The shell translator rewrites test bodies and loses Bats reporting.
The unit lane needs complete TAP results and JUnit reports without
changing how live-cluster suites run.
Sourced production helpers still need a dash pass, and unit test bodies
need nounset without exporting shell options into subprocesses.
Assisted-by: LLM
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
The hook's four kubectl calls carried --request-timeout=30s. A non-zero
value there makes kubectl skip its in-cluster credentials: client-go
consults them only while the assembled config still equals the default,
and the flag lands in that config, so every call went to kubectl's
built-in default cluster and was refused.
This package failed more quietly than kafka did. Each call is guarded by
`|| echo WARNING` and the script sets no -e, so the hook exited 0 and
printed "ACME cleanup complete."; hook-succeeded then deleted the Job that
held those warnings. The ACME solver objects it exists to reap were left
behind, and the only record went with the Job. Its own suite matched the
rendered command including the flag, so the broken form was pinned.
The gate is the point of this change. Two packages had it, neither was
visible in a rendered manifest, and nothing stops the next hook from
reaching for the same flag, since it reads as ordinary defensive practice.
hack/check-hook-request-timeout.bats fails any non-vendored template whose
kubectl call carries a non-zero --request-timeout, skipping files that name
KUBECONFIG because an explicit kubeconfig is not served by the in-cluster
branch. That per-file judgement is the coarse part and is written down in
the file rather than left to be inferred: apps/kubernetes keeps the flag on
two calls that pass their own kubeconfig, and stays green.
Bounding the work is still available where it belongs: --timeout for a
watch, activeDeadlineSeconds for the Job, which is what this hook already
had at 120s.
Assisted-by: LLM
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
Myasnikov Daniil