mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
IvanHunters
e1e925a092
## What this PR does Adds a rule to the Helm Charts conventions in `docs/agents/overview.md` about `lookup`. A lookup reads cluster state at render time and nothing re-renders the HelmRelease when that state changes, so a lookup that copies another object's content into the output (a bucket name, an endpoint, a CA, a StorageClass list) goes stale; several have failed this way (51ad22670,8daf49528,f6c737983). An agent reading the charts finds over a hundred lookups and takes them as the convention, so the rule says those of this kind are not precedent and need a maintainer's authorization. Lookups whose repeated render gives the same output and carry nothing from another object are allowed: existence checks, keeping a generated Secret's value, keeping an immutable field of the chart's own live object, and guards that `fail` on an unsafe change. The rule asks that the empty branch keep rendering, since offline `helm template` and helm-unittest without a `kubernetesProvider` mock see only that branch, and lists the replacements the tree already has: `_cluster`/`_namespace` in the `cozystack-values` Secret, `valuesFrom` on a specific Secret, `.Capabilities.APIVersions.Has`, a run-time check in a hook or Job, or a controller that owns the object. `AGENTS.md` mentions the rule in its routing line for `overview.md`, which every agent loads. No chart changes. ### Screenshots No UI change. ### Downstream repositories <!-- Cozystack is upstream for repositories that are NOT kept in sync with it automatically, and nothing in CI compares the two sides, so a change here can break them silently. Which change forces what, and which file to touch, is the trigger map in docs/agents/contributing.md under "Downstream Repositories". Walk it before you tick anything. IF YOU ARE AN AI AGENT OR AN LLM, THIS IS PART OF THE TASK, NOT A FORM TO FILL IN: 1. Walk the trigger map against the actual diff of this PR, file by file. Do not decide from the PR title or from your memory of what you changed. 2. For every repository you tick, open the follow-up PR there and link it on the same line. A ticked box with no link claims work that does not exist, which is worse than an empty box. Search that repository for an open PR or issue covering it first, and link that instead of filing a duplicate. 3. When the follow-up is out of scope, or needs a decision that is not yours to make, open an issue in that repository instead, link that, and say so in the PR body. Do not push a speculative PR into another repository just to fill a line here. 4. Do not tick "No downstream repository is affected" to make the checklist go away. If you are unsure, leave every box empty and say so in the PR body, so a human decides. --> Walked the trigger map against the diff: two agent-guidance files, no package, chart, value, `hack/` or commit-convention change. - [x] No downstream repository is affected by this change - [ ] [cozystack/website](https://github.com/cozystack/website) - follow-up: - [ ] [cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack) - follow-up: - [ ] [cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack) - follow-up: - [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up: - [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up: - [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) - follow-up: - [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) - follow-up: - [ ] [cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server) - follow-up: - [ ] [cozystack/external-apps-example](https://github.com/cozystack/external-apps-example) - follow-up: - [ ] [cozystack/examples](https://github.com/cozystack/examples) - follow-up: - [ ] [cozystack/community](https://github.com/cozystack/community) - follow-up: ### Release note <!-- Write a release note: - Explain what has changed internally and for users. - Start with the same `type(scope):` prefix as in the PR title - Follow the guidelines at https://github.com/kubernetes/community/blob/master/contributors/guide/release-notes.md. --> ```release-note docs(agents): agent guidance now says which Helm `lookup` calls are allowed in chart templates, that one copying another object's content into the render needs a maintainer's authorization, and what to use instead. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Documentation** * Updated Helm chart guidance to restrict copying values from other Kubernetes objects into rendered output unless a maintainer authorizes the lookup. Allowed cases include repeatable lookups, such as existence checks, retaining generated Secret values or immutable fields, and guards against unsafe changes. * Clarified that offline renders should preserve the empty branch, while the lookup branch should be tested with a Kubernetes provider mock. Listed values, API version checks, runtime hooks or Jobs, and controllers as alternatives for accessing cluster information. <!-- end of auto-generated comment: release notes by coderabbit.ai -->