feat: checksum annotations (#938)

mikhail-klimko · mikhail-klimko · commit 30dca955ddd7 · 2025-11-18T19:38:03.000+03:00
diff --git a/charts/gitops-runtime/templates/app-proxy/deployment.yaml b/charts/gitops-runtime/templates/app-proxy/deployment.yaml
@@ -6,6 +6,9 @@
 {{- $_ := set $appProxyContext.Values "redis" (get .Values "redis") }}
 {{- $_ := set $appProxyContext.Values "redis-ha" (get .Values "redis-ha") }}
 
+{{- $_ := set $appProxyContext.Values.podAnnotations "checksum/config-codefresh-cm" (include (print $.Template.BasePath "/codefresh-cm.yaml") . | sha256sum) }}
+{{- $_ := set $appProxyContext.Values.podAnnotations "checksum/config-cap-app-proxy" (include (print $.Template.BasePath "/app-proxy/config.yaml") . | sha256sum) }}
+
 {{/* Merge environment variables with the ones in _app-proxy-env.yaml */}}
 {{- $mainContainerMergedValues := mergeOverwrite $appProxyContext.Values.env (include "codefresh-gitops-runtime.app-proxy.calculated-env-vars" . | fromYaml) }}
 {{- $_ := set $appProxyContext.Values "env" $mainContainerMergedValues }}
diff --git a/charts/gitops-runtime/templates/argo-gateway/configmap.yaml b/charts/gitops-runtime/templates/argo-gateway/configmap.yaml
@@ -15,8 +15,3 @@ metadata:
     {{- include "argo-gateway.labels" . | nindent 4 }}
 data:
   {{- $mergedConfig | toYaml | nindent 2 }}
-  {{- if index .Values "argo-cd" "enabled" }}
-  foo: bar
-  {{- else }}
-  baz: qux
-  {{- end }}
diff --git a/charts/gitops-runtime/templates/argo-gateway/deployment.yaml b/charts/gitops-runtime/templates/argo-gateway/deployment.yaml
@@ -21,8 +21,10 @@ spec:
       {{- include "argo-gateway.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with $context.Values.podAnnotations }}
       annotations:
+        checksum/config-argo-gateway: {{ include (print $.Template.BasePath "/argo-gateway/configmap.yaml") . | sha256sum }}
+        checksum/config-codefresh-cm: {{ include (print $.Template.BasePath "/codefresh-cm.yaml") . | sha256sum }}
+      {{- with $context.Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
diff --git a/charts/gitops-runtime/templates/event-reporters/cluster-event-reporter/deployment.yaml b/charts/gitops-runtime/templates/event-reporters/cluster-event-reporter/deployment.yaml
@@ -25,8 +25,13 @@ spec:
       {{- include "cluster-event-reporter.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with $context.Values.podAnnotations }}
       annotations:
+        checksum/config-event-reporter: {{ include (print $.Template.BasePath "/event-reporters/cluster-event-reporter/configmap.yaml") . | sha256sum }}
+        checksum/config-codefresh-cm: {{ include (print $.Template.BasePath "/codefresh-cm.yaml") . | sha256sum }}
+        {{- if index .Values "argo-cd" "enabled" }}
+        checksum/config-argocd: {{ include ("argo-cd.config.params") (index .Subcharts "argo-cd") | sha256sum }}
+        {{- end }}
+      {{- with $context.Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
diff --git a/charts/gitops-runtime/templates/event-reporters/runtime-event-reporter/deployment.yaml b/charts/gitops-runtime/templates/event-reporters/runtime-event-reporter/deployment.yaml
@@ -25,8 +25,13 @@ spec:
       {{- include "runtime-event-reporter.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with $context.Values.podAnnotations }}
       annotations:
+        checksum/config-event-reporter: {{ include (print $.Template.BasePath "/event-reporters/runtime-event-reporter/configmap.yaml") . | sha256sum }}
+        checksum/config-codefresh-cm: {{ include (print $.Template.BasePath "/codefresh-cm.yaml") . | sha256sum }}
+        {{- if index .Values "argo-cd" "enabled" }}
+        checksum/config-argocd: {{ include ("argo-cd.config.params") (index .Subcharts "argo-cd") | sha256sum }}
+        {{- end }}
+      {{- with $context.Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
diff --git a/charts/gitops-runtime/tests/app-proxy-hosted_test.yaml b/charts/gitops-runtime/tests/app-proxy-hosted_test.yaml
@@ -2,6 +2,9 @@ suite: Test hosted runtime flow in app-proxy
 templates:
   - app-proxy/deployment.yaml
   - app-proxy/config.yaml
+  - _components/cap-app-proxy/_deployment.yaml
+  - _components/cap-app-proxy/_config.yaml
+  - codefresh-cm.yaml
 tests:
 - it: accountId appears in app-proxy env if provided - used in hosted
   template: 'app-proxy/deployment.yaml'
@@ -26,7 +29,7 @@ tests:
     global.codefresh.accountId: ""
   asserts:
   - failedTemplate:
-      errorMessage: 'global.codefresh.accountId must be provided for hosted runtimes'
+      errorMessage: 'global.codefresh.accountId is required for tunnel based runtime'
 
 - it: accountId appears in app-proxy env and runtime type is HELM_HOSTED
   template: 'app-proxy/deployment.yaml'
@@ -66,4 +69,4 @@ tests:
       path: spec.template.spec.containers[0].env
       content:
         name: INSTALLATION_TYPE
-        value: "HELM_HOSTED"
+        value: "HELM_HOSTED"
diff --git a/charts/gitops-runtime/tests/app-proxy-image-enrichemnt_test.yaml b/charts/gitops-runtime/tests/app-proxy-image-enrichemnt_test.yaml
@@ -5,6 +5,9 @@ templates:
   - app-proxy/enrichment/sa.yaml
   - app-proxy/enrichment/rbac.yaml
   - app-proxy/enrichment/enforce-workflows-enabled.yaml
+  - _components/cap-app-proxy/_deployment.yaml
+  - _components/cap-app-proxy/_config.yaml
+  - codefresh-cm.yaml
 tests:
 - it: Fail template if enrichment is enabled and workflows disabled
   template: 'app-proxy/enrichment/enforce-workflows-enabled.yaml'
diff --git a/charts/gitops-runtime/tests/app-proxy-misc_test.yaml b/charts/gitops-runtime/tests/app-proxy-misc_test.yaml
@@ -3,6 +3,9 @@ suite: misc tests on app-proxy templates generation
 templates:
   - app-proxy/deployment.yaml
   - app-proxy/config.yaml
+  - _components/cap-app-proxy/_deployment.yaml
+  - _components/cap-app-proxy/_config.yaml
+  - codefresh-cm.yaml
 tests:
 - it: overriding of environment variables on main container
   template: 'app-proxy/deployment.yaml'
@@ -222,7 +225,7 @@ tests:
         mountPath: /my-secret
 
 - it: Fail template if runtime name not provided
-  template: 'app-proxy/config.yaml'
+  template: 'app-proxy/deployment.yaml'
   set:
     global.codefresh.userToken.token: dummy
     global.codefresh.accountId: asddd
diff --git a/charts/gitops-runtime/tests/argo-api-gateway_test.yaml b/charts/gitops-runtime/tests/argo-api-gateway_test.yaml
@@ -2,6 +2,7 @@
 suite: argo-gateway tests
 templates:
   - argo-gateway/**
+  - codefresh-cm.yaml
 tests:
   - it: Argo Api Gateway ConfigMap should have valid data
     template: argo-gateway/configmap.yaml
diff --git a/charts/gitops-runtime/tests/checksum_test.yaml b/charts/gitops-runtime/tests/checksum_test.yaml
@@ -0,0 +1,78 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
+suite: checksum tests
+templates:
+  - event-reporters/**/deployment.yaml
+  - event-reporters/**/configmap.yaml
+  - argo-gateway/deployment.yaml
+  - argo-gateway/configmap.yaml
+  - app-proxy/deployment.yaml
+  - app-proxy/config.yaml
+  - _components/cap-app-proxy/_deployment.yaml
+  - _components/cap-app-proxy/_config.yaml
+  - codefresh-cm.yaml
+tests:
+- it: default checksum annotations is present
+  values:
+  - ./values/mandatory-values-ingress.yaml
+  asserts:
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-argo-gateway"]
+      value: ab112b8010e1534e8b45f746764af03ca4e7c9fa5cd0a01f04830e0a6c6e77e1
+    template: argo-gateway/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-codefresh-cm"]
+      value: 4fa7b6b4939725018068441ee7ea7ec594c30d6e58020fdaa89b07ca9515b650
+    template: argo-gateway/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-event-reporter"]
+      value: d016ba2b10b22e24da8854027d4e3fccfe02ee3db4441512ba38a0eb34e124f5
+    template: event-reporters/cluster-event-reporter/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-codefresh-cm"]
+      value: 4fa7b6b4939725018068441ee7ea7ec594c30d6e58020fdaa89b07ca9515b650
+    template: event-reporters/cluster-event-reporter/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-argocd"]
+      value: 4ae1efd920b2b1b83a9b74fabd84defe9869f7c66a444bcfd4ce7dbb5cb846c8
+    template: event-reporters/cluster-event-reporter/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-cap-app-proxy"]
+      value: 8963a9c81220fd8440ccc4e8675be794c83988751fd0d8591c60b2cd3923fbd4
+    template: app-proxy/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-codefresh-cm"]
+      value: 4fa7b6b4939725018068441ee7ea7ec594c30d6e58020fdaa89b07ca9515b650
+    template: app-proxy/deployment.yaml
+
+- it: checksum annotations should change when configmap changes
+  template: argo-gateway/deployment.yaml
+  set:
+    argo-cd.enabled: false
+    global.integrations.argo-cd.server.svc: my-argocd-server
+  values:
+  - ./values/mandatory-values-ingress.yaml
+  asserts:
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-argo-gateway"]
+      value: 89ba18c028caf3aafa73763816296570ec6d82afafa8744419773a4be6d84aff
+    template: argo-gateway/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-codefresh-cm"]
+      value: 6fc94d431ae6064fddc76734ec7c66d8b60af02cb22d9b1298e8403a8adcda82
+    template: argo-gateway/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-event-reporter"]
+      value: e76508c530cbb199da90e2dfee0ecb4b6ce79ed86e2b5368c3d670b5ccc9fbe2
+    template: event-reporters/cluster-event-reporter/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-codefresh-cm"]
+      value: 6fc94d431ae6064fddc76734ec7c66d8b60af02cb22d9b1298e8403a8adcda82
+    template: event-reporters/cluster-event-reporter/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-cap-app-proxy"]
+      value: b302ea8929baccb98f9b0086987f76de6e3591e72f356915d951e6a6437611f6
+    template: app-proxy/deployment.yaml
+  - equal:
+      path: spec.template.metadata.annotations["checksum/config-codefresh-cm"]
+      value: 6fc94d431ae6064fddc76734ec7c66d8b60af02cb22d9b1298e8403a8adcda82
+    template: app-proxy/deployment.yaml
diff --git a/charts/gitops-runtime/tests/custom-ca_test.yaml b/charts/gitops-runtime/tests/custom-ca_test.yaml
@@ -4,9 +4,13 @@ templates:
   - tls-custom-ca/codefresh-tls-certs.yaml
   - tls-custom-ca/workflow-pipelines-git-webhooks.yaml
   - app-proxy/deployment.yaml
+  - app-proxy/config.yaml
   - hooks/pre-uninstall/delete-runtime-from-platform.yaml
   - gitops-operator/*
   - _components/gitops-operator/*
+  - _components/cap-app-proxy/_deployment.yaml
+  - _components/cap-app-proxy/_config.yaml
+  - codefresh-cm.yaml
 tests:
 
 - it: test chart created secret contents - default secret key
diff --git a/charts/gitops-runtime/tests/event-reporters_test.yaml b/charts/gitops-runtime/tests/event-reporters_test.yaml
@@ -2,6 +2,7 @@
 suite: argo-gateway tests
 templates:
   - event-reporters/**/*.yaml
+  - codefresh-cm.yaml
 tests:
   - it: Runtime Reporter should be deployed with forked ArgoCD
     template: event-reporters/runtime-event-reporter/deployment.yaml
diff --git a/charts/gitops-runtime/tests/global_constraints_test.yaml b/charts/gitops-runtime/tests/global_constraints_test.yaml
@@ -1,6 +1,7 @@
 suite: Test global constraints (nodeSelector, tolerations)
 templates:
   - app-proxy/deployment.yaml
+  - app-proxy/config.yaml
   - gitops-operator/*
   - event-reporters/**
   - argo-gateway/**
@@ -15,6 +16,9 @@ templates:
   - charts/argo-events/*
   - charts/argo-rollouts/*
   - charts/argo-workflows/*
+  - _components/cap-app-proxy/_deployment.yaml
+  - _components/cap-app-proxy/_config.yaml
+  - codefresh-cm.yaml
 values:
   - ./values/mandatory-values.yaml
 tests:
diff --git a/charts/gitops-runtime/tests/installation-token_test.yaml b/charts/gitops-runtime/tests/installation-token_test.yaml
@@ -1,7 +1,11 @@
 suite: test installation token in app proxy
 templates:
   - app-proxy/deployment.yaml
+  - app-proxy/config.yaml
   - installation-token-secret.yaml
+  - _components/cap-app-proxy/_deployment.yaml
+  - _components/cap-app-proxy/_config.yaml
+  - codefresh-cm.yaml
 
 tests:
 - it: app proxy plain string value
diff --git a/charts/gitops-runtime/tests/redis_test.yaml b/charts/gitops-runtime/tests/redis_test.yaml
@@ -3,8 +3,12 @@ suite: redis tests
 templates:
   - cf-argocd-extras/**/*.yaml
   - app-proxy/deployment.yaml
+  - app-proxy/config.yaml
   - redis/**
   - charts/redis-ha/**
+  - _components/cap-app-proxy/_deployment.yaml
+  - _components/cap-app-proxy/_config.yaml
+  - codefresh-cm.yaml
 tests:
   - it: Standalone Redis Deployment should be created by when redis.enabled is true
     template: redis/deployment.yaml
diff --git a/charts/gitops-runtime/tests/runtime-gitcredentials_test.yaml b/charts/gitops-runtime/tests/runtime-gitcredentials_test.yaml
@@ -1,8 +1,11 @@
 suite: test runtime git credentials in app proxy
 templates:
   - app-proxy/deployment.yaml
+  - app-proxy/config.yaml
   - git-password-secret.yaml
-
+  - _components/cap-app-proxy/_deployment.yaml
+  - _components/cap-app-proxy/_config.yaml
+  - codefresh-cm.yaml
 tests:
 - it: secret created for plain text value
   template: 'git-password-secret.yaml'
