mirror of
https://github.com/kubevela/kubevela.git
synced 2026-07-29 18:31:22 +00:00
dependabot/go_modules/github.com/buger/jsonparser-1.1.2
1985 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Kavish
|
f47468ecb0 |
Refactor: Use updated StepStatusCache (#7246)
* Refactor: Use updated StepStatusCache. Signed-off-by: kash2104 <kparikh1104@gmail.com> * Feat: Use MemoryCacheStore from centralized package. Signed-off-by: kash2104 <kparikh1104@gmail.com> * Perf: Deprecate MemoryCacheStore cache. Signed-off-by: kash2104 <kparikh1104@gmail.com> * Test: Initialize StepStatusCache before test starts. Signed-off-by: kash2104 <kparikh1104@gmail.com> * Build: Update kubevela/pkg version to use cache package. Signed-off-by: kash2104 <kparikh1104@gmail.com> * Build: Update kubevela/workflow to use StepStatusCache functions. Signed-off-by: kash2104 <kparikh1104@gmail.com> * Test: Increase test coverage for StepStatusCache. Signed-off-by: kash2104 <kparikh1104@gmail.com> --------- Signed-off-by: kash2104 <kparikh1104@gmail.com> |
||
sakirr
|
3a4e09e1c4 |
Test: add table-driven tests for CUEGenerator enum evaluation edge cases (#7188)
* Test: add table-driven tests for CUEGenerator enum evaluation edge cases Signed-off-by: sakirr05 <sakirahmed75531@gmail.com> * Chore: retrigger e2e tests Signed-off-by: sakirr05 <sakirahmed75531@gmail.com> --------- Signed-off-by: sakirr05 <sakirahmed75531@gmail.com> Co-authored-by: sakirr05 <sakirahmed75531@gmail.com> |
||
Shaurya Srivastava
|
50c3223ce3 |
Feat: add configurable HTTP timeout to request, webhook, and notification steps (#7243)
* Feat: expose HTTP timeout on built-in workflow steps Allow request, webhook, and notification steps to set an optional timeout (Go duration string) that is forwarded to http.#HTTPDo as request.timeout, so slow HTTP calls are no longer stuck at the 3s default. Signed-off-by: shaurya2k06 <shaurya2k06@gmail.com> * Feat: Made requested changes Signed-off-by: shaurya2k06 <shaurya2k06@gmail.com> * Fix: align timeout duration regex with Go ParseDuration Accept "0" and leading-dot fractions like ".5s", matching time.ParseDuration more closely while still rejecting unit-less values such as "30". Signed-off-by: shaurya2k06 <shaurya2k06@gmail.com> --------- Signed-off-by: shaurya2k06 <shaurya2k06@gmail.com> |
||
Anas Khan
|
39183d5ba3 |
Fix(addon): correct metadata.yaml filename in addon validation errors (#7224)
The addon package validator reported the required manifest as `matadata.yaml` in two of its error messages, telling addon authors to fix a file that does not exist. The correct filename is `metadata.yaml` (see the MetadataFileName constant and the sibling error on the missing-manifest branch, which already spell it right). Correct the two misspelled literals in validateAddonPackage and update the matching assertions in TestCheckAddonPackageValid, which already exercises the empty-name and empty-version branches. Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> |
||
Paranitharan Kalaiselvan
|
56e5cd5ff5 |
feat: support configurable timeout via request.timeout in http builtin (#7239)
Signed-off-by: Paranitharan Kalaiselvan <paranitharan_kalaiselvan@gmail.com> Co-authored-by: Paranitharan Kalaiselvan <paranitharan_kalaiselvan@gmail.com> |
||
|
Anas Khan
|
6fd0e71e50 |
Fix: prevent panics in ParseGitlab on malformed addon registry URLs (#7206)
ParseGitlab indexed the results of splitting the address without bounds checks, so a malformed (but repo-name-matching) GitLab registry URL crashed the controller/CLI instead of returning an error. Three inputs panic today: - https://gitlab.com/catalog -> slice bounds out of range [:-1] - https://gitlab.com/kubevela/catalog/tree -> index out of range [2] - https://catalog.gitlab.com/kubevela/foo -> index out of range [1] Add length/empty guards that return the existing invalid-format error (errInvalidFormatMsg, consistent with Parse) for the empty owner slice, the short host split, and the missing tree branch segment. Behaviour for all currently-valid inputs is unchanged. Also fix the caller NewAsyncReader, which dereferenced the returned content before checking the error: on any ParseGitlab error content is nil, so the assignment nil-panicked before the error could be returned. Move the error check above the dereference. Extend TestParseGitlab with the three malformed cases (wantErr). Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> |
||
|
Anas Khan
|
74c5724554 |
Fix: nil pointer panic in getMatchingDefinitionRevision on malformed revision version (#7207)
* Fix: nil pointer panic in getMatchingDefinitionRevision on malformed revision version getMatchingDefinitionRevision dereferenced the semver result (v.String()) before checking semver.NewVersion's parse error. A DefinitionRevision whose name carries the expected prefix but an unparseable version segment (e.g. configmap-component-v1.bad) made semver.NewVersion return (nil, err), so v.String() panicked instead of returning the error. Move the error check ahead of the map write so a bad version returns the error as intended. Valid input is unaffected. Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> * test: cover empty version segment in getMatchingDefinitionRevision Add a regression case for a DefinitionRevision whose version segment is empty (name ending in the definition name plus a trailing hyphen, e.g. configmap-component-). Such a name is filtered out by the revisionPrefix HasPrefix check before it reaches semver.NewVersion, and semver.NewVersion would return an error for an empty string anyway, so the same err != nil guard that fixes the malformed-version panic already rejects it cleanly. This locks in that behaviour and addresses the empty-segment edge case raised in review. Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> --------- Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> |
||
Ankit kumar
|
4f7d787871 |
Fix: make podDisruptive actually trigger pod restart . (#7231)
* fix: make podDisruptive actually trigger pod restart for outputs-based traits When a TraitDefinition sets podDisruptive: true but renders its output via outputs: (e.g. a ConfigMap) instead of patch:, the workload's pod was never restarted when the trait's content changed - podDisruptive was effectively a no-op. This adds propagatePodDisruptiveHash, called from SetOAMContract for every rendered trait. When the trait's TraitDefinition has podDisruptive: true and the target workload has a spec.template, a content hash of the trait's rendered output is stamped onto spec.template.metadata.annotations as app.oam.dev/trait-restart-hash-<traitType>. Since this lives inside spec.template, any change to the trait's content changes the pod template, causing the owning controller (Deployment/StatefulSet/...) to roll the pods automatically. Fixes #7204 Signed-off-by: Ankit Kumar <ankitkumarrain12@gmail.com> * fix: address cubic review for podDisruptive restart hash Harden annotation key length checks against the Kubernetes name-segment limit (63 chars after the slash) and document selective metadata hashing so user name/labels/annotations change the restart hash while controller/OAM revision churn does not. Expand unit coverage and drop a duplicate test case. Signed-off-by: Ankit Kumar <ankitkumarrain12@gmail.com> * Revert "fix: address cubic review for podDisruptive restart hash" This reverts commit d666da0024099b8935347137cac81609b7c1d84a. Signed-off-by: Ankit Kumar <ankitkumarrain12@gmail.com> --------- Signed-off-by: Ankit Kumar <ankitkumarrain12@gmail.com> |
||
|
Anas Khan
|
2f401979c4 |
Fix: reject non-revision names in ExtractRevision (#7210)
ExtractRevision parsed the last hyphen segment as the revision number without validating the name shape, so a bareword like "5" returned 5,nil and any name lacking a trailing v-prefixed segment silently mis-parsed instead of erroring. Mirror the existing ExtractRevisionNum guards: error with ErrBadRevision when there is no delimiter or the last segment is not v-prefixed. Extend the colocated bad-name test cases accordingly. Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com> |
||
Himanshu Singh
|
8bb75684c5 |
propagate CUE health-eval errors from GetStatus (#7226)
Signed-off-by: hisingh <hisingh@guidewire.com> Co-authored-by: hisingh <hisingh@guidewire.com> |
||
Jerrin Francis
|
a59bd39e72 |
feat: add configurable CUE compatibility upgrade controls (#7229)
Wire per-pass CUE compatibility toggles through controller config, CLI, and Helm values/docs; align validate behavior with enabled passes; add CLI --enable-all support; harden flag sync in wrappers; and bump github.com/kubevela/pkg to v1.11.1 plus github.com/kubevela/workflow to v0.7.2. Signed-off-by: Brian Kane <briankane1@gmail.com> Co-authored-by: Brian Kane <briankane1@gmail.com> |
||
Brian Kane
|
a1f26b01af |
feat: wire CUE version-compatibility engine into kubevela template loader (#7215)
- Bump github.com/kubevela/pkg to v1.11.0 and github.com/kubevela/workflow to v0.7.0 - Remove local replace directives for both modules - Wire EnableCUEVersionCompatibility as a pointer alias into the engine to eliminate data race - Add --enable-cue-version-compatibility and --cue-compatibility-cache-size flags via CUEConfig - Fix all call sites (webhooks, CLI def.go) to dereference the pointer alias correctly - Add individual revive-compliant doc comments on re-exported types - Add examples/legacy-upgrade-demo/ demonstrating runtime legacy list syntax rewriting Signed-off-by: Brian Kane <briankane1@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
Vishal Kumar
|
d7f67354f8 |
Feat: Added new deploy-components workflow step (#7213)
* feat(workflow): add deploy-components step for per-component multi-cluster targeting Adds a pure-CUE workflow-step definition that lets each component in an Application resolve its own target cluster(s) via topology policies, filling the gap between apply-component (single component, static cluster) and deploy (all components, cross-product against policies). Signed-off-by: vishal210893 <vishal210893@gmail.com> * chore(workflow): add rendered deploy-components WorkflowStepDefinition manifest Generated from vela-templates/definitions/internal/workflowstep/deploy-components.cue via make def-install, for installation as part of the vela-core Helm chart. Signed-off-by: vishal210893 <vishal210893@gmail.com> * test(e2e): add multicluster e2e for deploy-components step Covers per-component topology-policy targeting (each component lands only on its resolved cluster, no cross-product) and fast-fail validation when a referenced component name is not present in the application. Signed-off-by: vishal210893 <vishal210893@gmail.com> * docs(workflow): add example doc for deploy-components step Required by the definition-doc CI check for any new WorkflowStepDefinition. Signed-off-by: vishal210893 <vishal210893@gmail.com> * fix(workflow): normalize deploy-components import block to grouped form The rendered manifest was generated with flat "import X" lines; the project's CUE formatter (as used by CI's make reviewable) renders multi-import blocks grouped as import (...). Fixes the check-diff CI job. Signed-off-by: vishal210893 <vishal210893@gmail.com> * fix(workflow): gate deploy-components applies on validation to prevent partial rollout Previously, _missingComponents was derived from deploy's own realized keys, which meant an invalid component name could only be detected after applies for valid components had already started -- a partial rollout on failure. Compute _missingComponents directly from the loaded component set instead (via iteration, matching the pattern deploy itself already uses reliably -- an indexed lookup against the same field was empirically found to evaluate before the load task resolves, causing false positives), and wrap deploy in an if-guard so no component is applied unless every referenced name is valid. Verified against a live multicluster setup: the negative case now applies zero resources before failing, and the positive case is unaffected. Signed-off-by: vishal210893 <vishal210893@gmail.com> * style(workflow): tighten deploy-components comments Comments narrated the debugging history behind each constraint; state them as plain engineering facts instead. Signed-off-by: vishal210893 <vishal210893@gmail.com> * fix(workflow): correct mistyped #do string in multicluster.#GetPlacementsFromTopologyPolicies The exported CUE symbol's #do value ("get-placements-from-tmulticlusterology-policies") never matched the registered provider handler key ("get-placements-from-topology-policies"), making it unusable by any CUE template. Fix the string and rename the symbol to match. Unused elsewhere in the tree, so no other callers are affected. deploy-components keeps its own local copy (for backport safety) but now documents that it mirrors the corrected symbol. Signed-off-by: vishal210893 <vishal210893@gmail.com> * refactor(workflow): use the shared topology-placement symbol in deploy-components Now that multicluster.#GetPlacementsFromTopologyPolicies is fixed, drop the local #GetPlacements duplicate and reference the shared symbol directly. deploy-components is new in this release, so there's no backport scenario where it could ship without the fix landing alongside it. Verified against a live multicluster controller build: positive case resolves placements and applies correctly, negative case still gates deploy on validation with zero partial rollout. Signed-off-by: vishal210893 <vishal210893@gmail.com> --------- Signed-off-by: vishal210893 <vishal210893@gmail.com> |
||
|
Brian Kane
|
5a44b5f10c |
Feat: auto remediate cue issues (#7199)
* feat(cue/upgrade): auto-remediate legacy CUE syntax at render time
Transparently rewrite CUE templates that use deprecated list arithmetic
(+, *) and conflicting field names (error) so that older definitions
continue to work with CUE ≥ v0.14 (KubeVela ≥ 1.11).
- CUEUpgradeFunc registry with ID, CUE/KubeVela version guards, precheck,
and upgrade function fields
- upgradeListConcatenation: rewrites list1+list2 → list.Concat([list1,list2])
and list*n → list.Repeat(list, n); adds "list" import as needed
- collectAddChain + extractListConcatArgs: flatten left-associative + chains
and existing list.Concat([...]) leaves into a single flat call, so both
fresh chains (a+b+c+d) and partially-upgraded chains produce one
list.Concat([a,b,c,d]) with no nesting across repeated passes
- upgradeErrorFieldLabel: rewrites unquoted `error` field labels to "error"
to avoid conflict with the CUE 0.14 built-in; precheck uses a tighter
\berror\s*: regex to avoid false positives on identifiers like errorMessage
- EnsureCueVersionCompatibility: single entry point used at render time;
LRU cache with TTL eviction, Prometheus metrics, feature flag
- ParseVersion: regex anchored to reject garbage suffixes (e.g. "1.11foo")
while accepting pre-release+build metadata (e.g. "v1.13.0-alpha.1+dev")
- template.go: call EnsureCueVersionCompatibility for every template area
(main, health, custom status, status detail) with correct DefinitionKind
derived from which definition pointer is non-nil
- validate.go: upgrade policy templates before compiling in
validateNoRequiredParameters
- `vela def upgrade FILE [-o OUTPUT]`: upgrades a single .cue file
- `vela def upgrade FILE --validate [--quiet]`: exit 1 if upgrade needed
- `vela def compat definitions` / `vela def compat applications`: scan
cluster definitions/apps for compat issues; output as table or YAML
- Cyclomatic complexity kept below threshold by extracting scanDefinitions,
scanDefRevisions, buildDefCompatReport, scanApplications, scanAppRevision
as standalone functions with options structs
- revisionNum() helper for numeric vN comparison (avoids lexicographic bugs)
- mergeImports() dedup helper shared by ToCUEString and formatCUEString
- ANSI escape sequences replaced with fatih/color for portability
- goconst: "yaml" → outputFormatYAML named constant throughout
- Component, trait, and policy definition validating handlers: removed
spurious obj.Name argument from fmt.Sprintf in warning messages
- FromCUEString: only prepend importString to the stored template when
imports are non-empty; empty importString ("\n") was causing a leading
newline that made yaml.v3 use |2 block scalar on every generated YAML
- gen_sdk testdata: removed unused imports (vela/op, encoding/base64) from
one_of.cue that were exposed by our importString+templateString change
- e2e test: fix flaky trait-order assertion using ContainElements instead
of index-based equality
Upgraded all built-in .cue files that used deprecated list arithmetic:
- vela-templates/definitions/internal/component/cron-task.cue
- vela-templates/definitions/internal/trait/command.cue
- vela-templates/definitions/internal/trait/container-ports.cue
- vela-templates/definitions/internal/trait/env.cue
- vela-templates/definitions/internal/trait/init-container.cue
Removed unused stdlib imports that caused `def gen-api` to fail:
- vela-templates/definitions/internal/workflowstep/apply-deployment.cue
- vela-templates/definitions/internal/workflowstep/apply-terraform-provider.cue
- vela-templates/definitions/internal/workflowstep/build-push-image.cue
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
* fix(cue/upgrade): address PR review comments
- sync.atomic.Pointer for compatCache to fix data race on reinit
- SummaryVec → HistogramVec for both duration metrics (aggregatable
across HA replicas); buckets tuned to sub-millisecond upgrade path
and millisecond render path respectively
- errorFieldLabelRe: extend to match optional (?) and required (!)
field constraint markers before the colon
- cue-compatibility-cache-size: clamp negative values to 0 (disabled)
with warning log; document 0=disabled in flag help; cache put is
no-op when capacity <= 0
- webhook: replace RequiresUpgrade+EnsureCueVersionCompatibility double
parse with single EnsureCueVersionCompatibility call; use string
comparison to detect upgrade and emit warning
- def compat: log warning when ApplicationRevision fetch fails instead
of silently skipping (partial results are preserved)
- e2e: only delete definitions in DeferCleanup if this test created
them (avoid deleting pre-existing shared resources)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
* fix(cue/upgrade): address further PR review comments
- EnsureCueVersionCompatibility: return (string, bool) where bool
indicates semantic upgrades were applied (len(applied)>0), not
string inequality — prevents false-positive warnings from
formatting-only normalisation; update all call sites
- webhook handlers (component, trait, policy): switch from
RequiresUpgrade+EnsureCueVersionCompatibility double-call to single
EnsureCueVersionCompatibility call using wasUpgraded bool; remove
now-unused strings imports
- cache: skip eviction goroutine when capacity==0 (disabled); set
compatCacheCancel=nil on disabled path to avoid stale cancel on
next InitCompatibilityCache call
- e2e: replace boolean ownership tracking with createAndTrack helper
that checks pre-existence via Get before Create, eliminating both
the ambiguous-create leak and the boilerplate booleans
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
* fix: address reviewer comments — cache determinism, e2e ownership race
- cache: store normalised string in compatEntry.upgraded even when no
semantic fixes were applied, so cache-hit and cache-miss paths return
identical output (fixes non-deterministic behaviour flagged in review)
- upgrade: return entry.upgraded on the requiresUpgrade=false cache-hit
path instead of the raw input cueStr
- e2e: replace GET-then-CREATE ownership inference with atomic CREATE-
first pattern; err==nil means we created it (register DeferCleanup),
IsAlreadyExists means it pre-existed (skip cleanup), eliminating the
GET/CREATE race window that could misattribute ownership
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
---------
Signed-off-by: Brian Kane <briankane1@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
|
||
Ayush Kumar
|
5d19a031fa |
Fix: do not log or persist credentials embedded in Terraform module remote URLs (#7201)
The remote URL of a Terraform module can embed credentials (for example https://user:token@host/repo.git). The cache-reuse logic logged the raw URL and wrote it to the .remote-url cache marker, which could leak those credentials into controller logs and onto disk. Strip the userinfo from the URL before logging it and before writing the cache marker. The marker now stores a credential-free URL and the reuse check compares the same stripped form, so cache reuse and re-clone-on-change behave as before while no secret is persisted. Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com> |
||
|
Ayush Kumar
|
a10dba6d37 |
Fix: resolve gosec G304 lint failure in Terraform module cache check (#7190)
Wrap the cache remote marker read in filepath.Clean, the same pattern other os.ReadFile call sites in this repo use to satisfy gosec. The path is built from filepath.Join and a constant suffix, with the module name validated beforehand, so behavior is unchanged. The finding surfaced on master after the GHSA-fmgp-q6jx-gg3x merge because the advisory workflow did not run the full lint job. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> |
||
|
Ayush Kumar
|
f6a64398b5 |
Merge commit from fork
* fix: prevent unbounded read in Terraform remote configuration loader (GHSA-fmgp-q6jx-gg3x) * fix: bound remote Terraform clone and invalidate cache on rejection Follow-up hardening for GHSA-fmgp-q6jx-gg3x. Bound the clone of the attacker-supplied repository: shallow Depth:1, a 2-minute fetch timeout via PlainCloneContext, and post-clone caps on the retained tree size (64 MiB) and file count, rejecting and removing a clone that exceeds them. Invalidate the clone cache: re-clone when the recorded remote URL changes, and remove the cache on a failed clone or a rejected read so a corrected repository is re-fetched instead of a poisoned or stale tree being reused. Validate the module name before building the cache path, and log clone, rejection, and eviction events. |
||
goingforstudying-ctrl
|
8598986e4f |
feat(helm): set User-Agent when downloading Helm repo index.yaml (#7162)
Signed-off-by: goingforstudying-ctrl <goingforstudying@gmail.com> Co-authored-by: goingforstudying-ctrl <goingforstudying@ctrl.com> |
||
Anurag Pappula
|
24ae77d39f |
Fix(controller): set Ready condition to False on reconcile failure (#7168)
* fix(controller): set Ready condition to False on reconcile failure endWithNegativeCondition set only the failing sub-condition (e.g. Parsed=False/ReconcileError) but left the rollup Ready condition unchanged, so a reconcile failure left Ready at True/ReconcileSuccess from the last successful reconcile. Health checkers polling Ready as the application health signal missed the failure. Also set Ready=False/ReconcileError alongside the sub-condition with the same message, so the rollup reflects the failure on every path that ends through endWithNegativeCondition. Fixes #7164 Signed-off-by: Anuragp22 <anuragp2003b@gmail.com> * test(controller): assert Ready condition propagates sub-condition message Address cubic review on #7168: verify the persisted Ready condition's Message field equals the failing sub-condition's Message, so a future refactor that drops the message propagation in endWithNegativeCondition gets caught by the test. Signed-off-by: Anuragp22 <anuragp2003b@gmail.com> --------- Signed-off-by: Anuragp22 <anuragp2003b@gmail.com> |
||
Vaibhav Agrawal
|
a24d3a9c64 |
Fix: defkit changes for resource builder docs (#7136)
* Fix: update predicateToCUE to honor custom iteration variable and ensure Filter, Map, and Dedupe stages are rendered correctly Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * Chore: remove accidentally committed .claude-session-head Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * Fix: ensure let bindings are emitted before output block and handle guard conditions in list comprehensions Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * Fix: update ArrayConcat to use list.Concat for CUE v0.11 compatibility and auto-detect required imports Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * Fix: enhance test coverage for writeMapBody field variants and import detection in trait templates Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * Fix: ensure required imports are detected for traits without a Template() function Signed-off-by: Vishal Kumar <vishal210893@gmail.com> --------- Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> |
||
|
Ayush Kumar
|
3eaf62b2a2 |
Fix(helmchart): wire options correctly (#7151) and decompose provider (#7154)
* Refactor(helm): extract type declarations into types.go Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): extract Provider, constructors, and dry-run ctx into provider.go Move the Provider singleton, NewProvider/NewProviderWithConfig constructors, DefaultCacheTTLConfig, the dry-run context helpers (WithDryRun/isDryRun), and the small log/cache key utilities out of helm.go into a dedicated provider.go. No behavior change. All 240 unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): extract chart fetching into chart_fetch.go Move detectChartSourceType, isMutableVersion, fetchChart (cache wrapper), fetchChartWithoutCache, determineCacheTTL, and the three per-source fetchers (fetchOCIChart, fetchURLChart, fetchRepoChart) out of helm.go. No behavior change. All 240 unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): extract values resolution into values.go Move mergeValues, loadValuesFromSource, resolveValuesFromNamespace, loadConfigMapValues, loadSecretValues, plus the valueSourceMissingError sentinel and errCrossNamespaceValuesFrom guard out of helm.go. No behavior change. All 240 unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): extract post-renderer and ownership helpers into postrender.go Move getActionConfig, velaLabelPostRenderer (struct + Run), velaOwnerLabels, and isOwnedByVela out of helm.go. No behavior change. All 240 unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): extract manifest parsing into manifest.go Move parseManifestResources, isClusterScopedGVK, isClusterScopedKindStaticFallback, isTestResource, cleanResource, and orderResources out of helm.go. No behavior change. All 240 unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): extract release secret lifecycle into release_secrets.go Move validateReleaseHealth, cleanOrphanedReleaseSecrets, listReleaseSecretNames, labelReleaseSecrets, deleteReleaseSecretsDirect, and InvalidateRelease out of helm.go. No behavior change. All 240 unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): extract dry-run render into dryrun.go Move dryRunRender (used by webhook validation) and getKubeVersion (cluster Kubernetes version capabilities lookup) out of helm.go. No behavior change. All 240 unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): extract release dispatcher into release.go Move installOrUpgradeChart (dispatcher between install/upgrade with fingerprint dedup, adoption detection, and publishVersion pin short-circuit) and computeReleaseFingerprint out of helm.go. No behavior change. All 240 unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): split install/upgrade into install.go and upgrade.go with option appliers Move freshInstall, newInstallAction, and isRetryableInstallError into install.go. Extract the inline upgrade block from installOrUpgradeChart into a new performUpgrade function in upgrade.go. Introduce applyCommonInstallOptions and applyCommonUpgradeOptions free functions that own option-to-action wiring per Helm action type. The asymmetry between the two (MaxHistory/CleanupOnFail/Recreate live only in the upgrade applier) is now visible in code and reflects the Helm SDK shape. No behavior change. All 240 unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Chore(helm): remove Uninstall provider (unused) The helmchart ComponentDefinition only calls helm.#Render. Deletion is handled by KubeVela GC and ResourceTracker, never by helm uninstall, so the Uninstall CUE template and the workflow provider registration were exercised by tests only. Touched: UninstallParams/UninstallReturns in types.go, the Uninstall Go function and its registration in helm.go, the #Uninstall block in helm.cue, the uninstall registration in pkg/workflow/providers/helm/helm.go, and the corresponding helm_test.go cases. No behavior change for any in-tree caller. All 237 remaining unit specs remain green. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix(helm): wire includeCRDs and install-path force; drop waitTimeout (#7151) includeCRDs was a complete no-op: the field was declared on RenderOptionsParams but never read. Wire it through SkipCRDs on both action.Install and action.Upgrade (inverted, since the user-facing field expresses inclusion). force was wired on upgrade only. action.Install has a Force field in Helm SDK v3.14.4, so wire it there too. waitTimeout had no backing Helm SDK field (only Timeout exists, covering both connection and wait). Remove the field from RenderOptionsParams and the CUE schema. timeout now documents its dual role. maxHistory, cleanupOnFail, and recreatePods stay upgrade-only per the Helm SDK shape; CUE comments now state this explicitly. Tests: 18 new specs covering applyCommonInstallOptions and applyCommonUpgradeOptions (each option, nil opts, unparseable timeout, asymmetry of upgrade-only fields). Suite: 258 of 258 passing. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Refactor(helm): split helm_test.go alongside production files helm_test.go was a single 2500-line test file. Mirror the production file layout: types_test.go, provider_test.go, chart_fetch_test.go, values_test.go, postrender_test.go, manifest_test.go, release_test.go, release_secrets_test.go, dryrun_test.go, install_test.go (extended with isRetryableInstallError/newInstallAction/freshInstall), upgrade_test.go. helm_test.go now owns only Render-entry tests (matching helm.go after the production split). No test logic change. Suite remains 258 of 258 passing. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Docs(helm): add one-line responsibility comment to each provider file Every production .go file in the helm provider now opens with a single descriptive line immediately after the package declaration, so a reader can scan the directory and know what each file owns without opening it. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * chore(helm): fix the helmchart CD Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Test(helm): drop uninstall expectations from workflow provider tests CI revealed three failing assertions in pkg/workflow/providers/helm: GetTemplate was expected to contain 'uninstall', and GetProviders was expected to expose an uninstall key with a non-nil function. The Uninstall provider was removed earlier in this branch since the native helmchart ComponentDefinition never invoked it, but the workflow-provider tests still referenced it. Update them to assert the render-only surface. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix(helm): address cubic AI review on PR #7154 P0: release.go installOrUpgradeChart only treats driver.ErrReleaseNotFound as a missing release; other Get errors are surfaced rather than silently falling through to freshInstall. P1: release.go guards existingRelease.Info nil before reading Status. postrender.go isOwnedByVela now matches the full velaCtx triple (AppName + AppNamespace + Name) rather than any non-empty ownership label, so two Applications targeting the same release name in the same namespace do not mis-detect each other as already owned. P2: values.go deep-clones inline values before CoalesceTables so nested maps cannot be mutated through to the caller. dryrun.go uses the full server GitVersion when present so charts with patch-level kubeVersion constraints validate correctly. install.go isRetryableInstallError now catches 'cannot reuse a name that is still in use' and the dash-hyphen variant. upgrade.go applyCommonUpgradeOptions documents that helm v3 only consults SkipCRDs on the install-mode upgrade path. postrender.go Run no longer short-circuits when only the context is nil, so direct callers still get namespace defaulting. Tests: remove three non-hermetic / no-cluster tests that did not actually assert their named behaviour. values_test now uses distinct application and release namespaces in the cross-namespace guard scenario, and adds a second positive case for the release-namespace branch. chart_fetch_test fetchOCIChart-with-auth block now captures and restores singleton.KubeClient via BeforeEach/AfterEach to match the sibling fetchURLChart and fetchRepoChart blocks. Suite stays green at 255 specs. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix(helm): preserve numeric types in inline-values deep clone Cubic flagged the JSON round-trip in deepCloneValues for coercing int to float64. Switch to runtime.DeepCopyJSON which walks the same nested map/slice/scalar shape but preserves Go numeric types. Templates that depend on integer type assertions (e.g. {{ .Values.replicaCount | int }}) now see the original type instead of a coerced float. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix(helm): deep-clone inline values without runtime.DeepCopyJSON Cubic flagged that runtime.DeepCopyJSON panics on plain int values because the helper only accepts the narrow set of types json.Unmarshal returns. CUE evaluation routinely produces Go int / int32 / int64 values, so the previous switch from json round-tripping to runtime.DeepCopyJSON traded one bug (int->float64 coercion) for another (panic on int). Replace with a hand-rolled recursive walk that recreates maps and slices and copies scalars by interface assignment. Scalars are immutable in Go, so the interface copy is sufficient. The implementation accepts every type CUE evaluation can produce. Add five focused unit tests: nil input, int preservation, int64/float64 preservation, nested-map isolation, and slice isolation. Suite at 260 specs. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Test(helm): exercise installOrUpgradeChart with helm fake KubeClient Codecov patch coverage was failing because the file split moved installOrUpgradeChart into a new file (release.go) with no direct coverage. The previous unit tests were no-cluster smokes that did not assert anything meaningful and were rightly deleted earlier in this branch on cubic feedback. Add a small seam (actionConfigFactory field on Provider, defaulting to the real cluster getter) so tests can swap in helm SDK kubefake.PrintingKubeClient plus an in-memory release storage driver. Six new specs exercise the dispatcher end-to-end: fresh install, fingerprint dedup short-circuit, chart-version upgrade, values-change upgrade, adoption of vanilla helm releases, and publishVersion pin short-circuit. Package coverage climbs from ~71% to 82.6%. installOrUpgradeChart goes from 0% to 85.2%. performUpgrade goes from 0% to 90.9%. The remaining gaps (freshInstall retry path, release_secrets cluster helpers) require a real Kubernetes API and are exercised in the e2e suite. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Test(helm): plug the second cluster-leak seam in dispatcher tests Cubic flagged that the new dispatcher tests still let real Kubernetes calls escape: validateReleaseHealth (started as a goroutine after fingerprint-dedup short-circuit) called p.getActionConfig directly, and labelReleaseSecrets / listReleaseSecretNames / deleteReleaseSecretsDirect built a clientset from p.helmClient.RESTClientGetter(). Add a kubeClientFactory field on Provider next to actionConfigFactory and route all four helpers through it. installProviderWithFake injects a clientsetfake clientset alongside the fake action.Configuration. The release_secrets tests are reworked to use the helper as well, replacing the previous 'should not panic without a real cluster' smokes with assertions against the fake clientset: list filters to vela-owned secrets, label patches missing labels but never overwrites existing ones, delete cleans only matching helm-owned secrets. Verified the suite emits zero 'Kubernetes cluster unreachable' log lines now. 266 specs green. Also strengthened the adoption test to assert all three app.oam.dev ownership labels. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Fix(helm): restore corrupt-secret recovery via fall-through-on-any-Get-error The earlier cubic-driven P0 fix narrowed the dispatcher to fall through to freshInstall only when getAction.Run returned driver.ErrReleaseNotFound. That broke the documented self-healing contract validated by test/e2e-test/helmchart_test.go ('Helmchart Self-Healing / should recover from corrupted Helm release secret'): a corrupted .data.release surfaces from the helm storage driver as a decode error (base64 / gzip / json), not as driver.ErrReleaseNotFound, so the strict check trapped those errors and skipped the orphan-state cleanup path that freshInstall + isRetryableInstallError implement. Restore the original fall-through-on-any-error behaviour with two safety improvements: (1) non-NotFound errors are now logged at warning level so operators can spot RBAC / transient API failures that the recovery path then addresses (or fails to address); (2) the fingerprint slice in the stale-cache-clear log is bounds-checked so a short cached value cannot panic. Add a unit regression that wraps the in-memory storage driver in a corruptingDriver returning a synthetic decode error for the named release. Asserts the dispatcher swallows the error, runs fresh install, and repopulates the cache with the new fingerprint. Mirrors the e2e contract at the unit-test layer so a future refactor cannot regress this without breaking both gates. Suite: 267 of 267 passing. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Test(helm): seed corruption-recovery test at the canonical helm storage key Cubic flagged that the new corrupt-secret regression seeded the in-memory storage driver at 'rel.v1' while helm SDK derives canonical keys of the form 'sh.helm.release.v1.<name>.v<version>'. The mismatch meant the seeded release never collided with helms install-path probe and the test passed without actually exercising the recovery branch. Switch the seed key to the canonical form via the same makeKey shape helm SDK uses internally. The corruptingDriver layered on top still returns a synthetic decode error for Get/Query against the named release, so the dispatcher is forced through the swallow-and-fall-through path. Tightened the comment to be explicit about test scope: this unit pins the dispatcher-layer contract, the e2e test pins the end-to-end cleanup. Also relaxed the pre-seeded cache fingerprint to a realistic-length value so the truncation-safe log path exercises cleanly. Suite: 267 of 267 passing. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Test(helm): drop canonical-key seed from corruption-recovery test The canonical-key seed made the in-memory storage collide with the key helm SDK derives for the release, which triggered the orphan-state cleanup retry path in freshInstall. Cleanup uses the kubeClientFactory clientset (a fake clientset with no helm release secrets) so it deletes nothing; the storage-driver entry stays put; the retry install then fails with release: already exists. CI confirmed against the previous commit. Seed only the corruptingDriver this time, no pre-existing release in storage. The dispatcher swallows the synthetic decode error from Get/Query and falls through to a clean fresh install, which is the contract this unit test is meant to pin. The full storage + clientset cleanup loop remains exercised by the e2e Helmchart Self-Healing scenario. Updated the test comment to be explicit about scope: storage and clientset are intentionally not bridged in the fake setup; that bridging belongs in the e2e test, not here. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> --------- Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> |
||
|
Ayush Kumar
|
bcf6af9747 |
Feat: helm chart auth (#7148)
* feat: kv native helm auth implementation Signed-off-by: Ayush Kumar <aykumar@guidewire.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat: add e2e test cases for helm auth Signed-off-by: Ayush Kumar <aykumar@guidewire.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * test: remove the env auth gate and improve test cases Signed-off-by: Ayush Kumar <aykumar@guidewire.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * lint: drop unused []byte return from non-docker secret dispatchers unparam flagged dispatchBasicAuthSecret, dispatchTLSSecret, and dispatchOpaqueSecret because the second return value (raw config bytes) was always nil. Only dispatchDockerConfigJSONSecret actually needs that slot for the OCI temp credfile. Drop it from the other three and update resolveAuthOptions plus the unit tests to match. Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat: pr review changes Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * style: gofmt/goimports auth.go doc comments Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * chore: remove e2e-auth-images-load-local target The dedicated target is gone; e2e-test-local now reads the same .vscode/k3d-preload.txt image list that the VS Code setup task uses so both flows pull from one source. Empty or missing file is a no-op. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * chore: inline auth-test image list in e2e-test-local `.vscode/k3d-preload.txt` is gitignored so it would not exist on a fresh clone. Inline the three auth-test registry images directly in the Make target so `make e2e-test-local` is self-contained. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat: address PR review comments - Webhook ValidateCuexTemplate now wraps the context in helm.WithDryRun so a ComponentDefinition with concrete helm.#Render arguments cannot trigger a real chart fetch or install during admission validation. - helmchart audit ConfigMap keeps `helm.oam.dev/chart` as a label when the source string is a valid Kubernetes label value (alphanumeric + `.-_`, 1-63 chars); URLs containing `://` or `/` only live in the annotation. Preserves existing label selectors for repo-style sources without breaking long OCI/HTTPS URLs. - helm_test.go capture-and-restore singleton.KubeClient in fetchURLChart and fetchRepoChart auth Describes so fake clients do not leak into later tests in the package. - utils_test.go swap the defer order so singleton.ReloadClients runs before WorkloadCompiler.Reload, otherwise the compiler reload would pick up the fake dynamic client and leak fake state. - e2e.mk pre-load loop separates docker pull and k3d image import with `;` rather than `&&`. `set -e` does not abort a for-loop body when a command inside an `&&` chain fails, so the old form could continue after a failed pull. Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * style: gofmt AfterAll indentation in helmchart_test.go Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat: enhance Docker Hub credential handling in auth configuration Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat: enhance Docker Hub credential handling in auth configuration Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * fix(helm-auth): normalize Docker Hub alias for dockerconfigjson Secrets Cubic flagged that the Docker Hub alias fix in writeOCIRegistryConfigFile only covered synthesized basic-auth credentials. For verbatim kubernetes.io/dockerconfigjson Secrets, a user-supplied config keyed under "registry-1.docker.io" (the OCI pull host) would not be found by ORAS/Helm, which normalizes to "https://index.docker.io/v1/". normalizeDockerHubAliases parses the verbatim JSON, and when any of the three Docker Hub host aliases ("registry-1.docker.io", "index.docker.io", "docker.io") is keyed but the canonical v1 key is absent, copies the entry under the canonical key. No-op when: - the canonical key is already present - no Docker Hub host is involved - the JSON is malformed or missing the auths field Includes 7 new unit specs for the helper covering each alias, the no-op cases, and malformed input. Also brings in collateral local-fix changes: - pkg/webhook/utils/utils_test.go: register the cue.oam.dev/v1alpha1 Package GVK in the fake DynamicClient scheme so TestValidateCuexTemplate/withCuexPackageImports can resolve the test/ext package after the WorkloadCompiler switch. - gofmt field-alignment normalization on auth_test.go and auth_registry_helpers_test.go (drift caught by check-diff CI). Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * fix: namespace-default rendered resources, bind chart cache to credentials, surface HTTP 401s clearly, inject auth-test CA in e2e Four fixes from stress testing the helmchart component: 1. Rendered resources without metadata.namespace landed in vela-system. Both code paths now default to releaseNamespace for namespaced kinds: the velaLabelPostRenderer (before helm SDK apply) and parseManifestResources (before KubeVela's tracker re-applies). isClusterScopedKind covers CRDs, ClusterRoles, Namespaces, etc. 2. Cached chart bytes survived credential rotation. computeAuthCacheTag hashes Secret.Type + sorted Data into a 16-char tag suffixed onto the cache key when auth.secretRef is declared. Any Secret edit (or different Secret reference) invalidates the cache and forces a fresh registry call that exercises the new credentials at the wire. Public charts (no auth) are unaffected. 3. HTTP 401/403 on chart fetch surfaced as YAML/JSON parse errors. HTTPGetWithOption now rejects non-2xx responses with 'HTTP <status>: <body>' instead of returning the raw body for downstream parsers to choke on. 4. E2E HTTPS tests against chartmuseum's self-signed cert failed at the admission webhook. injectAuthTestCA patches vela-core in BeforeSuite with an init container that combines /etc/ssl/certs/ca-certificates.crt with testdata/auth/certs/ca.crt into a shared volume and points SSL_CERT_FILE at it. Also normalize Docker Hub host aliases on verbatim kubernetes.io/dockerconfigjson Secrets (cubic comment), and revert TestValidateCuexTemplate's fake DynamicClient to the empty-scheme form that lets it wrap every GVK as Unstructured (CI unit test fix). Finding 3 (options.wait default) is deferred: schema-level defaults don't materialize for optional fields carried into _options as a structural copy. Tracked separately. Issue 2 from the stress matrix (cache + credential rotation) is also filed upstream as kubevela/kubevela#7150 for a longer-term credential-bound cache invalidation design. Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * fix(helm-auth): RESTMapper scope detection + auth tag binds source URL + drop flaky webhook test case Address cubic P1 review comments and the unit-test CI failure. isClusterScopedKind only matched well-known built-in kinds; isClusterScopedGVK now asks the RESTMapper first so third-party cluster-scoped CRDs are recognised, with the static allowlist as a fallback. computeAuthCacheTag now folds params.Source and params.RepoURL into the hash so a multi-host dockerconfigjson Secret cannot reuse cached bytes across different registries. TestValidateCuexTemplate/withCuexPackageImports relied on cuex.DefaultCompiler.Reload picking up a fake-client-served Package CRD; since ValidateCuexTemplate now uses velacuex.WorkloadCompiler the fake-client setup does not surface the test/ext package, so the case is dropped (covered transitively by the helm provider unit tests and the e2e suite under helm.WithDryRun). Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * style: gofmt import order in helm.go (lint + check-diff) Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * fix(e2e): correct vela-core selector, alpine bundler, harden rollout wait The label selector app.kubernetes.io/name=vela-core also matches the cluster-gateway Deployment, so the init container was being appended to the wrong workload and the controller pod never picked up the test CA. Switching to the unique controller.oam.dev/name label fixes the routing, and the diagnostic message at the empty-list branch is updated to point operators at the new label. addVolume and addInitContainer now update in place when an entry with the same name already exists. Previously they silently skipped, which meant the first patch on a cluster stuck for the lifetime of that cluster and a corrected image or args could not be picked up by a re-run. busybox:1.36 ships without /etc/ssl/certs/ca-certificates.crt, so the bundler was silently producing an empty combined.crt. alpine:3.18 ships the public CA roots, so concatenating the auth-test CA onto the system bundle produces a usable trust store that the main container reads via SSL_CERT_FILE. waitForDeploymentsAvailable used to return as soon as DeploymentAvailable flipped to True and the new RS reached the desired replica count, which left a window where old-RS pods still satisfied Available while the controller container was still running with the previous image. The check now also requires Status.Replicas == Status.UpdatedReplicas, AvailableReplicas >= specReplicas and UnavailableReplicas == 0, so the helper only returns once the rollout is fully complete. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * test(e2e): gate auth-test setup behind KUBEVELA_E2E_AUTH so other suites stay green webhook-upgrade-check runs the same test/e2e-test suite as the full e2e job but with ginkgo --focus-file requiredparam_validation_test.go. The unconditional setupAuthRegistries in BeforeSuite was bringing up the ChartMuseum / zot / nginx-bearer stack and patching vela-core for a focus that did not need any of it, and the patched controller never finished rolling on the upgrade-check cluster (the helm upgrade in that job is expected to fail, so vela-core is in a stretched state when our BeforeSuite tries to patch it). Re-introduce KUBEVELA_E2E_AUTH=1 as the explicit opt-in. BeforeSuite and AfterSuite only touch the auth registries when the env var is set, the Helmchart Auth Describe block skips otherwise, and the make e2e-test and e2e-test-local targets export the env so the full suite still runs the auth specs. CI workflows that run a focused subset (like webhook-upgrade-check) inherit the default off behavior and stop paying the registry-setup cost. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> --------- Signed-off-by: Ayush Kumar <aykumar@guidewire.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> |
||
Asish Kumar
|
5664912a4c |
Feat: support per-application reconciliation interval override via annotation (#7089)
* Feat: support per-application reconciliation interval override via annotation Add the app.oam.dev/reconcile-interval annotation that lets operators override the global ApplicationReSyncPeriod on a per-application basis. This is useful when different applications have different drift-detection needs: a production app might need reconciliation every minute while a dev/staging app can safely use a longer interval to reduce API server load. When the annotation is present and contains a valid Go duration string (e.g. "1m", "15m", "30s") at or above the 10s minimum floor, the controller uses that value as RequeueAfter instead of the global default. Invalid or below-minimum values are logged as warnings and silently fall back to the global default, preserving full backward compatibility. The implementation adds a forApp() chain method to reconcileResult so that only the return paths where the default resync period matters (normal completion and error recovery) need to be annotated, leaving all explicit requeue() calls untouched. Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> * test: add e2e coverage for app reconcile interval Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> * chore: trigger ci rerun Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> * fix: address reconcile interval review feedback Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> * fix: satisfy reconcile interval lint Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> --------- Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> |
||
|
Jerrin Francis
|
c81b141302 |
Fix: handle optional collections in CUE strict mode in defkit (#7102)
* fix(defkit): handle optional collections in CUE strict mode
Applying a defkit-generated ComponentDefinition that referenced optional
Array/Map params via SetIf guards failed at template render with errors
like:
output.metadata: cannot reference optional field: labels
output.spec.template.spec.containers.0: cannot reference optional field: args
parameter: cannot reference optional field: volume
The cuegen was emitting `parameter.X` (dot syntax), `len(parameter.X)`,
and OneOf-with-default discriminator blocks that all violate CUE strict
mode. Update condition rendering to match the bracket-existence pattern
used by KubeVela's built-in components (cron-task.cue, daemon.cue):
- LenCondition / ArrayContainsCondition / MapHasKeyCondition on
collection params now emit `parameter["X"] != _|_` (or `== _|_`
for IsEmpty). Trade-off: IsNotEmpty / LenGt(0) / Contains()
collapse to existence checks; for exact-length predicates use
Validators(...) on the parameter schema.
- LenCondition on String params is unchanged (raw `len(...)`) since
string length checks are typically used in Validators against
required/defaulted strings where strict mode does not fire.
- OneOfParam with HasDefault() drops the `?` marker so the sibling-
scope `if name == "..."` blocks can reference the discriminator
without strict-mode errors. Mirrors how Bool with Default()
behaves.
Two related fixes bundled in:
- StringKeyMapParam gains HasKey, IsEmpty, IsNotEmpty, LenEq, LenGt
for parity with MapParam — they generate identical CUE today.
- ArrayParam.RequiredImports() reports the "list" stdlib import
when MinItems/MaxItems is set, and the import-detection walker
now visits SetIfOp/SpreadIfOp/IfBlock condition operands.
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
* Fixing go lint issues
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
* fix: Reverting ArrayContainsCondition
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
* fix(defkit): chained-if guards + AbsentOrEmpty for collection conditions
Extends PR #7102 to fix several semantic and structural bugs in how
conditions on optional collection parameters render to CUE.
LenCondition: drop the unused `fallback` field and render uniformly as
`parameter["X"] != _|_ if len(parameter["X"]) op N`. Restores exact-length
semantics that were previously collapsed to bare existence checks; works
for required strings too (the outer guard always passes).
AbsentOrEmptyCondition (new): returned by IsEmpty() and LenEq(0) on
Array/Map/StringKeyMap params. Expands at render time into TWO if blocks
(absent + set-and-empty) since CUE cannot express "absent OR empty" as a
single boolean — `||` is strict in both operands and `len(_|_)`
propagates bottom. Fires on both nil and empty inputs, symmetric with
IsNotEmpty().
ArrayContainsCondition: render as `parameter["X"] != _|_ if
list.Contains(parameter["X"], val)` instead of the `&&`-joined form. CUE
does not short-circuit `&&`, so list.Contains was evaluated against `_|_`
when the field was absent.
Compound joiners (AndCondition, LogicalExpr AND mode,
AllConditionsCondition): detect chained-guard operands via a new
`usesChainedGuard` helper and join with ` if ` instead of ` && ` —
chained-if expressions are invalid inside `(...) && (...)`.
writeValidator: refactored through a new `writeIfBlocksForCond` helper so
both FailWhen and OnlyWhen correctly expand AbsentOrEmptyCondition into
two if blocks (the validator struct duplicates under each guard).
writeFieldNode bracket-access leaf: previously dropped node.cond and
condValues entirely, emitting bracket-access fields unconditionally. Now
mirrors the regular-field rendering so SetIf(cond, "data[hyphen-key]",
value) emits the expected if-block wrapper.
Tests: 1198 specs pass. Removes 4 obsolete Fallback() tests; adds
regression coverage for FailWhen/OnlyWhen with collection IsEmpty(),
bracket-access conditional rendering, and the IsEmpty two-if-block form.
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
* Fixing the lint errors
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
* Adding test case for handling hyphenated fields in cue
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
---------
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
|
||
|
Ayush Kumar
|
28892ccc7e |
Feat: implement valuesFrom support for helmchart component and update… (#7099)
* feat: implement valuesFrom support for helmchart component and update documentation examples Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com> * fix: address cubic review feedback on valuesFrom Three issues raised by cubic AI review on kubevela#7099: 1. docs/examples/helmchart-valuesfrom/secret-and-inline.yaml — Expected-result comments used incorrect paths (resources.cpu / resources.mem) and values (500m) that did not match the actual CM data. Rewrote the narrative to use the real paths (resources.limits.cpu / resources.limits.memory) and bundled the Secret inline in the manifest so the example is self-contained and the expected output is deterministic. 2. docs/examples/helmchart-valuesfrom/secret-and-inline.yaml — The Secret was marked optional: true while the narrative required it for the merged output to match. Bundled the Secret inline and dropped the optional flag, removing the order/timing ambiguity. README.md updated to drop the now-redundant "create the Secret first" instruction. 3. pkg/cue/cuex/providers/helm/helm.go:Render — After removing the unconditional "default" fallback for releaseNamespace, Helm could run with an empty namespace when both Context.AppNamespace and Release.Namespace were unset (non-normal code paths — direct callers, tests, CLI tooling). Restored the "default" fallback at the end of the namespace resolution while keeping the Application-namespace plumbing for tenant-scoped cross-namespace rejection. Co-authored-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com> * feat: add valuesFrom fingerprinting for helmchart components to trigger workflow restarts on ConfigMap/Secret changes Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add valuesFrom fingerprinting for helmchart components to trigger workflow restarts on ConfigMap/Secret changes Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: enhance valuesFrom support for helmchart components with fingerprinting and error handling Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * docs: clarify cross-namespace restrictions for valuesFrom in helmchart examples Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add publishVersion support to Helm provider for stable release management Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: improve error handling for application retrieval in Helm provider Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add application publishVersion lookup defense in Helm provider tests Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> --------- Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-authored-by: Anaswara Suresh <anaswarasuresh2212@gmail.com> |
||
|
Vaibhav Agrawal
|
2268d95c1c |
Fix: OutputsGroupIf silently dropped by component and trait CUE generators (#7100)
* Fix: add support for OutputsGroupIf in CUEGenerator and related tests Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> * Fix: render OutputsGroupIf on traits with no plain Outputs sibling The trait CUE generator previously gated the `outputs:` block on `len(outputs) > 0`, so a trait that declared conditional resources only via `OutputsGroupIf` (with no sibling `Outputs()` call) emitted no outputs block at all. The grouped resources were silently dropped. Change the gate to `len(outputs) > 0 || len(outputGroups) > 0` so the outputs block opens whenever either plain outputs or groups are present, matching the behavior the component generator already has. Adds trait-side tests covering: grouped-only (the bug repro), multiple independent groups without plain outputs, and a regression check for plain-before-grouped ordering. Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> --------- Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> |
||
|
Jerrin Francis
|
a6c7a56602 |
Fix: auto-detect "strings" import for StringParam MinLen/MaxLen in defkit (#7098)
* fix(defkit): auto-detect "strings" import for StringParam MinLen/MaxLen
StringParam with MinLen or MaxLen generates CUE constraints using
strings.MinRunes() and strings.MaxRunes(), but the CUE generator only
scanned template elements for required imports — never the parameter
list itself. This caused generated definitions to fail validation with
`reference "strings" not found`.
- Implement ImportRequirer on StringParam, returning ["strings"] when
MinLen or MaxLen is set.
- Extend detectRequiredImports to scan component parameters in addition
to template helpers and resources.
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
* Adding testcases
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
* test(defkit): match multi-line CUE import block in auto-import tests
The generated CUE emits imports as a block:
import (
"strings"
)
The assertions were checking for the single-line form `import "strings"`,
which never matched. Replace with MatchRegexp(`import\s+\(\s+"strings"\s+\)`)
so the regex matches any whitespace (incl. newlines) between `import`, `(`,
`"strings"`, and `)`. Also count `"strings"` (not `import "strings"`) when
asserting the import is not duplicated.
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
* ci: retrigger checks
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
---------
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
|
||
|
Brian Kane
|
079356fad9 |
Fix: Corrects CLI generation and documentation issues (#7095)
Signed-off-by: Brian Kane <briankane1@gmail.com> |
||
|
Ayush Kumar
|
bdf647df8c |
Feat: native helm component and provider (#7080)
* Proof Concept Signed-off-by: Brian Kane <briankane1@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Cleanup dispatch stages and remove dry run namespaces Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Single Health Condition Working Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Multiple Health Conditions Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Support Empty Health Status Signed-off-by: Brian Kane <briankane1@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Caching Signed-off-by: Brian Kane <briankane1@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * includes changes from make-reviewable Signed-off-by: Amit Singh <singhamitch@outlook.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * minor formatting fixes Signed-off-by: Amit Singh <singhamitch@outlook.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * fix: handles cases where resource is nil Signed-off-by: Amit Singh <singhamitch@outlook.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: creates chart release before returning rendered resources to kubevela Signed-off-by: Amit Singh <singhamitch@outlook.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: helm release record via dry-run for helm list visibility The previous createChartRelease did a real helm install/upgrade which deployed resources directly, conflicting with KubeVela's dispatch ("exists but not managed by any application" errors). Also, Helm's lazy client via cli.New().RESTClientGetter() silently wrote to in-memory storage instead of Kubernetes secrets, so helm list never showed releases. Fix: use dry-run install to build a release object without deploying resources, and bypass Helm's lazy client by creating a direct Kubernetes clientset wired to helmdriver.NewSecrets. Set KubeVersion from the real cluster version to pass chart constraints. Prevent duplicate revisions on repeated reconciles via mutex serialization and in-memory fingerprint tracking (chartVersion + values). New revisions are only created when chart version or values actually change. Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * fix: override Kubernetes version for kubeVersion validation in chart release Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Enhance Helm chart component definition and CUE provider, update API types, and add new examples and documentation. Signed-off-by: Chaitanya Reddy Onteddu <co@guidewire.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Add Helm uninstall action and optimize install/upgrade with release fingerprinting and KubeVela ownership labels. Signed-off-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Introduce to prevent resources from being applied while ensuring they are recorded for garbage collection, and apply it to Helm release secrets. Signed-off-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Enhance velaLabelPostRenderer to include Helm ownership annotations and improve cache invalidation logic for Helm releases Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Enhance Helm release secret tracking for garbage collection during application deletion and upgrades Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Co-Authored-By: Jerrin Francis <jerrinfrancis7@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Add Helm chart test and application definition for podinfo deployment Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Refactor Helm release secret handling and improve metadata filtering for KubeVela adoption Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Label existing Helm release secrets with KubeVela ownership for better tracking and cleanup Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Remove outdated documentation files for Helm integration and revision management Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Add various Helm chart application test and improve test coverage for Helmchart component Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Update Helm chart tests to validate deployment list and ensure label presence Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Enhance Helm chart tests for resource verification and application health checks Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Update Helm chart test scenarios for multi-component health checks and resource configurations Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Implement dry-run mode for Helm provider to enhance validation without cluster interaction Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Refactor import statements and enhance Helmchart edge case tests for better error handling and validation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Refactor Helm provider methods for improved error handling and retry logic during installation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Improve Helm provider tests and documentation with enhanced assertions and example configurations Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Register helm package with cuex.DefaultCompiler for improved import resolution Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Remove crossplane application configuration from crossplane-app.yaml Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Enhance workload compiler with external package loading and improve Helm chart health checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Remove unused cuex import and initialization function from helm provider Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Replace cuex.DefaultCompiler with localcuex.WorkloadCompiler for improved CUE compilation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: Implement dry-run mode for Helm provider functions during validation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * test: add unit tests for Helm provider and workflow provider - Created suite tests for the Helm provider in pkg/cue/cuex/providers/helm/suite_test.go. - Implemented unit tests for Helm workflow provider in pkg/workflow/providers/helm/helm_test.go. - Added suite tests for Helm workflow provider in pkg/workflow/providers/helm/suite_test.go. Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> * feat: Add additional health check tests for error scenarios Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> * feat: Enhance health check logic and improve documentation in helmchart definition Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> * feat: Refactor helmchart template for improved readability and structure Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> * docs: remove redundant struct-only tests from helm_test.go Signed-off-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com> * Feat: Implement CUE sanitization for OpenAPI schema generation Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat: Add tests for rendering and fetching Helm charts with dry-run support Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> * feat: Enhance required parameter validation tests with retry logic for webhook synchronization Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> * feat: Improve chart version retrieval by sorting entries and enhancing error messages Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> * feat: Enhance primary output handling for Helm charts with stable ConfigMap metadata Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> * chore: Fix CUE formatting alignment in helmchart definition Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> * feat: Extend timeout for self-healing Helmchart tests to improve reliability Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> * feat: Increase timeout for golangci-lint to enhance linting reliability Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> --------- Signed-off-by: Brian Kane <briankane1@gmail.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Signed-off-by: Amit Singh <singhamitch@outlook.com> Signed-off-by: Reetika Malhotra <malhotra.reetika25@gmail.com> Signed-off-by: Chaitanya Reddy Onteddu <co@guidewire.com> Signed-off-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com> Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> Co-authored-by: Brian Kane <briankane1@gmail.com> Co-authored-by: Amit Singh <singhamitch@outlook.com> Co-authored-by: Jerrin Francis <jerrinfrancis7@gmail.com> Co-authored-by: Reetika Malhotra <malhotra.reetika25@gmail.com> Co-authored-by: Chaitanya Reddy Onteddu <co@guidewire.com> Co-authored-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com> Co-authored-by: Vishal Kumar <vishal210893@gmail.com> Co-authored-by: Anaswara Suresh <anaswarasuresh2212@gmail.com> Co-authored-by: vaibhav0096 <vaibhav.agrawal0096@gmail.com> |
||
|
Ayush Kumar
|
012a134829 |
Feat: extend fluent builder API validator patterns (#7092)
* Feat: Add NotEmpty and NegativePattern constraints to StringParam; implement Closed for MapParam Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add validation support for array and map parameters - Introduced validators for ArrayParam and MapParam, allowing for cross-field validation within structured parameters. - Added NonEmpty validation for ArrayParam to ensure arrays are not empty. - Implemented ConditionalStructOp for conditional struct generation based on specified conditions. - Created a new Validator type for defining validation rules with optional guard conditions. - Added tests for various validation scenarios, including mutual exclusion and conditional parameters. - Enhanced the CUE generation logic to incorporate new validation features and conditional struct handling. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: extend fluent API with new scoped field conditions and improve validation checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: enhance ArrayParam with NotEmpty constraint and update ScopedField documentation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: rename ScopedField to LocalField for improved clarity in condition building Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: refactor local field conditions to use RegexMatch and streamline condition building Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: simplify condition handling by removing unused comparison types and refactoring NotCondition usage Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * refactor: remove unused raw CUE block handling from baseDefinition and ComponentDefinition Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * test: update condition handling in parameter tests to use NotExpr and Cond methods Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * refactor: remove negative pattern handling from StringParam and related tests Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add support for emitting raw header blocks in template generation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * refactor: remove non-empty check from ArrayParam and update related tests Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * refactor: convert parameter constraint tests to use Ginkgo and Gomega for improved readability and maintainability Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: extend fluent APIs for OAM with new CUE generation tests and condition evaluations Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * refactor: clean up whitespace in component, cuegen, expr, param, and resource files Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: enhance CUE generation by adding support for new expression types and iterator references Signed-off-by: Ayush Kumar <aykumar@guidewire.com> Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * refactor: remove unnecessary whitespace in cuegen.go Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * refactor: rename LenOf to LenOfExpr for clarity in comparison methods Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: enhance CUE generation and validation for string arrays in ArrayParam Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> --------- Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> Signed-off-by: Ayush Kumar <aykumar@guidewire.com> Co-authored-by: Ayush Kumar <aykumar@guidewire.com> |
||
|
Asish Kumar
|
54197b4721 |
Fix: rename statusDetails CUE field to details to match Status struct (#7088)
The StatusDetails() function in defkit was rendering the CUE field as "statusDetails:" instead of "details:", which is the actual JSON tag defined on the Details field in the common.Status struct. This mismatch caused CUE rendering failures at runtime because the controller expects the field to be named "details" (matching the json:"details,omitempty" tag in apis/core.oam.dev/common/types.go). Fixed in all four definition types (component, trait, policy, workflow step) and updated corresponding test assertions to verify the correct field name. Signed-off-by: Asish Kumar <officialasishkumar@gmail.com> |
||
|
Brian Kane
|
73e4c791a9 |
Fix: rebuild appliedResources from ResourceTracker instead of filtering by name (#7083)
appliedResources entries use resource names, not component names, so filtering them against component names incorrectly dropped valid entries. Rebuild directly from the current ResourceTracker each reconcile - already in memory, no extra API calls. Signed-off-by: Brian Kane <briankane1@gmail.com> |
||
|
Jerrin Francis
|
69d046f7b3 |
Fix: Align legacy config provider keys with workflow repo to resolve CUE conflict and key collision (#7078)
* Fix: Align legacy config provider keys with workflow repo to resolve CUE conflict and kube key collision Rename legacy config #do keys and Go provider map keys from short form (create, read, list, delete) to hyphenated form (create-config, read-config, list-config, delete-config) to match workflow PR #225. This resolves three issues: - CUE unification failure when kubevela and workflow legacy config templates are concatenated into the same op package - Go provider key collision where kube's read/list/delete silently overwrote config's identically-named functions - Silent misdispatch of op.#ReadConfig/ListConfig/DeleteConfig to kube handlers instead of config handlers Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * Adding testcase to test future key drifts Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> --------- Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> |
||
lif
|
e65938087d |
Feat: Validate undeclared parameters in application definitions (#7075)
* Feat: Validate undeclared parameters in application definitions (#6862) Add a new feature gate ValidateUndeclaredParameters that rejects parameters not declared in the CUE definition schema at admission time. When enabled, any parameter field not present in the template's parameter stanza will cause a validation error. Signed-off-by: majiayu000 <1835304752@qq.com> * Fix: Handle CUE pattern constraints and improve undeclared param validation - Detect pattern constraints ([string]: T) using LookupPath to avoid false positives on webservice labels/annotations fields - Use GetSelectorLabel() for safe selector extraction - Add klog debug logging when schema compilation fails - Sort undeclared field names for deterministic error messages - Add test cases for pattern constraints and sorted output Signed-off-by: majiayu000 <1835304752@qq.com> * Fix: go fmt alignment in validate_test.go Signed-off-by: majiayu000 <1835304752@qq.com> * fix: address review feedback on PR #7075 - Handle conditional parameter declarations via two-pass schema compilation: first without params for base fields, then with declared params to resolve CUE conditionals - Return nil from findUndeclaredFields when schema.Fields() errors to prevent false positives from empty declared map - Recurse into list elements containing structs using cue.AnyIndex so undeclared fields inside arrays are detected - Save/restore previous feature gate state in tests instead of resetting to fixed values Signed-off-by: majiayu000 <1835304752@qq.com> --------- Signed-off-by: majiayu000 <1835304752@qq.com> |
||
|
Jerrin Francis
|
124cd105d6 |
Chore: Updating pkg and workflow versions (#7077)
* Updating pkg and workflow version Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * Running reviewable Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * Removing accidental commit of .claude Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * Updating testdata to use new config provider Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * Updating testdata to use new config provider Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> --------- Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> |
||
|
Brian Kane
|
38dea0b56c |
feat: application-scoped policies (#7067)
Introduces application-scoped policies and global auto-applied policies for KubeVela. Key changes: - PolicyDefinition gains `scope`, `global`, and `priority` fields - Global policies (global=true, scope=Application) are auto-applied to every Application in their namespace (and vela-system globals apply cluster-wide) without being listed in spec.policies - PolicyScopeIndex: in-memory singleton index of PolicyDefinition metadata, bootstrapped at startup and kept live via watch events. Follows KubeVela's 2-step lookup (local namespace → vela-system) - ApplicationPolicyCache: per-app cache of rendered policy results, invalidated by spec hash, revision hash, or TTL; cleared on deletion - Policy rendering pipeline extended to inject global policies before user-specified ones, respecting priority ordering - Appfile.Context carries context.Context from controller into rendering - Feature gates: EnableApplicationScopedPolicies and EnableGlobalPolicies (both Alpha, default false); admission webhook warns when a PolicyDefinition targets a disabled gate Signed-off-by: Brian Kane <briankane1@gmail.com> |
||
|
Brian Kane
|
61e06c0bbb |
Feat: Immutable Parameters (#7059)
Signed-off-by: Brian Kane <briankane1@gmail.com> |
||
|
Brian Kane
|
e5779ec9ec |
Feat: Cue 0.14.1 Preupgrade CLI Check (#6983)
* Feat: Cue 0.14.1 Preupgrade CLI Check Signed-off-by: Brian Kane <briankane1@gmail.com> * Feat: Add Support for Repeat Operations Signed-off-by: Brian Kane <briankane1@gmail.com> --------- Signed-off-by: Brian Kane <briankane1@gmail.com> |
||
|
Ayush Kumar
|
21640b55cd |
Refactor: sort map keys before rendering in CUE generation functions (#7073)
* Refactor: sort map keys before rendering in CUE generation functions Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: add tests for alphabetical ordering of labels and outputs in CUE generation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: add tests for alphabetical ordering of computed fields and output groups in CUE generation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> --------- Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> |
||
|
Ayush Kumar
|
401ad98a37 |
Feat: add ClosedUnion and ClosedStruct support in defkit (#7069)
* feat: add ClosedUnion and ClosedStruct support in defkit - Introduced ClosedUnionParam and ClosedStructOption to handle closed struct disjunctions in parameters. - Implemented methods for creating closed structs and adding fields. - Enhanced CUE generation to support closed unions, allowing for more complex parameter definitions. - Added tests for ClosedUnion and ClosedStruct to ensure correct functionality and integration. - Updated existing tests to cover new features and ensure backward compatibility. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: enhance CUE generation with deduplication and inner braces for array elements Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: enhance WorkflowStep parameter handling in CUE generation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add WithDirectFields method to BuiltinActionBuilder for direct field rendering Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: streamline string formatting in CUE generation for improved readability Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: enhance CUE generation with deduplication support and improve test assertions Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add support for ClosedUnion and condition rendering in CUE generation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: refactor value rendering in CUE generation to improve builder support Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add GuardedBlockAction and corresponding CUE generation support Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: update writeOneOfParam and writeStructField to use marker instead of optional Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add ClosedUnionParam support and update related tests for optionality Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: update parameter definitions to remove required constraints in example code Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: enhance CUE generation with multiline value indentation and improved block handling Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * feat: add baseContainer definition to CUE generation for container patterns Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * fix: update test to expect _baseContainer singular field in PatchContainer output The _baseContainer: *_|_ | {...} field was intentionally added to CUE generation but the test was still asserting it should not exist. Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> --------- Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> |
||
|
Jerrin Francis
|
c6ee19ee45 |
Fix: remove Mandatory() API and make non-optional the default field state in defkit (#7070)
Replace the three-state field marker system (Optional/Mandatory/Required)
with a simpler two-state system where the default behavior produces
`field: type` (no marker), `.Required()` produces `field!: type`, and
`.Optional()` produces `field?: type`.
- Remove Mandatory(), IsMandatory(), ForceOptional(), IsForceOptional()
from all param types, StructField, Param interface, and CUE generator
- Replace `mandatory` and `forceOptional` fields with `optional` field
in baseParam and StructField
- Simplify CUE marker resolution to: default=none, Required="!",
Optional="?"
- Remove BeMandatory() matcher and mandatoryParam interface
- Migrate all test usages: .Mandatory() removed (now default behavior),
.ForceOptional() replaced with .Optional()
Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com>
|
||
|
Jerrin Francis
|
cf66f20cd9 |
Feat: introduce Mandatory() API and three-state CUE field markers in defkit (#7068)
* feat(defkit): introduce Mandatory() API and three-state CUE field markers Add a new .Mandatory() fluent method to all defkit param types and StructField, giving callers explicit control over all three CUE field presence semantics: field?: type — optional, emitted by default (no method call) field: type — non-optional; must have a value, defaults/merging can satisfy (.Mandatory()) field!: type — required in input; user must explicitly provide it (.Required()) Previously, Required() emitted no marker (identical to a mandatory field), making it impossible to generate the CUE ! marker at all. Now Required() emits ! and Mandatory() emits no marker, matching their intuitive meanings. - Add `mandatory bool` field to baseParam and StructField - Add IsMandatory() accessor to baseParam, StructField, and Param interface - Add .Mandatory() builder method to all 10 concrete param types and StructField - Replace the `optional string` variable in cuegen.go with a typed `marker` variable backed by named constants (fieldMarkerOptional, fieldMarkerNone, fieldMarkerRequired) - Update IsOptional() to return !required && !mandatory - Update Optional() to clear mandatory instead of required - Update all tests to use .Mandatory() for non-optional fields Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * fix(defkit): correct doc comments after Required/Mandatory semantic swap Fix misleading comments that still described the pre-swap behaviour. Mandatory() comments incorrectly referenced the "!" marker, and Required()/IsRequired() accessors had stale descriptions. Aligned all doc comments and field annotations with the actual semantics: Required → "!" marker, Mandatory → non-optional (no ? marker). Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * feat(defkit): add BeMandatory matcher and fix BeOptional for three-state semantics BeOptional incorrectly returned true for mandatory params by checking !IsRequired(). Now uses IsOptional() which correctly excludes both required and mandatory params. Adds BeMandatory() matcher and updates paramAccessor interface with IsOptional/IsMandatory methods. Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * fix(defkit): clear required flag in Optional() for all param types The previous commit only fixed StringParam.Optional(). Apply the same fix to Int, Bool, Float, Array, Map, Struct, StructField, Enum, OneOf, and StringKeyMap so that Optional() consistently resets both mandatory and required flags across all parameter types. Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * fix(defkit): make Required() and Mandatory() mutually exclusive and fix missing optional markers in CUE generation Required() and Mandatory() only set their own flag without clearing the other, allowing both to be true simultaneously via chaining. Each method now clears the opposite flag so the last call wins, matching the reset semantics that Optional() already followed. Also fix CUE generation for int, bool, float, and enum params where the optional marker was dropped from format strings when a default value was present, causing those fields to always render without the field marker regardless of their optional/mandatory/required state. Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> * Empty commit to re-trigger e2e Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> --------- Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> |
||
Kelly Navarro
|
79d1ee7029 |
Fix: StateKeep: add nil-guard in dispatch path and clean up stale ResourceTracker entries for deleted apply-once resources (#7065)
* fix: address issue #7055 Signed-off-by: Kelly Navarro <gabrnavarro@users.noreply.github.com> * chore: remove bot artifact (pr_body.md) Signed-off-by: Kelly Navarro <gabrnavarro@users.noreply.github.com> * fix: address review feedback (attempt 2) Addresses review comments on #7055. Signed-off-by: Kelly Navarro <gabrnavarro@users.noreply.github.com> --------- Signed-off-by: Kelly Navarro <gabrnavarro@users.noreply.github.com> Co-authored-by: gabrnavarro <gabrnavarro@users.noreply.github.com> |
||
|
Vishal Kumar
|
732b49d236 |
Feat: defkit api completeness (#7064)
* docs: map existing codebase Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs: initialize project Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * Fix: add Short() and Ignore() methods to FloatParam for API completeness FloatParam was the only param type missing Short(string) and Ignore() fluent methods; the underlying baseParam fields already existed. Adds matching test cases following the existing BoolParam/IntParam pattern. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(defkit): add StatusDetails() to all 4 definition types via baseDefinition Adds statusDetails string field to baseDefinition with setStatusDetails() setter and GetStatusDetails() getter. Exposes StatusDetails(string) fluent method on ComponentDefinition, TraitDefinition, WorkflowStepDefinition, and PolicyDefinition. Updates writeStatus in cuegen.go and the inline status render block in trait.go to render statusDetails as a #"""..."""# CUE block alongside customStatus and healthPolicy when set. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(01-02): add ForceOptional() to IntParam, FloatParam, EnumParam - IntParam.ForceOptional() *IntParam - FloatParam.ForceOptional() *FloatParam - EnumParam.ForceOptional() *EnumParam - Test cases for all three types following BoolParam/StringParam patterns Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(02-01): add Labels()/GetLabels() to PolicyDefinition and fix hardcoded labels CUE - Add labels map[string]string field to PolicyDefinition struct - Add Labels() fluent setter and GetLabels() getter - Replace hardcoded labels: {} in PolicyCUEGenerator with nil-conditional sorted output - Add sort import to policy.go Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * test(02-01): add Ginkgo tests for PolicyDefinition.Labels - Test store/return labels - Test sorted key output in CUE - Test labels block omitted when Labels() never called - Test empty labels block when Labels called with empty map Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs(02-01): complete Labels on PolicyDefinition plan - SUMMARY.md: plan 02-01 execution results - STATE.md: phase 2 in progress, B1 satisfied, key decisions recorded - ROADMAP.md: phase 2 progress updated (1/3 plans) - REQUIREMENTS.md: B1 marked complete Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(02-02): add annotations field to baseDefinition with getter/setter Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(02-03): wire status block rendering into WorkflowStep and Policy CUE generators - Add status: { customStatus, healthPolicy, statusDetails } rendering to WorkflowStepCUEGenerator.GenerateTemplate - Add same status block rendering to PolicyCUEGenerator.GenerateTemplate - Block only emitted when at least one status field is non-empty, matching trait.go pattern Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(02-02): add Annotations() fluent method to all 4 definition types Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(02-02): conditional sorted annotations CUE block for component, trait, policy Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * test(02-03): add Ginkgo status block CUE render tests for WorkflowStep and Policy - 5 new tests in WorkflowStepDefinition/Status Block CUE Render context - 5 new tests in PolicyDefinition/Status Block CUE Render context - Rule 3 fix: restore sort import in trait.go (used by annotations render, spuriously flagged) Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(02-02): merge user annotations before category in workflow step CUE block Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(02-02): add sorted annotations CUE block to WorkflowStepCUEGenerator - Wire sorted user annotations rendering into WorkflowStep.GenerateFullDefinition - Matches pattern already added to Component, Trait, and Policy generators Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(02-02): merge user annotations into metadata.annotations in ToYAML for all 4 types Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs(02-03): complete Wire Status Block Rendering plan - Add 02-03-SUMMARY.md with full execution record - Update STATE.md: phase 2 complete, new decision recorded - Update ROADMAP.md progress for phase 2 - Mark B4 complete in REQUIREMENTS.md Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * test(02-02): add Annotations Ginkgo tests for all 4 definition types Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs(02-02): complete Annotations plan - SUMMARY, STATE, ROADMAP updated Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs(03): create phase 3 plans for missing CRD spec fields Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(03-01): add Version() fluent method and GetVersion() to all 4 definition types - version string field added to baseDefinition struct - setVersion/GetVersion methods on baseDefinition following existing pattern - Version(string) fluent setter on TraitDefinition, ComponentDefinition, PolicyDefinition, WorkflowStepDefinition - TDD RED+GREEN: tests for round-trip pass; CUE/YAML render tests added (fail, to be fixed in next task) Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(03-02): add ManageWorkload/ControlPlaneOnly/RevisionEnabled to TraitDefinition - Add manageWorkload, controlPlaneOnly, revisionEnabled bool fields to TraitDefinition struct - Add ManageWorkload(), ControlPlaneOnly(), RevisionEnabled() fluent setters - Add IsManageWorkload(), IsControlPlaneOnly(), IsRevisionEnabled() getters - Emit conditionally in ToYAML only when true; ToCue() unaffected - Add 11 round-trip tests covering defaults, setters, and YAML emission Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * test(03-03): add Ginkgo tests for ChildResourceKind accumulator on ComponentDefinition - 7 specs covering nil default, single entry, multi-entry accumulation, selector preservation, ToYAML emit/omit, and chaining Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(03-02): add ManageHealthCheck to PolicyDefinition - Add manageHealthCheck bool field to PolicyDefinition struct - Add ManageHealthCheck() fluent setter and IsManageHealthCheck() getter - Emit conditionally in ToYAML only when true; ToCue() unaffected - Add 5 round-trip tests covering default, setter, YAML emission, and chaining Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * test(03-03): add Ginkgo tests for PodSpecPath on ComponentDefinition - 5 specs covering empty default, set/get round-trip, ToYAML emit/omit, and chaining; both fields satisfy C5 (childResourceKinds) and C6 (podSpecPath) Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(03-01): render version in CUE output and spec.version in ToYAML for all 4 definition types - cuegen.go: conditional version emit in ComponentDefinition GenerateFullDefinition (after description) - trait.go: conditional version emit in TraitCUEGenerator.GenerateFullDefinition; spec.version in ToYAML - policy.go: conditional version emit in PolicyCUEGenerator.GenerateFullDefinition; spec.version in ToYAML - workflow_step.go: conditional version emit in WorkflowStepCUEGenerator.GenerateFullDefinition; spec.version in ToYAML - version omitted entirely when not set; TDD GREEN phase complete Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs(03-03): complete ChildResourceKind+PodSpecPath plan - SUMMARY, STATE, ROADMAP updated - C5 (childResourceKinds accumulator) and C6 (podSpecPath) requirements satisfied - 12 Ginkgo specs added covering both fields Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs(03-02): complete boolean CRD spec fields plan — manageWorkload/controlPlaneOnly/revisionEnabled/manageHealthCheck Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs(03-01): complete Version() plan — SUMMARY, STATE, ROADMAP updated - 03-01-SUMMARY.md created documenting Version() on all 4 definition types - STATE.md: 03-01 session log entry added; phase 3 marked complete; decision recorded - ROADMAP.md: phase 3 updated to 3/3 plans executed; status Complete - REQUIREMENTS.md: C1 marked complete Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs(04): add gap closure plan 04-03 for vela-go-definitions call sites Closes 17 ArrayOf→Of and 1 FilterPred→Filter call sites broken by the phase 04 renames. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(phase-4): low-risk renames — SetField→Set, ArrayOf→Of, FilterPred→Filter A1: PolicyTemplate.SetField() renamed to Set() A3: StructField.ArrayOf() renamed to Of() A5: HelperBuilder.FilterPred(Predicate) renamed to Filter(Predicate); HelperBuilder.Filter(Condition) renamed to FilterCond(Condition) All callers within defkit updated. Verification: 894 Ginkgo specs pass, go build exits 0, zero occurrences of old names in pkg/definition/defkit/. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * docs(05-high-impact-renames): create phase plan Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat(phase-5): high-impact renames — Values→Enum, Fields→WithFields A4: EnumParam.Values() renamed to Enum() — aligns with StringParam.Enum() and StructField.Enum(); 10 call sites updated in defkit tests A2: StructParam.Fields() and OneOfVariant.Fields() renamed to WithFields() — aligns with ArrayParam and MapParam; ~50 call sites updated in defkit tests Both repos build clean. go test ./pkg/definition/defkit/... passes. Non-target .Fields() methods (InCondition, StructBuilder, ArrayElement etc.) correctly preserved. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * chore: exclude .planning/ and .claude/ from version control Local development artifacts only — not for upstream. Signed-off-by: Vishal Kumar <vishal210893@gmail.com> 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * refactor: adjust formatting for consistency in component and policy definitions Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat: add FilterCond method for filtering items by Condition expression Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat: enhance filter condition handling with AND-composition for multiple filters Signed-off-by: Vishal Kumar <vishal210893@gmail.com> * feat: rename Enum method to Values for consistency in parameter definitions Signed-off-by: Jerrin Francis <jfo@> * feat: simplify labels handling in policy and trait definitions Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> --------- Signed-off-by: Vishal Kumar <vishal210893@gmail.com> Signed-off-by: Jerrin Francis <jfo@> Signed-off-by: Jerrin Francis <jerrinfrancis7@gmail.com> Co-authored-by: Claude <noreply@anthropic.com> |
||
|
Ayush Kumar
|
6a0ac8d910 |
Fix: add enum generation for struct fields in CUEGenerator (#7058)
* Fix: add enum generation for struct fields in CUEGenerator Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * ci: retrigger checks Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> --------- Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> |
||
|
Brian Kane
|
3c74ac68bf |
Fix: Allow status.details field to support dynamic keys and option to disable validation (#7056)
Signed-off-by: Brian Kane <briankane1@gmail.com> |
||
|
Vishal Kumar
|
356ecffe74 |
Fix: Update duration format handling and enhance StringParam with enum string support (#7053)
* Fix: update duration format handling and enhance StringParam with enum string support Signed-off-by: Anaswara Suresh M K <anaswarasuresh2212@gmail.com> Signed-off-by: vishal210893 <vishal210893@gmail.com> * date build-push-image workflow and improve image handlinggp Signed-off-by: Anaswara Suresh M K <anaswarasuresh2212@gmail.com> * chore: commit to re run pipeline Signed-off-by: Anaswara Suresh M K <anaswarasuresh2212@gmail.com> * Feat: add deduplication and field order tracking in collections and array elements Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com> * Fix: update test expectation for parameter data count in workflow step Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com> * Feat: add tests for label handling and template body in workflow steps Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com> * Feat: add tests for label handling and template body in workflow steps Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com> * Refactor: rename AllowString to OpenEnum for clarity in enum handling Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com> * Chore: format StringParam struct for improved readability Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com> --------- Signed-off-by: Anaswara Suresh M K <anaswarasuresh2212@gmail.com> Signed-off-by: vishal210893 <vishal210893@gmail.com> Signed-off-by: Vaibhav Agrawal <vaibhav.agrawal0096@gmail.com> |
||
Oana Schipor
|
b9a44ebfaa |
Fix: do not recreate externally deleted apply-once resources on reconciliation (#7051)
* skip ext deleted resources from state keep Signed-off-by: Oana Schipor <oana.schipor@vortexa.com> * state keep test Signed-off-by: Oana Schipor <oana.schipor@vortexa.com> * re-trigger CI Signed-off-by: Oana Schipor <oana.schipor@vortexa.com> --------- Signed-off-by: Oana Schipor <oana.schipor@vortexa.com> |
||
|
Ayush Kumar
|
3f7ad2ba95 |
Feat: defkit comp def discrepancies (#7048)
* Feat: add MapVariant operation and support for OneOf parameters with default variant Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: enhance string parameter output to include optional prefix in CUE generation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: add ConditionalOrFieldRef for fallback handling and support inline array values Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: update CUE generation to support inline arrays with conditional wrapping Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: update CUE generation to support inline arrays with conditional wrapping Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: add support for compound optional fields and enhance array builder with guarded filtering Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: add comprehensive tests for ArrayBuilder functionality Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: implement field grouping in StatusBuilder for consolidated CUE output Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: enhance CUE decomposition to support condValues and improve filtering logic Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: add metadata labels to ComponentDefinition and update CUE generation Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: clean up comments and formatting in cuegen and param files Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: enhance CUE generation, trait definitions, and PatchContainer logic CUE Generation: - Simplify condition decomposition logic and rename GetDirective method - Add condition decomposition and lifting logic to improve generated CUE output - Refactor cueTypeForParamType to use a standalone cueTypeStr function for reusability Collections: - Enhance MapVariant operation to merge variant mappings and preserve non-matching items Trait Definitions: - Enhance TraitDefinition and PatchContainerConfig with new attributes (MultiContainerCheckField, MultiContainerErrMsg) - Update emission logic in TraitCUEGenerator for multi-container support PatchContainer: - Update error messages to use camelCase for consistency with KubeVela conventions Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: enhance test descriptions for clarity and accuracy in array_builder, collections, and status tests Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: enhance handling of optional fields in collections and improve test descriptions for clarity Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: improve ConditionalOrFieldRef tests for clarity and accuracy in handling primary and fallback fields Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: enhance test descriptions for clarity and accuracy in array_builder and expr tests Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> * Feat: improve formatting of test data in collections tests for better readability Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> --------- Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com> |
||
|
Vishal Kumar
|
5369aa666a |
Fix: reorder cue buffer construction and add test for status with import statement (#7047)
Signed-off-by: vishal210893 <vishal210893@gmail.com> |