Merge pull request #134 from sighupio/chore/manifest-testing

ci: introduce manifest testing with kube-linter

Author: marcopaggioro

.bumpversion.cfg

@@ -5,20 +5,28 @@
 name: Check License Header Presence
 kind: pipeline
 type: docker
-
 clone:
   depth: 1
-
+volumes:
+  - name: mise-cache
+    host:
+      path: /root/mise_data_dir
 steps:
-  - name: Check License Header Presence
-    image: docker.io/library/golang:1.20
+  - name: check
+    image: quay.io/sighup/mise:v2026.6.14
     pull: always
+    environment:
+      MISE_DATA_DIR: /mise-data
+      GITHUB_TOKEN:
+        from_secret: github_token
+    volumes:
+      - name: mise-cache
+        path: /mise-data
     commands:
-      - go install github.com/google/addlicense@v1.1.1
-      - addlicense -c "SIGHUP s.r.l" -v -l bsd -y "2017-present" --check .
+      - mise run check-license
 
 ---
-name: Linting
+name: validate
 kind: pipeline
 type: docker
 
@@ -35,27 +43,9 @@ platform:
 environment:
   # Mise configuration envvars.
   MISE_DATA_DIR: /mise-data
-  MISE_OVERRIDE_CONFIG_FILENAMES: "mise.ci.toml"
 
 steps:
-  # - name: lint
-  #   image: quay.io/sighup/policeman
-  #   pull: always
-  #   environment:
-  #     FILTER_REGEX_EXCLUDE: (\.github)
-  #     # Identifies false positives like missing 'selector'.
-  #     # Doing this is valid for Kustomize patches
-  #     VALIDATE_KUBERNETES_KUBEVAL: "false"
-  #     # Some duplicated code is intended.
-  #     VALIDATE_JSCPD: "false"
-  #     # hadolint already validated dockerfiles
-  #     VALIDATE_DOCKERFILE: "false"
-  #     # Disable natural language checks
-  #     VALIDATE_NATURAL_LANGUAGE: "false"
-  #   depends_on:
-  #     - clone
-
-  - name: Render Manifests
+  - name: render
     image: quay.io/sighup/mise:v2025.4.4
     pull: always
     depends_on:
@@ -67,18 +57,31 @@ steps:
       - name: mise-cache
         path: /mise-data
     commands:
-      - |
-        mise use kustomize@5.6.0
-        eval "$(mise activate bash --shims)"
+      - eval "$(mise activate bash --shims)"
       - kustomize build katalog/gatekeeper > gatekeeper.yml
       - kustomize build katalog/kyverno > kyverno.yml
 
+  - name: lint
+    image: quay.io/sighup/mise:v2026.6.14
+    pull: always
+    environment:
+      MISE_DATA_DIR: /mise-data
+      GITHUB_TOKEN:
+        from_secret: github_token
+    volumes:
+      - name: mise-cache
+        path: /mise-data
+    depends_on:
+      - render
+    commands:
+      - mise run lint
+
   - &check-deprecated-apis
     name: check-deprecated-apis
     image: us-docker.pkg.dev/fairwinds-ops/oss/pluto:v5
     pull: always
     depends_on:
-      - Render Manifests
+      - lint
     commands:
       # we use --ignore-deprecations because we don't want the CI to fail when the API has not been removed yet.
       - /pluto detect $${KUBERNETES_MANIFESTS} --ignore-deprecations --target-versions=k8s=v1.35.0
@@ -102,7 +105,7 @@ kind: pipeline
 type: docker
 
 depends_on:
-  - Linting
+  - validate
 
 clone:
   depth: 1
@@ -114,7 +117,6 @@ platform:
 environment:
   # Mise configuration.
   MISE_DATA_DIR: "/mise-data"
-  MISE_OVERRIDE_CONFIG_FILENAMES: "mise.ci.toml"
 
   # Cluster version.
   CLUSTER_VERSION: "v1.33.2"
@@ -211,7 +213,7 @@ kind: pipeline
 type: docker
 
 depends_on:
-  - Linting
+  - validate
 
 clone:
   depth: 1
@@ -223,7 +225,6 @@ platform:
 environment:
   # Mise configuration.
   MISE_DATA_DIR: "/mise-data"
-  MISE_OVERRIDE_CONFIG_FILENAMES: "mise.ci.toml"
 
   # Cluster version.
   CLUSTER_VERSION: "v1.33.2"
@@ -320,7 +321,7 @@ kind: pipeline
 type: docker
 
 depends_on:
-  - Linting
+  - validate
 
 clone:
   depth: 1
@@ -332,7 +333,6 @@ platform:
 environment:
   # Mise configuration.
   MISE_DATA_DIR: "/mise-data"
-  MISE_OVERRIDE_CONFIG_FILENAMES: "mise.ci.toml"
 
   # Cluster version.
   CLUSTER_VERSION: "v1.34.0"
@@ -429,7 +429,7 @@ kind: pipeline
 type: docker
 
 depends_on:
-  - Linting
+  - validate
 
 clone:
   depth: 1
@@ -441,7 +441,6 @@ platform:
 environment:
   # Mise configuration.
   MISE_DATA_DIR: "/mise-data"
-  MISE_OVERRIDE_CONFIG_FILENAMES: "mise.ci.toml"
 
   # Cluster version.
   CLUSTER_VERSION: "v1.34.0"
@@ -538,7 +537,7 @@ kind: pipeline
 type: docker
 
 depends_on:
-  - Linting
+  - validate
 
 clone:
   depth: 1
@@ -550,7 +549,6 @@ platform:
 environment:
   # Mise configuration.
   MISE_DATA_DIR: "/mise-data"
-  MISE_OVERRIDE_CONFIG_FILENAMES: "mise.ci.toml"
 
   # Cluster version.
   CLUSTER_VERSION: "v1.35.0"
@@ -647,7 +645,7 @@ kind: pipeline
 type: docker
 
 depends_on:
-  - Linting
+  - validate
 
 clone:
   depth: 1
@@ -659,7 +657,6 @@ platform:
 environment:
   # Mise configuration.
   MISE_DATA_DIR: "/mise-data"
-  MISE_OVERRIDE_CONFIG_FILENAMES: "mise.ci.toml"
 
   # Cluster version.
   CLUSTER_VERSION: "v1.35.0"

.drone.yml

@@ -0,0 +1,20 @@
+# Copyright (c) 2017-present SIGHUP s.r.l All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
+
+checks:
+  doNotAutoAddDefaults: false
+  include:
+    - exposed-services
+    - use-namespace
+  exclude:
+    - job-ttl-seconds-after-finished
+    - no-read-only-root-fs
+    - pdb-unhealthy-pod-eviction-policy
+    - privilege-escalation-container
+    - privileged-container
+    - run-as-non-root
+    - unset-cpu-requirements
+    - unset-memory-requirements
+  ignorePaths:
+    - katalog/tests/**

.kube-linter.yaml

@@ -3,11 +3,12 @@
 # license that can be found in the LICENSE file.
 
 [tools]
+bats = "1.11.0"
+drone = "1.9.0"
 kind = "0.31.0"
-kubectl = "1.35.5"
+kube-linter = "0.8.3"
+kubectl = "1.35.6"
 kustomize = "5.6.0"
-bats = "1.11.0"
-drone = "latest"
 "ubi:google/addlicense" = "v1.1.1"
 
 # Development task definitions
@@ -19,6 +20,14 @@ addlicense -c "SIGHUP s.r.l" -y "2017-present" -v -l bsd .
 echo "✅ License headers added!"
 '''
 
+[tasks.check-license]
+description = "Check that all files have license headers"
+run = '''
+echo "🔍 Checking license headers..."
+addlicense -c "SIGHUP s.r.l" -y "2017-present" -v -l bsd --check .
+echo "✅ All files have license headers!"
+'''
+
 [tasks.validate-manifests]
 description = "Validate all manifests can be built"
 run = '''
@@ -28,9 +37,10 @@ kustomize build katalog/kyverno > /dev/null && echo "  ✅ kyverno"
 echo "✅ All manifests validated!"
 '''
 
-[tasks.setup]
-description = "Complete development environment setup"
-depends = ["add-license", "validate-manifests"]
+[tasks.lint]
+description = "Lint all katalog manifests with kube-linter"
 run = '''
-echo "✅ Development environment ready!"
+echo "🔍 Linting katalog/ with kube-linter..."
+kube-linter lint --config .kube-linter.yaml katalog/
+echo "✅ All manifests passed linting!"
 '''