HelmRelease Verifier

Small Python CLI to verify Flux HelmRelease deployments via the Kubernetes API and publish JUnit-compatible results.

Local Run

Prerequisites:

• Python 3.11+
• kubeconfig/context with access to target cluster

Single release (pipeline-like):

uv run helmrelease-verifier verify \
  -r <release> \
  -e <app-version> \
  -o ./results.xml

If -n/--namespace is omitted, the current kube context namespace is used.

Short alias (same command, fewer keystrokes):

uv run hrv verify -r <release> -e <app-version>

Dynamic pytest sweep across HelmReleases:

uv run hrv verify -A -r "api|service"

All targets in current namespace (omit -r):

uv run hrv verify -o pytest-report.html

All targets in all namespaces:

uv run hrv verify -A -o pytest-report.html

Controller selection (repeatable):

uv run hrv verify -A -c flux -c argo -r "sample"

Current Argo CD support is a discovery and pytest stub path. It is intended as extension scaffolding and reports argo.stub test cases.

Default sweep behavior: no rollout waiting (-w 0). This is ideal for full-cluster audits.

Optional bounded wait per release (seconds):

uv run hrv verify -A -w 30

Optional parallel execution:

uv run hrv verify -A -P 4

Namespace and release filtering:

uv run hrv verify -n "^(dev|stage|prod)-apps$" -r "service$"

Generated by discovery mode:

• Default HTML report: pytest-report.html
• Override/add outputs with -o:
  • .html => pytest HTML report
  • .xml => JUnit XML
• Examples:
  • -o pytest-report.html
  • -o results.xml
  • -o pytest-report.html -o results.xml

Using pipx (from repo checkout):

pipx run --spec . helmrelease-verifier -h

Run tests:

uv run pytest

Tool unit tests do not generate an HTML report by default.

If needed:

uv run pytest --html=pytest-report.html --self-contained-html

CI Integration Examples

Ready-to-copy examples:

• GitHub Actions: examples/github-actions/verify-helmreleases.yml
• Azure DevOps Pipelines: examples/azure-pipelines/verify-helmreleases.yml

Both examples publish the dynamic pytest HTML report as build artifact and fail the job when one or more HelmReleases fail verification. Both examples intentionally use uv for consistent developer and CI behavior; PyPI publishing is handled by the release workflow.

Repository workflows:

• CI: .github/workflows/ci.yml
• Release to PyPI (tag-triggered): .github/workflows/release.yml