Proposal: a nightly CNTi essential-tests check and badge for the eUPF chart #668

Summary

We'd like to propose a nightly GitHub Actions job that installs the eUPF chart with its defaults on a kind cluster, runs the CNTi Test Suite's essential tests against it, and shows the result as a badge in the README. It runs on a fork in 4 minutes. On main today the chart passes 14 of 19 essential tests, one short of the pass mark of 15. With #666 it passes 15 of 19.

CNTi and the test suite

The Cloud Native Telecom Initiative (CNTi) is an LF Networking project that works on cloud native practices for network functions on Kubernetes. Its test suite installs a workload on a cluster and checks it while it runs: probes, SIGTERM handling, rolling updates and rollbacks, scaling, draining a node, and the security posture of the pods. The essential tests are 19 of them, with a pass mark of 15. testsuite-action runs them in a repository's own CI and publishes the result as a badge.

Examples of projects show the badge from their own CI today:

• Aether SD-Core, a 5G core control plane from OMEC: omec-project/sdcore-helm-charts, nightly since 2 October, 16 of 19.
• OCUDU gNB, a 5G RAN: ocudu_helm, on merge requests and main since 10 October, 19 of 19, through the GitLab CI/CD component.
• Jitsi Meet: jitsi-contrib/jitsi-helm, nightly since 2 October, 18 of 19.

eUPF would be the first user plane function with one.

Why it fits eUPF

1. It guards what fix(helm): make default values produce a startable pod (#645) #649 just fixed. The chart's defaults now start a working UPF. The nightly job installs exactly those defaults and fails if they stop working: a new image, a values change, a newer Kubernetes.
2. It checks what the existing CI doesn't. build.yml, test.yml and the security scan check the code and the manifests. The essential tests check the running pod: that it comes back after a node drain, scales up and back, rolls an image forward and back, stops cleanly on SIGTERM, has working probes and limits, and keeps a reasonable security posture.
3. It's cheap. Four minutes on ubuntu-latest, no secrets, no change to the chart.
4. A visible signal for operators. eUPF is tested with free5GC, Open5GS and OAI. People who assemble those stacks on Kubernetes look for this kind of evidence, and the badge shows it next to the build and test badges, with the run behind it.

Where the chart stands

Measured on a fork, chart defaults, suite v2.2.0. The only cluster setting is net.ipv4.ip_forward allowed on the kind kubelets, as the chart README asks.

The tests that don't pass, and why:

Proposal

• Workflow: .github/workflows/cnti.yml, nightly and by hand on main, with the suite and kind configuration in .github/cnti/. The same steps run read-only on pull requests that change the job or its configuration; chart changes don't trigger it.
• Version pin: a released suite version, bumped on purpose after reading the release notes, never latest.
• Badge: the CNTi essential badge with the score, published by the action to an orphan branch badges, in the README's badge row. Only runs on main get a write token for it. It shows how close the chart is to the full 19, not just pass or fail, and links to the run behind it. GitHub's plain workflow badge is also possible, as Jitsi chose.
• Order: merging fix(helm): default to the documented capability set instead of privileged #666 first means the badge goes live green at 15 of 19.

Questions

1. Would you like the nightly essential-tests check and the badge in this repository?
2. Anything you'd like done differently in the job?