ExtractRevision parsed the last hyphen segment as the revision number
without validating the name shape, so a bareword like "5" returned
5,nil and any name lacking a trailing v-prefixed segment silently
mis-parsed instead of erroring. Mirror the existing ExtractRevisionNum
guards: error with ErrBadRevision when there is no delimiter or the
last segment is not v-prefixed. Extend the colocated bad-name test
cases accordingly.
Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
* feat(cue/upgrade): auto-remediate legacy CUE syntax at render time
Transparently rewrite CUE templates that use deprecated list arithmetic
(+, *) and conflicting field names (error) so that older definitions
continue to work with CUE ≥ v0.14 (KubeVela ≥ 1.11).
- CUEUpgradeFunc registry with ID, CUE/KubeVela version guards, precheck,
and upgrade function fields
- upgradeListConcatenation: rewrites list1+list2 → list.Concat([list1,list2])
and list*n → list.Repeat(list, n); adds "list" import as needed
- collectAddChain + extractListConcatArgs: flatten left-associative + chains
and existing list.Concat([...]) leaves into a single flat call, so both
fresh chains (a+b+c+d) and partially-upgraded chains produce one
list.Concat([a,b,c,d]) with no nesting across repeated passes
- upgradeErrorFieldLabel: rewrites unquoted `error` field labels to "error"
to avoid conflict with the CUE 0.14 built-in; precheck uses a tighter
\berror\s*: regex to avoid false positives on identifiers like errorMessage
- EnsureCueVersionCompatibility: single entry point used at render time;
LRU cache with TTL eviction, Prometheus metrics, feature flag
- ParseVersion: regex anchored to reject garbage suffixes (e.g. "1.11foo")
while accepting pre-release+build metadata (e.g. "v1.13.0-alpha.1+dev")
- template.go: call EnsureCueVersionCompatibility for every template area
(main, health, custom status, status detail) with correct DefinitionKind
derived from which definition pointer is non-nil
- validate.go: upgrade policy templates before compiling in
validateNoRequiredParameters
- `vela def upgrade FILE [-o OUTPUT]`: upgrades a single .cue file
- `vela def upgrade FILE --validate [--quiet]`: exit 1 if upgrade needed
- `vela def compat definitions` / `vela def compat applications`: scan
cluster definitions/apps for compat issues; output as table or YAML
- Cyclomatic complexity kept below threshold by extracting scanDefinitions,
scanDefRevisions, buildDefCompatReport, scanApplications, scanAppRevision
as standalone functions with options structs
- revisionNum() helper for numeric vN comparison (avoids lexicographic bugs)
- mergeImports() dedup helper shared by ToCUEString and formatCUEString
- ANSI escape sequences replaced with fatih/color for portability
- goconst: "yaml" → outputFormatYAML named constant throughout
- Component, trait, and policy definition validating handlers: removed
spurious obj.Name argument from fmt.Sprintf in warning messages
- FromCUEString: only prepend importString to the stored template when
imports are non-empty; empty importString ("\n") was causing a leading
newline that made yaml.v3 use |2 block scalar on every generated YAML
- gen_sdk testdata: removed unused imports (vela/op, encoding/base64) from
one_of.cue that were exposed by our importString+templateString change
- e2e test: fix flaky trait-order assertion using ContainElements instead
of index-based equality
Upgraded all built-in .cue files that used deprecated list arithmetic:
- vela-templates/definitions/internal/component/cron-task.cue
- vela-templates/definitions/internal/trait/command.cue
- vela-templates/definitions/internal/trait/container-ports.cue
- vela-templates/definitions/internal/trait/env.cue
- vela-templates/definitions/internal/trait/init-container.cue
Removed unused stdlib imports that caused `def gen-api` to fail:
- vela-templates/definitions/internal/workflowstep/apply-deployment.cue
- vela-templates/definitions/internal/workflowstep/apply-terraform-provider.cue
- vela-templates/definitions/internal/workflowstep/build-push-image.cue
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
* fix(cue/upgrade): address PR review comments
- sync.atomic.Pointer for compatCache to fix data race on reinit
- SummaryVec → HistogramVec for both duration metrics (aggregatable
across HA replicas); buckets tuned to sub-millisecond upgrade path
and millisecond render path respectively
- errorFieldLabelRe: extend to match optional (?) and required (!)
field constraint markers before the colon
- cue-compatibility-cache-size: clamp negative values to 0 (disabled)
with warning log; document 0=disabled in flag help; cache put is
no-op when capacity <= 0
- webhook: replace RequiresUpgrade+EnsureCueVersionCompatibility double
parse with single EnsureCueVersionCompatibility call; use string
comparison to detect upgrade and emit warning
- def compat: log warning when ApplicationRevision fetch fails instead
of silently skipping (partial results are preserved)
- e2e: only delete definitions in DeferCleanup if this test created
them (avoid deleting pre-existing shared resources)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
* fix(cue/upgrade): address further PR review comments
- EnsureCueVersionCompatibility: return (string, bool) where bool
indicates semantic upgrades were applied (len(applied)>0), not
string inequality — prevents false-positive warnings from
formatting-only normalisation; update all call sites
- webhook handlers (component, trait, policy): switch from
RequiresUpgrade+EnsureCueVersionCompatibility double-call to single
EnsureCueVersionCompatibility call using wasUpgraded bool; remove
now-unused strings imports
- cache: skip eviction goroutine when capacity==0 (disabled); set
compatCacheCancel=nil on disabled path to avoid stale cancel on
next InitCompatibilityCache call
- e2e: replace boolean ownership tracking with createAndTrack helper
that checks pre-existence via Get before Create, eliminating both
the ambiguous-create leak and the boilerplate booleans
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
* fix: address reviewer comments — cache determinism, e2e ownership race
- cache: store normalised string in compatEntry.upgraded even when no
semantic fixes were applied, so cache-hit and cache-miss paths return
identical output (fixes non-deterministic behaviour flagged in review)
- upgrade: return entry.upgraded on the requiresUpgrade=false cache-hit
path instead of the raw input cueStr
- e2e: replace GET-then-CREATE ownership inference with atomic CREATE-
first pattern; err==nil means we created it (register DeferCleanup),
IsAlreadyExists means it pre-existed (skip cleanup), eliminating the
GET/CREATE race window that could misattribute ownership
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Brian Kane <briankane1@gmail.com>
---------
Signed-off-by: Brian Kane <briankane1@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
The remote URL of a Terraform module can embed credentials (for example
https://user:token@host/repo.git). The cache-reuse logic logged the raw URL
and wrote it to the .remote-url cache marker, which could leak those
credentials into controller logs and onto disk.
Strip the userinfo from the URL before logging it and before writing the cache
marker. The marker now stores a credential-free URL and the reuse check
compares the same stripped form, so cache reuse and re-clone-on-change behave
as before while no secret is persisted.
Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com>
Wrap the cache remote marker read in filepath.Clean, the same pattern
other os.ReadFile call sites in this repo use to satisfy gosec. The
path is built from filepath.Join and a constant suffix, with the module
name validated beforehand, so behavior is unchanged.
The finding surfaced on master after the GHSA-fmgp-q6jx-gg3x merge
because the advisory workflow did not run the full lint job.
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* fix: prevent unbounded read in Terraform remote configuration loader (GHSA-fmgp-q6jx-gg3x)
* fix: bound remote Terraform clone and invalidate cache on rejection
Follow-up hardening for GHSA-fmgp-q6jx-gg3x.
Bound the clone of the attacker-supplied repository: shallow Depth:1, a
2-minute fetch timeout via PlainCloneContext, and post-clone caps on the
retained tree size (64 MiB) and file count, rejecting and removing a clone
that exceeds them.
Invalidate the clone cache: re-clone when the recorded remote URL changes,
and remove the cache on a failed clone or a rejected read so a corrected
repository is re-fetched instead of a poisoned or stale tree being reused.
Validate the module name before building the cache path, and log clone,
rejection, and eviction events.
* fix(controller): set Ready condition to False on reconcile failure
endWithNegativeCondition set only the failing sub-condition (e.g.
Parsed=False/ReconcileError) but left the rollup Ready condition
unchanged, so a reconcile failure left Ready at True/ReconcileSuccess
from the last successful reconcile. Health checkers polling Ready as
the application health signal missed the failure.
Also set Ready=False/ReconcileError alongside the sub-condition with
the same message, so the rollup reflects the failure on every path
that ends through endWithNegativeCondition.
Fixes#7164
Signed-off-by: Anuragp22 <anuragp2003b@gmail.com>
* test(controller): assert Ready condition propagates sub-condition message
Address cubic review on #7168: verify the persisted Ready condition's
Message field equals the failing sub-condition's Message, so a future
refactor that drops the message propagation in endWithNegativeCondition
gets caught by the test.
Signed-off-by: Anuragp22 <anuragp2003b@gmail.com>
---------
Signed-off-by: Anuragp22 <anuragp2003b@gmail.com>
* Feat: support per-application reconciliation interval override via annotation
Add the app.oam.dev/reconcile-interval annotation that lets operators
override the global ApplicationReSyncPeriod on a per-application basis.
This is useful when different applications have different drift-detection
needs: a production app might need reconciliation every minute while a
dev/staging app can safely use a longer interval to reduce API server load.
When the annotation is present and contains a valid Go duration string
(e.g. "1m", "15m", "30s") at or above the 10s minimum floor, the
controller uses that value as RequeueAfter instead of the global default.
Invalid or below-minimum values are logged as warnings and silently fall
back to the global default, preserving full backward compatibility.
The implementation adds a forApp() chain method to reconcileResult so that
only the return paths where the default resync period matters (normal
completion and error recovery) need to be annotated, leaving all explicit
requeue() calls untouched.
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
* test: add e2e coverage for app reconcile interval
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
* chore: trigger ci rerun
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
* fix: address reconcile interval review feedback
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
* fix: satisfy reconcile interval lint
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
---------
Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
* feat: implement valuesFrom support for helmchart component and update documentation examples
Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
* fix: address cubic review feedback on valuesFrom
Three issues raised by cubic AI review on kubevela#7099:
1. docs/examples/helmchart-valuesfrom/secret-and-inline.yaml —
Expected-result comments used incorrect paths (resources.cpu /
resources.mem) and values (500m) that did not match the actual CM
data. Rewrote the narrative to use the real paths
(resources.limits.cpu / resources.limits.memory) and bundled the
Secret inline in the manifest so the example is self-contained and
the expected output is deterministic.
2. docs/examples/helmchart-valuesfrom/secret-and-inline.yaml —
The Secret was marked optional: true while the narrative required
it for the merged output to match. Bundled the Secret inline and
dropped the optional flag, removing the order/timing ambiguity.
README.md updated to drop the now-redundant "create the Secret
first" instruction.
3. pkg/cue/cuex/providers/helm/helm.go:Render —
After removing the unconditional "default" fallback for
releaseNamespace, Helm could run with an empty namespace when both
Context.AppNamespace and Release.Namespace were unset (non-normal
code paths — direct callers, tests, CLI tooling). Restored the
"default" fallback at the end of the namespace resolution while
keeping the Application-namespace plumbing for tenant-scoped
cross-namespace rejection.
Co-authored-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
* feat: add valuesFrom fingerprinting for helmchart components to trigger workflow restarts on ConfigMap/Secret changes
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* feat: add valuesFrom fingerprinting for helmchart components to trigger workflow restarts on ConfigMap/Secret changes
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* feat: enhance valuesFrom support for helmchart components with fingerprinting and error handling
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* docs: clarify cross-namespace restrictions for valuesFrom in helmchart examples
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* ci: retrigger checks
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* feat: add publishVersion support to Helm provider for stable release management
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* feat: improve error handling for application retrieval in Helm provider
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* ci: retrigger checks
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* feat: add application publishVersion lookup defense in Helm provider tests
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
---------
Signed-off-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Co-authored-by: Anaswara Suresh <anaswarasuresh2212@gmail.com>
appliedResources entries use resource names, not component names, so filtering
them against component names incorrectly dropped valid entries. Rebuild directly
from the current ResourceTracker each reconcile - already in memory, no extra
API calls.
Signed-off-by: Brian Kane <briankane1@gmail.com>
Introduces application-scoped policies and global auto-applied policies
for KubeVela.
Key changes:
- PolicyDefinition gains `scope`, `global`, and `priority` fields
- Global policies (global=true, scope=Application) are auto-applied to
every Application in their namespace (and vela-system globals apply
cluster-wide) without being listed in spec.policies
- PolicyScopeIndex: in-memory singleton index of PolicyDefinition
metadata, bootstrapped at startup and kept live via watch events.
Follows KubeVela's 2-step lookup (local namespace → vela-system)
- ApplicationPolicyCache: per-app cache of rendered policy results,
invalidated by spec hash, revision hash, or TTL; cleared on deletion
- Policy rendering pipeline extended to inject global policies before
user-specified ones, respecting priority ordering
- Appfile.Context carries context.Context from controller into rendering
- Feature gates: EnableApplicationScopedPolicies and EnableGlobalPolicies
(both Alpha, default false); admission webhook warns when a
PolicyDefinition targets a disabled gate
Signed-off-by: Brian Kane <briankane1@gmail.com>
* Fix: omit component revision in additionalLabel to add to k8s object when component revision is not set and DisableAllComponentRevision setted true
Signed-off-by: 那金洋(29362878) <najinyang001@ke.com>
* Fix: omit component revision in additionalLabel to add to k8s object when component revision is not set and DisableAllComponentRevision setted true test cases
Signed-off-by: 那金洋(29362878) <najinyang001@ke.com>
---------
Signed-off-by: 那金洋(29362878) <najinyang001@ke.com>
* fix: check component status after initial deployment
Signed-off-by: Brian Kane <briankane1@gmail.com>
* Fix: applications should correctly reflect component health throughout the apps lifecycle
Signed-off-by: Brian Kane <briankane1@gmail.com>
* Fix: check component status after initial deployment
Signed-off-by: Brian Kane <briankane1@gmail.com>
---------
Signed-off-by: Brian Kane <briankane1@gmail.com>
Co-authored-by: Mikhail Elenskii <elenskii-mikhail@outlook.com>
- Remove gomega from workflow e2e-test step
- Change the app phase to WorkFlowFailed when there is an error in workflow
- Change the app10.yaml file
Signed-off-by: Chaitanyareddy0702 <chaitanyareddy0702@gmail.com>
Author: VibhorChinda <vibhorchinda@gmail.com>
Anas KhanandGitHub
Ayush KumarandGitHub
Anurag PappulaandGitHub
Asish KumarandGitHub
Amit SinghandGitHub
Aberham OscarandGitHub
Tianxin DongandGitHub
Tianxin DongandGitHub
Daniel HigueroandGitHub
JohnJanandGitHub
qiaozpandGitHub
SomefiveandGitHub
yyzxwandGitHub
