Commit Graph
3 Commits
Author SHA1 Message Date
bcf6af9747 Feat: helm chart auth (#7148)
* feat: kv native helm auth implementation

Signed-off-by: Ayush Kumar <aykumar@guidewire.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* feat: add e2e test cases for helm auth

Signed-off-by: Ayush Kumar <aykumar@guidewire.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* test: remove the env auth gate and improve test cases

Signed-off-by: Ayush Kumar <aykumar@guidewire.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* lint: drop unused []byte return from non-docker secret dispatchers

unparam flagged dispatchBasicAuthSecret, dispatchTLSSecret, and
dispatchOpaqueSecret because the second return value (raw config
bytes) was always nil. Only dispatchDockerConfigJSONSecret actually
needs that slot for the OCI temp credfile. Drop it from the other
three and update resolveAuthOptions plus the unit tests to match.

Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* feat: pr review changes

Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* style: gofmt/goimports auth.go doc comments

Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* chore: remove e2e-auth-images-load-local target

The dedicated target is gone; e2e-test-local now reads the same
.vscode/k3d-preload.txt image list that the VS Code setup task
uses so both flows pull from one source. Empty or missing file
is a no-op.

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* chore: inline auth-test image list in e2e-test-local

`.vscode/k3d-preload.txt` is gitignored so it would not exist on a
fresh clone. Inline the three auth-test registry images directly
in the Make target so `make e2e-test-local` is self-contained.

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* feat: address PR review comments

- Webhook ValidateCuexTemplate now wraps the context in helm.WithDryRun
  so a ComponentDefinition with concrete helm.#Render arguments cannot
  trigger a real chart fetch or install during admission validation.
- helmchart audit ConfigMap keeps `helm.oam.dev/chart` as a label when
  the source string is a valid Kubernetes label value (alphanumeric +
  `.-_`, 1-63 chars); URLs containing `://` or `/` only live in the
  annotation. Preserves existing label selectors for repo-style sources
  without breaking long OCI/HTTPS URLs.
- helm_test.go capture-and-restore singleton.KubeClient in fetchURLChart
  and fetchRepoChart auth Describes so fake clients do not leak into
  later tests in the package.
- utils_test.go swap the defer order so singleton.ReloadClients runs
  before WorkloadCompiler.Reload, otherwise the compiler reload would
  pick up the fake dynamic client and leak fake state.
- e2e.mk pre-load loop separates docker pull and k3d image import with
  `;` rather than `&&`. `set -e` does not abort a for-loop body when a
  command inside an `&&` chain fails, so the old form could continue
  after a failed pull.

Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* style: gofmt AfterAll indentation in helmchart_test.go

Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* feat: enhance Docker Hub credential handling in auth configuration

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* feat: enhance Docker Hub credential handling in auth configuration

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* fix(helm-auth): normalize Docker Hub alias for dockerconfigjson Secrets

Cubic flagged that the Docker Hub alias fix in writeOCIRegistryConfigFile
only covered synthesized basic-auth credentials. For verbatim
kubernetes.io/dockerconfigjson Secrets, a user-supplied config keyed
under "registry-1.docker.io" (the OCI pull host) would not be found by
ORAS/Helm, which normalizes to "https://index.docker.io/v1/".

normalizeDockerHubAliases parses the verbatim JSON, and when any of the
three Docker Hub host aliases ("registry-1.docker.io", "index.docker.io",
"docker.io") is keyed but the canonical v1 key is absent, copies the
entry under the canonical key. No-op when:
  - the canonical key is already present
  - no Docker Hub host is involved
  - the JSON is malformed or missing the auths field

Includes 7 new unit specs for the helper covering each alias, the no-op
cases, and malformed input.

Also brings in collateral local-fix changes:
  - pkg/webhook/utils/utils_test.go: register the cue.oam.dev/v1alpha1
    Package GVK in the fake DynamicClient scheme so
    TestValidateCuexTemplate/withCuexPackageImports can resolve the
    test/ext package after the WorkloadCompiler switch.
  - gofmt field-alignment normalization on auth_test.go and
    auth_registry_helpers_test.go (drift caught by check-diff CI).

Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* fix: namespace-default rendered resources, bind chart cache to credentials, surface HTTP 401s clearly, inject auth-test CA in e2e

Four fixes from stress testing the helmchart component:

1. Rendered resources without metadata.namespace landed in vela-system.
   Both code paths now default to releaseNamespace for namespaced kinds:
   the velaLabelPostRenderer (before helm SDK apply) and
   parseManifestResources (before KubeVela's tracker re-applies).
   isClusterScopedKind covers CRDs, ClusterRoles, Namespaces, etc.

2. Cached chart bytes survived credential rotation.
   computeAuthCacheTag hashes Secret.Type + sorted Data into a 16-char
   tag suffixed onto the cache key when auth.secretRef is declared. Any
   Secret edit (or different Secret reference) invalidates the cache and
   forces a fresh registry call that exercises the new credentials at the
   wire. Public charts (no auth) are unaffected.

3. HTTP 401/403 on chart fetch surfaced as YAML/JSON parse errors.
   HTTPGetWithOption now rejects non-2xx responses with
   'HTTP <status>: <body>' instead of returning the raw body for
   downstream parsers to choke on.

4. E2E HTTPS tests against chartmuseum's self-signed cert failed at the
   admission webhook. injectAuthTestCA patches vela-core in BeforeSuite
   with an init container that combines /etc/ssl/certs/ca-certificates.crt
   with testdata/auth/certs/ca.crt into a shared volume and points
   SSL_CERT_FILE at it.

Also normalize Docker Hub host aliases on verbatim
kubernetes.io/dockerconfigjson Secrets (cubic comment), and revert
TestValidateCuexTemplate's fake DynamicClient to the empty-scheme form
that lets it wrap every GVK as Unstructured (CI unit test fix).

Finding 3 (options.wait default) is deferred: schema-level defaults
don't materialize for optional fields carried into _options as a
structural copy. Tracked separately.

Issue 2 from the stress matrix (cache + credential rotation) is also
filed upstream as kubevela/kubevela#7150 for a longer-term
credential-bound cache invalidation design.

Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* fix(helm-auth): RESTMapper scope detection + auth tag binds source URL + drop flaky webhook test case

Address cubic P1 review comments and the unit-test CI failure. isClusterScopedKind only matched well-known built-in kinds; isClusterScopedGVK now asks the RESTMapper first so third-party cluster-scoped CRDs are recognised, with the static allowlist as a fallback. computeAuthCacheTag now folds params.Source and params.RepoURL into the hash so a multi-host dockerconfigjson Secret cannot reuse cached bytes across different registries. TestValidateCuexTemplate/withCuexPackageImports relied on cuex.DefaultCompiler.Reload picking up a fake-client-served Package CRD; since ValidateCuexTemplate now uses velacuex.WorkloadCompiler the fake-client setup does not surface the test/ext package, so the case is dropped (covered transitively by the helm provider unit tests and the e2e suite under helm.WithDryRun).

Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* style: gofmt import order in helm.go (lint + check-diff)

Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* fix(e2e): correct vela-core selector, alpine bundler, harden rollout wait

The label selector app.kubernetes.io/name=vela-core also matches the
cluster-gateway Deployment, so the init container was being appended to
the wrong workload and the controller pod never picked up the test CA.
Switching to the unique controller.oam.dev/name label fixes the routing,
and the diagnostic message at the empty-list branch is updated to point
operators at the new label.

addVolume and addInitContainer now update in place when an entry with
the same name already exists. Previously they silently skipped, which
meant the first patch on a cluster stuck for the lifetime of that
cluster and a corrected image or args could not be picked up by a
re-run.

busybox:1.36 ships without /etc/ssl/certs/ca-certificates.crt, so the
bundler was silently producing an empty combined.crt. alpine:3.18 ships
the public CA roots, so concatenating the auth-test CA onto the system
bundle produces a usable trust store that the main container reads via
SSL_CERT_FILE.

waitForDeploymentsAvailable used to return as soon as DeploymentAvailable
flipped to True and the new RS reached the desired replica count, which
left a window where old-RS pods still satisfied Available while the
controller container was still running with the previous image. The
check now also requires Status.Replicas == Status.UpdatedReplicas,
AvailableReplicas >= specReplicas and UnavailableReplicas == 0, so the
helper only returns once the rollout is fully complete.

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* test(e2e): gate auth-test setup behind KUBEVELA_E2E_AUTH so other suites stay green

webhook-upgrade-check runs the same test/e2e-test suite as the full e2e
job but with ginkgo --focus-file requiredparam_validation_test.go. The
unconditional setupAuthRegistries in BeforeSuite was bringing up the
ChartMuseum / zot / nginx-bearer stack and patching vela-core for a
focus that did not need any of it, and the patched controller never
finished rolling on the upgrade-check cluster (the helm upgrade in that
job is expected to fail, so vela-core is in a stretched state when our
BeforeSuite tries to patch it).

Re-introduce KUBEVELA_E2E_AUTH=1 as the explicit opt-in. BeforeSuite and
AfterSuite only touch the auth registries when the env var is set, the
Helmchart Auth Describe block skips otherwise, and the make e2e-test
and e2e-test-local targets export the env so the full suite still runs
the auth specs. CI workflows that run a focused subset (like
webhook-upgrade-check) inherit the default off behavior and stop paying
the registry-setup cost.

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>

---------

Signed-off-by: Ayush Kumar <aykumar@guidewire.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
2026-05-22 09:09:55 -07:00
28892ccc7e Feat: implement valuesFrom support for helmchart component and update… (#7099)
* feat: implement valuesFrom support for helmchart component and update documentation examples

Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>

* fix: address cubic review feedback on valuesFrom

Three issues raised by cubic AI review on kubevela#7099:

1. docs/examples/helmchart-valuesfrom/secret-and-inline.yaml —
   Expected-result comments used incorrect paths (resources.cpu /
   resources.mem) and values (500m) that did not match the actual CM
   data. Rewrote the narrative to use the real paths
   (resources.limits.cpu / resources.limits.memory) and bundled the
   Secret inline in the manifest so the example is self-contained and
   the expected output is deterministic.

2. docs/examples/helmchart-valuesfrom/secret-and-inline.yaml —
   The Secret was marked optional: true while the narrative required
   it for the merged output to match. Bundled the Secret inline and
   dropped the optional flag, removing the order/timing ambiguity.
   README.md updated to drop the now-redundant "create the Secret
   first" instruction.

3. pkg/cue/cuex/providers/helm/helm.go:Render —
   After removing the unconditional "default" fallback for
   releaseNamespace, Helm could run with an empty namespace when both
   Context.AppNamespace and Release.Namespace were unset (non-normal
   code paths — direct callers, tests, CLI tooling). Restored the
   "default" fallback at the end of the namespace resolution while
   keeping the Application-namespace plumbing for tenant-scoped
   cross-namespace rejection.

Co-authored-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>

* feat: add valuesFrom fingerprinting for helmchart components to trigger workflow restarts on ConfigMap/Secret changes

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: add valuesFrom fingerprinting for helmchart components to trigger workflow restarts on ConfigMap/Secret changes

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: enhance valuesFrom support for helmchart components with fingerprinting and error handling

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* docs: clarify cross-namespace restrictions for valuesFrom in helmchart examples

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* ci: retrigger checks

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: add publishVersion support to Helm provider for stable release management

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: improve error handling for application retrieval in Helm provider

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* ci: retrigger checks

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: add application publishVersion lookup defense in Helm provider tests

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

---------

Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
2026-04-28 20:02:58 -07:00
+1 bdf647df8c Feat: native helm component and provider (#7080)
* Proof Concept

Signed-off-by: Brian Kane <briankane1@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* Cleanup dispatch stages and remove dry run namespaces

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* Single Health Condition Working

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* Multiple Health Conditions

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* Support Empty Health Status

Signed-off-by: Brian Kane <briankane1@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* Caching

Signed-off-by: Brian Kane <briankane1@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* includes changes from make-reviewable

Signed-off-by: Amit Singh <singhamitch@outlook.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* minor formatting fixes

Signed-off-by: Amit Singh <singhamitch@outlook.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* fix: handles cases where resource is nil

Signed-off-by: Amit Singh <singhamitch@outlook.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: creates chart release before returning rendered resources to kubevela

Signed-off-by: Amit Singh <singhamitch@outlook.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: helm release record via dry-run for helm list visibility

The previous createChartRelease did a real helm install/upgrade which
deployed resources directly, conflicting with KubeVela's dispatch
("exists but not managed by any application" errors). Also, Helm's
lazy client via cli.New().RESTClientGetter() silently wrote to
in-memory storage instead of Kubernetes secrets, so helm list never
showed releases.

Fix: use dry-run install to build a release object without deploying
resources, and bypass Helm's lazy client by creating a direct
Kubernetes clientset wired to helmdriver.NewSecrets. Set KubeVersion
from the real cluster version to pass chart constraints.

Prevent duplicate revisions on repeated reconciles via mutex
serialization and in-memory fingerprint tracking (chartVersion +
values). New revisions are only created when chart version or values
actually change.

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* fix: override Kubernetes version for kubeVersion validation in chart release

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Enhance Helm chart component definition and CUE provider, update API types, and add new examples and documentation.

Signed-off-by: Chaitanya Reddy Onteddu <co@guidewire.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Add Helm uninstall action and optimize install/upgrade with release fingerprinting and KubeVela ownership labels.

Signed-off-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Introduce  to prevent resources from being applied while ensuring they are recorded for garbage collection, and apply it to Helm release secrets.

Signed-off-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Enhance velaLabelPostRenderer to include Helm ownership annotations and improve cache invalidation logic for Helm releases

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Enhance Helm release secret tracking for garbage collection during application deletion and upgrades

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-Authored-By: Jerrin Francis <jerrinfrancis7@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Add Helm chart test and application definition for podinfo deployment

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Refactor Helm release secret handling and improve metadata filtering for KubeVela adoption

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Label existing Helm release secrets with KubeVela ownership for better tracking and cleanup

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Remove outdated documentation files for Helm integration and revision management

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Add various Helm chart application test and improve test coverage for Helmchart component

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Update Helm chart tests to validate deployment list and ensure label presence

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Enhance Helm chart tests for resource verification and application health checks

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Update Helm chart test scenarios for multi-component health checks and resource configurations

Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Implement dry-run mode for Helm provider to enhance validation without cluster interaction

Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Refactor import statements and enhance Helmchart edge case tests for better error handling and validation

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Refactor Helm provider methods for improved error handling and retry logic during installation

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Improve Helm provider tests and documentation with enhanced assertions and example configurations

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Register helm package with cuex.DefaultCompiler for improved import resolution

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Remove crossplane application configuration from crossplane-app.yaml

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Enhance workload compiler with external package loading and improve Helm chart health checks

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Remove unused cuex import and initialization function from helm provider

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Replace cuex.DefaultCompiler with localcuex.WorkloadCompiler for improved CUE compilation

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* feat: Implement dry-run mode for Helm provider functions during validation

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

* test: add unit tests for Helm provider and workflow provider

- Created suite tests for the Helm provider in pkg/cue/cuex/providers/helm/suite_test.go.
- Implemented unit tests for Helm workflow provider in pkg/workflow/providers/helm/helm_test.go.
- Added suite tests for Helm workflow provider in pkg/workflow/providers/helm/suite_test.go.

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>

* feat: Add additional health check tests for error scenarios

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>

* feat: Enhance health check logic and improve documentation in helmchart definition

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>

* feat: Refactor helmchart template for improved readability and structure

Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>

* docs: remove redundant struct-only tests from helm_test.go

Signed-off-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com>

* Feat: Implement CUE sanitization for OpenAPI schema generation

Signed-off-by: Vishal Kumar <vishal210893@gmail.com>

* feat: Add tests for rendering and fetching Helm charts with dry-run support

Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com>

* feat: Enhance required parameter validation tests with retry logic for webhook synchronization

Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com>

* feat: Improve chart version retrieval by sorting entries and enhancing error messages

Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com>

* feat: Enhance primary output handling for Helm charts with stable ConfigMap metadata

Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com>

* chore: Fix CUE formatting alignment in helmchart definition

Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com>

* feat: Extend timeout for self-healing Helmchart tests to improve reliability

Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com>

* feat: Increase timeout for golangci-lint to enhance linting reliability

Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com>

---------

Signed-off-by: Brian Kane <briankane1@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Amit Singh <singhamitch@outlook.com>
Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com>
Signed-off-by: Chaitanya Reddy Onteddu <co@guidewire.com>
Signed-off-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com>
Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
Signed-off-by: Vishal Kumar <vishal210893@gmail.com>
Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com>
Co-authored-by: Brian Kane <briankane1@gmail.com>
Co-authored-by: Amit Singh <singhamitch@outlook.com>
Co-authored-by: Jerrin Francis <jerrinfrancis7@gmail.com>
Co-authored-by: Reetika Malhotra <malhotra.reetika25@gmail.com>
Co-authored-by: Chaitanya Reddy Onteddu <co@guidewire.com>
Co-authored-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com>
Co-authored-by: Vishal Kumar <vishal210893@gmail.com>
Co-authored-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
Co-authored-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com>
2026-04-15 11:06:33 +01:00