From a63855d71cfd478bfa4b3109b54fc6ceab47add1 Mon Sep 17 00:00:00 2001 From: mesutoezdil Date: Thu, 3 Sep 2026 10:25:25 +0200 Subject: [PATCH] ci: fix commentstart, conditions, defaultorrequired, optionalorrequired and defaults findings in api types --- .golangci-kal.yaml | 2 +- .../generated/ate.dev_csidriverconfigs.yaml | 16 ++++---- .../generated/ate.dev_sandboxconfigs.yaml | 14 +++---- .../generated/ate.dev_workerpools.yaml | 41 ++++++++++++------- pkg/api/v1alpha1/csidriverconfig_types.go | 21 ++++++---- pkg/api/v1alpha1/sandboxconfig_types.go | 17 ++++---- pkg/api/v1alpha1/workerpool_types.go | 41 ++++++++++++------- pkg/api/v1alpha1/zz_generated.deepcopy.go | 5 +++ 8 files changed, 95 insertions(+), 62 deletions(-) diff --git a/.golangci-kal.yaml b/.golangci-kal.yaml index 1607c9ebbe..82a8dcf3ca 100644 --- a/.golangci-kal.yaml +++ b/.golangci-kal.yaml @@ -108,7 +108,7 @@ linters: - path: 'pkg/api/v1alpha1/csidriverconfig_types\.go' text: '^optionalfields: .*\bCSIDriverTLSConfig\.(ServerName|UsePodIdentity)\b' - path: 'pkg/api/v1alpha1/csidriverconfig_types\.go' - text: '^nonpointerstructs: .*\bCSIDriverConfig\.Spec\b' + text: '^(nonpointerstructs|requiredfields): .*\bCSIDriverConfig\.Spec\b' - path: 'pkg/api/v1alpha1/workerpool_types\.go' text: '^optionalfields: .*\bWorkerPoolPodTemplate\.PriorityClassName\b' - path: 'pkg/api/v1alpha1/workerpool_types\.go' diff --git a/manifests/ate-install/generated/ate.dev_csidriverconfigs.yaml b/manifests/ate-install/generated/ate.dev_csidriverconfigs.yaml index 31bdc43f8d..607b559c7f 100644 --- a/manifests/ate-install/generated/ate.dev_csidriverconfigs.yaml +++ b/manifests/ate-install/generated/ate.dev_csidriverconfigs.yaml @@ -60,17 +60,17 @@ spec: metadata: type: object spec: - description: CSIDriverConfigSpec defines the desired state of CSIDriverConfig + description: spec defines the desired state of CSIDriverConfig properties: controllerEndpoint: description: |- - ControllerEndpoint is the gRPC endpoint for the CSI Controller service. + controllerEndpoint is the gRPC endpoint for the CSI Controller service. Must be a valid network URI (e.g. dns:///csi-service:9000 or tcp://127.0.0.1:9000). pattern: ^(tcp|dns)://.+$ type: string driverName: description: |- - DriverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io"). + driverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io"). Matches the StorageClass referenced in ActorTemplate volume definitions. maxLength: 63 minLength: 1 @@ -78,21 +78,21 @@ spec: type: string nodeSocketOverride: description: |- - NodeSocketOverride is an optional override for the CSI Node service socket + nodeSocketOverride is an optional override for the CSI Node service socket on the worker nodes. If empty, ATE defaults to unix:///var/lib/kubelet/plugins/[DriverName]/csi.sock. pattern: ^unix://.+$ type: string tls: - description: TLS configures TLS/mTLS for the connection to the ControllerEndpoint. + description: tls configures TLS/mTLS for the connection to the ControllerEndpoint. properties: enabled: - description: Enabled controls whether TLS is used. + description: enabled controls whether TLS is used. type: boolean serverName: - description: ServerName override for TLS verification. + description: serverName override for TLS verification. type: string usePodIdentity: - description: UsePodIdentity indicates whether to reuse Substrate's + description: usePodIdentity indicates whether to reuse Substrate's Pod Identity (SPIFFE) certificates. type: boolean required: diff --git a/manifests/ate-install/generated/ate.dev_sandboxconfigs.yaml b/manifests/ate-install/generated/ate.dev_sandboxconfigs.yaml index 6a7ee9871c..1be6df8048 100644 --- a/manifests/ate-install/generated/ate.dev_sandboxconfigs.yaml +++ b/manifests/ate-install/generated/ate.dev_sandboxconfigs.yaml @@ -77,13 +77,13 @@ spec: properties: sha256: description: |- - SHA256 is the lower-case hex SHA256 of the asset. It both names the cached + sha256 is the lower-case hex SHA256 of the asset. It both names the cached file (preventing collisions) and verifies the download's integrity. pattern: ^[a-f0-9]{64}$ type: string url: description: |- - URL is where to download the asset from (e.g. a gs:// URL). It may be + url is where to download the asset from (e.g. a gs:// URL). It may be fetched anonymously or with credentials depending on atelet's configuration. minLength: 1 @@ -94,7 +94,7 @@ spec: type: object type: object description: |- - Assets is the set of files atelet fetches for this runtime, keyed first by + assets is the set of files atelet fetches for this runtime, keyed first by architecture (GOARCH, e.g. "amd64", "arm64") and then by asset name. The asset names are interpreted by the sandbox backend: gVisor expects a "gvisor" asset (the release's gvisor.tar.zstd, which atelet extracts so @@ -106,14 +106,14 @@ spec: type: object default: description: |- - Default marks this SandboxConfig as the cluster-wide default for its + default marks this SandboxConfig as the cluster-wide default for its SandboxClass. A WorkerPool with no explicit SandboxConfigName resolves to the default config for its SandboxClass. At most one default is expected per SandboxClass. type: boolean pauseImage: description: |- - PauseImage is the container image used as the root sandbox container. + pauseImage is the container image used as the root sandbox container. It holds the sandbox's namespaces and runs no workload code, so it is an implementation detail of the sandbox rather than something actor authors choose. It is captured in the snapshot manifest alongside the sandbox @@ -132,15 +132,15 @@ spec: sandboxClass: default: gvisor description: |- - SandboxClass is the sandbox runtime family this config applies to. A + sandboxClass is the sandbox runtime family this config applies to. A WorkerPool only uses SandboxConfigs whose SandboxClass matches its own. + Defaults to gvisor. enum: - gvisor - microvm type: string required: - pauseImage - - sandboxClass type: object required: - spec diff --git a/manifests/ate-install/generated/ate.dev_workerpools.yaml b/manifests/ate-install/generated/ate.dev_workerpools.yaml index df0fd546c1..747208dd62 100644 --- a/manifests/ate-install/generated/ate.dev_workerpools.yaml +++ b/manifests/ate-install/generated/ate.dev_workerpools.yaml @@ -69,14 +69,14 @@ spec: description: spec defines the desired state of WorkerPool properties: replicas: - description: Replicas is the number of worker pods to run. + description: replicas is the number of worker pods to run. format: int32 minimum: 0 type: integer sandboxClass: default: gvisor description: |- - SandboxClass selects the sandbox runtime family for this pool, which drives + sandboxClass selects the sandbox runtime family for this pool, which drives the worker pod shape (KVM/vhost device mounts and node placement) and which SandboxConfigs are eligible. The concrete binary is still selected by WorkerImage. Defaults to gvisor. @@ -88,21 +88,21 @@ spec: type: string sandboxConfigName: description: |- - SandboxConfigName names a cluster-scoped SandboxConfig to use for fetching + sandboxConfigName names a cluster-scoped SandboxConfig to use for fetching sandbox binaries. It overrides the cluster-wide default SandboxConfig for this pool's SandboxClass. The referenced config's SandboxClass must match this pool's SandboxClass. If empty, the default SandboxConfig for the SandboxClass is used. type: string template: - description: Template holds optional metadata, scheduling, and resource + description: template holds optional metadata, scheduling, and resource settings for worker workloads. properties: annotations: additionalProperties: type: string description: |- - Annotations are added to the generated Deployment and worker pods. Keys + annotations are added to the generated Deployment and worker pods. Keys in the ate.dev domain and its subdomains are reserved for controllers. maxProperties: 64 type: object @@ -121,7 +121,7 @@ spec: pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ type: string description: |- - Labels are added to the generated Deployment and worker pods. Keys in + labels are added to the generated Deployment and worker pods. Keys in the ate.dev domain and its subdomains are reserved for controllers. maxProperties: 64 type: object @@ -132,7 +132,7 @@ spec: rule: self.all(key, !format.qualifiedName().validate(key).hasValue()) nodeAffinity: description: |- - NodeAffinity scheduling rules for the worker pods. Mapped to + nodeAffinity scheduling rules for the worker pods. Mapped to spec.affinity.nodeAffinity on the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: @@ -333,14 +333,14 @@ spec: nodeSelector: additionalProperties: type: string - description: NodeSelector is a selector which must be true for + description: nodeSelector is a selector which must be true for the pod to fit on a node. type: object priorityClassName: - description: PriorityClassName for the worker pods. + description: priorityClassName for the worker pods. type: string resources: - description: Resources are the compute resources allocated for + description: resources are the compute resources allocated for each worker pod. properties: claims: @@ -400,7 +400,7 @@ spec: type: object type: object tolerations: - description: Tolerations for the worker pods. + description: tolerations for the worker pods. items: description: |- The pod this Toleration is attached to tolerates any taint that matches @@ -442,8 +442,19 @@ spec: type: array x-kubernetes-list-type: atomic type: object + terminationGracePeriodSeconds: + default: 300 + description: |- + terminationGracePeriodSeconds is the termination grace period applied to + this pool's worker pods. On eviction, ateom traps SIGTERM and forwards it + to the actor so it can save state and exit cleanly before the kubelet + sends SIGKILL. Tune this to the maximum time your actors need to shut + down gracefully. Defaults to 300 (5 minutes). + format: int32 + minimum: 1 + type: integer workerImage: - description: WorkerImage is the ateom container image to deploy as + description: workerImage is the ateom container image to deploy as workers. minLength: 1 type: string @@ -455,17 +466,17 @@ spec: description: status is the observed state of WorkerPool properties: readyReplicas: - description: ReadyReplicas is the number of ready worker pods. + description: readyReplicas is the number of ready worker pods. format: int32 minimum: 0 type: integer replicas: - description: Replicas is the total number of worker pods. + description: replicas is the total number of worker pods. format: int32 minimum: 0 type: integer selector: - description: Selector is the label selector for the worker pods. + description: selector is the label selector for the worker pods. type: string type: object required: diff --git a/pkg/api/v1alpha1/csidriverconfig_types.go b/pkg/api/v1alpha1/csidriverconfig_types.go index 02d095245f..f1441409e6 100644 --- a/pkg/api/v1alpha1/csidriverconfig_types.go +++ b/pkg/api/v1alpha1/csidriverconfig_types.go @@ -20,7 +20,7 @@ import ( // CSIDriverConfigSpec defines the desired state of CSIDriverConfig type CSIDriverConfigSpec struct { - // DriverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io"). + // driverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io"). // Matches the StorageClass referenced in ActorTemplate volume definitions. // // +required @@ -29,7 +29,7 @@ type CSIDriverConfigSpec struct { // +kubebuilder:validation:Pattern=`^(substrate\.io/)?([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)$` DriverName string `json:"driverName"` - // ControllerEndpoint is the gRPC endpoint for the CSI Controller service. + // controllerEndpoint is the gRPC endpoint for the CSI Controller service. // Must be a valid network URI (e.g. dns:///csi-service:9000 or tcp://127.0.0.1:9000). // TODO: Harden endpoint validation to prevent invalid or unsafe URI inputs. // @@ -37,14 +37,14 @@ type CSIDriverConfigSpec struct { // +kubebuilder:validation:Pattern=`^(tcp|dns)://.+$` ControllerEndpoint string `json:"controllerEndpoint"` - // NodeSocketOverride is an optional override for the CSI Node service socket + // nodeSocketOverride is an optional override for the CSI Node service socket // on the worker nodes. If empty, ATE defaults to unix:///var/lib/kubelet/plugins/[DriverName]/csi.sock. // // +optional // +kubebuilder:validation:Pattern=`^unix://.+$` NodeSocketOverride string `json:"nodeSocketOverride,omitempty"` - // TLS configures TLS/mTLS for the connection to the ControllerEndpoint. + // tls configures TLS/mTLS for the connection to the ControllerEndpoint. // +optional TLS *CSIDriverTLSConfig `json:"tls,omitempty"` } @@ -52,16 +52,16 @@ type CSIDriverConfigSpec struct { // CSIDriverTLSConfig holds TLS and mTLS configuration for CSI driver connections. // +kubebuilder:validation:XValidation:rule="!self.enabled || (has(self.usePodIdentity) && self.usePodIdentity)",message="tls.usePodIdentity must be true when tls.enabled is true; manual certificates are not yet supported" type CSIDriverTLSConfig struct { - // Enabled controls whether TLS is used. + // enabled controls whether TLS is used. // +required Enabled bool `json:"enabled"` + // usePodIdentity indicates whether to reuse Substrate's Pod Identity (SPIFFE) certificates. // TODO: Add alternative support for manual certs by adding SecretReference fields. - // UsePodIdentity indicates whether to reuse Substrate's Pod Identity (SPIFFE) certificates. // +optional UsePodIdentity bool `json:"usePodIdentity,omitempty"` - // ServerName override for TLS verification. + // serverName override for TLS verification. // +optional ServerName string `json:"serverName,omitempty"` } @@ -76,9 +76,14 @@ type CSIDriverTLSConfig struct { // +kubebuilder:printcolumn:name="Driver",type=string,JSONPath=`.spec.driverName` // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp` type CSIDriverConfig struct { - metav1.TypeMeta `json:",inline"` + metav1.TypeMeta `json:",inline"` + + // metadata is a standard object metadata + // +optional metav1.ObjectMeta `json:"metadata,omitempty"` + // spec defines the desired state of CSIDriverConfig + // +required Spec CSIDriverConfigSpec `json:"spec"` } diff --git a/pkg/api/v1alpha1/sandboxconfig_types.go b/pkg/api/v1alpha1/sandboxconfig_types.go index 81cf44a589..d99132c361 100644 --- a/pkg/api/v1alpha1/sandboxconfig_types.go +++ b/pkg/api/v1alpha1/sandboxconfig_types.go @@ -33,7 +33,7 @@ const ( // AssetFile is one content-addressed file that atelet fetches for a sandbox // runtime (e.g. the gVisor runsc binary, or a micro-VM kernel/firmware/config). type AssetFile struct { - // URL is where to download the asset from (e.g. a gs:// URL). It may be + // url is where to download the asset from (e.g. a gs:// URL). It may be // fetched anonymously or with credentials depending on atelet's // configuration. // @@ -41,7 +41,7 @@ type AssetFile struct { // +kubebuilder:validation:MinLength=1 URL string `json:"url"` - // SHA256 is the lower-case hex SHA256 of the asset. It both names the cached + // sha256 is the lower-case hex SHA256 of the asset. It both names the cached // file (preventing collisions) and verifies the download's integrity. // // +required @@ -51,15 +51,16 @@ type AssetFile struct { // SandboxConfigSpec is the desired state of a SandboxConfig. type SandboxConfigSpec struct { - // SandboxClass is the sandbox runtime family this config applies to. A + // sandboxClass is the sandbox runtime family this config applies to. A // WorkerPool only uses SandboxConfigs whose SandboxClass matches its own. + // Defaults to gvisor. // - // +required + // +optional // +kubebuilder:validation:Enum=gvisor;microvm // +kubebuilder:default=gvisor - SandboxClass SandboxClass `json:"sandboxClass"` + SandboxClass SandboxClass `json:"sandboxClass,omitempty"` - // Default marks this SandboxConfig as the cluster-wide default for its + // default marks this SandboxConfig as the cluster-wide default for its // SandboxClass. A WorkerPool with no explicit SandboxConfigName resolves to // the default config for its SandboxClass. At most one default is expected // per SandboxClass. @@ -67,7 +68,7 @@ type SandboxConfigSpec struct { // +optional Default bool `json:"default,omitempty"` - // PauseImage is the container image used as the root sandbox container. + // pauseImage is the container image used as the root sandbox container. // It holds the sandbox's namespaces and runs no workload code, so it is an // implementation detail of the sandbox rather than something actor authors // choose. It is captured in the snapshot manifest alongside the sandbox @@ -83,7 +84,7 @@ type SandboxConfigSpec struct { // +kubebuilder:validation:XValidation:rule="self.contains('@')",message="All images must be pinned (changing the image invalidates snapshots)" PauseImage string `json:"pauseImage"` - // Assets is the set of files atelet fetches for this runtime, keyed first by + // assets is the set of files atelet fetches for this runtime, keyed first by // architecture (GOARCH, e.g. "amd64", "arm64") and then by asset name. The // asset names are interpreted by the sandbox backend: gVisor expects a // "gvisor" asset (the release's gvisor.tar.zstd, which atelet extracts so diff --git a/pkg/api/v1alpha1/workerpool_types.go b/pkg/api/v1alpha1/workerpool_types.go index aa60c1e25a..15773176d6 100644 --- a/pkg/api/v1alpha1/workerpool_types.go +++ b/pkg/api/v1alpha1/workerpool_types.go @@ -30,7 +30,7 @@ type WorkerPoolLabelValue string // settings for worker workloads. NodeAffinity is mapped to // spec.affinity.nodeAffinity on the pod. type WorkerPoolPodTemplate struct { - // Labels are added to the generated Deployment and worker pods. Keys in + // labels are added to the generated Deployment and worker pods. Keys in // the ate.dev domain and its subdomains are reserved for controllers. // // +optional @@ -39,7 +39,7 @@ type WorkerPoolPodTemplate struct { // +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="label keys must be valid Kubernetes qualified names" Labels map[string]WorkerPoolLabelValue `json:"labels,omitempty"` - // Annotations are added to the generated Deployment and worker pods. Keys + // annotations are added to the generated Deployment and worker pods. Keys // in the ate.dev domain and its subdomains are reserved for controllers. // // +optional @@ -48,52 +48,52 @@ type WorkerPoolPodTemplate struct { // +kubebuilder:validation:XValidation:rule="self.all(key, !format.qualifiedName().validate(key).hasValue())",message="annotation keys must be valid Kubernetes qualified names" Annotations map[string]string `json:"annotations,omitempty"` - // NodeSelector is a selector which must be true for the pod to fit on a node. + // nodeSelector is a selector which must be true for the pod to fit on a node. // // +optional NodeSelector map[string]string `json:"nodeSelector,omitempty"` - // Tolerations for the worker pods. + // tolerations for the worker pods. // // +optional // +kubebuilder:validation:MaxItems=16 // +listType=atomic Tolerations []corev1.Toleration `json:"tolerations,omitempty"` - // PriorityClassName for the worker pods. + // priorityClassName for the worker pods. // // +optional PriorityClassName string `json:"priorityClassName,omitempty"` - // NodeAffinity scheduling rules for the worker pods. Mapped to + // nodeAffinity scheduling rules for the worker pods. Mapped to // spec.affinity.nodeAffinity on the pod. // // +optional NodeAffinity *corev1.NodeAffinity `json:"nodeAffinity,omitempty"` - // Resources are the compute resources allocated for each worker pod. + // resources are the compute resources allocated for each worker pod. // // +optional Resources *corev1.ResourceRequirements `json:"resources,omitempty"` } type WorkerPoolSpec struct { - // Replicas is the number of worker pods to run. + // replicas is the number of worker pods to run. // +required // +kubebuilder:validation:Minimum=0 Replicas int32 `json:"replicas"` - // WorkerImage is the ateom container image to deploy as workers. + // workerImage is the ateom container image to deploy as workers. // +kubebuilder:validation:MinLength=1 // +required WorkerImage string `json:"workerImage"` - // Template holds optional metadata, scheduling, and resource settings for worker workloads. + // template holds optional metadata, scheduling, and resource settings for worker workloads. // // +optional Template *WorkerPoolPodTemplate `json:"template,omitempty"` - // SandboxClass selects the sandbox runtime family for this pool, which drives + // sandboxClass selects the sandbox runtime family for this pool, which drives // the worker pod shape (KVM/vhost device mounts and node placement) and which // SandboxConfigs are eligible. The concrete binary is still selected by // WorkerImage. Defaults to gvisor. @@ -105,27 +105,38 @@ type WorkerPoolSpec struct { // +kubebuilder:default=gvisor SandboxClass SandboxClass `json:"sandboxClass,omitempty"` - // SandboxConfigName names a cluster-scoped SandboxConfig to use for fetching + // sandboxConfigName names a cluster-scoped SandboxConfig to use for fetching // sandbox binaries. It overrides the cluster-wide default SandboxConfig for // this pool's SandboxClass. The referenced config's SandboxClass must match // this pool's SandboxClass. If empty, the default SandboxConfig for the // SandboxClass is used. // +optional SandboxConfigName string `json:"sandboxConfigName,omitempty"` + + // terminationGracePeriodSeconds is the termination grace period applied to + // this pool's worker pods. On eviction, ateom traps SIGTERM and forwards it + // to the actor so it can save state and exit cleanly before the kubelet + // sends SIGKILL. Tune this to the maximum time your actors need to shut + // down gracefully. Defaults to 300 (5 minutes). + // + // +optional + // +kubebuilder:validation:Minimum=1 + // +kubebuilder:default=300 + TerminationGracePeriodSeconds *int32 `json:"terminationGracePeriodSeconds,omitempty"` } type WorkerPoolStatus struct { - // Replicas is the total number of worker pods. + // replicas is the total number of worker pods. // +kubebuilder:validation:Minimum=0 // +optional Replicas int32 `json:"replicas"` - // ReadyReplicas is the number of ready worker pods. + // readyReplicas is the number of ready worker pods. // +kubebuilder:validation:Minimum=0 // +optional ReadyReplicas int32 `json:"readyReplicas,omitempty"` - // Selector is the label selector for the worker pods. + // selector is the label selector for the worker pods. // +optional Selector string `json:"selector,omitempty"` } diff --git a/pkg/api/v1alpha1/zz_generated.deepcopy.go b/pkg/api/v1alpha1/zz_generated.deepcopy.go index 25d0e6cf79..3f1dffe4b8 100644 --- a/pkg/api/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/api/v1alpha1/zz_generated.deepcopy.go @@ -342,6 +342,11 @@ func (in *WorkerPoolSpec) DeepCopyInto(out *WorkerPoolSpec) { *out = new(WorkerPoolPodTemplate) (*in).DeepCopyInto(*out) } + if in.TerminationGracePeriodSeconds != nil { + in, out := &in.TerminationGracePeriodSeconds, &out.TerminationGracePeriodSeconds + *out = new(int32) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkerPoolSpec.