ESO-541,ESO-551:Adds API changes for concurrent flag, replicas, and experimentalOverrides - #172
ESO-541,ESO-551:Adds API changes for concurrent flag, replicas, and experimentalOverrides#172siddhibhor-56 wants to merge 1 commit into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
WalkthroughThe PR adds optional core-controller replica configuration with 1–10 validation and leader-election documentation. It also adds component-level ChangesConfiguration controls
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)Error: build linters: unable to load custom analyzer "kubeapilinter": bin/kube-api-linter.so, plugin: not implemented Comment |
siddhibhor-56
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@siddhibhor-56: This pull request references ESO-541 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. This pull request references ESO-551 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: siddhibhor-56 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/v1alpha1/external_secrets_config_types.go`:
- Around line 155-167: Update the core controller Deployment rendering to use
ControllerConfig.Replicas for the Deployment replica count and
ControllerConfig.Concurrent for the --concurrent argument, falling back to 1
when either pointer is nil. Replace the hard-coded values in the renderer and
embedded Deployment while preserving the existing configuration flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fc08f376-7f54-47b8-b7bb-ad4fb9d0186f
⛔ Files ignored due to path filters (1)
api/v1alpha1/zz_generated.deepcopy.gois excluded by!**/zz_generated*
📒 Files selected for processing (5)
api/v1alpha1/external_secrets_config_types.goapi/v1alpha1/tests/externalsecretsconfig.operator.openshift.io/externalsecretsconfig.testsuite.yamlbundle/manifests/operator.openshift.io_externalsecretsconfigs.yamlconfig/crd/bases/operator.openshift.io_externalsecretsconfigs.yamldocs/api_reference.md
| // concurrent sets the core controller --concurrent flag (max concurrent reconciles). | ||
| // When omitted, defaults to 1 for backward compatibility. | ||
| // +kubebuilder:validation:Minimum=1 | ||
| // +kubebuilder:validation:Maximum=100 | ||
| // +optional | ||
| Concurrent *int32 `json:"concurrent,omitempty"` | ||
|
|
||
| // replicas sets the desired replica count for the external-secrets core controller Deployment. | ||
| // When omitted, defaults to 1. When greater than 1, leader election keeps a single active reconciler. | ||
| // +kubebuilder:validation:Minimum=1 | ||
| // +kubebuilder:validation:Maximum=10 | ||
| // +optional | ||
| Replicas *int32 `json:"replicas,omitempty"` |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -u
# Locate Go files that consume ControllerConfig or construct controller arguments.
fd -e go . | while IFS= read -r file; do
if rg -q '\bControllerConfig\b|\.Concurrent\b|\.Replicas\b|--concurrent' "$file"; then
ast-grep outline "$file" --items all
rg -n -C 5 '\bControllerConfig\b|\.Concurrent\b|\.Replicas\b|--concurrent|replicas:' "$file"
fi
doneRepository: openshift/external-secrets-operator
Length of output: 50392
🏁 Script executed:
#!/bin/bash
set -u
# Restrict the search to tracked, non-vendored source and test files.
git ls-files '*.go' ':!:vendor/**' \
| xargs -r rg -n -C 6 'ControllerConfig|\.Concurrent|\.Replicas|--concurrent|ExternalSecretsConfig' \
| head -n 1200Repository: openshift/external-secrets-operator
Length of output: 50391
🏁 Script executed:
#!/bin/bash
set -u
# Find the renderer and its focused tests without generated assets or vendor code.
for file in $(git ls-files '*.go' ':!:vendor/**' ':!:pkg/operator/assets/**'); do
if rg -q 'ControllerConfig|\.Concurrent|\.Replicas|--concurrent' "$file"; then
echo "===== $file ====="
rg -n -C 12 'ControllerConfig|\.Concurrent|\.Replicas|--concurrent' "$file"
fi
doneRepository: openshift/external-secrets-operator
Length of output: 50392
🏁 Script executed:
#!/bin/bash
set -u
echo '===== pkg/controller/external_secrets/deployments.go: deployment construction ====='
sed -n '1,430p' pkg/controller/external_secrets/deployments.go
echo '===== replica and concurrency assignments in source/tests ====='
rg -n -C 8 'Spec\.Replicas|Replicas:|--concurrent|updateContainerSpec|createOrApplyDeployment|CreateOrApplyDeployment' \
pkg/controller/external_secrets api pkg/operator \
-g '*.go' -g '!assets/**' | head -n 1200Repository: openshift/external-secrets-operator
Length of output: 38149
🏁 Script executed:
#!/bin/bash
set -u
# Check the embedded core-controller Deployment template for its baseline replica count.
rg -n -C 12 'name: external-secrets$|kind: Deployment|replicas:' \
pkg/operator/assets/bindata.go | head -n 500Repository: openshift/external-secrets-operator
Length of output: 18410
Wire ControllerConfig.Replicas and ControllerConfig.Concurrent into the core controller Deployment. The renderer hard-codes --concurrent=1 and the embedded Deployment has replicas: 1, so configured values are ignored. Retain 1 when either field is omitted.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@api/v1alpha1/external_secrets_config_types.go` around lines 155 - 167, Update
the core controller Deployment rendering to use ControllerConfig.Replicas for
the Deployment replica count and ControllerConfig.Concurrent for the
--concurrent argument, falling back to 1 when either pointer is nil. Replace the
hard-coded values in the renderer and embedded Deployment while preserving the
existing configuration flow.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
api/v1alpha1/tests/externalsecretsconfig.operator.openshift.io/externalsecretsconfig.testsuite.yaml (1)
1388-1433: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a lower-bound acceptance test.
The tests accept
2and10, and reject0and11. Add a case withreplicas: 1to cover the accepted lower boundary.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/v1alpha1/tests/externalsecretsconfig.operator.openshift.io/externalsecretsconfig.testsuite.yaml` around lines 1388 - 1433, Add a test case alongside the existing replicas validation cases that sets controllerConfig.replicas to 1 and expects the resource unchanged with replicas: 1, covering the accepted lower boundary.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/v1alpha1/external_secrets_config_types.go`:
- Around line 203-210: Remove the unused AdvancedOverrides CRD field, or
implement its handling in applyUserDeploymentConfigs so configured patches are
applied to the generated Deployment spec. If implementing it, validate patch
paths against an explicit allow-list before applying them and preserve the
documented restrictions on containers, initContainers, and ports.
---
Nitpick comments:
In
`@api/v1alpha1/tests/externalsecretsconfig.operator.openshift.io/externalsecretsconfig.testsuite.yaml`:
- Around line 1388-1433: Add a test case alongside the existing replicas
validation cases that sets controllerConfig.replicas to 1 and expects the
resource unchanged with replicas: 1, covering the accepted lower boundary.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1c7bf780-081e-4ab6-88e4-bc08b7a23a9d
⛔ Files ignored due to path filters (1)
api/v1alpha1/zz_generated.deepcopy.gois excluded by!**/zz_generated*
📒 Files selected for processing (5)
api/v1alpha1/external_secrets_config_types.goapi/v1alpha1/tests/externalsecretsconfig.operator.openshift.io/externalsecretsconfig.testsuite.yamlbundle/manifests/operator.openshift.io_externalsecretsconfigs.yamlconfig/crd/bases/operator.openshift.io_externalsecretsconfigs.yamldocs/api_reference.md
| // advancedOverrides applies raw patches on top of the final operator generated Deployment spec. | ||
| // WARNING: DO NOT USE UNLESS YOU KNOW EXACTLY WHAT YOU ARE DOING. | ||
| // This field can overwrite your own first-class CRD settings. You must NOT use this | ||
| // field to add or modify containers, initContainers, or ports, as doing so breaks | ||
| // the structural integrity of the operand and will fail deployment reconciliation. | ||
| // +kubebuilder:validation:Optional | ||
| // +kubebuilder:pruning:PreserveUnknownFields | ||
| AdvancedOverrides *runtime.RawExtension `json:"advancedOverrides,omitempty"` |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 8 --type go \
'\bAdvancedOverrides\b|RawExtension|MergePatch|StrategicMergePatch|JSONPatch|hostNetwork|hostPID|privileged|securityContext' .
rg -n -C 5 -g '*.yaml' -g '*.yml' \
'externalsecretsconfig|advancedOverrides|verbs:|resources:' config bundleRepository: openshift/external-secrets-operator
Length of output: 50392
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- tracked files containing AdvancedOverrides ---'
rg -n -C 12 --glob '!vendor/**' --glob '!**/zz_generated.deepcopy.go' \
'\bAdvancedOverrides\b' .
echo '--- override/patch application code ---'
rg -n -C 8 --glob '!vendor/**' \
'advancedOverrides|RawExtension|MergePatch|StrategicMergePatch|JSONPatch|Apply.*Override|Override.*Apply' \
--glob '*.go' --glob '*.yaml' --glob '*.yml'
echo '--- CRD schema for advancedOverrides ---'
rg -n -C 12 --glob '*.yaml' --glob '*.yml' \
'advancedOverrides|preserveUnknownFields|x-kubernetes-preserve-unknown-fields' \
config bundle deploy manifests 2>/dev/null || true
echo '--- focused API type context ---'
sed -n '160,225p' api/v1alpha1/external_secrets_config_types.goRepository: openshift/external-secrets-operator
Length of output: 3182
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- repository state ---'
git status --short
git diff --stat
echo '--- all non-vendor references ---'
rg -n -C 6 --glob '!vendor/**' \
'advancedOverrides|AdvancedOverrides|RawExtension' .
echo '--- deployment construction and reconciliation ---'
rg -n -C 5 --glob '!vendor/**' --glob '*.go' \
'Deployment\{|DeploymentSpec|apps/v1|CreateOrUpdate|Render|render|Patch' \
controllers internal pkg api
echo '--- tracked manifest locations and schemas ---'
git ls-files | rg '(^|/)(config|bundle|deploy|manifests|charts)(/|$)|crd|external.*secret'Repository: openshift/external-secrets-operator
Length of output: 50391
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- component configuration call graph ---'
rg -n -C 8 --glob '!vendor/**' --glob '*.go' \
'OverrideEnv|ComponentConfigs|componentConfigs|DeploymentConfig|ComponentConfig' \
api pkg test | head -n 1200
echo '--- API validation test for advancedOverrides ---'
sed -n '1415,1495p' api/v1alpha1/tests/externalsecretsconfig.operator.openshift.io/externalsecretsconfig.testsuite.yaml
echo '--- generated CRD schema ---'
sed -n '1298,1322p' config/crd/bases/operator.openshift.io_externalsecretsconfigs.yaml
echo '--- deployment reconciler files ---'
git ls-files 'pkg/controller/external_secrets/*' | sed -n '1,160p'Repository: openshift/external-secrets-operator
Length of output: 50391
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- deployment configuration implementation ---'
rg -n -C 12 --glob '*.go' \
'func \(r \*Reconciler\) applyUserDeploymentConfigs|applyUserDeploymentConfigs|DeploymentConfigs|OverrideEnv' \
pkg/controller/external_secrets/deployments.go
echo '--- advanced override test cases ---'
sed -n '1428,1495p' api/v1alpha1/tests/externalsecretsconfig.operator.openshift.io/externalsecretsconfig.testsuite.yaml
sed -n '1298,1320p' config/crd/bases/operator.openshift.io_externalsecretsconfigs.yaml
echo '--- exact AdvancedOverrides references outside generated/docs/tests ---'
rg -n --glob '!vendor/**' --glob '!**/zz_generated.deepcopy.go' \
'AdvancedOverrides|advancedOverrides' api pkg config bundle docs testRepository: openshift/external-secrets-operator
Length of output: 9696
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import pathlib
import subprocess
files = subprocess.check_output(["git", "ls-files", "-z", "*.go"]).decode().split("\0")
files = [pathlib.Path(p) for p in files if p and "vendor/" not in p]
matches = []
for path in files:
text = path.read_text(errors="replace")
for n, line in enumerate(text.splitlines(), 1):
if "AdvancedOverrides" in line or "advancedOverrides" in line:
matches.append((str(path), n, line.strip()))
print("Go references to AdvancedOverrides/advancedOverrides:")
for item in matches:
print(f"{item[0]}:{item[1]}:{item[2]}")
path = pathlib.Path("pkg/controller/external_secrets/deployments.go")
lines = path.read_text().splitlines()
start = next(i for i, line in enumerate(lines) if "func (r *Reconciler) applyUserDeploymentConfigs" in line)
end = next(i for i in range(start + 1, len(lines)) if lines[i].startswith("}"))
body = "\n".join(lines[start:end + 1])
print("\napplyUserDeploymentConfigs contains AdvancedOverrides:",
"AdvancedOverrides" in body or "advancedOverrides" in body)
print(body)
PYRepository: openshift/external-secrets-operator
Length of output: 1694
Remove or implement AdvancedOverrides.
AdvancedOverrides is accepted by the CRD, but applyUserDeploymentConfigs never reads it. Configured patches are silently ignored. If implemented, validate patch paths with an allow-list before applying them.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@api/v1alpha1/external_secrets_config_types.go` around lines 203 - 210, Remove
the unused AdvancedOverrides CRD field, or implement its handling in
applyUserDeploymentConfigs so configured patches are applied to the generated
Deployment spec. If implementing it, validate patch paths against an explicit
allow-list before applying them and preserve the documented restrictions on
containers, initContainers, and ports.
Source: Path instructions
|
@siddhibhor-56: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
ExternalSecretsConfigAPI fields for core controller scale and throughput:spec.controllerConfig.concurrent(*int32, min 1 / max 100) for--concurrent=<N>spec.controllerConfig.replicas(*int32, min 1 / max 10) for core controller Deployment replicasspec.controllerConfig.componentConfigs[].experimentalOverrides(*runtime.RawExtension)Implements the API surface from openshift/enhancements#2068 (ESO-540/ESO-550).
Summary by CodeRabbit