* fix: make podDisruptive actually trigger pod restart for outputs-based traits
When a TraitDefinition sets podDisruptive: true but renders its output
via outputs: (e.g. a ConfigMap) instead of patch:, the workload's pod
was never restarted when the trait's content changed - podDisruptive
was effectively a no-op.
This adds propagatePodDisruptiveHash, called from SetOAMContract for
every rendered trait. When the trait's TraitDefinition has
podDisruptive: true and the target workload has a spec.template, a
content hash of the trait's rendered output is stamped onto
spec.template.metadata.annotations as
app.oam.dev/trait-restart-hash-<traitType>. Since this lives inside
spec.template, any change to the trait's content changes the pod
template, causing the owning controller (Deployment/StatefulSet/...)
to roll the pods automatically.
Fixes#7204
Signed-off-by: Ankit Kumar <ankitkumarrain12@gmail.com>
* fix: address cubic review for podDisruptive restart hash
Harden annotation key length checks against the Kubernetes name-segment
limit (63 chars after the slash) and document selective metadata hashing
so user name/labels/annotations change the restart hash while
controller/OAM revision churn does not. Expand unit coverage and drop a
duplicate test case.
Signed-off-by: Ankit Kumar <ankitkumarrain12@gmail.com>
* Revert "fix: address cubic review for podDisruptive restart hash"
This reverts commit d666da0024099b8935347137cac81609b7c1d84a.
Signed-off-by: Ankit Kumar <ankitkumarrain12@gmail.com>
---------
Signed-off-by: Ankit Kumar <ankitkumarrain12@gmail.com>
- Bump github.com/kubevela/pkg to v1.11.0 and github.com/kubevela/workflow to v0.7.0
- Remove local replace directives for both modules
- Wire EnableCUEVersionCompatibility as a pointer alias into the engine to eliminate data race
- Add --enable-cue-version-compatibility and --cue-compatibility-cache-size flags via CUEConfig
- Fix all call sites (webhooks, CLI def.go) to dereference the pointer alias correctly
- Add individual revive-compliant doc comments on re-exported types
- Add examples/legacy-upgrade-demo/ demonstrating runtime legacy list syntax rewriting
Signed-off-by: Brian Kane <briankane1@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(cue/upgrade): auto-remediate legacy CUE syntax at render time
Transparently rewrite CUE templates that use deprecated list arithmetic
(+, *) and conflicting field names (error) so that older definitions
continue to work with CUE ≥ v0.14 (KubeVela ≥ 1.11).
- CUEUpgradeFunc registry with ID, CUE/KubeVela version guards, precheck,
and upgrade function fields
- upgradeListConcatenation: rewrites list1+list2 → list.Concat([list1,list2])
and list*n → list.Repeat(list, n); adds "list" import as needed
- collectAddChain + extractListConcatArgs: flatten left-associative + chains
and existing list.Concat([...]) leaves into a single flat call, so both
fresh chains (a+b+c+d) and partially-upgraded chains produce one
list.Concat([a,b,c,d]) with no nesting across repeated passes
- upgradeErrorFieldLabel: rewrites unquoted `error` field labels to "error"
to avoid conflict with the CUE 0.14 built-in; precheck uses a tighter
\berror\s*: regex to avoid false positives on identifiers like errorMessage
- EnsureCueVersionCompatibility: single entry point used at render time;
LRU cache with TTL eviction, Prometheus metrics, feature flag
- ParseVersion: regex anchored to reject garbage suffixes (e.g. "1.11foo")
while accepting pre-release+build metadata (e.g. "v1.13.0-alpha.1+dev")
- template.go: call EnsureCueVersionCompatibility for every template area
(main, health, custom status, status detail) with correct DefinitionKind
derived from which definition pointer is non-nil
- validate.go: upgrade policy templates before compiling in
validateNoRequiredParameters
- `vela def upgrade FILE [-o OUTPUT]`: upgrades a single .cue file
- `vela def upgrade FILE --validate [--quiet]`: exit 1 if upgrade needed
- `vela def compat definitions` / `vela def compat applications`: scan
cluster definitions/apps for compat issues; output as table or YAML
- Cyclomatic complexity kept below threshold by extracting scanDefinitions,
scanDefRevisions, buildDefCompatReport, scanApplications, scanAppRevision
as standalone functions with options structs
- revisionNum() helper for numeric vN comparison (avoids lexicographic bugs)
- mergeImports() dedup helper shared by ToCUEString and formatCUEString
- ANSI escape sequences replaced with fatih/color for portability
- goconst: "yaml" → outputFormatYAML named constant throughout
- Component, trait, and policy definition validating handlers: removed
spurious obj.Name argument from fmt.Sprintf in warning messages
- FromCUEString: only prepend importString to the stored template when
imports are non-empty; empty importString ("\n") was causing a leading
newline that made yaml.v3 use |2 block scalar on every generated YAML
- gen_sdk testdata: removed unused imports (vela/op, encoding/base64) from
one_of.cue that were exposed by our importString+templateString change
- e2e test: fix flaky trait-order assertion using ContainElements instead
of index-based equality
Upgraded all built-in .cue files that used deprecated list arithmetic:
- vela-templates/definitions/internal/component/cron-task.cue
- vela-templates/definitions/internal/trait/command.cue
- vela-templates/definitions/internal/trait/container-ports.cue
- vela-templates/definitions/internal/trait/env.cue
- vela-templates/definitions/internal/trait/init-container.cue
Removed unused stdlib imports that caused `def gen-api` to fail:
- vela-templates/definitions/internal/workflowstep/apply-deployment.cue
- vela-templates/definitions/internal/workflowstep/apply-terraform-provider.cue
- vela-templates/definitions/internal/workflowstep/build-push-image.cue
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
* fix(cue/upgrade): address PR review comments
- sync.atomic.Pointer for compatCache to fix data race on reinit
- SummaryVec → HistogramVec for both duration metrics (aggregatable
across HA replicas); buckets tuned to sub-millisecond upgrade path
and millisecond render path respectively
- errorFieldLabelRe: extend to match optional (?) and required (!)
field constraint markers before the colon
- cue-compatibility-cache-size: clamp negative values to 0 (disabled)
with warning log; document 0=disabled in flag help; cache put is
no-op when capacity <= 0
- webhook: replace RequiresUpgrade+EnsureCueVersionCompatibility double
parse with single EnsureCueVersionCompatibility call; use string
comparison to detect upgrade and emit warning
- def compat: log warning when ApplicationRevision fetch fails instead
of silently skipping (partial results are preserved)
- e2e: only delete definitions in DeferCleanup if this test created
them (avoid deleting pre-existing shared resources)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
* fix(cue/upgrade): address further PR review comments
- EnsureCueVersionCompatibility: return (string, bool) where bool
indicates semantic upgrades were applied (len(applied)>0), not
string inequality — prevents false-positive warnings from
formatting-only normalisation; update all call sites
- webhook handlers (component, trait, policy): switch from
RequiresUpgrade+EnsureCueVersionCompatibility double-call to single
EnsureCueVersionCompatibility call using wasUpgraded bool; remove
now-unused strings imports
- cache: skip eviction goroutine when capacity==0 (disabled); set
compatCacheCancel=nil on disabled path to avoid stale cancel on
next InitCompatibilityCache call
- e2e: replace boolean ownership tracking with createAndTrack helper
that checks pre-existence via Get before Create, eliminating both
the ambiguous-create leak and the boilerplate booleans
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
* fix: address reviewer comments — cache determinism, e2e ownership race
- cache: store normalised string in compatEntry.upgraded even when no
semantic fixes were applied, so cache-hit and cache-miss paths return
identical output (fixes non-deterministic behaviour flagged in review)
- upgrade: return entry.upgraded on the requiresUpgrade=false cache-hit
path instead of the raw input cueStr
- e2e: replace GET-then-CREATE ownership inference with atomic CREATE-
first pattern; err==nil means we created it (register DeferCleanup),
IsAlreadyExists means it pre-existed (skip cleanup), eliminating the
GET/CREATE race window that could misattribute ownership
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
---------
Signed-off-by: Brian Kane <briankane1@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Feat: Validate undeclared parameters in application definitions (#6862)
Add a new feature gate ValidateUndeclaredParameters that rejects
parameters not declared in the CUE definition schema at admission time.
When enabled, any parameter field not present in the template's parameter
stanza will cause a validation error.
Signed-off-by: majiayu000 <1835304752@qq.com>
* Fix: Handle CUE pattern constraints and improve undeclared param validation
- Detect pattern constraints ([string]: T) using LookupPath to avoid
false positives on webservice labels/annotations fields
- Use GetSelectorLabel() for safe selector extraction
- Add klog debug logging when schema compilation fails
- Sort undeclared field names for deterministic error messages
- Add test cases for pattern constraints and sorted output
Signed-off-by: majiayu000 <1835304752@qq.com>
* Fix: go fmt alignment in validate_test.go
Signed-off-by: majiayu000 <1835304752@qq.com>
* fix: address review feedback on PR #7075
- Handle conditional parameter declarations via two-pass schema
compilation: first without params for base fields, then with
declared params to resolve CUE conditionals
- Return nil from findUndeclaredFields when schema.Fields() errors
to prevent false positives from empty declared map
- Recurse into list elements containing structs using cue.AnyIndex
so undeclared fields inside arrays are detected
- Save/restore previous feature gate state in tests instead of
resetting to fixed values
Signed-off-by: majiayu000 <1835304752@qq.com>
---------
Signed-off-by: majiayu000 <1835304752@qq.com>
Introduces application-scoped policies and global auto-applied policies
for KubeVela.
Key changes:
- PolicyDefinition gains `scope`, `global`, and `priority` fields
- Global policies (global=true, scope=Application) are auto-applied to
every Application in their namespace (and vela-system globals apply
cluster-wide) without being listed in spec.policies
- PolicyScopeIndex: in-memory singleton index of PolicyDefinition
metadata, bootstrapped at startup and kept live via watch events.
Follows KubeVela's 2-step lookup (local namespace → vela-system)
- ApplicationPolicyCache: per-app cache of rendered policy results,
invalidated by spec hash, revision hash, or TTL; cleared on deletion
- Policy rendering pipeline extended to inject global policies before
user-specified ones, respecting priority ordering
- Appfile.Context carries context.Context from controller into rendering
- Feature gates: EnableApplicationScopedPolicies and EnableGlobalPolicies
(both Alpha, default false); admission webhook warns when a
PolicyDefinition targets a disabled gate
Signed-off-by: Brian Kane <briankane1@gmail.com>
* feat(appfile): Add comprehensive unit tests for appfile package
This commit significantly enhances the test coverage for the `pkg/appfile` package by adding a comprehensive suite of new unit tests. These tests improve the reliability of core application parsing, generation, and validation logic.
Key additions include:
- **Parsing:** New tests for policy parsing, legacy application revision handling, and dynamic component loading.
- **Manifest Generation:** Added coverage for `GenerateComponentManifests` and `GeneratePolicyManifests` to ensure correctness of generated resources.
- **OAM Contracts:** New tests for `SetOAMContract` and `setWorkloadRefToTrait` to verify OAM label and reference injection.
- **Template & Context:** Added tests for loading templates from revisions (`LoadTemplateFromRevision`) and preparing the process context (`PrepareProcessContext`).
- **Validation:** Enhanced validation tests for component parameters and uniqueness of output names.
As part of this effort, the existing tests were also migrated from Ginkgo to the standard `testing` package with `testify/assert` to maintain consistency across the codebase.
Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com>
* refactor(pkg/component): Migrate ref-objects tests to standard Go testing and add new test cases
This commit refactors the unit tests for `pkg/component/ref-objects` from a Ginkgo-based suite to the standard Go `testing` package. Additionally, new unit test cases have been added to further enhance test coverage and ensure the robustness of the `ref-objects` functionality.
Key changes include:
- Deletion of `pkg/component/ref_objects_suite_test.go`.
- Introduction of `pkg/component/main_test.go` to manage test environment setup and teardown using `TestMain`.
- Creation of `pkg/component/ref_objects_test.go` containing all the ref-objects related unit tests, now using standard Go testing functions, along with newly added test cases for improved coverage.
This migration improves consistency with other unit tests in the codebase and leverages the native Go testing framework.
Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com>
* chore(pkg/component): Reorder imports in ref_objects_test.go
This commit reorders the import statements in `pkg/component/ref_objects_test.go` to adhere to standard Go formatting and import grouping conventions. This change improves code readability and consistency.
Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com>
---------
Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com>
* Fix(parser) - Valid value must be an empty string or consist of alphanumeric characters, '-', '' or '.', and must start and end with an alphanumeric character
Signed-off-by: Jonatas Teixeira <jonatas.teixeira@hellofresh.com>
* Fix(e2e) - Increase waiting to prevent test start before port-forwared be finished
Signed-off-by: Jonatas Teixeira <jonatas.teixeira@hellofresh.com>
* Fix(e2e) - Adjust the time
Signed-off-by: Jonatas Teixeira <jonatas.teixeira@hellofresh.com>
* Fix(e2e) - Increase waiting to prevent test start before port-forwared be finished - By using gomega
Signed-off-by: Jonatas Teixeira <jonatas.teixeira@hellofresh.com>
* Fix(e2e) - Change vela command to get app status
Signed-off-by: Jonatas Teixeira <jonatas.teixeira@hellofresh.com>
---------
Signed-off-by: Jonatas Teixeira <jonatas.teixeira@hellofresh.com>
Ankit kumarandGitHub
lifandGitHub
Bryan LeongandGitHub
AshvinBambhaniya2003andGitHub
Vaibhav AgrawalandGitHub
Jonatas TeixeiraandGitHub
Tianxin DongandGitHub
Daniel HigueroandGitHub
qiaozpandGitHub
JohnJanandGitHub
StevenLeiZhangandGitHub
SomefiveandGitHub
yyzxwandGitHub
barnettZQGandGitHub
