[WORKBENCH] Determine how to reliably test using sealedSecrets in GHA
Nobody has claimed this yet.
- Dominant language
- Markdown
- Stars
- 46
- Forks
- 40
- Avg merge
- 4h 3m
- Merged PRs (30d)
- 6
Description
As it stands right now, we have no good way to test the sealedSecrets.
There is an issue with what we're passing in, and what sealedSecrets expects as output. https://github.com/rstudio/helm/blob/50f2a96b501cec5dc3bbafa9c573b13f65b6db8d/charts/rstudio-workbench/templates/configmap-session.yaml#L22 uses https://github.com/rstudio/helm/blob/50f2a96b501cec5dc3bbafa9c573b13f65b6db8d/charts/rstudio-library/templates/_config.tpl#L46-L71 which outputs an object, but sealedSecrets expects an encrypted string.
The problem is that we install a new cluster every time for testing, which creates a new pem file to encrypt secrets and convert them to sealedSecrets which you are then supposed to apply to the cluster. Doing that in an automated, repeatable, and reliable way is going to take some work
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with charts/rstudio-workbench/templates/configmap-session.yaml and charts/rstudio-library/templates/_config.tpl, then trace how the GitHub Actions workflow creates a fresh cluster and handles the generated pem file. The work is done when sealedSecrets can be tested automatically and repeatably in those newly created clusters, with the expected encrypted-string format verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, helm, kubernetes
- Domain
- ci-cd, devops, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100