[schwarztrinker]

Refs #1035

What changed

• new scripts/tests/test_ingress_allowlist.py — 5 unittest cases over a Helm render of the
  umbrella chart: the allow-list annotation on every rendered Ingress (3 by default: nova, trino,
  keycloak), no annotation with an empty list, the superset Ingress covered in a second render,
  65 entries refused, a non-CIDR refused. Failure messages name the offending Ingress and host.
• .github/workflows/ci.yml — one step at the end of the helm-lint job's umbrella-chart block
  (after helm dependency update chart): python3 -m unittest scripts.tests.test_ingress_allowlist -v.

No chart change.

One deviation from the ticket, for the same outcome

Step 3 assumes the lint job's unittest discover has no Helm. It does: ubuntu-latest ships
Helm (3.22.1 on the current image), so discover there would run the module with chart/charts/
unfetched and fail. The module therefore also skips itself — with a printed
skip: chart/charts/ lacks … line — when chart/Chart.yaml declares a sub-chart that
chart/charts/*.tgz does not contain. The helm-lint job fetches them first, so the check bites
there; nothing is switched off.

Commands

$ helm dependency update chart            # chart/charts is gitignored
Update Complete. ⎈Happy Helming!⎈  Saving 7 charts
$ python3 -m unittest scripts.tests.test_ingress_allowlist -v
test_a_heavy_component_is_covered_too ... ok
test_a_non_cidr_fails_the_render ... ok
test_an_empty_list_renders_no_annotation ... ok
test_every_public_ingress_carries_the_list ... ok
test_more_than_64_entries_fail_the_render ... ok
Ran 5 tests in 16.744s
OK
$ python3 -m unittest discover -s scripts/tests
Ran 268 tests in 46.393s
OK (skipped=1)
$ helm lint chart
1 chart(s) linted, 0 chart(s) failed
$ # lint-job simulation: helm present, chart/charts/ removed
Ran 263 tests ... OK (skipped=2)
skip: chart/charts/ lacks cloudnative-pg, seaweedfs, lakekeeper, trino, superset, airflow, jupyterhub (run `helm dependency update chart`)
$ python3 -c "import yaml;yaml.safe_load(open('.github/workflows/ci.yml'));print('ci.yml parses')"
ci.yml parses

Mutation check (delete the if $allowed block, 3 lines at chart/templates/ingress.yaml:87-89):

test_a_heavy_component_is_covered_too ... FAIL
test_every_public_ingress_carries_the_list ... FAIL
  AssertionError: None != '203.0.113.0/24,198.51.100.0/24' : Ingress nova (example.com) does not carry nginx.ingress.kubernetes.io/whitelist-source-range='203.0.113.0/24,198.51.100.0/24'
Ran 5 tests — FAILED (failures=2)
$ git checkout -- chart/templates/ingress.yaml   # restored, 5 tests OK

Local Helm is 3.18.4; CI's helm-lint job uses 3.19.0.

Not tested

• Live curl 403/200 against the lab — a maintainer action (locks out every address not in the
  list), stays with design: admin network allow-list for the platform's public endpoints (PlatformInstance.spec.network.allowedCidrs) #427.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.