feat(oac): exempt username-scoped cluster roles and add Render releaseNamespace#3333
Conversation
…eNamespace
Allow cluster-scoped fixed-name lint to pass when allowMultipleInstall=false
and the resource name is templated on {{ .Values.bfl.username }}, detected
via paired username dry-runs. Add ClusterScopedFixedNameOpts and wire
username probes in checkAllowMultipleInstall.
Extend helmrender.Render with an optional releaseNamespace argument: empty
uses RenderNamespace; non-empty overrides instAction.Namespace. Username
probes pass each probe username as the release namespace so
{{ .Release.Namespace }} renders consistently during comparison.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| } | ||
| //if err := resources.CheckWorkloadReplicas(list, replicas); err != nil { | ||
| // errs = append(errs, err) | ||
| //} |
There was a problem hiding this comment.
Workload replica lint disabled
High Severity
checkManifestWorkloadRefs no longer calls resources.CheckWorkloadReplicas because that block is commented out. Lint still runs on the mandatory path via lintRenderedScenario, so manifests with workloadReplicas can pass when rendered Deployment/StatefulSet names do not match the declared keys.
Reviewed by Cursor Bugbot for commit 82cec78. Configure here.
| if strings.HasPrefix(e.Name(), ".") { | ||
| continue | ||
| } | ||
|
|
There was a problem hiding this comment.
V2 fleet skip commented out
Medium Severity
scanFleet no longer skips v2 manifest directories because the isV2ManifestDir guard is commented out, while the function comment still says v2 apps are excluded. Fleet report tests will run full Lint on v2 layouts that the harness was designed to skip.
Reviewed by Cursor Bugbot for commit 82cec78. Configure here.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
There are 4 total unresolved issues (including 2 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6e9ce7d. Configure here.
| if !k8sQuantity.MatchString(p.value) { | ||
| errs = append(errs, fmt.Errorf("%s%s must be a valid Kubernetes quantity (got %q)", prefix, p.field, p.value)) | ||
| if err := validateResourceQuantity(p.value, prefix+p.field, templateOnly, true); err != nil { | ||
| errs = append(errs, err) |
There was a problem hiding this comment.
Auto disk skip breaks validation
Medium Severity
In validateQuantities, entries equal to the auto-resolve sentinel are skipped before validateResourceQuantity runs, so template-only spec.resources[] rows can keep -1 on requiredDisk or limitedDisk even though the new rules and tests expect a rejection there.
Reviewed by Cursor Bugbot for commit 6e9ce7d. Configure here.
| } | ||
| remaining = append(remaining, key) | ||
| } | ||
| return remaining |
There was a problem hiding this comment.
Username probe index mis-pairs roles
High Severity
filterUsernameScopedClusterKeys aligns username dry-runs to release-probe cluster resources by sorted index. When a fixed cluster-scoped name and a username-templated one sort differently across probes, exemptions and violations can be applied to the wrong resources.
Reviewed by Cursor Bugbot for commit 6e9ce7d. Configure here.
…Render releaseNamespace (#3333)
3 participants
Background
Allow cluster-scoped fixed-name lint to pass when allowMultipleInstall=false
and the resource name is templated on {{ .Values.bfl.username }}, detected
via paired username dry-runs. Add ClusterScopedFixedNameOpts and wire
username probes in checkAllowMultipleInstall.
Extend helmrender.Render with an optional releaseNamespace argument: empty
uses RenderNamespace; non-empty overrides instAction.Namespace. Username
probes pass each probe username as the release namespace so
{{ .Release.Namespace }} renders consistently during comparison.
Target Version for Merge
v1.12.6,v1.12.7
Related Issues
None
PRs Involving Sub-Systems
None
Other information:
Note
Medium Risk
Changes OAC lint behavior for cluster-scoped charts and manifest resource validation rules; incorrect probe pairing could miss real collisions or accept bad manifests.
Overview
OAC lint now treats cluster-scoped RBAC whose
metadata.namefollows{{ .Values.bfl.username }}as acceptable whenoptions.allowMultipleInstallis false. For that case,checkAllowMultipleInstallruns extra Helm dry-runs with two usernames (namespace set to each probe user) andCheckClusterScopedFixedNamesskips “fixed name” hits when names differ across those probes. The cluster-scoped error hint now points authors at{{ .Release.Namespace }}instead of release name.helmrender.Rendertakes a fourth argument,releaseNamespace(empty keepsRenderNamespace); username probes use it so namespace-templated charts compare correctly.Manifest validation threads
options.templateOnlyinto resource quantity checks: template-only apps may use-1on CPU/memory/GPU (and modernspec.resources[]entries) for install-time auto resolution, but disk quantities must stay explicit; non-template manifests still reject-1on legacy flat fields.Reviewed by Cursor Bugbot for commit 6e9ce7d. Bugbot is set up for automated code reviews on this repo. Configure here.