chart: add invite users feature flag

.github/workflows/ci.yml

@@ -55,6 +55,9 @@ jobs:
       - name: 'Autoscaler unit configuration'
         run: bash test/autoscaler-unit.sh
 
+      - name: 'Invite users feature flag'
+        run: bash test/invite-users.sh
+
       - name: 'Install kubeconform'
         run: |
           curl -sSL -o /tmp/kubeconform.tar.gz \

README.md

@@ -118,6 +118,7 @@ production-ready set of values except for the `secrets` portion.
 | `services.icc.features.risk_service_dump.enable` | Enable long-term storage for the risk service | false | No |
 | `services.icc.features.ffc.enable` | Fussion, Fission & Cascade | false | No |
 | `services.icc.features.scaler_trends_learning.enable` | Enable scaler trend learning | false | No |
+| `services.icc.features.invite_users.enable` | Allow super-admins to invite users by email from Settings > Users | false | No |
 | `services.icc.features.skew_protection.enable` | Enable version skew protection via Gateway API (opt-in, see [Requirements](#gateway-api-skew-protection)) | false | No |
 | `services.icc.features.skew_protection.auto_cleanup` | Delete expired Deployment and Service resources | false | No |
 | `services.icc.features.skew_protection.http_grace_period_ms` | Min time to keep an HTTP version draining | 1800000 | No |

chart/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: helm
-version: 4.3.0
+version: 4.4.0
 kubeVersion: ">= 1.30.0-0"
 description: Platformatic microservices
 type: application

chart/templates/deployment/_icc.yaml

@@ -109,6 +109,8 @@ spec:
               value: "{{ .features.scaler_trends_learning.enable | default false | toString }}"
             - name: PLT_FEATURE_SKEW_PROTECTION
               value: "{{ .features.skew_protection.enable | default false | toString }}"
+            - name: PLT_FEATURE_INVITE_USERS
+              value: '{{ dig "features" "invite_users" "enable" false . | toString }}'
             - name: PLT_SKEW_AUTO_CLEANUP
               value: "{{ dig "features" "skew_protection" "auto_cleanup" false . | toString }}"
             {{- with dig "features" "skew_protection" "http_grace_period_ms" nil . }}

chart/values.yaml

@@ -81,6 +81,8 @@ services:
         enable: false
       scaler_trends_learning:
         enable: false
+      invite_users:
+        enable: false                        # Show "Invite users" in Settings > Users
       deployer:
         enable: false                        # ICC deployer creates workloads via the deploy API (Deployments/Services/pull Secrets). Off = observe-only, least privilege
       skew_protection:

test/invite-users.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+CHART_DIR="$ROOT_DIR/chart"
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+invite_users() {
+  awk '
+    $1 == "-" && $2 == "name:" && $3 == "PLT_FEATURE_INVITE_USERS" { found = 1; next }
+    found && $1 == "value:" { gsub(/["\047]/, "", $2); print $2; exit }
+  '
+}
+
+required_values=(
+  --set-string services.icc.database_url=postgres://user:pass@db:5432
+  --set-string services.icc.valkey.apps_url=redis://valkey:6379/0
+  --set-string services.icc.valkey.icc_url=redis://valkey:6379/1
+  --set-string services.icc.prometheus.url=http://prometheus:9090
+)
+
+default_value=$(helm template invite-users "$CHART_DIR" \
+  --kube-version 1.30.0 \
+  "${required_values[@]}" | invite_users)
+
+[[ "$default_value" == 'false' ]] || \
+  fail "default invite users flag is $default_value, expected false"
+
+enabled_value=$(helm template invite-users "$CHART_DIR" \
+  --kube-version 1.30.0 \
+  "${required_values[@]}" \
+  --set services.icc.features.invite_users.enable=true | invite_users)
+
+[[ "$enabled_value" == 'true' ]] || \
+  fail "enabled invite users flag is $enabled_value, expected true"
+
+# Values files written before this option existed have no invite_users key.
+missing_value=$(helm template invite-users "$CHART_DIR" \
+  --kube-version 1.30.0 \
+  "${required_values[@]}" \
+  --set services.icc.features.invite_users=null | invite_users)
+
+[[ "$missing_value" == 'false' ]] || \
+  fail "invite users flag without the key is $missing_value, expected false"
+
+echo 'Invite users tests passed'