test(functional): add gitops-backed k3s smoke workflow - #1513
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📥 CommitsReviewing files that changed from the base of the PR and between d67d2cf16841c76dbd396e6b8f8868953e528ad7 and e4f0900. 📒 Files selected for processing (7)
✅ Files skipped from review due to trivial changes (2)
🚧 Files skipped from review as they are similar to previous changes (5)
📝 WalkthroughWalkthroughAdds a new ChangesFunctional K3s Smoke CI Environment
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/functional-k3s.yml (2)
47-66: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winVerify downloaded tools before installing or executing them.
The workflow pins versions, but it still installs unsigned/unverified remote artifacts and pipes the k3d installer directly to
bash. Add checksum/signature verification foryq,kubeseal, and k3d before installing/running them.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/functional-k3s.yml around lines 47 - 66, The Install gitops CLI tools and Install k3d steps in functional-k3s.yml fetch remote binaries/scripts and run them without verification. Update the workflow to verify the downloaded yq, kubeseal, and k3d artifacts using published checksums or signatures before installing or executing them, and avoid piping the k3d installer directly into bash; use a downloaded, verified script or installer artifact instead.
154-157: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winPass
KUBE_CTXto the sealing target too.All surrounding GitOps targets use the workflow’s explicit
${KUBE_CONTEXT}override, but theseseal-from-filecalls fall back to inventory-derived context. Keep sealing on the same cluster/cert path as bootstrap and deploy.Proposed fix
- make -C deploy/gitops seal-from-file ENV="${GITOPS_ENV}" NAMESPACE="${INFRA_NAMESPACE}" NAME=clickhouse-creds VALUE_FILE="${secret_dir}/clickhouse-creds.yaml" - make -C deploy/gitops seal-from-file ENV="${GITOPS_ENV}" NAMESPACE="${INFRA_NAMESPACE}" NAME=mariadb-creds VALUE_FILE="${secret_dir}/mariadb-creds.yaml" - make -C deploy/gitops seal-from-file ENV="${GITOPS_ENV}" NAMESPACE="${INFRA_NAMESPACE}" NAME=redis-creds VALUE_FILE="${secret_dir}/redis-creds.yaml" - make -C deploy/gitops seal-from-file ENV="${GITOPS_ENV}" NAMESPACE="${INSIGHT_NAMESPACE}" NAME=insight-db-creds VALUE_FILE="${secret_dir}/insight-db-creds.yaml" + make -C deploy/gitops seal-from-file ENV="${GITOPS_ENV}" KUBE_CTX="${KUBE_CONTEXT}" NAMESPACE="${INFRA_NAMESPACE}" NAME=clickhouse-creds VALUE_FILE="${secret_dir}/clickhouse-creds.yaml" + make -C deploy/gitops seal-from-file ENV="${GITOPS_ENV}" KUBE_CTX="${KUBE_CONTEXT}" NAMESPACE="${INFRA_NAMESPACE}" NAME=mariadb-creds VALUE_FILE="${secret_dir}/mariadb-creds.yaml" + make -C deploy/gitops seal-from-file ENV="${GITOPS_ENV}" KUBE_CTX="${KUBE_CONTEXT}" NAMESPACE="${INFRA_NAMESPACE}" NAME=redis-creds VALUE_FILE="${secret_dir}/redis-creds.yaml" + make -C deploy/gitops seal-from-file ENV="${GITOPS_ENV}" KUBE_CTX="${KUBE_CONTEXT}" NAMESPACE="${INSIGHT_NAMESPACE}" NAME=insight-db-creds VALUE_FILE="${secret_dir}/insight-db-creds.yaml"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/functional-k3s.yml around lines 154 - 157, The seal-from-file invocations in the GitOps workflow are missing the explicit Kubernetes context override used by the other deploy/bootstrap targets. Update the make calls in the sealing step to pass KUBE_CTX using the workflow’s ${KUBE_CONTEXT} value so the seal-from-file target uses the same cluster and cert path as the rest of the pipeline; keep the change localized to the repeated seal-from-file commands.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/functional-k3s.yml:
- Around line 187-199: The rollout checks in the functional-k3s workflow
silently succeed when `kubectl get deployments -o name` returns nothing, so add
an explicit assertion before the `rollout status` loop to require at least one
Deployment in the target namespace. Update the shell logic around the deployment
`while IFS= read -r deployment` block to fail fast if the deployment list is
empty, using the existing `kubectl -n "${INSIGHT_NAMESPACE}" get deployments -o
name` command as the source of truth. Keep the subsequent deployment,
statefulset, and job checks unchanged, but ensure the smoke test now fails when
no app deployments are rendered.
---
Nitpick comments:
In @.github/workflows/functional-k3s.yml:
- Around line 47-66: The Install gitops CLI tools and Install k3d steps in
functional-k3s.yml fetch remote binaries/scripts and run them without
verification. Update the workflow to verify the downloaded yq, kubeseal, and k3d
artifacts using published checksums or signatures before installing or executing
them, and avoid piping the k3d installer directly into bash; use a downloaded,
verified script or installer artifact instead.
- Around line 154-157: The seal-from-file invocations in the GitOps workflow are
missing the explicit Kubernetes context override used by the other
deploy/bootstrap targets. Update the make calls in the sealing step to pass
KUBE_CTX using the workflow’s ${KUBE_CONTEXT} value so the seal-from-file target
uses the same cluster and cert path as the rest of the pipeline; keep the change
localized to the repeated seal-from-file commands.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b73d25b5-fa94-4eca-835e-e3b95e035ba8
📥 Commits
Reviewing files that changed from the base of the PR and between 95009a5 and d67d2cf16841c76dbd396e6b8f8868953e528ad7.
📒 Files selected for processing (7)
.github/workflows/functional-k3s.ymldeploy/gitops/.gitignoredeploy/gitops/environments/functional-ci/clickhouse-values.yamldeploy/gitops/environments/functional-ci/inventory.yamldeploy/gitops/environments/functional-ci/mariadb-values.yamldeploy/gitops/environments/functional-ci/redis-values.yamldeploy/gitops/environments/functional-ci/values.yaml
Comment on lines
+187
to
+199
| while IFS= read -r deployment; do | ||
| kubectl -n "${INSIGHT_NAMESPACE}" rollout status "${deployment}" --timeout=5m | ||
| done < <(kubectl -n "${INSIGHT_NAMESPACE}" get deployments -o name) | ||
|
|
||
| while IFS= read -r statefulset; do | ||
| kubectl -n "${INSIGHT_NAMESPACE}" rollout status "${statefulset}" --timeout=5m | ||
| done < <(kubectl -n "${INSIGHT_NAMESPACE}" get statefulsets -o name) | ||
|
|
||
| while IFS= read -r job; do | ||
| kubectl -n "${INSIGHT_NAMESPACE}" wait "${job}" \ | ||
| --for=condition=Complete \ | ||
| --timeout=5m | ||
| done < <(kubectl -n "${INSIGHT_NAMESPACE}" get jobs -o name) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Fail when the app renders no deployments.
These loops silently pass on empty kubectl get ... -o name output. Since this smoke test must prove the app services deployed, assert at least one Deployment before rollout checks.
Proposed fix
- while IFS= read -r deployment; do
+ mapfile -t deployments < <(kubectl -n "${INSIGHT_NAMESPACE}" get deployments -o name)
+ if (( ${`#deployments`[@]} == 0 )); then
+ echo "No deployments found in ${INSIGHT_NAMESPACE}; Insight app did not render deployable workloads." >&2
+ exit 1
+ fi
+
+ for deployment in "${deployments[@]}"; do
kubectl -n "${INSIGHT_NAMESPACE}" rollout status "${deployment}" --timeout=5m
- done < <(kubectl -n "${INSIGHT_NAMESPACE}" get deployments -o name)
+ done📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| while IFS= read -r deployment; do | |
| kubectl -n "${INSIGHT_NAMESPACE}" rollout status "${deployment}" --timeout=5m | |
| done < <(kubectl -n "${INSIGHT_NAMESPACE}" get deployments -o name) | |
| while IFS= read -r statefulset; do | |
| kubectl -n "${INSIGHT_NAMESPACE}" rollout status "${statefulset}" --timeout=5m | |
| done < <(kubectl -n "${INSIGHT_NAMESPACE}" get statefulsets -o name) | |
| while IFS= read -r job; do | |
| kubectl -n "${INSIGHT_NAMESPACE}" wait "${job}" \ | |
| --for=condition=Complete \ | |
| --timeout=5m | |
| done < <(kubectl -n "${INSIGHT_NAMESPACE}" get jobs -o name) | |
| mapfile -t deployments < <(kubectl -n "${INSIGHT_NAMESPACE}" get deployments -o name) | |
| if (( ${`#deployments`[@]} == 0 )); then | |
| echo "No deployments found in ${INSIGHT_NAMESPACE}; Insight app did not render deployable workloads." >&2 | |
| exit 1 | |
| fi | |
| for deployment in "${deployments[@]}"; do | |
| kubectl -n "${INSIGHT_NAMESPACE}" rollout status "${deployment}" --timeout=5m | |
| done | |
| while IFS= read -r statefulset; do | |
| kubectl -n "${INSIGHT_NAMESPACE}" rollout status "${statefulset}" --timeout=5m | |
| done < <(kubectl -n "${INSIGHT_NAMESPACE}" get statefulsets -o name) | |
| while IFS= read -r job; do | |
| kubectl -n "${INSIGHT_NAMESPACE}" wait "${job}" \ | |
| --for=condition=Complete \ | |
| --timeout=5m | |
| done < <(kubectl -n "${INSIGHT_NAMESPACE}" get jobs -o name) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/functional-k3s.yml around lines 187 - 199, The rollout
checks in the functional-k3s workflow silently succeed when `kubectl get
deployments -o name` returns nothing, so add an explicit assertion before the
`rollout status` loop to require at least one Deployment in the target
namespace. Update the shell logic around the deployment `while IFS= read -r
deployment` block to fail fast if the deployment list is empty, using the
existing `kubectl -n "${INSIGHT_NAMESPACE}" get deployments -o name` command as
the source of truth. Keep the subsequent deployment, statefulset, and job checks
unchanged, but ensure the smoke test now fails when no app deployments are
rendered.
ktursunov
approved these changes
Jun 30, 2026
Signed-off-by: Valeriy.Romanov <valeriy.romanov@acronis.com>
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a functional K3s smoke workflow that validates the non-interactive GitOps deployment path in GitHub Actions.
The workflow provisions an ephemeral k3d/K3s cluster, uses the committed
deploy/gitopsMakefile targets to bootstrap prerequisites, seal temporary CI secrets, install L2 infra, and deploy the Insight umbrella chart.What changed
Functional K3s Smokeworkflow.deploy/gitops/environments/functional-cienvironment for CI smoke deployments.bootstrapfetch-certseal-from-filesystemdeploy-appstatusSummary by CodeRabbit
New Features
Tests
Chores