packs: prep for namespace provisioner — simulate, reconciler, e2e, chart, beginner examples

.github/workflows/validate-pr.yml

@@ -190,3 +190,22 @@ jobs:
           echo "=== ReconcilerProbe ===" && kubectl get reconcilerprobe probe -o yaml || true
           echo "=== All resources in default ===" && kubectl get all || true
           echo "=== Operator logs ===" && kubectl logs -l app.kubernetes.io/name=orkestra --tail=100 || true
+
+  # ── Fixture: Orkestra Helm chart ────────────────────────────────────────────
+  # Runs only when the chart or its fixtures change.
+  # Installs the chart into a kind cluster via ork e2e and asserts infrastructure.
+  fixture-chart:
+    name: Fixture — Orkestra chart (kind cluster)
+    runs-on: ubuntu-latest
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      contains(github.event.pull_request.changed_files, 'charts/')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Run chart e2e
+        uses: orkspace/orkestra-action@main
+        with:
+          working-directory: charts/orkestra
+          e2e: "true"

charts/orkestra/Chart.yaml

@@ -7,7 +7,7 @@ description: >-
   Control Center. Runtime and Gateway deploy independently.
 type: application
 version: 1.7.7
-appVersion: "v0.7.7"
+appVersion: "0.7.7"
 
 keywords:
   - orkestra

charts/orkestra/e2e.yaml

@@ -0,0 +1,141 @@
+apiVersion: orkestra.orkspace.io/v1
+kind: E2E
+metadata:
+  name: orkestra-chart-e2e
+  description: >
+    custom.target: kubernetes — Orkestra Helm chart installed via setup.helm
+    with gateway enabled. CRD, bundle, and fixture CR are applied before the
+    chart so Orkestra reconciles on first boot. Asserts that all three
+    deployments are ready, that conditional templates are not created when their
+    flags are off (default values), and that the runtime reconciles the fixture
+    CR producing a Deployment and Service.
+
+spec:
+  custom:
+    target: kubernetes
+
+  cluster:
+    provider: kind
+    name: ork-chart-e2e
+    reuse: false
+
+  setup:
+    apply:
+      - path: fixtures/crd.yaml
+        wait:
+          - kind: CustomResourceDefinition
+            name: websites.demo.orkestra.io
+            timeout: 30s
+      - path: fixtures/orkestra-bundle.yaml
+        wait:
+          - kind: ConfigMap
+            name: orkestra-katalog
+            namespace: orkestra-system
+            timeout: 30s
+      - path: fixtures/cr.yaml
+        wait:
+          - kind: Website
+            name: hello-website
+            namespace: default
+            timeout: 30s
+    helm:
+      - chart: ./
+        release: orkestra
+        namespace: orkestra-system
+        createNamespace: true
+        values:
+          gateway.enabled: true
+        wait:
+          - kind: Deployment
+            name: orkestra-runtime
+            namespace: orkestra-system
+            ready: true
+            timeout: 120s
+          - kind: Deployment
+            name: orkestra-gateway
+            namespace: orkestra-system
+            ready: true
+            timeout: 120s
+          - kind: Deployment
+            name: orkestra-cc
+            namespace: orkestra-system
+            ready: true
+            timeout: 120s
+
+  expect:
+    - name: All three deployments are ready
+      after: setup-complete
+      timeout: 120s
+      resources:
+        - kind: Deployment
+          name: orkestra-runtime
+          namespace: orkestra-system
+          ready: true
+        - kind: Deployment
+          name: orkestra-gateway
+          namespace: orkestra-system
+          ready: true
+        - kind: Deployment
+          name: orkestra-cc
+          namespace: orkestra-system
+          ready: true
+
+    - name: Services created for runtime, gateway, and control center
+      after: setup-complete
+      timeout: 30s
+      resources:
+        - kind: Service
+          name: orkestra-runtime
+          namespace: orkestra-system
+        - kind: Service
+          name: orkestra-gateway
+          namespace: orkestra-system
+        - kind: Service
+          name: orkestra-cc
+          namespace: orkestra-system
+
+    - name: PodDisruptionBudgets created (runtime, gateway, and cc — enabled by default)
+      after: setup-complete
+      timeout: 30s
+      resources:
+        - kind: PodDisruptionBudget
+          name: orkestra-runtime
+          namespace: orkestra-system
+        - kind: PodDisruptionBudget
+          name: orkestra-gateway
+          namespace: orkestra-system
+        - kind: PodDisruptionBudget
+          name: orkestra-cc
+          namespace: orkestra-system
+
+    - name: Ingress not created (controlCenter.ingress.enabled defaults to false)
+      after: setup-complete
+      timeout: 30s
+      resources:
+        - kind: Ingress
+          namespace: orkestra-system
+          count: 0
+
+    - name: NetworkPolicies not created (networkPolicy.enabled defaults to false)
+      timeout: 30s
+      resources:
+        - kind: NetworkPolicy
+          namespace: orkestra-system
+          count: 0
+
+    - name: Namespace protection webhook registered by gateway
+      timeout: 60s
+      resources:
+        - kind: ValidatingWebhookConfiguration
+          name: orkestra-namespace-protection
+
+    - name: Runtime reconciles fixture CR — Deployment and Service created
+      timeout: 90s
+      resources:
+        - kind: Deployment
+          name: hello-website
+          namespace: default
+          ready: true
+        - kind: Service
+          name: hello-website-svc
+          namespace: default

charts/orkestra/fixtures/cr.yaml

@@ -0,0 +1,9 @@
+apiVersion: demo.orkestra.io/v1alpha1
+kind: Website
+metadata:
+  name: hello-website
+  namespace: default
+spec:
+  image: nginx:1.25
+  replicas: 1
+  port: 80

charts/orkestra/fixtures/crd.yaml

@@ -0,0 +1,36 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: websites.demo.orkestra.io
+spec:
+  group: demo.orkestra.io
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              required: [image]
+              properties:
+                image:
+                  type: string
+                replicas:
+                  type: integer
+                  default: 1
+                port:
+                  type: integer
+                  default: 80
+            status:
+              type: object
+              x-kubernetes-preserve-unknown-fields: true
+  names:
+    kind: Website
+    plural: websites
+    singular: website
+  scope: Namespaced

charts/orkestra/fixtures/katalog.yaml

@@ -0,0 +1,45 @@
+apiVersion: orkestra.orkspace.io/v1
+kind: Katalog
+metadata:
+  name: hello-website
+  version: 0.1.0
+  description: Fixture katalog for chart e2e — one CRD, one Deployment, one Service.
+
+security:
+  namespaceProtection:
+    enabled: true
+    cleanupOnShutdown: true
+
+gateway:
+  enabled: true
+
+spec:
+  crds:
+    website:
+      apiTypes:
+          group: demo.orkestra.io
+          version: v1alpha1
+          kind: Website
+          plural: websites
+      allowedNamespaces:
+        - default
+
+      operatorBox:
+        status:
+          fields:
+            - path: phase
+              value: "Running"
+
+        onCreate:
+          deployments:
+            - name: "{{ .metadata.name }}"
+              image: "{{ .spec.image }}"
+              replicas: "{{ .spec.replicas }}"
+              port: "{{ .spec.port }}"
+              reconcile: true
+
+          services:
+            - name: "{{ .metadata.name }}-svc"
+              port: "80"
+              targetPort: "{{ .spec.port }}"
+              reconcile: true