jakman85andClaude Opus 4.8
b2752aec48
Roll the verified Option-B per-app oauth2-proxy sidecar out to the remaining four forward-auth apps after the pihole canary was confirmed fail-closed (unauthenticated -> 302 to Keycloak, pod 2/2, clean sidecar OIDC discovery). Each app's Gateway route now terminates at its oauth2-proxy sidecar (:4180, --allowed-group=media-users, --upstream=http://127.0.0.1:<uiport>); the gateway-ingress CiliumNetworkPolicy allows the Gateway to reach ONLY :4180, so the bare UI is never served un-authenticated (fail-closed; R-IDP-02/06). The apps' own app/API ports stay in-Service for EAST-WEST callers (arr -> qbittorrent:8080 / jackett:9117) via the existing reciprocal-ingress allows. - keycloak: confidential jackett/qbittorrent/radarr/sonarr clients (realm-import + realm-clients mirror), provisioned live via kcadm (groups membership mapper). - secrets: four SOPS/age <app>-oauth2-proxy-credentials, wired into apps/wave-0 and apps/wave-1 by the renderer's sidecar-creds wave rule. - ci: remove the temporary canary deferral (all five goldens now reproduce). Co-Authored-By: Claude Opus 4.8 <[email protected]>
121 lines
5.3 KiB
Bash
Executable File
121 lines
5.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ci/render-golden.sh — Stage: render==golden reproducibility gate.
|
|
#
|
|
# WHY: the committed apps/ tree is a set of GOLDENS produced by ONE canonical
|
|
# invocation of catalog/render.py. If a golden is hand-edited, or a catalog
|
|
# ServiceDefinition is changed without re-rendering, the goldens drift from
|
|
# their source of truth and Flux deploys something no one reviewed. The three
|
|
# L1 render spot-checks (conformance/tests/l1-rendering/*) only cover a couple
|
|
# of assertions on a couple of services — they let a real source/golden
|
|
# mismatch through (image-automation objects present in gitea/nextcloud but
|
|
# absent everywhere else). This stage closes that hole: it renders EVERY
|
|
# onboarded catalog service with the canonical command and FAILS on ANY diff
|
|
# vs the committed golden.
|
|
#
|
|
# CANONICAL RENDER (source of truth for apps/):
|
|
# python3 catalog/render.py --all catalog -o apps --wave-layout --no-image-automation
|
|
#
|
|
# The `--no-image-automation` flag is canonical because image automation is
|
|
# authored-but-DISABLED (DECISIONS-LOG: "Phase 4 image-automation merged but
|
|
# DISABLED pending a Gitea write-cred"; pihole/all apps onboarded via
|
|
# `--no-image-automation`). The Flux image-reflector/-automation controllers
|
|
# are NOT installed in-cluster, so emitting ImageRepository/ImagePolicy CRs
|
|
# would leave apps referencing controllers that don't exist. Every onboarded
|
|
# app must render identically under this ONE command.
|
|
#
|
|
# Runs in CI WITHOUT a cluster (pure render + diff). Exit codes per ci/lib.sh:
|
|
# 0 = pass, 1 = fail (blocks merge), 3 = skip (renderer/tooling missing).
|
|
set -euo pipefail
|
|
CI_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck disable=SC1091
|
|
source "${CI_DIR}/lib.sh"
|
|
|
|
APPS_DIR="${APPS_DIR:-${REPO_ROOT}/apps}"
|
|
RENDER_PY="${RENDER_PY:-${REPO_ROOT}/catalog/render.py}"
|
|
PYTHON="${PYTHON:-python3}"
|
|
|
|
# Catalog services that are intentionally NOT onboarded to the apps tree yet
|
|
# (computed into a wave by the renderer but with NO committed manifest — see
|
|
# DESIGN-waves.md §"Catalog services not yet onboarded"). They render as a
|
|
# by-product of `--all catalog` but must NOT have a golden; the gate ignores
|
|
# their rendered output. Onboarding one = add its golden and drop it here.
|
|
#
|
|
: "${RENDER_GOLDEN_NOT_ONBOARDED:=keycloak vm-demo}"
|
|
|
|
log "Stage: render==golden reproducibility (canonical render vs committed apps/)"
|
|
|
|
if ! entrypoint_ready "$PYTHON"; then
|
|
skip "python3 not available — cannot run the renderer. UNWIRED, not green."
|
|
summary "- render-golden: **SKIPPED** (python3 missing)"
|
|
exit 3
|
|
fi
|
|
if [ ! -f "$RENDER_PY" ]; then
|
|
skip "renderer not present at '${RENDER_PY}' (catalog/render.py) — UNWIRED, not green."
|
|
summary "- render-golden: **SKIPPED** (renderer missing)"
|
|
exit 3
|
|
fi
|
|
if [ ! -d "$CATALOG_DIR" ] || ! compgen -G "${CATALOG_DIR}/*.yaml" >/dev/null 2>&1; then
|
|
skip "no catalog ServiceDefinitions under '${CATALOG_DIR}' — nothing to render."
|
|
summary "- render-golden: **SKIPPED** (empty catalog)"
|
|
exit 3
|
|
fi
|
|
|
|
# --- Render every service with the ONE canonical command into a temp dir -----
|
|
TMP_RENDER="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_RENDER"' EXIT
|
|
|
|
if ! "$PYTHON" "$RENDER_PY" --all "$CATALOG_DIR" -o "$TMP_RENDER" --wave-layout --no-image-automation; then
|
|
err "canonical render failed to run"
|
|
summary "- render-golden: **FAILED** (renderer error)"
|
|
exit 1
|
|
fi
|
|
|
|
# Drop the not-onboarded services' rendered output — they have no golden by design.
|
|
for svc in $RENDER_GOLDEN_NOT_ONBOARDED; do
|
|
find "$TMP_RENDER" -type f -name "${svc}.yaml" -delete
|
|
done
|
|
|
|
# --- Compare EVERY rendered service against its committed golden --------------
|
|
# For each rendered file (relative path wave-N/<name>.yaml):
|
|
# - the committed golden apps/wave-N/<name>.yaml MUST exist, and
|
|
# - it MUST be byte-identical to the freshly rendered output.
|
|
# Any missing golden or any diff is a hard FAIL (blocks merge).
|
|
fail=0
|
|
checked=0
|
|
while IFS= read -r -d '' rendered; do
|
|
rel="${rendered#"$TMP_RENDER"/}"
|
|
golden="${APPS_DIR}/${rel}"
|
|
checked=$((checked + 1))
|
|
if [ ! -f "$golden" ]; then
|
|
err "MISSING GOLDEN: catalog renders '${rel}' but apps/${rel} does not exist"
|
|
err " -> re-render (see canonical command in this script's header) and commit, or add it to RENDER_GOLDEN_NOT_ONBOARDED"
|
|
fail=1
|
|
continue
|
|
fi
|
|
if ! diff -u "$golden" "$rendered" >/dev/null 2>&1; then
|
|
err "GOLDEN DRIFT: apps/${rel} does not match the canonical render:"
|
|
diff -u "$golden" "$rendered" >&2 || true
|
|
fail=1
|
|
fi
|
|
done < <(find "$TMP_RENDER" -type f -print0)
|
|
|
|
if [ "$checked" -eq 0 ]; then
|
|
err "renderer produced no output — cannot verify goldens"
|
|
summary "- render-golden: **FAILED** (renderer produced nothing)"
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$fail" -ne 0 ]; then
|
|
err "render==golden check FAILED — the committed apps/ goldens are NOT reproducible"
|
|
err " from the canonical render. A golden was hand-edited, or a catalog source"
|
|
err " changed without re-rendering. Fix:"
|
|
err " ${PYTHON} catalog/render.py --all catalog -o apps --wave-layout --no-image-automation"
|
|
err " then remove the not-onboarded outputs (${RENDER_GOLDEN_NOT_ONBOARDED// /, }) and commit."
|
|
summary "- render-golden: **FAILED** (goldens drifted from canonical render)"
|
|
exit 1
|
|
fi
|
|
|
|
ok "render==golden: all ${checked} onboarded service golden(s) reproduce from the canonical render"
|
|
summary "- render-golden: **passed** (${checked} services; canonical \`--no-image-automation\` render)"
|
|
exit 0
|