From a2f5b2242739c777fedc3ce9627517512c5a86e9 Mon Sep 17 00:00:00 2001 From: MergeCheck Date: Fri, 3 Jul 2026 00:54:22 -0300 Subject: [PATCH 1/2] fix(automatisch): add template validation gate --- charts/automatisch/templates/_helpers.tpl | 27 +++++++++ charts/automatisch/templates/validate.yaml | 2 + charts/automatisch/tests/validation_test.yaml | 59 +++++++++++++++++++ 3 files changed, 88 insertions(+) create mode 100644 charts/automatisch/templates/validate.yaml create mode 100644 charts/automatisch/tests/validation_test.yaml diff --git a/charts/automatisch/templates/_helpers.tpl b/charts/automatisch/templates/_helpers.tpl index 548e31547..8b26d7735 100644 --- a/charts/automatisch/templates/_helpers.tpl +++ b/charts/automatisch/templates/_helpers.tpl @@ -39,6 +39,33 @@ app.kubernetes.io/instance: {{ .Release.Name }} {{- end -}} {{- end -}} +{{- define "automatisch.validate" -}} +{{- if and (not .Values.postgresql.enabled) (not .Values.database.external.host) -}} +{{- fail "database.external.host is required when postgresql.enabled is false" -}} +{{- end -}} +{{- if and (not .Values.postgresql.enabled) (not .Values.database.external.existingSecret) (not .Values.database.external.password) -}} +{{- fail "database.external.password or database.external.existingSecret is required when postgresql.enabled is false" -}} +{{- end -}} +{{- if and (not .Values.redis.enabled) (not .Values.redis_config.external.host) -}} +{{- fail "redis_config.external.host is required when redis.enabled is false" -}} +{{- end -}} +{{- if and .Values.ingress.enabled (not .Values.ingress.hosts) -}} +{{- fail "ingress.enabled requires ingress.hosts to contain at least one host" -}} +{{- end -}} +{{- if .Values.ingress.enabled -}} +{{- range $index, $host := .Values.ingress.hosts -}} +{{- if not $host.host -}} +{{- fail (printf "ingress.hosts[%d].host is required when ingress.enabled is true" $index) -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- range $key, $_ := .Values.podLabels -}} +{{- if or (eq $key "app.kubernetes.io/name") (eq $key "app.kubernetes.io/instance") -}} +{{- fail (printf "podLabels must not override selector label %q" $key) -}} +{{- end -}} +{{- end -}} +{{- end -}} + {{- define "automatisch.image" -}} {{- printf "%s:%s" .Values.image.repository .Values.image.tag -}} {{- end -}} diff --git a/charts/automatisch/templates/validate.yaml b/charts/automatisch/templates/validate.yaml new file mode 100644 index 000000000..0202b4d1c --- /dev/null +++ b/charts/automatisch/templates/validate.yaml @@ -0,0 +1,2 @@ +{{/* SPDX-License-Identifier: Apache-2.0 */}} +{{- include "automatisch.validate" . -}} diff --git a/charts/automatisch/tests/validation_test.yaml b/charts/automatisch/tests/validation_test.yaml new file mode 100644 index 000000000..448d779c2 --- /dev/null +++ b/charts/automatisch/tests/validation_test.yaml @@ -0,0 +1,59 @@ +# SPDX-License-Identifier: Apache-2.0 +suite: Validation +templates: + - templates/validate.yaml +tests: + - it: should render no validation manifest by default + asserts: + - hasDocuments: + count: 0 + + - it: should fail when external database host is missing + set: + postgresql.enabled: false + database.external.password: secret + asserts: + - failedTemplate: + errorMessage: "database.external.host is required when postgresql.enabled is false" + + - it: should fail when external database credentials are missing + set: + postgresql.enabled: false + database.external.host: postgres.example.com + asserts: + - failedTemplate: + errorMessage: "database.external.password or database.external.existingSecret is required when postgresql.enabled is false" + + - it: should fail when external redis host is missing + set: + redis.enabled: false + asserts: + - failedTemplate: + errorMessage: "redis_config.external.host is required when redis.enabled is false" + + - it: should fail when ingress is enabled without hosts + set: + ingress.enabled: true + ingress.hosts: [] + asserts: + - failedTemplate: + errorMessage: "ingress.enabled requires ingress.hosts to contain at least one host" + + - it: should fail when an ingress host entry has no hostname + set: + ingress.enabled: true + ingress.hosts: + - paths: + - path: / + pathType: Prefix + asserts: + - failedTemplate: + errorMessage: "ingress.hosts[0].host is required when ingress.enabled is true" + + - it: should fail when podLabels override selector labels + set: + podLabels: + app.kubernetes.io/name: custom + asserts: + - failedTemplate: + errorMessage: 'podLabels must not override selector label "app.kubernetes.io/name"' From d5e12c553a8060ccb80ef8dff572e9de71d192a6 Mon Sep 17 00:00:00 2001 From: MergeCheck Date: Sun, 5 Jul 2026 19:50:29 -0300 Subject: [PATCH 2/2] fix(automatisch): derive protected pod label keys --- charts/automatisch/templates/_helpers.tpl | 3 ++- charts/automatisch/tests/validation_test.yaml | 8 ++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/charts/automatisch/templates/_helpers.tpl b/charts/automatisch/templates/_helpers.tpl index 8b26d7735..5c2fc4ae5 100644 --- a/charts/automatisch/templates/_helpers.tpl +++ b/charts/automatisch/templates/_helpers.tpl @@ -59,8 +59,9 @@ app.kubernetes.io/instance: {{ .Release.Name }} {{- end -}} {{- end -}} {{- end -}} +{{- $selectorLabels := include "automatisch.selectorLabels" . | fromYaml -}} {{- range $key, $_ := .Values.podLabels -}} -{{- if or (eq $key "app.kubernetes.io/name") (eq $key "app.kubernetes.io/instance") -}} +{{- if hasKey $selectorLabels $key -}} {{- fail (printf "podLabels must not override selector label %q" $key) -}} {{- end -}} {{- end -}} diff --git a/charts/automatisch/tests/validation_test.yaml b/charts/automatisch/tests/validation_test.yaml index 448d779c2..ac1f2b686 100644 --- a/charts/automatisch/tests/validation_test.yaml +++ b/charts/automatisch/tests/validation_test.yaml @@ -57,3 +57,11 @@ tests: asserts: - failedTemplate: errorMessage: 'podLabels must not override selector label "app.kubernetes.io/name"' + + - it: should fail when podLabels override release selector label + set: + podLabels: + app.kubernetes.io/instance: custom + asserts: + - failedTemplate: + errorMessage: 'podLabels must not override selector label "app.kubernetes.io/instance"'