CI: workload cluster gitops workflow, tests required Keycloak and Vault resources (!8090) · Merge requests · Sylva-projects / sylva-core

What does this MR do and why?

Given a team and a user defined as in sylva-projects/sylva-elements/ci-tooling/ci-deployment-values!426 (83a588e5), the present MR tests that the required Keycloak and Vault resources are present and have a correct status. The OIDC workflow is not tested. However the tests ensure that OIDC workflow is possible

See results

uv run sylva-test-framework run -- --mgmt-cluster-kubeconfig=... --category gitops
tests/test_gitops.py::test_vault_config_custom_resources PASSED                                                                                                                           
tests/test_gitops.py::test_keycloak_config_custom_resources PASSED

uv run sylva-test-framework run -- --mgmt-cluster-kubeconfig=... --category unit-tests
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_happy_path_all_values_found PASSED                                                                                 [  5%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_returns_none_when_no_team_with_vault_write_group PASSED                                                            [ 11%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_returns_none_group_when_team_has_no_keycloak_group PASSED                                                          [ 16%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_returns_none_user_when_group_has_no_members PASSED                                                                 [ 22%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_returns_none_user_when_all_members_disabled PASSED                                                                 [ 27%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_missing_workload_team_defs_key_returns_all_none PASSED                                                             [ 33%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_missing_keycloak_values_key_returns_team_and_group_but_no_user PASSED                                              [ 38%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_missing_all_keys_returns_all_none PASSED                                                                           [ 44%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_selects_first_matching_team PASSED                                                                                 [ 50%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_picks_first_enabled_user_in_group PASSED                                                                           [ 55%]
tests/test_gitops_unit_tests.py::TestGetTestValuesFromMgmtValues::test_skips_disabled_users_when_finding_enabled_user PASSED                                                              [ 61%]
tests/test_gitops_unit_tests.py::TestAssertCorrectConditions::test_passes_when_matching_condition_found PASSED                                                                            [ 66%]
tests/test_gitops_unit_tests.py::TestAssertCorrectConditions::test_passes_when_multiple_keys_match PASSED                                                                                 [ 72%]
tests/test_gitops_unit_tests.py::TestAssertCorrectConditions::test_raises_when_no_matching_condition PASSED                                                                               [ 77%]
tests/test_gitops_unit_tests.py::TestAssertCorrectConditions::test_raises_when_conditions_list_is_empty PASSED                                                                            [ 83%]
tests/test_gitops_unit_tests.py::TestAssertCorrectConditions::test_partial_key_match_is_not_sufficient PASSED                                                                             [ 88%]
tests/test_gitops_unit_tests.py::TestAssertCorrectConditions::test_passes_when_one_of_multiple_conditions_matches PASSED                                                                  [ 94%]
tests/test_gitops_unit_tests.py::TestAssertCorrectConditions::test_missing_expected_key_in_condition_is_no_match PASSED                                                                   [100%]

Technical details

Fixtures are used to generate custom resource GVKs (group, version, kind). These GVKs can be registered in kr8s client.
Expected gitops parameters (ex: user, team, etc.) are dynamically computed
Tests are conditionned to prequisites (unit activation, correct values) in order to run them when no gitops settings are set
Unit tests for test helpers

See &111

Test coverage

✅ See https://gitlab.com/sylva-projects/sylva-core/-/pipelines/2590982292 (Thanos failed because the thanos unit is not deployed)

CI configuration

Below you can choose test deployment variants to run in this MR's CI.

Click to open to CI configuration

Legend:

Icon	Meaning	Available values
☁️	Infra Provider	`capd`, `capo`, `capm3`
🚀	Bootstrap Provider	`kubeadm` (alias `kadm`), `rke2`, `okd`, `ck8s`
🐧	Node OS	`ubuntu`, `suse`, `na`, `leapmicro`
🛠️	Deployment Options	Deployment option list and description
🎬	Pipeline Scenarios	Available scenario list and description
🟢	Enabled units	Any available units name, by default apply to management and workload cluster. Can be prefixed by `mgmt:` or `wkld:` to be applied only to a specific cluster type
🔴	Disabled units	Any available units name, by default apply to management and workload cluster. Can be prefixed by `mgmt:` or `wkld:` to be applied only to a specific cluster type
🏗️	Target platform	Can be used to select specific deployment environment Available platform list and description
⚡	Pipeline control	`autorun`, `manual` or `blocking`. Can be used to override global config and start a deployment pipeline the required way

Global config for deployment pipelines

autorun pipelines
allow failure on pipelines
record sylvactl events

Notes:

Enabling autorun will make deployment pipelines to be run automatically without human interaction
Disabling allow failure will make deployment pipelines mandatory for pipeline success.
if both autorun and allow failure are disabled, deployment pipelines will need manual triggering but will be blocking the pipeline

Be aware: after configuration change, pipeline is not triggered automatically. Please run it manually (by clicking the run pipeline button in Pipelines tab) or push new code.

Edited Jul 09, 2026 by Loic Nicolle

CI: workload cluster gitops workflow, tests required Keycloak and Vault resources

What does this MR do and why?

Technical details

Related reference(s)

Test coverage

CI configuration

Global config for deployment pipelines

Merge request reports