37 lines
1.3 KiB
Bash
Executable File
37 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
|
|
command -v kubectl >/dev/null
|
|
command -v python3 >/dev/null
|
|
bash -n "${project_dir}/install.sh"
|
|
bash -n "${project_dir}/create-ci-kubeconfig.sh"
|
|
bash -n "${project_dir}/test.sh"
|
|
python3 - "${project_dir}" <<'PY'
|
|
import pathlib
|
|
import sys
|
|
import yaml
|
|
|
|
root = pathlib.Path(sys.argv[1])
|
|
expected = {
|
|
"namespace.yaml": {"Namespace"},
|
|
"diun.yaml": {"ServiceAccount", "ClusterRole", "ClusterRoleBinding", "PersistentVolumeClaim"},
|
|
"app.yaml": {"ConfigMap", "Deployment"},
|
|
"ci-deployer.yaml": {"ServiceAccount", "Role", "RoleBinding", "Secret"},
|
|
}
|
|
for filename, kinds in expected.items():
|
|
with (root / filename).open(encoding="utf-8") as stream:
|
|
documents = list(yaml.safe_load_all(stream))
|
|
assert documents and all(isinstance(document, dict) for document in documents), filename
|
|
assert kinds <= {document.get("kind") for document in documents}, filename
|
|
PY
|
|
grep -Fq 'resourceNames: ["diun", "diun-matrix-script"]' "${project_dir}/ci-deployer.yaml"
|
|
if grep -Eq 'resources: \["secrets"\]|resources:[[:space:]]*\[[^]]*secrets' \
|
|
"${project_dir}/ci-deployer.yaml"; then
|
|
echo 'CI deployer must not access Kubernetes Secrets' >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo 'Diun manifests and scripts validated'
|