build: lint rendered chart using kubeconform

.github/workflows/lint-test.yaml → .github/workflows/test-lint.yaml

@@ -10,24 +10,28 @@ on:
     paths:
     - 'charts/plex-media-server/**'
 
+env:
+  KUBECONFORM_VERSION: v0.6.7
+
 jobs:
   docs:
     name: Bump Chart Version and Re-Generate Docs
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-    - uses: gabe565/setup-helm-docs-action@d5c35bdc9133cfbea3b671acadf50a29029e87c2 # v1
+    - uses: gabe565/setup-helm-docs-action@d5c35bdc9133cfbea3b671acadf50a29029e87c2  # v1
 
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
       with:
         fetch-depth: 0
         ref: ${{ github.event.pull_request.head.ref }}
 
     - name: Set up chart-testing
-      uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2
+      uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b  # v2
 
+    # yamllint disable rule:line-length
     - name: Check if version bump is needed
       id: check_bump
       run: |
@@ -40,11 +44,12 @@ jobs:
         else
             echo "needsBump=false" >> "$GITHUB_OUTPUT"
         fi
+    # yamllint enable rule:line-length
 
     - name: Cache binaries
       id: cache-bin
       if: ${{ steps.check_bump.outputs.needsBump == 'true' }}
-      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
       env:
         cache-name: cache-semver
       with:
@@ -98,17 +103,20 @@ jobs:
         echo "last=${current_ver}" >> "$GITHUB_OUTPUT"
         echo "new=${new_ver}" >> "$GITHUB_OUTPUT"
 
+    # yamllint disable rule:line-length
     - name: Update Chart Version
       if: ${{ steps.check_bump.outputs.needsBump == 'true' }}
       shell: bash
       run: |
         sed -i "s/version: ${{ steps.get_version.outputs.last }}/version: ${{ steps.get_version.outputs.new }}/g" "charts/plex-media-server/Chart.yaml"
+    # yamllint enable rule:line-length
 
     - name: Update Docs
       shell: bash
       run: |
         helm-docs --chart-search-root charts --chart-to-generate charts/plex-media-server
 
+    # yamllint disable rule:line-length
     - name: Commit Changes
       env:
         message: ${{ steps.check_bump.outputs.needsBump == 'true' && format('to v{0}', steps.get_version.outputs.new) || 'documentation'  }}
@@ -120,27 +128,26 @@ jobs:
           git commit -m "chore: update $APP chart $message" --all
           git push origin "HEAD:$GITHUB_HEAD_REF"
         fi
+    # yamllint enable rule:line-length
 
   lint-test:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4
       with:
         fetch-depth: 0
 
     - name: Set up Helm
-      uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4
-      with:
-        version: v3.13.1
+      uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112  # v4
 
-    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
       with:
         python-version: 3.x
         check-latest: true
 
     - name: Set up chart-testing
-      uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2
+      uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b  # v2
 
     - name: Run chart-testing (list-changed)
       id: list-changed
@@ -151,10 +158,57 @@ jobs:
         fi
 
     - name: Run chart-testing (lint)
+      if: steps.list-changed.outputs.changed == 'true'
       run: ct lint --config .github/linters/ct.yaml
 
+    - name: Cache kubeconform
+      id: cache-kubeconform
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4
+      env:
+        cache-name: cache-kubeconform
+      with:
+        path: bin
+        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.KUBECONFORM_VERSION }}
+        restore-keys: |
+          ${{ runner.os }}-build-${{ env.cache-name }}-
+          ${{ runner.os }}-build-
+          ${{ runner.os }}-
+
+    # yamllint disable rule:line-length
+    - name: Install kubeconform
+      if: steps.cache-kubeconform.outputs.cache-hit != 'true'
+      run: |
+        mkdir -p "$GITHUB_WORKSPACE/bin"
+
+        curl -sSLO \
+          "https://github.com/yannh/kubeconform/releases/download/${{ env.KUBECONFORM_VERSION }}/kubeconform-linux-amd64.tar.gz" &&
+        tar -xf "kubeconform-linux-amd64.tar.gz" &&
+        rm "kubeconform-linux-amd64.tar.gz" &&
+        mv kubeconform "$GITHUB_WORKSPACE/bin"
+    # yamllint enable rule:line-length
+
+    - name: Setup PATH
+      run: |
+        echo "$GITHUB_WORKSPACE/bin" >> "$GITHUB_PATH"
+
+    # yamllint disable rule:line-length
+    - name: Run kubeconform
+      id: kubeconform
+      run: |
+        app=plex-media-server
+        helm template pms "charts/${app}" \
+          --namespace example \
+          --values "charts/${app}/ci/ci-values.yaml" \
+          --set 'pms.gpu.nvidia.enabled=true' |
+        kubeconform \
+          -kubernetes-version=1.32.0 \
+          -schema-location default \
+          -strict \
+          -output tap
+    # yamllint enable rule:line-length
+
     - name: Create kind cluster
-      uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1
+      uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3  # v1
       if: steps.list-changed.outputs.changed == 'true'
 
     - name: Run chart-testing (install)

charts/plex-media-server/Chart.yaml

@@ -22,7 +22,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.0.1
+version: 1.0.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/plex-media-server/README.md

@@ -1,6 +1,6 @@
 # plex-media-server
 
-![Version: 0.10.0](https://img.shields.io/badge/Version-0.10.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.41.6](https://img.shields.io/badge/AppVersion-1.41.6-informational?style=flat-square)
+![Version: 1.0.2](https://img.shields.io/badge/Version-1.0.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.41.6](https://img.shields.io/badge/AppVersion-1.41.6-informational?style=flat-square)
 
 **Homepage:** <https://www.plex.tv>
 
@@ -114,16 +114,18 @@ Before contributing, please read the [Code of Conduct](../../CODE_OF_CONDUCT.md)
 | image.tag | string | `"1.41.6.9685-d301f511a"` | If unset use "latest" |
 | imagePullSecrets | list | `[]` |  |
 | ingress.annotations | object | `{}` | Custom annotations to put on the ingress resource |
-| ingress.certificateSecret | string | `""` | Optional secret name to provide valid https connections using an existing SSL certificate |
 | ingress.enabled | bool | `false` | Specify if an ingress resource for the pms server should be created or not |
 | ingress.ingressClassName | string | `"ingress-nginx"` | The ingress class that should be used |
+| ingress.tls | list | `[]` | Optional TLS configuration to provide valid https connections using an existing SSL certificate |
 | ingress.url | string | `""` | The url to use for the ingress reverse proxy to point at this pms instance |
 | initContainer | object | `{"image":{"pullPolicy":"IfNotPresent","registry":"index.docker.io","repository":"alpine","sha":"","tag":"3.21"},"script":""}` | A basic image that will convert the configmap to a file in the rclone config volume this is ignored if rclone is not enabled |
 | initContainer.image.registry | string | `"index.docker.io"` | The public dockerhub registry |
 | initContainer.image.tag | string | `"3.21"` | If unset use latest |
 | initContainer.script | string | `""` | A custom script that will be run in an init container to do any setup before the PMS service starts up This will be run every time the pod starts, make sure that some mechanism is included to prevent this from running more than once if it should only be run on the first startup. |
 | nameOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
+| pms.claimSecret.key | string | `""` |  |
+| pms.claimSecret.name | string | `""` |  |
 | pms.configExistingClaim | string | `""` | Name of an existing `PersistentVolumeClaim` for the PMS database NOTE: When set, 'configStorage' and 'storageClassName' are ignored. |
 | pms.configStorage | string | `"2Gi"` | The volume size to provision for the PMS database |
 | pms.gpu.nvidia.enabled | bool | `false` |  |

charts/plex-media-server/ci/ci-values.yaml

@@ -0,0 +1,64 @@
+image:
+  tag: null
+  pullPolicy: Always
+
+global:
+  imageRegistry: ""
+
+dnsConfig: {}
+
+ingress:
+  enabled: true
+  ingressClassName: my-class
+  url: example.com
+  tls:
+  - hosts:
+    - plex.example.com
+    secretName: cert-example-com
+
+  annotations:
+    plex.tv/description: just an annotation
+
+pms:
+  configStorage: 1Gi
+
+  resources:
+    limits:
+      cpu: 100m
+      memory: 128Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+
+  securityContext: {}
+
+  shareProcessNamespace: true
+
+service:
+  type: ClusterIP
+  port: 32400
+  annotations:
+    plex.tv/description: just an annotation
+
+priorityClassName: system-node-critical
+
+commonLabels:
+  plex.tv/name: pms
+
+extraEnv:
+  HOSTNAME: PlexServer
+  TZ: Etc/UTC
+  PLEX_UPDATE_CHANNEL: '5'
+  PLEX_UID: '1000'
+  PLEX_GID: '1000'
+  ALLOWED_NETWORKS: '0.0.0.0/0'
+
+extraVolumeMounts:
+- name: dev-dri
+  mountPath: /dev/dri
+
+extraVolumes:
+- name: dev-dri
+  hostPath:
+    path: /dev/dri
+    type: Directory

charts/plex-media-server/templates/statefulset.yaml

@@ -29,6 +29,9 @@ spec:
       runtimeClassName: {{ .Values.runtimeClassName | quote }}
       {{- end }}
       serviceAccountName: {{ include "pms-chart.serviceAccountName" . }}
+      {{- if .Values.pms.shareProcessNamespace }}
+      shareProcessNamespace: {{ .Values.pms.shareProcessNamespace }}
+      {{- end }}
       tolerations:
         {{- toYaml .Values.tolerations | nindent 8 }}
       nodeSelector:
@@ -158,9 +161,6 @@ spec:
         securityContext:
           {{- toYaml . | nindent 10 }}
         {{- end }}
-      {{- if .Values.pms.shareProcessNamespace }}
-        shareProcessNamespace: {{ .Values.pms.shareProcessNamespace }}
-      {{- end }}
         volumeMounts:
         - name: pms-config
           mountPath: /config