Validate the Helm Charts

helm repo add cnpg https://cloudnative-pg.github.io/charts
helm repo add nats https://nats-io.github.io/k8s/helm/charts/
helm repo add rustfs https://charts.rustfs.com
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo add jetstack https://charts.jetstack.io
helm repo update

helm dependency build ./deploy/charts/tektona-control-plane
helm dependency build ./deploy/charts/tektona-runner

# The registry holds no image tagged with the chart version, so a chart built
# from the repository needs the tag. A chart pulled from the registry does not.
global:
  imageTag: "<commit sha>"
  imagePullSecrets:
    - name: "regcred"

domains:
  api: "api.example.com"
  app: "app.example.com"
  sandboxIngress: "sandbox.example.com"
  agentlinkTrustDomain: "agentlink.example.com"
  # The API refuses to start without these two.
  vnc: "vnc.example.com"
  sshWebsocket: "ssh.example.com"
  # The address that the CLI dials for direct SSH access.
  sshHost: "ssh.example.com"

cluster:
  # Must equal location in the runner file.
  sandboxLocation: "eu"

database:
  host: "postgres.example.com"
  name: "platform_api"
  existingSecret: "tektona-database"

messaging:
  url: "nats://nats.example.com:4222"
  # The chart always creates the JetStream streams. They are custom resources,
  # and this installs the NATS resource controller that reconciles them.
  controller:
    deploy: true

nack:
  jetstream:
    nats:
      # The controller needs the server address of its own.
      url: "nats://nats.example.com:4222"

objectStorage:
  endpoint: "https://s3.example.com"
  bucket: "tektona-sandboxes"
  existingSecret: "tektona-object-storage"

# See Configure Sign-On for a Microsoft Entra ID example.
auth:
  issuer: "https://auth.example.com"
  # Both URLs come from <issuer>/.well-known/openid-configuration.
  jwksUrl: "https://auth.example.com/.well-known/jwks.json"
  userinfoUrl: "https://auth.example.com/userinfo"
  existingSecret: "tektona-oidc"
  sessionSecret: "tektona-session"

credentials:
  masterSecret: "tektona-credentials"

sandboxGateway:
  certificate:
    create: true

global:
  imageTag: "<commit sha>"
  imagePullSecrets:
    - name: "regcred"

location: "eu"

sandboxRunner:
  # kvm, or tcg for a node that cannot offer hardware virtualization.
  # There is no default: see Runner Node Requirements.
  acceleration: "kvm"

domains:
  sandboxIngress: "sandbox.example.com"
  agentlinkTrustDomain: "agentlink.example.com"

messaging:
  url: "nats://nats.example.com:4222"

objectStorage:
  endpoint: "https://s3.example.com"
  bucket: "tektona-sandboxes"
  existingSecret: "tektona-object-storage"

sandboxGateway:
  hostKeySecret: "tektona-access-gateway-host-key"

egress:
  certificate:
    # The inspection sidecar of the egress gateway needs this authority. Set
    # egress.injectCaSecret instead when you bring your own.
    create: true

agentGateway:
  certificate:
    # No chart creates this certificate unless you ask for it.
    create: true

helm template tektona-control-plane ./deploy/charts/tektona-control-plane \
  --namespace tektona-system --values values-control-plane.yaml > /dev/null
helm template tektona-runner ./deploy/charts/tektona-runner \
  --namespace tektona-system --values values-runner.yaml > /dev/null

Error: execution error at (tektona-control-plane/templates/platform-api-deployment.yaml:136:24): domains.vnc is required

helm template tektona-control-plane ./deploy/charts/tektona-control-plane \
  --namespace tektona-system \
  --values values-control-plane.yaml > rendered-control-plane.yaml

grep -oE 'image: "[^"]+"' rendered-control-plane.yaml | sort -u

{ grep -A1 'secretKeyRef:' rendered-control-plane.yaml | grep -oE 'name: [A-Za-z0-9._-]+'
  grep -oE 'secretName: [A-Za-z0-9._-]+' rendered-control-plane.yaml
} | awk '{print $2}' | sort -u > required-secrets.txt

helm template tektona-runner ./deploy/charts/tektona-runner \
  --namespace tektona-system \
  --values values-runner.yaml > rendered-runner.yaml

while read -r name; do
  kubectl get secret "$name" --namespace tektona-system > /dev/null 2>&1 \
    || echo "missing: $name"
done < required-secrets.txt

helm install tektona-control-plane ./deploy/charts/tektona-control-plane \
  --namespace tektona-system --create-namespace \
  --values values-control-plane.yaml \
  --dry-run=server

kubectl label node <node> tektona.ai/sandbox-runner=true
kubectl get nodes --selector tektona.ai/sandbox-runner=true

lsmod | grep vhost_vsock
ls -l /dev/kvm /dev/net/tun

helm install tektona-control-plane ./deploy/charts/tektona-control-plane \
  --namespace tektona-system --create-namespace \
  --values values-control-plane.yaml --wait --timeout 10m

helm install tektona-runner ./deploy/charts/tektona-runner \
  --namespace tektona-system \
  --values values-runner.yaml --wait --timeout 10m

kubectl get events --namespace tektona-system --sort-by .lastTimestamp | tail -20

kubectl get pods --namespace tektona-system \
  --selector app.kubernetes.io/instance=tektona-control-plane
kubectl get pods --namespace tektona-system \
  --selector app.kubernetes.io/instance=tektona-runner

kubectl port-forward --namespace tektona-system \
  service/tektona-control-plane-platform-api 9090:9090 &
sleep 2
curl --silent --show-error --fail http://localhost:9090/readyz && echo " ready"
kill %1

kubectl port-forward --namespace tektona-system \
  service/tektona-control-plane-platform-api 9090:9090 &
sleep 2
# 1 means a registered worker holds a session to the engine.
curl --silent http://localhost:9090/metrics \
  | grep tektona_template_build_engine_connected
kill %1

tektona template ls

tektona login
tektona sandbox create tektona/desktop
tektona sandbox ls
tektona sandbox ssh <sandbox-id>

tektona sandbox rm <sandbox-id>