-
Notifications
You must be signed in to change notification settings - Fork 36
Validate TWD spec via CRD CEL rules at apply time (fixes #62) #293
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
9 commits
Select commit
Hold shift + click to select a range
d593790
Validate TWD spec via CRD CEL rules instead of reconciler
carlydf ef1c54d
Fix CRD CEL rule cost violations caught by envtest
carlydf 4a72bc2
Enforce webhook-only spec checks in reconciler with event+condition
carlydf e02aec8
Don't requeue on invalid spec — watch triggers on spec update
carlydf 4eff7d8
Remove webhook checks now enforced by CRD CEL rules
carlydf 7fb0ab5
Add envtest integration tests for TWD CRD CEL validation rules
carlydf bc15997
Test that >20 Progressive steps are rejected by the CRD maxItems cons…
carlydf 30af982
fmt
carlydf 2c0e840
Merge branch 'main' of github.com:temporalio/temporal-worker-controll…
carlydf File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
122 changes: 122 additions & 0 deletions
122
api/v1alpha1/temporalworkerdeployment_cel_validation_test.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,122 @@ | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the MIT License. | ||
| // | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2024 Datadog, Inc. | ||
|
|
||
| package v1alpha1 | ||
|
|
||
| // Integration tests for CRD-level CEL validation rules on TemporalWorkerDeployment. | ||
| // | ||
| // These tests hit a real kube-apiserver (via envtest) so they verify that the | ||
| // x-kubernetes-validations blocks in the generated CRD manifest are syntactically | ||
| // valid and semantically correct. The webhook Go code is NOT involved here — we are | ||
| // testing what the API server enforces regardless of whether the webhook is enabled. | ||
|
|
||
| import ( | ||
| "strings" | ||
| "time" | ||
|
|
||
| . "github.com/onsi/ginkgo/v2" | ||
| . "github.com/onsi/gomega" | ||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| ) | ||
|
|
||
| var _ = Describe("TemporalWorkerDeployment CRD CEL validation", func() { | ||
| var ns string | ||
|
|
||
| BeforeEach(func() { | ||
| ns = makeTestNamespace("twd-cel") | ||
| }) | ||
|
|
||
| // baseTWD returns a minimal valid TWD in the given namespace. | ||
| baseTWD := func(name string) *TemporalWorkerDeployment { | ||
| return &TemporalWorkerDeployment{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: name, | ||
| Namespace: ns, | ||
| }, | ||
| Spec: TemporalWorkerDeploymentSpec{ | ||
| Template: corev1.PodTemplateSpec{ | ||
| Spec: corev1.PodSpec{ | ||
| Containers: []corev1.Container{{Name: "worker", Image: "worker:latest"}}, | ||
| }, | ||
| }, | ||
| RolloutStrategy: RolloutStrategy{Strategy: UpdateAllAtOnce}, | ||
| WorkerOptions: WorkerOptions{ | ||
| TemporalConnectionRef: TemporalConnectionReference{Name: "my-connection"}, | ||
| TemporalNamespace: "default", | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| It("accepts a valid TWD", func() { | ||
| Expect(k8sClient.Create(ctx, baseTWD("valid-worker"))).To(Succeed()) | ||
| }) | ||
|
|
||
| It("rejects name longer than 63 characters", func() { | ||
| twd := baseTWD(strings.Repeat("a", 64)) | ||
| err := k8sClient.Create(ctx, twd) | ||
| Expect(err).To(HaveOccurred()) | ||
| Expect(err.Error()).To(ContainSubstring("name cannot be more than 63 characters")) | ||
| }) | ||
|
|
||
| It("rejects Progressive strategy with no steps", func() { | ||
| twd := baseTWD("prog-no-steps") | ||
| twd.Spec.RolloutStrategy = RolloutStrategy{Strategy: UpdateProgressive} | ||
| err := k8sClient.Create(ctx, twd) | ||
| Expect(err).To(HaveOccurred()) | ||
| Expect(err.Error()).To(ContainSubstring("steps are required for Progressive rollout")) | ||
| }) | ||
|
|
||
| It("rejects more than 20 Progressive steps", func() { | ||
| steps := make([]RolloutStep, 21) | ||
| for i := range steps { | ||
| steps[i] = RolloutStep{ | ||
| RampPercentage: i + 1, | ||
| PauseDuration: metav1.Duration{Duration: time.Minute}, | ||
| } | ||
| } | ||
| twd := baseTWD("prog-too-many-steps") | ||
| twd.Spec.RolloutStrategy = RolloutStrategy{Strategy: UpdateProgressive, Steps: steps} | ||
| err := k8sClient.Create(ctx, twd) | ||
| Expect(err).To(HaveOccurred()) | ||
| Expect(err.Error()).To(ContainSubstring("Too many")) | ||
| }) | ||
|
|
||
| It("rejects a Progressive step with pauseDuration less than 30s", func() { | ||
| twd := baseTWD("short-pause") | ||
| twd.Spec.RolloutStrategy = RolloutStrategy{ | ||
| Strategy: UpdateProgressive, | ||
| Steps: []RolloutStep{ | ||
| {RampPercentage: 50, PauseDuration: metav1.Duration{Duration: 10 * time.Second}}, | ||
| }, | ||
| } | ||
| err := k8sClient.Create(ctx, twd) | ||
| Expect(err).To(HaveOccurred()) | ||
| Expect(err.Error()).To(ContainSubstring("pause duration must be at least 30s")) | ||
| }) | ||
|
|
||
| It("rejects gate.inputFrom with both configMapKeyRef and secretKeyRef set", func() { | ||
| twd := baseTWD("bad-gate-inputfrom") | ||
| twd.Spec.RolloutStrategy = RolloutStrategy{ | ||
| Strategy: UpdateAllAtOnce, | ||
| Gate: &GateWorkflowConfig{ | ||
| WorkflowType: "my-gate", | ||
| InputFrom: &GateInputSource{ | ||
| ConfigMapKeyRef: &corev1.ConfigMapKeySelector{ | ||
| LocalObjectReference: corev1.LocalObjectReference{Name: "my-cm"}, | ||
| Key: "key", | ||
| }, | ||
| SecretKeyRef: &corev1.SecretKeySelector{ | ||
| LocalObjectReference: corev1.LocalObjectReference{Name: "my-secret"}, | ||
| Key: "key", | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
| err := k8sClient.Create(ctx, twd) | ||
| Expect(err).To(HaveOccurred()) | ||
| Expect(err.Error()).To(ContainSubstring("exactly one of configMapKeyRef or secretKeyRef must be set")) | ||
| }) | ||
| }) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.