mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 21:14:56 +09:00
Aleksei Sviridkin
7214efc8e5
## What this PR does Every migration that stamps the `cozystack-version` ConfigMap must carry the `platform.cozystack.io/no-delete=true` label so the `cozystack-no-delete-guardrail` ValidatingAdmissionPolicy guards it. The chart template renders the labeled ConfigMap only on first install, so each upgrade-time stamp has to re-emit the label by hand — migration 43 had to inline-copy migration 42's heredoc to avoid a label-less apply by the same field manager stripping it. The bug class was patched per-migration, not eliminated. This extracts the stamp into a shared, sourced helper (`render_cozystack_version_manifest` + `stamp_cozystack_version`) under `images/migrations/migrations/lib/`, and routes migrations 42, 43, 44 and the `run-migrations.sh` bootstrap path through it. The labeled manifest now has a single definition, so future migrations cannot drift back to a label-less apply. The upgrade path is behavior-preserving: the rendered manifest is byte-identical to the previous heredocs (pinned by a golden unit test). The bootstrap path in `run-migrations.sh` previously created the ConfigMap without the label — it now carries it like every migration-driven stamp. Adds `hack/cozystack-version-stamp.bats` (8 tests) covering the helper: label presence, ConfigMap name, quoted-string version type, namespace default and override, required-argument guard, and the byte-exact golden manifest. Closes #2781 ### Release note ```release-note fix(platform): always stamp the platform.cozystack.io/no-delete label on the cozystack-version ConfigMap, including the migration bootstrap path, so deletion protection cannot be silently dropped ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Release Notes * **Tests** * Expanded validation to confirm the version-stamp manifest is parseable YAML, includes the required no-delete label, targets the correct `cozystack-version` ConfigMap, and quotes the version value correctly. * Added coverage for default and overridden namespaces, argument validation failures, and a golden “byte-for-byte” render check. * Added a guardrail test to prevent bypassing the shared stamping logic by direct `kubectl` ConfigMap stamping. * **Refactor** * Centralized `cozystack-version` rendering and stamping into a shared helper and updated migrations and the migrations runner to use it consistently. <!-- end of auto-generated comment: release notes by coderabbit.ai -->