ci: add lint ci for helm chart.

.github/workflows/lint-chart.yaml

@@ -0,0 +1,81 @@
+# validate any chart changes under charts directory
+name: Chart Lint
+
+env:
+  HELM_VERSION: v3.11.2
+  KIND_VERSION: v0.23.0
+  KIND_NODE_IMAGE: kindest/node:v1.30.0
+  K8S_VERSION: v1.30.0
+
+on:
+  push:
+    # Exclude branches created by Dependabot to avoid triggering current workflow
+    # for PRs initiated by Dependabot.
+    branches-ignore:
+      - 'dependabot/**'
+    paths:
+      - "kwok/charts/**"
+  pull_request:
+    paths:
+      - "kwok/charts/**"
+
+permissions:
+  contents: read
+
+jobs:
+  chart-lint-test:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
+        with:
+          version: ${{ env.HELM_VERSION }}
+
+      - name: Run chart-testing (template)
+        run: |
+          helm template --dependency-update ./kwok/charts --debug > /dev/null   
+
+      # Python is required because `ct lint` runs Yamale (https://github.com/23andMe/Yamale) and
+      # yamllint (https://github.com/adrienverge/yamllint) which require Python
+      - name: Set up Python
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1
+        with:
+          python-version: "3.10"
+          check-latest: true
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992
+
+      - name: Add dependency chart repos
+        run: |
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$( ct list-changed --target-branch ${{ github.event.repository.default_branch }})
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Run chart-testing (lint)
+        if: steps.list-changed.outputs.changed == 'true'
+        run: ct lint --debug --check-version-increment=false --target-branch ${{ github.event.repository.default_branch }}
+
+      - name: Create kind cluster
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
+        if: steps.list-changed.outputs.changed == 'true'
+        with:
+          wait: 120s
+          version: ${{ env.KIND_VERSION }}
+          node_image: ${{ env.KIND_NODE_IMAGE }}
+          kubectl_version: ${{ env.K8S_VERSION }}
+
+      - name: Run chart-testing (install)
+        if: steps.list-changed.outputs.changed == 'true'
+        run: ct install --debug --helm-extra-args "--timeout 800s" --target-branch ${{ github.event.repository.default_branch }}

kwok/charts/templates/role.yaml

@@ -75,4 +75,4 @@ rules:
   # Write
   - apiGroups: ["coordination.k8s.io"]
     resources: ["leases"]
-    verbs: ["delete"]
+    verbs: ["delete"]

kwok/charts/templates/secret-webhook-cert.yaml

@@ -11,4 +11,4 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 # data: {} # Injected by karpenter-webhook
-{{- end }}
+{{- end }}