miki3421 opened a new pull request, #235: URL: https://github.com/apache/openserverless-task/pull/235
Replace the duplicated ingress-nginx and cert-manager manifests with checksum-verified, pinned Helm charts. Existing provider tasks delegate to a shared Bun runner while preserving controller versions, provider-specific settings, and K3s Traefik. Existing manifest installations require explicit `--adopt`: the runner checks original manifest fingerprints and live configuration before transferring ownership. Ingress Service addresses and node ports are retained during adoption. cert-manager CRDs remain outside Helm; uninstall preserves CRDs, Issuers, Certificates and TLS Secrets. Validated legacy CRDs receive ownership metadata so reinstall does not require adopting them again. Deployment rollouts are explicitly awaited after Helm completes. Also updates chart caching/rendering and image discovery, removes eight copied manifests, and adds lifecycle and real-chart rendering tests. The K3s version update in #232 is excluded from this PR. Addresses apache/openserverless#254. Validation: - 36 Bun tests passed (186 assertions), including chart rendering for Kind/EKS/AKS/GKE and cert-manager. License headers: 197 valid, 0 invalid; whitespace checks passed. - Kind: ingress adoption, stable Service UID/IP/ports, repeat install, uninstall/reinstall and HTTP 200; all 55 application Ingress objects retained identity/specification. cert-manager installation/adoption, repeat install, certificate issuance, uninstall preservation and reinstall/new issuance passed. - Kind application suite: 14 SUCCESS results, including actual HTTP SSO mock login/action execution. SSL and localhost static checks are skipped by that suite; certificate issuance was tested separately. - Existing K3s v1.36.4+k3s1: cert-manager adoption and full uninstall/reinstall lifecycle passed, including preserved resource UIDs/Secret data and new certificate issuance. Traefik and all seven original application Ingress objects remained unchanged. Used the matching K3s kubectl client. - K3s application checks: 11/12 passed, including runtime tests and HTTP SSO mock. Cloud provisioning and domain-changing TLS scripts were deliberately excluded; tests used the existing cluster. Known validation limitation: K3s `7-static.sh` fails because it expects the old static-distributor welcome sentence. The returned page matches `oplugins-op/deploy/content/index.html` byte for byte; the expected sentence is in a different asset, `oplugins/util/upload/assets/index.html`. The assertion and application content have not been changed to hide this failure. Real cloud LoadBalancer/NLB behavior on AKS/EKS/GKE and real Keycloak integration were not tested. Chart pins intentionally preserve the previous versions; upgrading components or replacing the retired ingress-nginx controller is separate work. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
