OSAC-22: Create OSAC umbrella Helm chart and installer tooling

.github/workflows/helm-integration.yaml

@@ -0,0 +1,86 @@
+name: Helm Integration Test
+
+on:
+  schedule:
+    # Run daily at 06:00 UTC
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+
+jobs:
+  integration-test:
+    name: Deploy to Kind Cluster
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      with:
+        submodules: recursive
+        persist-credentials: false
+
+    - name: Update submodules to pinned commits
+      run: git submodule update --init --recursive
+
+    - name: Set up Helm
+      uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4  # v4
+      with:
+        version: v3.17.0
+
+    - name: Create Kind cluster
+      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc  # v1
+      with:
+        cluster_name: osac-integration
+
+    - name: Install cert-manager
+      run: |
+        kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.1/cert-manager.yaml
+        kubectl wait --for=condition=Available deployment/cert-manager -n cert-manager --timeout=120s
+        kubectl wait --for=condition=Available deployment/cert-manager-webhook -n cert-manager --timeout=120s
+        kubectl wait --for=condition=Available deployment/cert-manager-cainjector -n cert-manager --timeout=120s
+
+    - name: Build chart dependencies
+      run: helm dependency build charts/osac/
+
+    - name: Lint chart
+      run: helm lint charts/osac/
+
+    - name: Template chart (dry-run validation)
+      run: helm template osac charts/osac/ --values values/development.yaml > /dev/null
+
+    - name: Deploy umbrella chart
+      continue-on-error: true
+      run: |
+        helm install osac charts/osac/ \
+          --namespace osac \
+          --create-namespace \
+          --values values/development.yaml \
+          --set validation.enabled=false \
+          --set aap.bootstrap.enabled=false \
+          --set aap.aap.instance.enabled=false \
+          --set dbMigrate.enabled=false \
+          --timeout 10m \
+          --wait
+
+    - name: Check deployed resources
+      if: always()
+      run: |
+        echo "=== Pods ==="
+        kubectl get pods -n osac 2>/dev/null || true
+        echo "=== Deployments ==="
+        kubectl get deployments -n osac 2>/dev/null || true
+        echo "=== Services ==="
+        kubectl get services -n osac 2>/dev/null || true
+        echo "=== Helm status ==="
+        helm status osac -n osac 2>/dev/null || true
+
+    - name: Test idempotency (helm upgrade with no changes)
+      continue-on-error: true
+      run: |
+        helm upgrade osac charts/osac/ \
+          --namespace osac \
+          --values values/development.yaml \
+          --set validation.enabled=false \
+          --set aap.bootstrap.enabled=false \
+          --set aap.aap.instance.enabled=false \
+          --set dbMigrate.enabled=false \
+          --timeout 10m \
+          --wait

.github/workflows/helm-lint.yaml

@@ -0,0 +1,38 @@
+name: Helm Lint
+
+on:
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  helm-lint:
+    name: Lint Helm Charts
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      with:
+        submodules: recursive
+        persist-credentials: false
+
+    - name: Set up Helm
+      uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4  # v4
+      with:
+        version: v3.17.0
+
+    - name: Build chart dependencies
+      run: helm dependency build charts/osac/
+
+    - name: Lint umbrella chart
+      run: helm lint charts/osac/
+
+    - name: Template umbrella chart (dry-run)
+      run: helm template osac charts/osac/ --values values/development.yaml > /dev/null
+
+    - name: Validate values schema
+      run: |
+        # Ensure values.schema.json is valid JSON
+        python3 -m json.tool charts/osac/values.schema.json > /dev/null

.pre-commit-config.yaml

@@ -1,3 +1,4 @@
+exclude: 'charts/.*'
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
   rev: v5.0.0

Makefile

@@ -0,0 +1,59 @@
+INSTALLER_NAMESPACE ?= osac
+VALUES_FILE ?= values/development.yaml
+DEPLOY_MODE ?= helm
+
+.PHONY: help
+help: ## Display this help
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n\nTargets:\n"} /^[a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2 }' $(MAKEFILE_LIST)
+
+##@ Helm Chart Management
+
+.PHONY: sync-charts
+sync-charts: ## Update submodules to latest main and rebuild chart dependencies
+	git submodule update --init --recursive --remote
+	helm dependency build charts/osac/
+
+.PHONY: helm-deps
+helm-deps: ## Build Helm chart dependencies
+	helm dependency build charts/osac/
+
+.PHONY: helm-lint
+helm-lint: ## Lint the umbrella chart
+	helm dependency build charts/osac/
+	helm lint charts/osac/
+
+.PHONY: helm-template
+helm-template: ## Dry-run render all templates
+	helm dependency build charts/osac/
+	helm template osac charts/osac/ --values $(VALUES_FILE)
+
+##@ Deployment
+
+.PHONY: helm-deploy
+helm-deploy: ## Deploy OSAC to current cluster using Helm
+	helm dependency build charts/osac/
+	helm upgrade --install osac charts/osac/ \
+		--namespace $(INSTALLER_NAMESPACE) \
+		--create-namespace \
+		--values $(VALUES_FILE) \
+		--timeout 40m \
+		--wait
+
+.PHONY: helm-undeploy
+helm-undeploy: ## Uninstall OSAC from current cluster
+	helm uninstall osac --namespace $(INSTALLER_NAMESPACE)
+
+.PHONY: setup
+setup: ## Run setup.sh with DEPLOY_MODE=helm
+	DEPLOY_MODE=$(DEPLOY_MODE) ./scripts/setup.sh
+
+.PHONY: teardown
+teardown: ## Teardown OSAC deployment
+	./scripts/teardown.sh
+
+##@ Validation
+
+.PHONY: helm-validate
+helm-validate: helm-lint ## Validate Helm chart (lint + template)
+	helm template osac charts/osac/ --values $(VALUES_FILE) > /dev/null
+	@echo "Validation passed."