Namespace Package Verify #1536
Namespace Package Verify #1536
Conversation
Signed-off-by: Ken Sipe <kensipe@gmail.com>
There was a problem hiding this comment.
Lgtm. However, we should mark one of these KEP-31 related PRs as release/highlight to get the changelog visibility with a lengthy description of the feature and with release/breaking because this is sort-of breaking: using namespaces resources used to work and now it doesn't.
| labels: | ||
| app: my-app` | ||
|
|
||
| pf := packages.Files{ |
There was a problem hiding this comment.
This could be a table test and you would "save" ~50 slocs 😉
| } | ||
| ns, err := renderer.YamlToObject(val) | ||
| if err != nil { | ||
| res.AddErrors(fmt.Sprintf("Unable to marshal NamespaceManifest %q ", pf.Operator.NamespaceManifest)) |
There was a problem hiding this comment.
| res.AddErrors(fmt.Sprintf("Unable to marshal NamespaceManifest %q ", pf.Operator.NamespaceManifest)) | |
| res.AddErrors(fmt.Sprintf("Unable to marshal NamespaceManifest %q ", pf.Operator.NamespaceManifest)) | |
| return |
We probably want to abort checking here, right?
| // it would be great if we could marshal the templates into an unstructured runtime.Object to confirm Namespace | ||
| // however with templating we don't have the ability to have all required information to do so. | ||
| // best effort is to confirm that "kind: Namespace" is not used. |
There was a problem hiding this comment.
It might be an idea in the future to let the operator developer to provide an example-params.yaml in the operator development that provides values for all required parameters so we can render the templates and verify more thoroughly...
There was a problem hiding this comment.
I like that idea... however :). in cases where there are conditional branches in the templates... you would only be able to evaluate the one in the example :( which still has the likelihood of missing constraints like this.
kensipe
added
the
release/breaking-change
Signed-off-by: Ken Sipe <kensipe@gmail.com>
Package Verify now includes namespace checks
kind: Namespaceallowed in an operatorkind: NamespaceSigned-off-by: Ken Sipe kensipe@gmail.com
Fixes #