ci: use prebuilt HaRP image and verify operator Service preservation

Signed-off-by: Oleksander Piskun <oleksandr2088@icloud.com>

Author: oleksandr-nc

.github/workflows/tests-deploy-k8s-clusterip.yml

@@ -8,9 +8,6 @@
 # works when HaRP runs outside the cluster (e.g. Docker on the host) because
 # kube-proxy makes ClusterIPs routable via iptables/ipvs.
 #
-# NOTE: Requires HaRP with ClusterIP address resolution fix.
-# Once merged into HaRP main and released, switch to the prebuilt image.
-#
 name: Tests - K8s Deploy (ClusterIP)
 
 on:
@@ -128,18 +125,8 @@ jobs:
       - name: Pre-pull ExApp image into k3s
         run: sudo k3s ctr images pull ghcr.io/nextcloud/app-skeleton-python:latest
 
-      # Build HaRP from fix branch (ClusterIP address resolution fix).
-      # TODO: switch to prebuilt image once HaRP fix/k8s-manual-expose-persistence is released.
-      - name: Checkout HaRP
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          repository: nextcloud/HaRP
-          ref: fix/k8s-manual-expose-persistence
-          path: harp-src
-
-      - name: Build HaRP image
-        run: docker build -t harp:test harp-src/
+      - name: Pull HaRP image
+        run: docker pull ghcr.io/nextcloud/nextcloud-appapi-harp:latest
 
       - name: Start HaRP with K8s backend
         run: |
@@ -153,7 +140,7 @@ jobs:
             -e HP_K8S_NAMESPACE="nextcloud-exapps" \
             -e HP_K8S_VERIFY_SSL="false" \
             --restart unless-stopped \
-            -d harp:test
+            -d ghcr.io/nextcloud/nextcloud-appapi-harp:latest
 
       - name: Start nginx proxy
         run: |
@@ -190,7 +177,6 @@ jobs:
       - name: Run K8s integration tests (ClusterIP)
         env:
           K8S_EXPOSE_TYPE: clusterip
-          HARP_HAS_MANAGED_BY_LABEL: "true"
         run: python3 apps/${{ env.APP_NAME }}/tests/test_occ_commands_k8s.py
 
       - name: Collect HaRP logs

.github/workflows/tests-deploy-k8s-manual.yml

@@ -7,9 +7,6 @@
 # etc.) themselves.  HaRP creates the Deployment but does NOT create a Service.
 # This workflow tests the deploy lifecycle with operator-managed Services.
 #
-# NOTE: Requires HaRP with manual-expose annotation persistence support.
-# Once merged into HaRP main and released, switch to the prebuilt image.
-#
 name: Tests - K8s Deploy (Manual)
 
 on:
@@ -128,18 +125,8 @@ jobs:
       - name: Pre-pull ExApp image into k3s
         run: sudo k3s ctr images pull ghcr.io/nextcloud/app-skeleton-python:latest
 
-      # Build HaRP from fix branch (manual expose annotation support).
-      # TODO: switch to prebuilt image once HaRP fix/k8s-manual-expose-persistence is released.
-      - name: Checkout HaRP
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          repository: nextcloud/HaRP
-          ref: fix/k8s-manual-expose-persistence
-          path: harp-src
-
-      - name: Build HaRP image
-        run: docker build -t harp:test harp-src/
+      - name: Pull HaRP image
+        run: docker pull ghcr.io/nextcloud/nextcloud-appapi-harp:latest
 
       - name: Start HaRP with K8s backend
         run: |
@@ -153,7 +140,7 @@ jobs:
             -e HP_K8S_NAMESPACE="nextcloud-exapps" \
             -e HP_K8S_VERIFY_SSL="false" \
             --restart unless-stopped \
-            -d harp:test
+            -d ghcr.io/nextcloud/nextcloud-appapi-harp:latest
 
       - name: Start nginx proxy
         run: |
@@ -191,7 +178,6 @@ jobs:
         env:
           K8S_EXPOSE_TYPE: manual
           MANUAL_CLUSTER_IP: ${{ env.MANUAL_CLUSTER_IP }}
-          HARP_HAS_MANAGED_BY_LABEL: "true"
         run: python3 apps/${{ env.APP_NAME }}/tests/test_occ_commands_k8s.py
 
       - name: Collect HaRP logs

.github/workflows/tests-deploy-k8s.yml

@@ -117,18 +117,8 @@ jobs:
       - name: Pre-pull ExApp image into k3s
         run: sudo k3s ctr images pull ghcr.io/nextcloud/app-skeleton-python:latest
 
-      # Build HaRP from fix branch (K8s fixes: ClusterIP resolution, managed-by labels, Succeeded phase).
-      # TODO: switch to prebuilt image once HaRP fix/k8s-manual-expose-persistence is released.
-      - name: Checkout HaRP
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-          repository: nextcloud/HaRP
-          ref: fix/k8s-manual-expose-persistence
-          path: harp-src
-
-      - name: Build HaRP image
-        run: docker build -t harp:test harp-src/
+      - name: Pull HaRP image
+        run: docker pull ghcr.io/nextcloud/nextcloud-appapi-harp:latest
 
       - name: Start HaRP with K8s backend
         run: |
@@ -142,7 +132,7 @@ jobs:
             -e HP_K8S_NAMESPACE="nextcloud-exapps" \
             -e HP_K8S_VERIFY_SSL="false" \
             --restart unless-stopped \
-            -d harp:test
+            -d ghcr.io/nextcloud/nextcloud-appapi-harp:latest
 
       - name: Start nginx proxy
         run: |
@@ -179,7 +169,6 @@ jobs:
       - name: Run K8s integration tests
         env:
           K8S_EXPOSE_TYPE: nodeport
-          HARP_HAS_MANAGED_BY_LABEL: "true"
         run: python3 apps/${{ env.APP_NAME }}/tests/test_occ_commands_k8s.py
 
       - name: Collect HaRP logs

tests/test_occ_commands_k8s.py

@@ -33,10 +33,6 @@
     "loadbalancer": "LoadBalancer",
 }
 
-# Whether the HaRP version under test supports managed-by labels on Services.
-# ClusterIP and Manual workflows build from the fix branch; NodePort uses prebuilt.
-HARP_HAS_MANAGED_BY_LABEL = os.environ.get("HARP_HAS_MANAGED_BY_LABEL", "false") == "true"
-
 # Separate daemon name for validation tests to avoid interfering with the deploy daemon
 K8S_VALIDATION_DAEMON = "k8s_validation"
 
@@ -346,13 +342,12 @@ def test_k8s_single_deploy():
                     assert actual_type == expected_type, (
                         f"Service type mismatch: expected {expected_type}, got {actual_type}"
                     )
-                    if HARP_HAS_MANAGED_BY_LABEL:
-                        managed_by = item["metadata"].get("labels", {}).get(
-                            "app.kubernetes.io/managed-by"
-                        )
-                        assert managed_by == "harp", (
-                            f"Service missing managed-by=harp label, got: {managed_by}"
-                        )
+                    managed_by = item["metadata"].get("labels", {}).get(
+                        "app.kubernetes.io/managed-by"
+                    )
+                    assert managed_by == "harp", (
+                        f"Service missing managed-by=harp label, got: {managed_by}"
+                    )
                     found = True
                     break
             assert found, (
@@ -417,7 +412,13 @@ def test_k8s_single_unregister_keep_data():
     deploy_output = kubectl_output("get deploy -o name", check=False)
     assert "app-skeleton-python" not in deploy_output, f"Deployment still exists: {deploy_output}"
 
-    if not IS_MANUAL:
+    if IS_MANUAL:
+        # Operator-managed Service must be preserved (HaRP only deletes managed-by=harp Services)
+        svc_output = kubectl_output("get svc -o name", check=False)
+        assert "app-skeleton-python" in svc_output, (
+            f"Operator-managed Service was deleted during unregister: {svc_output}"
+        )
+    else:
         svc_output = kubectl_output("get svc -o name", check=False)
         assert "app-skeleton-python" not in svc_output, f"Service still exists: {svc_output}"