Skip to content

ci: fix commentstart, conditions, defaultorrequired, optionalorrequired and defaults findings in api types #1314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Mesut Oezdil (mesutoezdil) wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: fix commentstart, conditions, defaultorrequired, optionalorrequired and defaults findings in api types #1314

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .golangci-kal.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ linters:
- path: 'pkg/api/v1alpha1/csidriverconfig_types\.go'
text: '^optionalfields: .*\bCSIDriverTLSConfig\.(ServerName|UsePodIdentity)\b'
- path: 'pkg/api/v1alpha1/csidriverconfig_types\.go'
text: '^nonpointerstructs: .*\bCSIDriverConfig\.Spec\b'
text: '^(nonpointerstructs|requiredfields): .*\bCSIDriverConfig\.Spec\b'
- path: 'pkg/api/v1alpha1/workerpool_types\.go'
text: '^optionalfields: .*\bWorkerPoolPodTemplate\.PriorityClassName\b'
- path: 'pkg/api/v1alpha1/workerpool_types\.go'
Expand Down
16 changes: 8 additions & 8 deletions manifests/ate-install/generated/ate.dev_csidriverconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,39 +60,39 @@ spec:
metadata:
type: object
spec:
description: CSIDriverConfigSpec defines the desired state of CSIDriverConfig
description: spec defines the desired state of CSIDriverConfig
properties:
controllerEndpoint:
description: |-
ControllerEndpoint is the gRPC endpoint for the CSI Controller service.
controllerEndpoint is the gRPC endpoint for the CSI Controller service.
Must be a valid network URI (e.g. dns:///csi-service:9000 or tcp://127.0.0.1:9000).
pattern: ^(tcp|dns)://.+$
type: string
driverName:
description: |-
DriverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io").
driverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io").
Matches the StorageClass referenced in ActorTemplate volume definitions.
maxLength: 63
minLength: 1
pattern: ^(substrate\.io/)?([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)$
type: string
nodeSocketOverride:
description: |-
NodeSocketOverride is an optional override for the CSI Node service socket
nodeSocketOverride is an optional override for the CSI Node service socket
on the worker nodes. If empty, ATE defaults to unix:///var/lib/kubelet/plugins/[DriverName]/csi.sock.
pattern: ^unix://.+$
type: string
tls:
description: TLS configures TLS/mTLS for the connection to the ControllerEndpoint.
description: tls configures TLS/mTLS for the connection to the ControllerEndpoint.
properties:
enabled:
description: Enabled controls whether TLS is used.
description: enabled controls whether TLS is used.
type: boolean
serverName:
description: ServerName override for TLS verification.
description: serverName override for TLS verification.
type: string
usePodIdentity:
description: UsePodIdentity indicates whether to reuse Substrate's
description: usePodIdentity indicates whether to reuse Substrate's
Pod Identity (SPIFFE) certificates.
type: boolean
required:
Expand Down
14 changes: 7 additions & 7 deletions manifests/ate-install/generated/ate.dev_sandboxconfigs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,13 +77,13 @@ spec:
properties:
sha256:
description: |-
SHA256 is the lower-case hex SHA256 of the asset. It both names the cached
sha256 is the lower-case hex SHA256 of the asset. It both names the cached
file (preventing collisions) and verifies the download's integrity.
pattern: ^[a-f0-9]{64}$
type: string
url:
description: |-
URL is where to download the asset from (e.g. a gs:// URL). It may be
url is where to download the asset from (e.g. a gs:// URL). It may be
fetched anonymously or with credentials depending on atelet's
configuration.
minLength: 1
Expand All @@ -94,7 +94,7 @@ spec:
type: object
type: object
description: |-
Assets is the set of files atelet fetches for this runtime, keyed first by
assets is the set of files atelet fetches for this runtime, keyed first by
architecture (GOARCH, e.g. "amd64", "arm64") and then by asset name. The
asset names are interpreted by the sandbox backend: gVisor expects a
"gvisor" asset (the release's gvisor.tar.zstd, which atelet extracts so
Expand All @@ -106,14 +106,14 @@ spec:
type: object
default:
description: |-
Default marks this SandboxConfig as the cluster-wide default for its
default marks this SandboxConfig as the cluster-wide default for its
SandboxClass. A WorkerPool with no explicit SandboxConfigName resolves to
the default config for its SandboxClass. At most one default is expected
per SandboxClass.
type: boolean
pauseImage:
description: |-
PauseImage is the container image used as the root sandbox container.
pauseImage is the container image used as the root sandbox container.
It holds the sandbox's namespaces and runs no workload code, so it is an
implementation detail of the sandbox rather than something actor authors
choose. It is captured in the snapshot manifest alongside the sandbox
Expand All @@ -132,15 +132,15 @@ spec:
sandboxClass:
default: gvisor
description: |-
SandboxClass is the sandbox runtime family this config applies to. A
sandboxClass is the sandbox runtime family this config applies to. A
WorkerPool only uses SandboxConfigs whose SandboxClass matches its own.
Defaults to gvisor.
enum:
- gvisor
- microvm
type: string
required:
- pauseImage
- sandboxClass
type: object
required:
- spec
Expand Down
41 changes: 26 additions & 15 deletions manifests/ate-install/generated/ate.dev_workerpools.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,14 +69,14 @@ spec:
description: spec defines the desired state of WorkerPool
properties:
replicas:
description: Replicas is the number of worker pods to run.
description: replicas is the number of worker pods to run.
format: int32
minimum: 0
type: integer
sandboxClass:
default: gvisor
description: |-
SandboxClass selects the sandbox runtime family for this pool, which drives
sandboxClass selects the sandbox runtime family for this pool, which drives
the worker pod shape (KVM/vhost device mounts and node placement) and which
SandboxConfigs are eligible. The concrete binary is still selected by
WorkerImage. Defaults to gvisor.
Expand All @@ -88,21 +88,21 @@ spec:
type: string
sandboxConfigName:
description: |-
SandboxConfigName names a cluster-scoped SandboxConfig to use for fetching
sandboxConfigName names a cluster-scoped SandboxConfig to use for fetching
sandbox binaries. It overrides the cluster-wide default SandboxConfig for
this pool's SandboxClass. The referenced config's SandboxClass must match
this pool's SandboxClass. If empty, the default SandboxConfig for the
SandboxClass is used.
type: string
template:
description: Template holds optional metadata, scheduling, and resource
description: template holds optional metadata, scheduling, and resource
settings for worker workloads.
properties:
annotations:
additionalProperties:
type: string
description: |-
Annotations are added to the generated Deployment and worker pods. Keys
annotations are added to the generated Deployment and worker pods. Keys
in the ate.dev domain and its subdomains are reserved for controllers.
maxProperties: 64
type: object
Expand All @@ -121,7 +121,7 @@ spec:
pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
type: string
description: |-
Labels are added to the generated Deployment and worker pods. Keys in
labels are added to the generated Deployment and worker pods. Keys in
the ate.dev domain and its subdomains are reserved for controllers.
maxProperties: 64
type: object
Expand All @@ -132,7 +132,7 @@ spec:
rule: self.all(key, !format.qualifiedName().validate(key).hasValue())
nodeAffinity:
description: |-
NodeAffinity scheduling rules for the worker pods. Mapped to
nodeAffinity scheduling rules for the worker pods. Mapped to
spec.affinity.nodeAffinity on the pod.
properties:
preferredDuringSchedulingIgnoredDuringExecution:
Expand Down Expand Up @@ -333,14 +333,14 @@ spec:
nodeSelector:
additionalProperties:
type: string
description: NodeSelector is a selector which must be true for
description: nodeSelector is a selector which must be true for
the pod to fit on a node.
type: object
priorityClassName:
description: PriorityClassName for the worker pods.
description: priorityClassName for the worker pods.
type: string
resources:
description: Resources are the compute resources allocated for
description: resources are the compute resources allocated for
each worker pod.
properties:
claims:
Expand Down Expand Up @@ -400,7 +400,7 @@ spec:
type: object
type: object
tolerations:
description: Tolerations for the worker pods.
description: tolerations for the worker pods.
items:
description: |-
The pod this Toleration is attached to tolerates any taint that matches
Expand Down Expand Up @@ -442,8 +442,19 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
terminationGracePeriodSeconds:
default: 300
description: |-
terminationGracePeriodSeconds is the termination grace period applied to
this pool's worker pods. On eviction, ateom traps SIGTERM and forwards it
to the actor so it can save state and exit cleanly before the kubelet
sends SIGKILL. Tune this to the maximum time your actors need to shut
down gracefully. Defaults to 300 (5 minutes).
format: int32
minimum: 1
type: integer
workerImage:
description: WorkerImage is the ateom container image to deploy as
description: workerImage is the ateom container image to deploy as
workers.
minLength: 1
type: string
Expand All @@ -455,17 +466,17 @@ spec:
description: status is the observed state of WorkerPool
properties:
readyReplicas:
description: ReadyReplicas is the number of ready worker pods.
description: readyReplicas is the number of ready worker pods.
format: int32
minimum: 0
type: integer
replicas:
description: Replicas is the total number of worker pods.
description: replicas is the total number of worker pods.
format: int32
minimum: 0
type: integer
selector:
description: Selector is the label selector for the worker pods.
description: selector is the label selector for the worker pods.
type: string
type: object
required:
Expand Down
21 changes: 13 additions & 8 deletions pkg/api/v1alpha1/csidriverconfig_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ import (

// CSIDriverConfigSpec defines the desired state of CSIDriverConfig
type CSIDriverConfigSpec struct {
// DriverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io").
// driverName is the standard CSI driver name (e.g. "hostpath.csi.k8s.io").
// Matches the StorageClass referenced in ActorTemplate volume definitions.
//
// +required
Expand All @@ -29,39 +29,39 @@ type CSIDriverConfigSpec struct {
// +kubebuilder:validation:Pattern=`^(substrate\.io/)?([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)$`
DriverName string `json:"driverName"`

// ControllerEndpoint is the gRPC endpoint for the CSI Controller service.
// controllerEndpoint is the gRPC endpoint for the CSI Controller service.
// Must be a valid network URI (e.g. dns:///csi-service:9000 or tcp://127.0.0.1:9000).
// TODO: Harden endpoint validation to prevent invalid or unsafe URI inputs.
//
// +required
// +kubebuilder:validation:Pattern=`^(tcp|dns)://.+$`
ControllerEndpoint string `json:"controllerEndpoint"`

// NodeSocketOverride is an optional override for the CSI Node service socket
// nodeSocketOverride is an optional override for the CSI Node service socket
// on the worker nodes. If empty, ATE defaults to unix:///var/lib/kubelet/plugins/[DriverName]/csi.sock.
//
// +optional
// +kubebuilder:validation:Pattern=`^unix://.+$`
NodeSocketOverride string `json:"nodeSocketOverride,omitempty"`

// TLS configures TLS/mTLS for the connection to the ControllerEndpoint.
// tls configures TLS/mTLS for the connection to the ControllerEndpoint.
// +optional
TLS *CSIDriverTLSConfig `json:"tls,omitempty"`
}

// CSIDriverTLSConfig holds TLS and mTLS configuration for CSI driver connections.
// +kubebuilder:validation:XValidation:rule="!self.enabled || (has(self.usePodIdentity) && self.usePodIdentity)",message="tls.usePodIdentity must be true when tls.enabled is true; manual certificates are not yet supported"
type CSIDriverTLSConfig struct {
// Enabled controls whether TLS is used.
// enabled controls whether TLS is used.
// +required
Enabled bool `json:"enabled"`

// usePodIdentity indicates whether to reuse Substrate's Pod Identity (SPIFFE) certificates.
// TODO: Add alternative support for manual certs by adding SecretReference fields.
// UsePodIdentity indicates whether to reuse Substrate's Pod Identity (SPIFFE) certificates.
// +optional
UsePodIdentity bool `json:"usePodIdentity,omitempty"`

// ServerName override for TLS verification.
// serverName override for TLS verification.
// +optional
ServerName string `json:"serverName,omitempty"`
}
Expand All @@ -76,9 +76,14 @@ type CSIDriverTLSConfig struct {
// +kubebuilder:printcolumn:name="Driver",type=string,JSONPath=`.spec.driverName`
// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
type CSIDriverConfig struct {
metav1.TypeMeta `json:",inline"`
metav1.TypeMeta `json:",inline"`

// metadata is a standard object metadata
// +optional
metav1.ObjectMeta `json:"metadata,omitempty"`

// spec defines the desired state of CSIDriverConfig
// +required
Spec CSIDriverConfigSpec `json:"spec"`
}

Expand Down
17 changes: 9 additions & 8 deletions pkg/api/v1alpha1/sandboxconfig_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,15 +33,15 @@ const (
// AssetFile is one content-addressed file that atelet fetches for a sandbox
// runtime (e.g. the gVisor runsc binary, or a micro-VM kernel/firmware/config).
type AssetFile struct {
// URL is where to download the asset from (e.g. a gs:// URL). It may be
// url is where to download the asset from (e.g. a gs:// URL). It may be
// fetched anonymously or with credentials depending on atelet's
// configuration.
//
// +required
// +kubebuilder:validation:MinLength=1
URL string `json:"url"`

// SHA256 is the lower-case hex SHA256 of the asset. It both names the cached
// sha256 is the lower-case hex SHA256 of the asset. It both names the cached
// file (preventing collisions) and verifies the download's integrity.
//
// +required
Expand All @@ -51,23 +51,24 @@ type AssetFile struct {

// SandboxConfigSpec is the desired state of a SandboxConfig.
type SandboxConfigSpec struct {
// SandboxClass is the sandbox runtime family this config applies to. A
// sandboxClass is the sandbox runtime family this config applies to. A
// WorkerPool only uses SandboxConfigs whose SandboxClass matches its own.
// Defaults to gvisor.
//
// +required
// +optional
// +kubebuilder:validation:Enum=gvisor;microvm
// +kubebuilder:default=gvisor
SandboxClass SandboxClass `json:"sandboxClass"`
SandboxClass SandboxClass `json:"sandboxClass,omitempty"`

// Default marks this SandboxConfig as the cluster-wide default for its
// default marks this SandboxConfig as the cluster-wide default for its
// SandboxClass. A WorkerPool with no explicit SandboxConfigName resolves to
// the default config for its SandboxClass. At most one default is expected
// per SandboxClass.
//
// +optional
Default bool `json:"default,omitempty"`

// PauseImage is the container image used as the root sandbox container.
// pauseImage is the container image used as the root sandbox container.
// It holds the sandbox's namespaces and runs no workload code, so it is an
// implementation detail of the sandbox rather than something actor authors
// choose. It is captured in the snapshot manifest alongside the sandbox
Expand All @@ -83,7 +84,7 @@ type SandboxConfigSpec struct {
// +kubebuilder:validation:XValidation:rule="self.contains('@')",message="All images must be pinned (changing the image invalidates snapshots)"
PauseImage string `json:"pauseImage"`

// Assets is the set of files atelet fetches for this runtime, keyed first by
// assets is the set of files atelet fetches for this runtime, keyed first by
// architecture (GOARCH, e.g. "amd64", "arm64") and then by asset name. The
// asset names are interpreted by the sandbox backend: gVisor expects a
// "gvisor" asset (the release's gvisor.tar.zstd, which atelet extracts so
Expand Down
Loading