gha-runner-scale-set-controller-experimental/tests/controller_rbac_single_namespace_test.yaml

@@ -0,0 +1,56 @@
+suite: "Controller RBAC single-namespace mode"
+templates:
+  - manager_single_namespace_controller_role.yaml
+  - manager_single_namespace_controller_role_binding.yaml
+  - manager_single_namespace_watch_role.yaml
+  - manager_single_namespace_watch_role_binding.yaml
+tests:
+  - it: should not render single-namespace roles when watchSingleNamespace is empty
+    set:
+      controller:
+        manager:
+          config:
+            watchSingleNamespace: ""
+    release:
+      name: "test-arc"
+      namespace: "test-ns"
+    asserts:
+      - hasDocuments:
+          count: 0
+        template: manager_single_namespace_controller_role.yaml
+      - hasDocuments:
+          count: 0
+        template: manager_single_namespace_controller_role_binding.yaml
+      - hasDocuments:
+          count: 0
+        template: manager_single_namespace_watch_role.yaml
+      - hasDocuments:
+          count: 0
+        template: manager_single_namespace_watch_role_binding.yaml
+
+  - it: should render roles in controller namespace and watch namespace
+    set:
+      controller:
+        manager:
+          config:
+            watchSingleNamespace: "demo"
+    release:
+      name: "test-arc"
+      namespace: "ctrl-ns"
+    asserts:
+      - equal:
+          path: metadata.namespace
+          value: "ctrl-ns"
+        template: manager_single_namespace_controller_role.yaml
+      - equal:
+          path: metadata.namespace
+          value: "ctrl-ns"
+        template: manager_single_namespace_controller_role_binding.yaml
+      - equal:
+          path: metadata.namespace
+          value: "demo"
+        template: manager_single_namespace_watch_role.yaml
+      - equal:
+          path: metadata.namespace
+          value: "demo"
+        template: manager_single_namespace_watch_role_binding.yaml

charts/gha-runner-scale-set-controller-experimental/tests/controller_serviceaccount_create_toggle_test.yaml

@@ -0,0 +1,46 @@
+suite: "Controller serviceAccount.create toggle"
+templates:
+  - serviceaccount.yaml
+  - deployment.yaml
+tests:
+  - it: should create ServiceAccount and use it in Deployment when create is true
+    set:
+      controller:
+        manager:
+          container:
+            image: "ghcr.io/actions/gha-runner-scale-set-controller:latest"
+        serviceAccount:
+          create: true
+          name: ""
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - hasDocuments:
+          count: 1
+        template: serviceaccount.yaml
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: "test-name-gha-rs-controller"
+        template: deployment.yaml
+
+  - it: should not create ServiceAccount and use provided name in Deployment when create is false
+    set:
+      controller:
+        manager:
+          container:
+            image: "ghcr.io/actions/gha-runner-scale-set-controller:latest"
+        serviceAccount:
+          create: false
+          name: "existing-sa"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - hasDocuments:
+          count: 0
+        template: serviceaccount.yaml
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: "existing-sa"
+        template: deployment.yaml

charts/gha-runner-scale-set-controller-experimental/tests/controller_serviceaccount_test.yaml

@@ -0,0 +1,72 @@
+suite: "Controller ServiceAccount"
+templates:
+  - serviceaccount.yaml
+tests:
+  - it: should render serviceaccount by default
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: apiVersion
+          value: "v1"
+      - equal:
+          path: kind
+          value: "ServiceAccount"
+      - equal:
+          path: metadata.name
+          value: "test-name-gha-rs-controller"
+      - equal:
+          path: metadata.namespace
+          value: "test-namespace"
+      - equal:
+          path: metadata.labels["actions.github.com/controller-service-account-name"]
+          value: "test-name-gha-rs-controller"
+      - equal:
+          path: metadata.labels["actions.github.com/controller-service-account-namespace"]
+          value: "test-namespace"
+
+  - it: should allow overriding serviceAccount.name when create is true
+    set:
+      controller:
+        serviceAccount:
+          create: true
+          name: "overwritten-name"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: metadata.name
+          value: "overwritten-name"
+      - equal:
+          path: metadata.labels["actions.github.com/controller-service-account-name"]
+          value: "overwritten-name"
+
+  - it: should render serviceAccount annotations
+    set:
+      controller:
+        serviceAccount:
+          create: true
+          annotations:
+            foo: bar
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - equal:
+          path: metadata.annotations.foo
+          value: "bar"
+
+  - it: should not render when serviceAccount.create is false
+    set:
+      controller:
+        serviceAccount:
+          create: false
+          name: "existing-sa"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - hasDocuments:
+          count: 0

charts/gha-runner-scale-set-controller-experimental/tests/controller_serviceaccount_validation_test.yaml

@@ -0,0 +1,32 @@
+suite: "Controller ServiceAccount validation"
+templates:
+  - serviceaccount.yaml
+  - deployment.yaml
+tests:
+  - it: should fail if serviceAccount.name is 'default'
+    set:
+      controller:
+        serviceAccount:
+          create: true
+          name: "default"
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - failedTemplate:
+          errorMessage: "serviceAccount.name cannot be set to 'default'"
+        template: serviceaccount.yaml
+
+  - it: should fail when serviceAccount.create is false and name is not set
+    set:
+      controller:
+        serviceAccount:
+          create: false
+          name: ""
+    release:
+      name: "test-name"
+      namespace: "test-namespace"
+    asserts:
+      - failedTemplate:
+          errorMessage: "serviceAccount.name must be set if serviceAccount.create is false"
+        template: deployment.yaml