CNFCERT-1258: Add kustomize validation check - #3054
Conversation
bda0fd3 to
9e3d962
Compare
9e3d962 to
cd26643
Compare
cd26643 to
f20c118
Compare
f20c118 to
d88abd7
Compare
sebrandon1
changed the title
|
@sebrandon1: This pull request references CNFCERT-1258 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest |
15b2e13 to
0bcb84b
Compare
|
/retest |
231c2f8 to
fd70e58
Compare
openshift-ci
Bot
added
the
needs-rebase
fd70e58 to
c8a6ad3
Compare
|
/retest |
c8a6ad3 to
aca47b2
Compare
openshift-ci
Bot
removed
the
needs-rebase
aca47b2 to
4b99d22
Compare
openshift-ci
Bot
added
the
needs-rebase
4b99d22 to
4592b5b
Compare
openshift-ci
Bot
removed
the
needs-rebase
4592b5b to
68a452d
Compare
openshift-ci
Bot
added
the
needs-rebase
68a452d to
d7d6305
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
Warning Review limit reached
Next review available in: 59 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds pull-request kustomization validation through GitHub Actions, Make integration, and a script that discovers and builds kustomizations with cleanup and aggregated failure reporting. ChangesKustomize validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant Runner
participant Make
participant TestScript
participant Kustomize
PullRequest->>GitHubActions: triggers workflow for main
GitHubActions->>Runner: starts validation job
Runner->>Make: run make test-kustomize
Make->>TestScript: invoke validation script
TestScript->>Kustomize: build discovered kustomizations
Kustomize-->>TestScript: return build output or errors
TestScript-->>Make: return validation status
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/kustomize-validation.yml:
- Around line 27-43: Remove the entire manual kustomize install loop and
subsequent sudo mv/kustomize/version check in the workflow (the curl | bash
download, retry loop, sudo mv kustomize /usr/local/bin/, and kustomize version
lines). Instead rely on the repository Makefile targets (test-kustomize and the
kustomize task) which install a pinned kustomize v5.1.1 into ./bin and update
PATH; delete the redundant installation steps to avoid the unpinned curl|bash
supply-chain risk and keep the workflow using the Makefile-managed kustomize.
In `@hack/test-kustomize.sh`:
- Around line 99-100: The script exits early due to set -e when running
BUILD_OUTPUT=$(kustomize build "$dir" 2>&1); change this to prevent errexit,
e.g. run BUILD_OUTPUT=$(kustomize build "$dir" 2>&1) || BUILD_EXIT=$? || true
(or temporarily disable errexit with set +e / set -e), then replace the
subsequent check that uses "$?" with a check against BUILD_EXIT (e.g. if [
"${BUILD_EXIT:-0}" -eq 0 ]; then) so each directory is tested and failures are
aggregated for the summary while still capturing the build output in
BUILD_OUTPUT.
In `@internal/clusterconfig/lvmconfig.go`:
- Around line 101-102: Current code only clears uid and resourceVersion on the
LocalVolume (lv.SetUID("") / lv.SetResourceVersion("")) leaving other transient
metadata; replace that ad-hoc cleanup by invoking the package's CleanResource
helper to fully sanitize metadata (e.g., call CleanResource(&lv.ObjectMeta) for
the LocalVolume) and do the same for the StorageClass export; remove the lone
SetUID/SetResourceVersion lines and ensure CleanResource is applied to the
resource ObjectMeta so managedFields, generation, ownerReferences, status,
creationTimestamp, etc., are all cleared consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 72dbf3e9-2924-4e4f-92b7-b9b534a788b8
📒 Files selected for processing (5)
.github/workflows/kustomize-validation.yml.golangci.ymlMakefilehack/test-kustomize.shinternal/clusterconfig/lvmconfig.go
💤 Files with no reviewable changes (1)
- .golangci.yml
|
/retest-required |
d7d6305 to
019eb8c
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@hack/test-kustomize.sh`:
- Around line 37-46: Add an explicit preflight check for the envsubst command
(from gettext) similar to the existing kustomize check: verify that envsubst is
available (command -v envsubst) before any patch generation or usage, emit a
clear error message advising installation of gettext/envsubst with
platform-specific instructions (e.g., apt install gettext on Linux, brew install
gettext on macOS) and exit non-zero if missing; update the script area that
later calls envsubst so it's guarded by this new check and references the symbol
envsubst to locate where to add it.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 4f76d700-7508-4274-a730-a7a6e2546eed
📒 Files selected for processing (5)
.github/workflows/kustomize-validation.yml.golangci.ymlMakefilehack/test-kustomize.shinternal/clusterconfig/lvmconfig.go
💤 Files with no reviewable changes (1)
- .golangci.yml
✅ Files skipped from review due to trivial changes (2)
- .github/workflows/kustomize-validation.yml
- internal/clusterconfig/lvmconfig.go
019eb8c to
bd90136
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/kustomize-validation.yml:
- Around line 16-17: The checkout step using actions/checkout@v4 currently
leaves credentials persisted; update that step to include persist-credentials:
false so the checkout does not retain Git credentials (since this workflow only
runs read-only validation). Locate the job step with name "Checkout repository"
and the uses: actions/checkout@v4 and add the persist-credentials: false key
under that step.
- Line 17: Replace the loose tag reference in the workflow's actions/checkout
usage with a pinned commit SHA: locate the line containing "uses:
actions/checkout@v4" and change it to use the exact commit SHA for the desired
v4 release (e.g., actions/checkout@<commit-sha>), and optionally add a comment
noting the v4 version for readability; ensure the unique string
"actions/checkout" is updated everywhere in this workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 2aeeac8b-97fb-4562-b609-4b6e894f22cf
📒 Files selected for processing (5)
.github/workflows/kustomize-validation.yml.golangci.ymlMakefilehack/test-kustomize.shinternal/clusterconfig/lvmconfig.go
💤 Files with no reviewable changes (1)
- .golangci.yml
🚧 Files skipped from review as they are similar to previous changes (3)
- hack/test-kustomize.sh
- Makefile
- internal/clusterconfig/lvmconfig.go
bd90136 to
0e5562d
Compare
0e5562d to
5891878
Compare
47bf53f to
a8e813a
Compare
c58f253 to
52ec517
Compare
|
@sebrandon1: This pull request references CNFCERT-1258 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
bd8a73a to
8144578
Compare
|
@sebrandon1: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
8144578 to
bd4be7a
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jc-rh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
4 participants
Summary
Adds a kustomize validation check that runs
kustomize buildagainst all kustomization.yaml files to catch YAML structure issues early. Ported from telco-reference#433 (merged).mainmake test-kustomizetarget for local validation; also wired intoci-jobandlintrelated-images/patch.yamlvia envsubst when missing, cleans up on exitvendor/,.git/,bin/,telco5g-konflux/directoriesJira: CNFCERT-1258
Related PRs
Test plan
make test-kustomizepasses locallymain