test: headlamp test

.claude/skills

@@ -0,0 +1 @@
+../.github/skills

.github/copilot-instructions.md

@@ -31,44 +31,12 @@ All Helmfile specs in `helmfile.d/` execute alphabetically. Use reusable anchors
 
 All user-configurable parameters MUST be defined in `values-schema.yaml` (JSON Schema). Run `npm run validate-values` to validate. The schema serves as both validation and documentation.
 
-## CLI Commands & Workflow
-
-### Essential Commands
-
-```bash
-# Bootstrap a new values repo (creates $ENV_DIR with defaults)
-otomi bootstrap
-
-# Validate user configuration against schema
-otomi validate-values
-
-# Validate rendered Kubernetes manifests
-otomi validate-templates [-l name=myapp]
-
-# Render values for inspection
-otomi values
-
-# Render chart values for a specific app
-otomi x helmfile -l name=myapp write-values
-
-# Deploy all charts (or use -l name=myapp for selective deploy)
-otomi apply [-l name=myapp]
-
-# Generate diff before applying
-otomi diff [-l name=myapp]
-
-# Deploy to cluster (initial setup)
-otomi install
-```
-
 ### Development Setup
 
 ```bash
 # Install dependencies (helmfile, helm, kubectl, etc.)
 npm run install-deps
 
-# Run CLI locally (bypass Docker)
-export IN_DOCKER=false
 export ENV_DIR=$PWD/tests/fixtures
 export NODE_ENV=test
 
@@ -111,6 +79,16 @@ The `binzx/otomi` script wraps all commands in Docker by default:
 - Template validation: `otomi validate-templates` (validates all rendered manifests against K8s schemas)
 - Policy tests: `npm run test:opa` (Rego policy testing)
 
+### Mandatory Template Diff Check
+
+When changing files under `charts/`, `values/`, or `helmfile.d/`, always run:
+
+```bash
+bin/compare.sh
+```
+
+Review and summarize rendered diffs before finalizing changes.
+
 ## Key Files & Directories
 
 | Path                   | Purpose                                      |

.github/skills/apl-add-app-ingress/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: apl-add-app-ingress
+description: Configure public exposure for a selected app by updating core namespace/admin app configuration and optionally scaffolding HTTPRoute auth-redirects plus authentication/authorization resources.
+argument-hint: <name> [--configure-public-security true|false]
+---
+
+# Configure Public App Exposure
+
+## Quick start
+
+1. Ask for required input: app name.
+2. Ask if HTTPRoute auth-redirects + authentication/authorization scaffolding should be created.
+3. Run:
+
+```bash
+npx tsx ci/src/configure-public-exposure.ts <name> [--configure-public-security true|false]
+```
+
+4. Validate:
+
+Use `/apl-test-gotemplate-renders` skill to validate Go template rendering.
+
+## Workflow
+
+Checklist:
+
+- [ ] Confirm selected app name.
+- [ ] Confirm whether to scaffold public-security resources.
+- [ ] Ensure namespace is configured for public exposure in core.yaml.
+- [ ] Ensure adminApps entry exists in core.yaml.
+- [ ] If security scaffolding is enabled, add `<name>-artifacts` release in the app Helmfile.
+- [ ] If security scaffolding is enabled, create values/<name>/<name>-raw.gotmpl with an HTTPRoute named `<name>-auth-redirects`.
+- [ ] If security scaffolding is enabled, ensure values/<name>/<name>.gotmpl defines podLabels with `otomi.io/auth: platform` and `otomi.io/auth-policy: platform`.
+- [ ] Run validation and template-diff checks.
+- [ ] Summarize touched files and rendered diffs.
+
+## Notes
+
+- The script expects an existing Helmfile release named `<name>` when `--configure-public-security` is true.
+- The script is idempotent for existing entries and files.
+- Main implementation is in ci/src/configure-public-exposure.ts.
+- .github/skills/add-app-ingress/scripts/add-app-ingress.sh is a compatibility wrapper.

.github/skills/apl-add-app/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: apl-add-app
+description: Add and wire a new Helm chart into APL Core by updating chart index, vendoring the chart, scaffolding Helmfile/defaults/values files, and running required validation checks. Use when adding a new app chart and the user provides or asks for name and repository; the script resolves the latest official stable semver chart version automatically.
+argument-hint: <name> <repository>
+---
+
+# Add Helm Chart
+
+## Quick start
+
+1. Ask for required inputs: chart name and chart repository.
+2. Run:
+
+```bash
+npx tsx ci/src/add-app-helm-chart.ts <name> <repository>
+```
+
+3. Validate:
+
+Use `/apl-test-gotemplate-renders` skill to validate Go template rendering.
+
+## Workflow
+
+Checklist:
+
+- [ ] Collect required parameters: name and repository.
+- [ ] Resolve latest official stable semver chart version automatically.
+- [ ] Keep chart name, app key, release name, and namespace identical.
+- [ ] Add dependency entry in chart/chart-index/Chart.yaml.
+- [ ] Vendor chart into charts/<name>/.
+- [ ] Create a new Helmfile file with the next highest numeric prefix in helmfile.d.
+- [ ] Add Helmfile release stanza in that new file using \*default anchor.
+- [ ] Always add namespace entry in core.yaml.
+- [ ] Add empty defaults entry in helmfile.d/snippets/defaults.yaml in alphabetical order.
+- [ ] Create values/<name>/<name>.gotmpl.
+- [ ] Add tests fixture app file in tests/fixtures/env/apps/<name>.yaml with enabled: true.
+- [ ] Add corresponding app entries in tests/integration/\*.yaml with enabled: false.
+- [ ] If public exposure is needed, run the apl-add-app-ingressskill afterward.
+- [ ] Run schema and template-diff checks.
+- [ ] Summarize generated diffs and touched files.
+
+## Notes
+
+- Default release anchor used by script is \*default.
+- Script is idempotent for existing entries and directories.
+- New Chart.yaml dependency entry is inserted in alphabetical order by dependency name.
+- If chart source is OCI, repository should be oci://... (script pulls from <repository>/<name>).
+- Chart version is auto-selected as latest stable semver; pre-release versions are ignored.
+- Main implementation is in ci/src/add-app-helm-chart.ts.
+- .github/skills/apl-add-app/scripts/add-app-helm-chart.sh is a compatibility wrapper.
+- Script confirms rendering path by running bin/compare.sh.

.github/skills/apl-test-gotemplate-renders/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: apl-test-gotemplate-renders
+description: Enforces rendered Go template comparison before and after templating-related changes using bin/compare.sh.
+---
+
+# Compare Go Template Renders
+
+## Quick start
+
+1. Make your code changes.
+2. export ENV_DIR=$PWD/tests/fixtures (if not already set)
+3. Run:
+
+```bash
+bin/compare.sh
+```
+
+3. Review diffs in rendered output and confirm they match intent.
+
+## Workflows
+
+### Standard workflow for templating changes
+
+- [ ] Run `bin/compare.sh` after making changes.
+- [ ] Inspect before/after rendered template differences.
+- [ ] Verify differences are expected and limited to intended behavior.
+- [ ] If unexpected diffs appear, revise changes and rerun `bin/compare.sh`.
+- [ ] Include a brief summary of observed render diffs in your report/PR notes.
+
+### Scope guardrail
+
+Use it only when changes affect `charts/**`, `values/**`, or `helmfile.d/**`

.github/workflows/ci-helm-chart.yml

@@ -60,7 +60,11 @@ jobs:
       - name: Install packages
         run: |
           cd ci/
-          npm install
+          npm ci
+      - name: Run CI script tests
+        run: |
+          cd ci/
+          npm run tests
       - name: Update helm charts
         env:
           CI_UPDATE_TYPE: ${{ inputs.CI_UPDATE_TYPE }}

.vscode/settings.json

@@ -60,5 +60,13 @@
   },
   "[dockerfile]": {
     "editor.defaultFormatter": "ms-azuretools.vscode-docker"
+  },
+  "chat.tools.terminal.autoApprove": {
+    "npx tsx ci/src/configure-public-exposure.ts": true,
+    "npx tsx ci/src/add-app-helm-chart.ts": true,
+    "export ENV_DIR=$PWD/tests/fixtures": true,
+    "bin/compare.sh": true,
+    "npm run validate-values": true,
+    "npm run validate-templates": true
   }
 }

AGENTS.md

@@ -0,0 +1,15 @@
+# TDD
+
+## Mandatory Template Diff Check
+
+When code changes any file under `charts/`, `values/`, or `helmfile.d/`, run:
+
+if no ENV_DIR is set then
+
+```bash
+
+export ENV_DIR=$PWD/tests/fixtures
+bin/compare.sh
+```
+
+Review and summarize the rendered diffs before finalizing changes.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

bin/dyff.sh

@@ -92,10 +92,46 @@ echo "$diff_output" | while read -r line; do
   elif [[ $line =~ ^Only[[:space:]]+in[[:space:]]+(.+):[[:space:]]+(.+)$ ]]; then
     only_in_dir="${BASH_REMATCH[1]}"
     only_in_file="${BASH_REMATCH[2]}"
+    full_path="$only_in_dir/$only_in_file"
+
     if [[ "$only_in_dir" == "$targetDirA"* ]]; then
-      print_comment "New file added: $(join_relative_path "$(to_relative_path "$only_in_dir" "$targetDirA")" "$only_in_file")"
+      file_path=$(join_relative_path "$(to_relative_path "$only_in_dir" "$targetDirA")" "$only_in_file")
+      if [[ -d "$full_path" ]]; then
+        print_comment "New directory added: $file_path"
+        # Recursively show all files in the new directory
+        find "$full_path" -type f | sort | while read -r new_file; do
+          rel_file=$(to_relative_path "$new_file" "$targetDirA")
+          print_comment "  New file: $rel_file"
+          dyff between /dev/null "$new_file" --omit-header \
+            --exclude "data.tls.key" --exclude "/data/ca.crt" --exclude "/data/tls.crt" --exclude "/data/tls.key" \
+            --exclude-regexp "/checksum" --exclude-regexp "/webhooks.*" --ignore-order-changes "${miscArgs[@]}" || true
+        done
+      else
+        print_comment "New file added: $file_path"
+        # Show the contents of the new file
+        dyff between /dev/null "$full_path" --omit-header \
+          --exclude "data.tls.key" --exclude "/data/ca.crt" --exclude "/data/tls.crt" --exclude "/data/tls.key" \
+          --exclude-regexp "/checksum" --exclude-regexp "/webhooks.*" --ignore-order-changes "${miscArgs[@]}" || true
+      fi
     elif [[ "$only_in_dir" == "$targetDirB"* ]]; then
-      print_comment "Old file deleted: $(join_relative_path "$(to_relative_path "$only_in_dir" "$targetDirB")" "$only_in_file")"
+      file_path=$(join_relative_path "$(to_relative_path "$only_in_dir" "$targetDirB")" "$only_in_file")
+      if [[ -d "$full_path" ]]; then
+        print_comment "Old directory deleted: $file_path"
+        # Recursively show all files in the deleted directory
+        find "$full_path" -type f | sort | while read -r old_file; do
+          rel_file=$(to_relative_path "$old_file" "$targetDirB")
+          print_comment "  Old file: $rel_file"
+          dyff between "$old_file" /dev/null --omit-header \
+            --exclude "data.tls.key" --exclude "/data/ca.crt" --exclude "/data/tls.crt" --exclude "/data/tls.key" \
+            --exclude-regexp "/checksum" --exclude-regexp "/webhooks.*" --ignore-order-changes "${miscArgs[@]}" || true
+        done
+      else
+        print_comment "Old file deleted: $file_path"
+        # Show the contents of the deleted file
+        dyff between "$full_path" /dev/null --omit-header \
+          --exclude "data.tls.key" --exclude "/data/ca.crt" --exclude "/data/tls.crt" --exclude "/data/tls.key" \
+          --exclude-regexp "/checksum" --exclude-regexp "/webhooks.*" --ignore-order-changes "${miscArgs[@]}" || true
+      fi
     else
       print_comment "$line"
     fi

chart/chart-index/Chart.yaml

@@ -17,6 +17,9 @@ dependencies:
   - name: cloudnative-pg
     version: 0.28.3
     repository: https://cloudnative-pg.github.io/charts
+  - name: headlamp
+    version: 0.44.0
+    repository: https://kubernetes-sigs.github.io/headlamp/
   - name: plugin-barman-cloud
     alias: cloudnative-pg-plugin-barman-cloud
     version: 0.6.0
@@ -114,3 +117,4 @@ dependencies:
   - name: trivy-operator
     version: 0.32.1
     repository: https://aquasecurity.github.io/helm-charts/
+

charts/headlamp/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/headlamp/Chart.yaml

@@ -0,0 +1,43 @@
+annotations:
+  artifacthub.io/category: monitoring-logging
+  artifacthub.io/license: Apache-2.0
+  artifacthub.io/screenshots: |
+    - title: Cluster Overview
+      url: https://raw.githubusercontent.com/kubernetes-sigs/headlamp/screenshots/screenshots/cluster_overview.png
+    - title: Cluster Chooser
+      url: https://raw.githubusercontent.com/kubernetes-sigs/headlamp/screenshots/screenshots/cluster_chooser.png
+    - title: Nodes
+      url: https://raw.githubusercontent.com/kubernetes-sigs/headlamp/screenshots/screenshots/nodes.png
+    - title: Resource edition
+      url: https://raw.githubusercontent.com/kubernetes-sigs/headlamp/screenshots/screenshots/resource_edition.png
+    - title: Editor Documentation
+      url: https://raw.githubusercontent.com/kubernetes-sigs/headlamp/screenshots/screenshots/editor_documentation.png
+    - title: Terminal
+      url: https://raw.githubusercontent.com/kubernetes-sigs/headlamp/screenshots/screenshots/terminal.png
+  artifacthub.io/signKey: |
+    fingerprint: 2956B7F7167769370C93730C7264DA7B85D08A37
+    url: https://keys.openpgp.org/vks/v1/by-fingerprint/2956B7F7167769370C93730C7264DA7B85D08A37
+apiVersion: v2
+appVersion: 0.44.0
+description: Headlamp is an easy-to-use and extensible Kubernetes web UI.
+home: https://headlamp.dev/
+icon: https://raw.githubusercontent.com/kubernetes-sigs/headlamp/main/docs/headlamp_light.svg
+keywords:
+- kubernetes
+- plugins
+- kinvolk
+- headlamp
+- dashboard
+- ui
+- web
+- monitoring
+- logging
+maintainers:
+- name: kinvolk
+  url: https://kinvolk.io/
+name: headlamp
+sources:
+- https://github.com/kubernetes-sigs/headlamp/tree/main/charts/headlamp
+- https://github.com/kubernetes-sigs/headlamp
+type: application
+version: 0.44.0