|
| 1 | +# Contributing to Vault Helm |
| 2 | + |
| 3 | +**Please note:** We take Vault's security and our users' trust very seriously. |
| 4 | +If you believe you have found a security issue in Vault, please responsibly |
| 5 | +disclose by contacting us at [email protected]. |
| 6 | + |
| 7 | +**First:** if you're unsure or afraid of _anything_, just ask or submit the |
| 8 | +issue or pull request anyways. You won't be yelled at for giving it your best |
| 9 | +effort. The worst that can happen is that you'll be politely asked to change |
| 10 | +something. We appreciate any sort of contributions, and don't want a wall of |
| 11 | +rules to get in the way of that. |
| 12 | + |
| 13 | +That said, if you want to ensure that a pull request is likely to be merged, |
| 14 | +talk to us! You can find out our thoughts and ensure that your contribution |
| 15 | +won't clash or be obviated by Vault's normal direction. A great way to do this |
| 16 | +is via the [Vault Discussion Forum][1]. |
| 17 | + |
| 18 | +This document will cover what we're looking for in terms of reporting issues. |
| 19 | +By addressing all the points we're looking for, it raises the chances we can |
| 20 | +quickly merge or address your contributions. |
| 21 | + |
| 22 | +[1]: https://discuss.hashicorp.com/c/vault |
| 23 | + |
| 24 | +## Issues |
| 25 | + |
| 26 | +### Reporting an Issue |
| 27 | + |
| 28 | +* Make sure you test against the latest released version. It is possible |
| 29 | + we already fixed the bug you're experiencing. Even better is if you can test |
| 30 | + against `main`, as bugs are fixed regularly but new versions are only |
| 31 | + released every few months. |
| 32 | + |
| 33 | +* Provide steps to reproduce the issue, and if possible include the expected |
| 34 | + results as well as the actual results. Please provide text, not screen shots! |
| 35 | + |
| 36 | +* Respond as promptly as possible to any questions made by the Vault |
| 37 | + team to your issue. Stale issues will be closed periodically. |
| 38 | + |
| 39 | +### Issue Lifecycle |
| 40 | + |
| 41 | +1. The issue is reported. |
| 42 | + |
| 43 | +2. The issue is verified and categorized by a Vault Helm collaborator. |
| 44 | + Categorization is done via tags. For example, bugs are marked as "bugs". |
| 45 | + |
| 46 | +3. Unless it is critical, the issue may be left for a period of time (sometimes |
| 47 | + many weeks), giving outside contributors -- maybe you!? -- a chance to |
| 48 | + address the issue. |
| 49 | + |
| 50 | +4. The issue is addressed in a pull request or commit. The issue will be |
| 51 | + referenced in the commit message so that the code that fixes it is clearly |
| 52 | + linked. |
| 53 | + |
| 54 | +5. The issue is closed. Sometimes, valid issues will be closed to keep |
| 55 | + the issue tracker clean. The issue is still indexed and available for |
| 56 | + future viewers, or can be re-opened if necessary. |
| 57 | + |
| 58 | +## Testing |
| 59 | + |
| 60 | +The Helm chart ships with both unit and acceptance tests. |
| 61 | + |
| 62 | +The unit tests don't require any active Kubernetes cluster and complete |
| 63 | +very quickly. These should be used for fast feedback during development. |
| 64 | +The acceptance tests require a Kubernetes cluster with a configured `kubectl`. |
| 65 | + |
| 66 | +### Test Using Docker Container |
| 67 | + |
| 68 | +The following are the instructions for running bats tests using a Docker container. |
| 69 | + |
| 70 | +#### Prerequisites |
| 71 | + |
| 72 | +* Docker installed |
| 73 | +* `vault-helm` checked out locally |
| 74 | + |
| 75 | +#### Test |
| 76 | + |
| 77 | +**Note:** the following commands should be run from the `vault-helm` directory. |
| 78 | + |
| 79 | +First, build the Docker image for running the tests: |
| 80 | + |
| 81 | +```shell |
| 82 | +docker build -f ${PWD}/test/docker/Test.dockerfile ${PWD}/test/docker/ -t vault-helm-test |
| 83 | +``` |
| 84 | +Next, execute the tests with the following commands: |
| 85 | +```shell |
| 86 | +docker run -it --rm -v "${PWD}:/test" vault-helm-test bats /test/test/unit |
| 87 | +``` |
| 88 | +It's possible to only run specific bats tests using regular expressions. |
| 89 | +For example, the following will run only tests with "injector" in the name: |
| 90 | +```shell |
| 91 | +docker run -it --rm -v "${PWD}:/test" vault-helm-test bats /test/test/unit -f "injector" |
| 92 | +``` |
| 93 | + |
| 94 | +### Test Manually |
| 95 | +The following are the instructions for running bats tests on your workstation. |
| 96 | +#### Prerequisites |
| 97 | +* [Bats](https://github.com/bats-core/bats-core) |
| 98 | + ```bash |
| 99 | + brew install bats-core |
| 100 | + ``` |
| 101 | +* [yq](https://pypi.org/project/yq/) |
| 102 | + ```bash |
| 103 | + brew install python-yq |
| 104 | + ``` |
| 105 | +* [helm](https://helm.sh) |
| 106 | + ```bash |
| 107 | + brew install kubernetes-helm |
| 108 | + ``` |
| 109 | + |
| 110 | +#### Test |
| 111 | + |
| 112 | +To run the unit tests: |
| 113 | + |
| 114 | + bats ./test/unit |
| 115 | + |
| 116 | +To run the acceptance tests: |
| 117 | + |
| 118 | + bats ./test/acceptance |
| 119 | + |
| 120 | +If the acceptance tests fail, deployed resources in the Kubernetes cluster |
| 121 | +may not be properly cleaned up. We recommend recycling the Kubernetes cluster to |
| 122 | +start from a clean slate. |
| 123 | + |
| 124 | +**Note:** There is a Terraform configuration in the |
| 125 | +[`test/terraform/`](https://github.com/hashicorp/vault-helm/tree/main/test/terraform) directory |
| 126 | +that can be used to quickly bring up a GKE cluster and configure |
| 127 | +`kubectl` and `helm` locally. This can be used to quickly spin up a test |
| 128 | +cluster for acceptance tests. Unit tests _do not_ require a running Kubernetes |
| 129 | +cluster. |
| 130 | + |
| 131 | +### Writing Unit Tests |
| 132 | + |
| 133 | +Changes to the Helm chart should be accompanied by appropriate unit tests. |
| 134 | + |
| 135 | +#### Formatting |
| 136 | + |
| 137 | +- Put tests in the test file in the same order as the variables appear in the `values.yaml`. |
| 138 | +- Start tests for a chart value with a header that says what is being tested, like this: |
| 139 | + ``` |
| 140 | + #-------------------------------------------------------------------- |
| 141 | + # annotations |
| 142 | + ``` |
| 143 | +
|
| 144 | +- Name the test based on what it's testing in the following format (this will be its first line): |
| 145 | + ``` |
| 146 | + @test "<section being tested>: <short description of the test case>" { |
| 147 | + ``` |
| 148 | +
|
| 149 | + When adding tests to an existing file, the first section will be the same as the other tests in the file. |
| 150 | +
|
| 151 | +#### Test Details |
| 152 | +
|
| 153 | +[Bats](https://github.com/bats-core/bats-core) provides a way to run commands in a shell and inspect the output in an automated way. |
| 154 | +In all of the tests in this repo, the base command being run is [helm template](https://docs.helm.sh/helm/#helm-template) which turns the templated files into straight yaml output. |
| 155 | +In this way, we're able to test that the various conditionals in the templates render as we would expect. |
| 156 | +
|
| 157 | +Each test defines the files that should be rendered using the `--show-only` flag, then it might adjust chart values by adding `--set` flags as well. |
| 158 | +The output from this `helm template` command is then piped to [yq](https://pypi.org/project/yq/). |
| 159 | +`yq` allows us to pull out just the information we're interested in, either by referencing its position in the yaml file directly or giving information about it (like its length). |
| 160 | +The `-r` flag can be used with `yq` to return a raw string instead of a quoted one which is especially useful when looking for an exact match. |
| 161 | +
|
| 162 | +The test passes or fails based on the conditional at the end that is in square brackets, which is a comparison of our expected value and the output of `helm template` piped to `yq`. |
| 163 | +
|
| 164 | +The `| tee /dev/stderr ` pieces direct any terminal output of the `helm template` and `yq` commands to stderr so that it doesn't interfere with `bats`. |
| 165 | +
|
| 166 | +#### Test Examples |
| 167 | +
|
| 168 | +Here are some examples of common test patterns: |
| 169 | +
|
| 170 | +- Check that a value is disabled by default |
| 171 | +
|
| 172 | + ``` |
| 173 | + @test "ui/Service: no type by default" { |
| 174 | + cd `chart_dir` |
| 175 | + local actual=$(helm template \ |
| 176 | + --show-only templates/ui-service.yaml \ |
| 177 | + . | tee /dev/stderr | |
| 178 | + yq -r '.spec.type' | tee /dev/stderr) |
| 179 | + [ "${actual}" = "null" ] |
| 180 | + } |
| 181 | + ``` |
| 182 | +
|
| 183 | + In this example, nothing is changed from the default templates (no `--set` flags), then we use `yq` to retrieve the value we're checking, `.spec.type`. |
| 184 | + This output is then compared against our expected value (`null` in this case) in the assertion `[ "${actual}" = "null" ]`. |
| 185 | +
|
| 186 | +
|
| 187 | +- Check that a template value is rendered to a specific value |
| 188 | + ``` |
| 189 | + @test "ui/Service: specified type" { |
| 190 | + cd `chart_dir` |
| 191 | + local actual=$(helm template \ |
| 192 | + --show-only templates/ui-service.yaml \ |
| 193 | + --set 'ui.serviceType=LoadBalancer' \ |
| 194 | + . | tee /dev/stderr | |
| 195 | + yq -r '.spec.type' | tee /dev/stderr) |
| 196 | + [ "${actual}" = "LoadBalancer" ] |
| 197 | + } |
| 198 | + ``` |
| 199 | +
|
| 200 | + This is very similar to the last example, except we've changed a default value with the `--set` flag and correspondingly changed the expected value. |
| 201 | +
|
| 202 | +- Check that a template value contains several values |
| 203 | + ``` |
| 204 | + @test "server/standalone-StatefulSet: custom resources" { |
| 205 | + cd `chart_dir` |
| 206 | + local actual=$(helm template \ |
| 207 | + --show-only templates/server-statefulset.yaml \ |
| 208 | + --set 'server.standalone.enabled=true' \ |
| 209 | + --set 'server.resources.requests.memory=256Mi' \ |
| 210 | + --set 'server.resources.requests.cpu=250m' \ |
| 211 | + . | tee /dev/stderr | |
| 212 | + yq -r '.spec.template.spec.containers[0].resources.requests.memory' | tee /dev/stderr) |
| 213 | + [ "${actual}" = "256Mi" ] |
| 214 | +
|
| 215 | + local actual=$(helm template \ |
| 216 | + --show-only templates/server-statefulset.yaml \ |
| 217 | + --set 'server.standalone.enabled=true' \ |
| 218 | + --set 'server.resources.limits.memory=256Mi' \ |
| 219 | + --set 'server.resources.limits.cpu=250m' \ |
| 220 | + . | tee /dev/stderr | |
| 221 | + yq -r '.spec.template.spec.containers[0].resources.limits.memory' | tee /dev/stderr) |
| 222 | + [ "${actual}" = "256Mi" ] |
| 223 | + ``` |
| 224 | +
|
| 225 | + *Note:* If testing more than two conditions, it would be good to separate the `helm template` part of the command from the `yq` sections to reduce redundant work. |
| 226 | +
|
| 227 | +- Check that an entire template file is not rendered |
| 228 | + ``` |
| 229 | + @test "syncCatalog/Deployment: disabled by default" { |
| 230 | + cd `chart_dir` |
| 231 | + local actual=$( (helm template \ |
| 232 | + --show-only templates/server-statefulset.yaml \ |
| 233 | + --set 'global.enabled=false' \ |
| 234 | + . || echo "---") | tee /dev/stderr | |
| 235 | + yq 'length > 0' | tee /dev/stderr) |
| 236 | + [ "${actual}" = "false" ] |
| 237 | + } |
| 238 | + ``` |
| 239 | + Here we are check the length of the command output to see if the anything is rendered. |
| 240 | + This style can easily be switched to check that a file is rendered instead. |
| 241 | +
|
| 242 | +## Contributor License Agreement |
| 243 | +
|
| 244 | +We require that all contributors sign our Contributor License Agreement ("CLA") |
| 245 | +before we can accept the contribution. |
| 246 | +
|
| 247 | +[Learn more about why HashiCorp requires a CLA and what the CLA includes](https://www.hashicorp.com/cla) |
0 commit comments