martin-mat opened a new issue, #1024: URL: https://github.com/apache/apisix-helm-chart/issues/1024
## Summary We'd like to propose a nightly GitHub Actions job for the apisix chart. It installs the chart on a kind cluster, runs the CNTi Test Suite's essential tests against it, and shows the result as a badge in the README. It already runs on a fork and passes with the chart as it is on `master`: **15 of 19 essential tests**, pass mark 15, in **4 minutes**. ## CNTi and the test suite The [Cloud Native Telecom Initiative (CNTi)](https://lf-networking.atlassian.net/wiki/spaces/CNTi/pages/130416641/Cloud+Native+Telecom+Initiative+CNTi) is an LF Networking project on cloud native practices for network functions on Kubernetes. Its [test suite](https://github.com/lfn-cnti/testsuite) installs a workload on a cluster and checks it while it runs: probes, SIGTERM handling, scaling, draining a node, and the security posture of the pods. The essential set is 19 of those tests, with a pass mark of 15. Examples of projects that already show the badge: free5GC ([free5gc-helm](https://github.com/free5gc/free5gc-helm#readme)), Aether SD-Core ([sdcore-helm-charts](https://github.com/omec-project/sdcore-helm-charts#readme)), Jitsi Meet ([jitsi-helm](https://github.com/jitsi-contrib/jitsi-helm#readme)) and the OCUDU gNB ([ocudu-gnb chart](https://gitlab.com/ocudu/ocudu_elements/ocudu_helm/-/tree/main/charts/ocudu-gnb#readme), on GitLab). ## Why it fits the apisix chart 1. **An API gateway is part of today's telecom stack.** Operators expose network capabilities to developers as APIs: the 5G core's Network Exposure Function, the CAMARA APIs behind GSMA Open Gateway, and the CAPIF framework that governs them. Every one of those APIs sits behind an API gateway on Kubernetes that authenticates, rate-limits and routes the calls. That's APISIX's role, and the open source 5G stacks the badge already covers (free5GC, Aether SD-Core, the OCUDU gNB) are the network functions behind such APIs. 2. **The badge is the evidence operators look for.** Before an operator puts an open source component in its network, it wants to know how that component behaves on Kubernetes: whether it survives a node drain, shuts down cleanly, and runs without privileges. The badge answers that next to the install instructions: - the score is measured, not self-declared, and it links to the run behind it; - it's the same check and the same score as the 5G projects above, so the gateway can be compared with the functions it fronts; - it updates nightly, so it shows the chart as it is today, not as it was at a one-time review. 3. **It tests how the gateway behaves once it runs,** which `ci.yaml` (lint, docs and install) doesn't. It checks that APISIX: - comes back when its node is drained; - scales up and back; - stops cleanly on SIGTERM; - keeps the security posture the defaults promise: non-root, no privilege, no host mounts. Run nightly, it also catches what a pull request can't: a new APISIX image or a newer Kubernetes changing that behaviour. 4. **It already passes, thanks to #1016 and #1017.** Exec in standalone mode lets APISIX receive SIGTERM, and standalone mode now implies the data_plane role. Before those two merged, it didn't reach the pass mark. 5. **It's cheap and fits ASF rules.** 4 minutes on a GitHub-hosted runner, and no secrets. It uses only GitHub's own actions and `helm/kind-action` at the commit on the ASF allow list. The suite is a released binary downloaded from its GitHub release and checked against its SHA-256, so no third-party action needs to be approved. ## Example running on a fork **[martin-mat/apisix-helm-chart](https://github.com/martin-mat/apisix-helm-chart/actions/runs/38709756818)**: chart 2.18.2, APISIX 3.19.0, suite v2.3.0: **15 of 19, passed**. The chart is installed in standalone mode (`apisix.deployment.mode: standalone`, `etcd.enabled: false`). Everything else is the chart's default. That tests APISIX itself rather than the bundled etcd. The four tests that don't pass: - `liveness`: the APISIX container has a readiness probe but no liveness probe (see #951). - `cpu_limits` and `memory_limits`: `resources` is empty by default, as `values.yaml` recommends. - `specialized_init_system`: the image starts openresty without an init (tini, dumb-init) in front of it. ## Proposal - **Workflow:** `.github/workflows/cnti.yml`, nightly and by hand, on a kind cluster of a control plane and two workers, so `node_drain` has somewhere to move the pod. The suite's configuration goes in `.github/cnti/`. - **Pull requests:** the same steps, read-only, only on pull requests that change the job or its configuration. Chart changes stay with `ci.yaml`. - **Version pin:** a released suite version with its checksum, bumped on purpose, never `latest`. - **Badge:** the CNTi badge with the score (`CNTi essential 15/19`). Only runs on `master` publish it, to an orphan branch `badges`, so it never touches the chart's history. It shows how far the chart is from 19, not just pass or fail, and links to the run behind it. - **Where it goes:** the root `README.md`, under the title. ## Question Would you like the CNTi essential check and badge for the apisix chart? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
