mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 20:41:30 +00:00
shankar0123
7fcdc73e20
CI break diagnosed from the runner log on 47da13e (Bundle 3 closure
commit): the existing helm-lint job invoked
helm lint --set server.tls.existingSecret=certctl-tls-ci
helm template --set server.tls.existingSecret=certctl-tls-ci
without supplying server.auth.apiKey or postgresql.auth.password.
Pre-Bundle-3 the chart accepted that and emitted empty-value Secrets;
post-Bundle-3 the new `certctl.requiredSecrets` helper fail-fasts at
template time with the operator-actionable diagnostic. CI helm-lint job
correctly failed loud — exactly what the new guard is supposed to do —
but the workflow itself was the missing piece.
Closure: every positive `helm lint` / `helm template` invocation in
the helm-lint job now passes the two new required values. Five new
inverse-render steps pin the fail-fast guards in CI so a future
regression (someone removes the helper, makes a key optional, etc.)
shows up as a red ::error:: with the exact Bundle 3 finding ID:
- D2: external Postgres mode renders 0 postgres-* templates
- D7: TLS both-set must REJECT
- D1: missing server.auth.apiKey must REJECT
- D1: missing postgresql.auth.password must REJECT
- D1: missing externalDatabase.url must REJECT (postgresql.enabled=false)
The CI image installs helm v3.13.0 which is identical to the sandbox
verification version, so green local + green CI line up.
Verification (sandbox, helm v3.16.3 — same fail-fast behavior):
helm lint <chart> [+required secrets] # 1 chart linted, 0 failed
helm template <4 positive modes> # all render
helm template <5 inverse modes> # all REJECTED with B3 diagnostic
bash scripts/ci-guards/B3-helm-chart-coherence.sh # clean