ci(k8s): gate the Helm chart in CI + a compose↔chart drift check (closes #168) #171

Merged

not merged 4 commits from ci/168-helm-chart-ci-gate into main 2026-09-18 13:25:25 +00:00

Conversation 0 Commits 4 Files Changed 6

+158 -6

4 Commits

Author	SHA1	Message	Date
not	421597851a	Merge branch 'main' into ci/168-helm-chart-ci-gate	2026-09-18 12:55:28 +00:00
not	70de3d0a4d	ci(k8s): gate the Helm chart on every PR (refs #168) ... `make k8s-lint` existed since the chart landed but nothing ran it, so the chart had no automated coverage at all. A `k8s` job now runs it plus `make k8s-drift` on every push and PR: no cluster, ~20s, and it catches the two failure modes the chart is actually exposed to — a values typo that renders invalid YAML, and a change made to one stack but not the other. helm is installed as its pinned static binary (the URL the Talos runbook already gives developers) rather than via a marketplace action: nothing extra to vet. The `k8s` targets stay out of `make ci` on purpose — helm is optional for anyone not deploying to Kubernetes — which is the one place local and CI now differ, noted in docs/runbooks/ci.md.	2026-09-10 11:01:29 +02:00
not	fddf14e5f9	feat(k8s): declare the six platform deviations so only new drift fails (refs #168) ... Six differences exist by design and are now recorded in DEVIATIONS with the reason each one was forced, so the check passes on today's tree and fails on tomorrow's accident: the four `*-init` Django services folded into their web pods (one migrator per database), and the two bootstrap Jobs compose runs from the host instead. Verified against both drift classes by hand: bumping OPENZAAK_TAG in compose alone reports openzaak + oz-celery, and adding a workload to values.yaml alone reports it by name.	2026-09-10 11:00:32 +02:00
not	5000b749b9	test(k8s): fail when compose and the Helm chart describe different stacks (refs #168) ... ADR-0033 shipped the chart with this cost written down: "a second deployment description to keep in step with compose. Nothing enforces that today; a drift check belongs in CI (follow-up)." An upstream image bump or a new service applied to only one of the two files lands unnoticed. `make k8s-drift` compares what each stack actually deploys — workload names and resolved container images, from `docker compose config` and a rendered chart — rather than diffing the two files, which differ by design. Red: it reports the six differences that exist today, all of them the platform deviations ADR-0033 forced. Declaring those as intended is the green step.	2026-09-10 10:59:53 +02:00