Review Helm

Deploys a Helm chart as a GitLab review environment and removes it when the review environment stops.

The component expects a Helm chart artifact under release/charts/ from needs-start, renders any configured values files with environment substitution, and runs helm upgrade --install against the selected namespace. After a successful deploy, it reads the first Ingress host in the namespace and writes it to review.env as CI_ENVIRONMENT_HOST, so GitLab can set the environment URL from the dotenv report.

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/helm@$CI_COMMIT_SHA
    inputs:
      name: my-app
      path: chart
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/review-helm@$CI_COMMIT_SHA
    inputs:
      release: my-app
      namespace: "$CI_ENVIRONMENT_SLUG"
      create-namespace: true
      value-files:
        - chart/values.review.yaml
      set-parameters:
        - image.tag=$CI_COMMIT_SHA
      needs-start:
        - job: build:helm:my-app
          artifacts: true

Set create-namespace: true when the component should create and delete the namespace for the review release. Keep it false when the namespace lifecycle is managed outside this component.

Helm tests are enabled by default. The component discovers and runs chart resources annotated with helm.sh/hook: test after installation. Set helm-test-enabled: false only when these tests are intentionally managed elsewhere. The start job lists the discovered hooks, captures helm test --logs, and publishes release/review-helm-tests.xml as a GitLab JUnit report. Charts without test hooks produce an empty successful test suite.

Both start and stop jobs capture namespace resources, events, selected workload status fields, Helm release metadata, and the last 300 lines from every pod container under release/review-diagnostics/. The diagnostic status summaries omit workload environment values, command arguments, annotations, release values, rendered manifests, hooks, and release notes. Application logs and events remain unchanged. Start-job failures trigger the same best-effort collection before the job exits, while the stop job records diagnostics before removing the release or namespace.

Kubernetes service account

The GitLab CI variable KUBECONFIG must point to a service account that can read the target namespace, manage the Helm release resources, and read Ingress resources so the component can discover the review URL.

Raw Helm hook manifests are temporary discovery input only. They are removed before test execution and are not included in the report artifacts. Hook retrieval or parsing failures fail the job instead of reporting an empty successful test suite.

Inputs

Name	Description	Default	Type
---	---	---	---
context	Kubernetes context to use for the review release.		string
create-namespace	Create and delete the namespace with the Helm test namespace helpers.	false	boolean
environment	GitLab environment prefix.	int	string
environment-identifier	GitLab environment suffix like `/$CI_PIPELINE_IID-$CI_COMMIT_SHORT_SHA`. CI variables are expanded before use.		string
helm-test-enabled	Run Helm test hooks after the review release is installed and publish their result as JUnit.	true	boolean
name	The name prefix for review start and stop jobs.	review-helm	string
namespace	Kubernetes namespace for the review release.	$CI_ENVIRONMENT_SLUG	string
needs-start	Jobs that provide the Helm chart artifact.	[{"job":"build:helm:helm","artifacts":true}]	array
needs-stop	Jobs that the stop job depends on.	[]	array
release	Helm release name.	$CI_PROJECT_NAME	string
rules	The rules to determine when to run the review process.	[{"if":"$CI_PIPELINE_SOURCE == \"schedule\"","when":"never"},{"if":"$CI_COMMIT_TAG =~ $CI_PATTERN_SEMVER","when":"never"},{"when":"always"}]	array
set-parameters	Helm --set parameters as key=value entries.	[]	array
stage	Pipeline stage for review Helm jobs.	test	string
tag			string
timeout	Timeout for Helm install, upgrade, and stop operations.	20m	string
value-files	Helm values files to pass to the review release.	[]	array