ci: add Helm chart validation workflow

.github/workflows/helm-validate.yml

@@ -0,0 +1,150 @@
+name: Helm Validate
+
+on:
+  pull_request:
+    paths:
+      - apollo-service/**
+      - apollo-portal/**
+      - .github/workflows/helm-validate.yml
+  push:
+    branches:
+      - main
+    paths:
+      - apollo-service/**
+      - apollo-portal/**
+      - .github/workflows/helm-validate.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Validate Charts
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.15.2
+
+      - name: Install kubeconform
+        run: |
+          KUBECONFORM_VERSION=v0.6.7
+          curl -sSL "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz" \
+            | tar -xz kubeconform
+          sudo mv kubeconform /usr/local/bin/kubeconform
+
+      - name: Prepare validation values
+        run: |
+          VALUES_DIR="${RUNNER_TEMP}/apollo-values"
+          mkdir -p "${VALUES_DIR}"
+
+          cat > "${VALUES_DIR}/apollo-service-values-dev.yaml" <<'EOF'
+          configdb:
+            host: apollodb-mysql.mysql
+            dbName: DevApolloConfigDB
+            userName: root
+            password: test
+            connectionStringProperties: characterEncoding=utf8&useSSL=false&allowPublicKeyRetrieval=true
+
+          configService:
+            replicaCount: 1
+            config:
+              contextPath: /config
+            ingress:
+              enabled: true
+              hosts:
+                - paths:
+                    - /config
+
+          adminService:
+            replicaCount: 1
+            config:
+              contextPath: /admin
+            ingress:
+              enabled: true
+              hosts:
+                - paths:
+                    - /admin
+          EOF
+
+          cat > "${VALUES_DIR}/apollo-service-values-pro.yaml" <<'EOF'
+          configdb:
+            host: apollodb-mysql.mysql
+            dbName: ProApolloConfigDB
+            userName: root
+            password: test
+            connectionStringProperties: characterEncoding=utf8&useSSL=false&allowPublicKeyRetrieval=true
+
+          configService:
+            replicaCount: 1
+
+          adminService:
+            replicaCount: 1
+          EOF
+
+          cat > "${VALUES_DIR}/apollo-portal-values.yaml" <<'EOF'
+          portaldb:
+            host: apollodb-mysql.mysql
+            userName: root
+            password: test
+            connectionStringProperties: characterEncoding=utf8&useSSL=false&allowPublicKeyRetrieval=true
+
+          replicaCount: 1
+
+          ingress:
+            enabled: true
+            hosts:
+              - paths:
+                  - /apollo
+
+          config:
+            envs: dev,pro
+            contextPath: /apollo
+            metaServers:
+              dev: http://apollo-service-dev-apollo-configservice:8080/config
+              pro: http://apollo-service-pro-apollo-configservice:8080
+          EOF
+
+          echo "VALUES_DIR=${VALUES_DIR}" >> "${GITHUB_ENV}"
+
+      - name: Verify Helm charts
+        run: |
+          set -euo pipefail
+
+          OUTPUT_DIR="${RUNNER_TEMP}/helm-rendered"
+          rm -rf "${OUTPUT_DIR}"
+          mkdir -p "${OUTPUT_DIR}"
+
+          echo "[1/3] Lint charts"
+          helm lint "${GITHUB_WORKSPACE}/apollo-service" -f "${VALUES_DIR}/apollo-service-values-dev.yaml"
+          helm lint "${GITHUB_WORKSPACE}/apollo-service" -f "${VALUES_DIR}/apollo-service-values-pro.yaml"
+          helm lint "${GITHUB_WORKSPACE}/apollo-portal" -f "${VALUES_DIR}/apollo-portal-values.yaml"
+
+          echo "[2/3] Render manifests"
+          helm template apollo-service-dev "${GITHUB_WORKSPACE}/apollo-service" \
+            --namespace apollo \
+            -f "${VALUES_DIR}/apollo-service-values-dev.yaml" \
+            > "${OUTPUT_DIR}/apollo-service-dev.yaml"
+
+          helm template apollo-service-pro "${GITHUB_WORKSPACE}/apollo-service" \
+            --namespace apollo \
+            -f "${VALUES_DIR}/apollo-service-values-pro.yaml" \
+            > "${OUTPUT_DIR}/apollo-service-pro.yaml"
+
+          helm template apollo-portal "${GITHUB_WORKSPACE}/apollo-portal" \
+            --namespace apollo \
+            -f "${VALUES_DIR}/apollo-portal-values.yaml" \
+            > "${OUTPUT_DIR}/apollo-portal.yaml"
+
+          echo "[3/3] Validate manifests with kubeconform"
+          kubeconform -strict -ignore-missing-schemas \
+            "${OUTPUT_DIR}/apollo-service-dev.yaml" \
+            "${OUTPUT_DIR}/apollo-service-pro.yaml" \
+            "${OUTPUT_DIR}/apollo-portal.yaml"

apollo-portal/templates/deployment-portal.yaml

@@ -60,7 +60,9 @@ spec:
     metadata:
       labels:
         app: {{ $portalFullName }}
-        {{- toYaml .Values.labels | nindent 8 }}
+        {{- with .Values.labels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- with .Values.annotations }}
       annotations:
         {{- toYaml . | nindent 8 }}

apollo-service/templates/deployment-adminservice.yaml

@@ -49,7 +49,9 @@ spec:
     metadata:
       labels:
         app: {{ $adminServiceFullName }}
-        {{- toYaml .Values.adminService.labels | nindent 8 }}
+        {{- with .Values.adminService.labels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- with .Values.adminService.annotations }}
       annotations:
         {{- toYaml . | nindent 8 }}

apollo-service/templates/deployment-configservice.yaml

@@ -51,7 +51,9 @@ spec:
     metadata:
       labels:
         app: {{ $configServiceFullName }}
-        {{- toYaml .Values.configService.labels | nindent 8 }}
+        {{- with .Values.configService.labels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- with .Values.configService.annotations }}
       annotations:
         {{- toYaml . | nindent 8 }}