Skip to content

[addon-operator] drop hooks and standalone CRDs from nelm render output - #815

Merged
ldmonster merged 3 commits into
mainfrom
fix/nelm-render-hooks-filter
Aug 3, 2026
Merged

[addon-operator] drop hooks and standalone CRDs from nelm render output#815
ldmonster merged 3 commits into
mainfrom
fix/nelm-render-hooks-filter

Conversation

@Glitchy-Sheep

Copy link
Copy Markdown
Contributor

Overview

Fixes the false AbsentHelmResourcesDetected loop:

  • modules whose charts have helm hooks got reinstalled every ~5 minutes.
  • NelmClient.Render now returns only regular release resources, same as helm3 rs.Manifest.

What this PR does / why we need it

Problem
  • Render output feeds two consumers: the release checksum (moduleChecksum) and the absent-resources monitor.
  • helm3lib returned rs.Manifest - regular resources only. The nelm client returns every object from chartRenderResult.Resources, including helm hooks and standalone CRDs.
  • A pre-delete hook Job exists in the cluster only while the release is being deleted. The monitor saw it "missing" on every tick and fired AbsentHelmResourcesDetected.
  • The checksum skip did not help: shouldRunHelmUpgrade runs the absent check on the same list, so every such ModuleRun forced a real upgrade.
  • Observed on the virtualization module: 815 release revisions in 3 days with identical values and manifests. With 10 revisions of history, rollback window shrank to ~50 minutes.
Fix
  • NelmClient.Render keeps only resources with StoreAs == regular.
  • One string comparison on a field nelm already fills - no extra YAML parsing.
  • Hooks (StoreAs == hook) and standalone CRDs (StoreAs == none) stay out of the checksum and the monitor list.
Before / After

Before: a chart with a pre-delete hook loops forever: absent event -> forced upgrade -> new revision every ~5 minutes.

After: the monitor tracks only objects that must exist in the cluster; with unchanged values and manifests there are no events, no upgrades, no new revisions.

Special notes for your reviewer

Tests
  • Test_NelmClient_Render_KeepsOnlyRegularResources - hooks and standalone CRDs stay out of Render output; two regular resources keep a single --- separator. The test fails without the filter (verified).
Rollout notes
  • After rollout, modules with hooks get one legit new revision: moduleChecksum no longer covers hook manifests.
  • deckhouse-controller module render no longer prints hooks and standalone CRDs - same as it was with helm3.
  • Needs backports: release-1.21 (DKP 1.76) and the v1.24.x line (DKP 1.77).
  • deckhouse-controller's own packages nelm client (internal/nelm/client.go) has the same unfiltered loop - separate issue.

- `Render` keeps only `StoreAs == regular` resources, same as helm3 `rs.Manifest`.
- The absent-resources monitor no longer waits for hook objects that never exist in the cluster.
- Fixes false `AbsentHelmResourcesDetected` firing every ~5 minutes and forcing endless release upgrades.

Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
- `fakeNelmActions` feeds canned `ChartRender` results, no cluster needed.
- Checks that hooks and standalone CRDs stay out of `Render` output.
- Two regular resources keep a single `---` separator after filtering.

Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
@Glitchy-Sheep
Glitchy-Sheep requested a review from ldmonster August 3, 2026 13:02
@Glitchy-Sheep
Glitchy-Sheep marked this pull request as ready for review August 3, 2026 13:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants