feat: namespace metadata sync on creation #1378 #1379

CharlieR-o-o-t · 2025-02-16T20:20:57Z

Sync metadata on namespace creation

netlify · 2025-02-16T20:21:17Z

✅ Deploy Preview for capsule-documentation canceled.

Name	Link
🔨 Latest commit	`fd83079`
🔍 Latest deploy log	https://app.netlify.com/sites/capsule-documentation/deploys/67c95b18f7cd4000087b3610

oliverbaehler · 2025-02-18T13:45:48Z

Hey until the new implementation is done i am happy to consider this one, could you adsd one e2e test?

CharlieR-o-o-t · 2025-03-06T00:02:40Z

Hello @oliverbaehler
Apologies for the delay, was on vacation.

At first look, I thought this change would be a quick 5-minute adventure. But soon I have realized that all mutation changes need to be handled in a single place. This PR will guarantee consistent namespace metadata on creation/reconcile.

I have also added e2e for both webhook and controller namespace reconcile.

Additionally, I encountered issues with the Harpoon image:
ghcr.io/alegrey91/harpoon:latest is a broken build—there is no execute bit set on the binary, causing the container to crash during trace-e2e. As a workaround, I switched Harpoon back to Docker Hub.

Please take a look when you'll have time.
pipeline should be ok this time.

CharlieR-o-o-t · 2025-03-06T20:53:44Z

/retest

CharlieR-o-o-t · 2025-03-06T23:03:58Z

Have no failed test in trace-e2e on my ubuntu workstation.
Doesn't look like related to my change. Will figure out.

Svarrogh1337 · 2025-04-11T10:52:47Z

Additionally, I encountered issues with the Harpoon image: ghcr.io/alegrey91/harpoon:latest is a broken build—there is no execute bit set on the binary, causing the container to crash during trace-e2e. As a workaround, I switched Harpoon back to Docker Hub.

Please take a look when you'll have time. pipeline should be ok this time.

You can git cherry-pick f06c38f280bcf524d6b58b172d4e86800c25f138 for fix. It's also already been merged into main, so you can take it from there too.

CharlieR-o-o-t · 2025-04-27T22:17:38Z

@Svarrogh1337 @oliverbaehler , apologies, just found time for this.
Latest harpoon produces deadlock, I can reproduce it only in github CI.
I just tried to remove harpoon from entrypoint for test purposes and everything is okay.

On my ubuntu workstation everything is ok even with harpoon:

Could you confirm?

oliverbaehler · 2025-04-29T14:22:16Z

pkg/webhook/namespace/patch.go

Why does the logic have to be in one handler?

The patch.go is a validating handler. Therefor it should not be combined with your change. You have done the right thing with registering a new route to generalize the mutation of namespace. However i would rename the current ownerreference folder into namespace-mutating or whatever and then keep the logic for patching in a dedicated handler (as is) and add a new handler, which just handles the nodeSelector.

Got your point about patch.go.

There is a huge logic to detect namespace ownership in onCreate, I just wanted to do it Once in one place.

@oliverbaehler , could you take a look at new PR. Is it what you wanted?

oliverbaehler · 2025-05-05T20:11:18Z

Yeah there was just a feagure merged which adds the subpackages for namespace mutations and validations. You may add your logic now as dedicated handler in the namespcae mutation package. Should be much simpler now

CharlieR-o-o-t · 2025-05-06T19:38:29Z

@oliverbaehler , I have made changes considering last mutation feature, could you take a look?

oliverbaehler · 2025-05-08T06:34:45Z

pkg/webhook/namespace/mutation/cordoning.go

You may delete this one, as yours achieves the same thing

oliverbaehler · 2025-05-08T06:37:39Z

pkg/webhook/namespace/mutation/metadata.go

+		// sync namespace metadata
+		capsuletenant.SyncNamespaceMetadata(tenant, ns)
+
+		return nil


You still need to patch the admission, this does not do anything yet:

Suggested change

// sync namespace metadata

capsuletenant.SyncNamespaceMetadata(tenant, ns)

return nil

// sync namespace metadata

capsuletenant.SyncNamespaceMetadata(tenant, ns)

marshaled, err := json.Marshal(ns)

if err != nil {

response := admission.Errored(http.StatusInternalServerError, err)

return &response

}

response := admission.PatchResponseFromRaw(req.Object.Raw, marshaled)

return &response

You still need to patch the admission, this does not do anything yet:

yes, sorry, night coding on vacation is evil), patch was lost in changes. fixed

oliverbaehler · 2025-05-08T06:47:26Z

I'm. really sorry @CharlieR-o-o-t , i just merged the other feature which also causes some conflicts since it changes some of the metadata code. I would just put everything into your sync function so it's also considered at admission create, sahouldn't be too big of a change

pkg/webhook/namespace/mutation/metadata.go

Signed-off-by: Siarhei Rasiukevich <s_rasiukevich@wargaming.net>

CharlieR-o-o-t · 2025-05-08T22:18:24Z

@oliverbaehler ,
Everything mentioned were fixed. Thank you for review.

I have also added additional commit on cordon webhook (26dbdf0).
Internal error was not returned.

oliverbaehler

Thank you very much for your efforts! 🚀

CharlieR-o-o-t · 2025-05-26T15:47:14Z

Yeah there was just a feagure merged which adds the subpackages for namespace mutations and validations. You may add your logic now as dedicated handler in the namespcae mutation package. Should be much simpler now

@oliverbaehler, As I can see by code only one handler will be executed onCreate, it's not clear for me purpose of InCapsuleGroups :/

capsule/pkg/webhook/utils/in_capsule_groups.go

Line 35 in de41fcb

for _, hndl := range h.handlers {

only CordoningLabelHandler is executed now(

oliverbaehler · 2025-05-26T16:31:39Z

Mh? Not sure what you are looking for, Cordoning does not even run OnCreate?

InCapsuleGroups tells the webhook, that the user submitting the admission (or rather one of their groups) must be mentioned in the capsuleCOnfiguration. Otherwise the admission is just allowed. This is not to interfere with non tenant operations.

CharlieR-o-o-t · 2025-05-26T16:35:36Z

I mean that no matter how many handlers added to InCapsuleGroups, executed only first.
This breaks the logic with mutation.

oliverbaehler · 2025-05-26T16:50:15Z

Why would you reason that? executed only first - not true at all.

CharlieR-o-o-t force-pushed the main branch from e5ddbd2 to f732261 Compare February 16, 2025 21:23

CharlieR-o-o-t force-pushed the main branch 7 times, most recently from f900474 to 8c03103 Compare March 6, 2025 00:02

CharlieR-o-o-t force-pushed the main branch 2 times, most recently from 13815a9 to 16ba36f Compare April 27, 2025 21:57

oliverbaehler reviewed Apr 29, 2025

View reviewed changes

CharlieR-o-o-t closed this May 5, 2025

CharlieR-o-o-t force-pushed the main branch from 16ba36f to 3c5874a Compare May 5, 2025 09:28

CharlieR-o-o-t reopened this May 5, 2025

CharlieR-o-o-t closed this May 6, 2025

CharlieR-o-o-t force-pushed the main branch from a8907f6 to 63c92f8 Compare May 6, 2025 15:38

CharlieR-o-o-t reopened this May 6, 2025

CharlieR-o-o-t force-pushed the main branch 3 times, most recently from c24ac88 to f5d264b Compare May 6, 2025 19:14

oliverbaehler requested changes May 8, 2025

View reviewed changes

CharlieR-o-o-t force-pushed the main branch from f5d264b to dd8ee6b Compare May 8, 2025 21:29

github-advanced-security bot found potential problems May 8, 2025

View reviewed changes

pkg/webhook/namespace/mutation/metadata.go Fixed Show fixed Hide fixed

feat: namespace metadata sync on creation projectcapsule#1378

af3d167

Signed-off-by: Siarhei Rasiukevich <s_rasiukevich@wargaming.net>

CharlieR-o-o-t force-pushed the main branch 5 times, most recently from ab130bf to eb003c5 Compare May 8, 2025 21:55

fix(tenant): internal error is not returned in cordon webhook

26dbdf0

Signed-off-by: Siarhei Rasiukevich <s_rasiukevich@wargaming.net>

CharlieR-o-o-t force-pushed the main branch from eb003c5 to ff91cfe Compare May 8, 2025 21:57

fix(utils): lint on pkg/utils/namespace_selector.go

d5ff538

Signed-off-by: Siarhei Rasiukevich <s_rasiukevich@wargaming.net>

CharlieR-o-o-t force-pushed the main branch from ff91cfe to d5ff538 Compare May 8, 2025 21:57

CharlieR-o-o-t requested a review from oliverbaehler May 8, 2025 22:16

oliverbaehler approved these changes May 9, 2025

View reviewed changes

oliverbaehler merged commit f85b618 into projectcapsule:main May 9, 2025
14 checks passed

-		// sync namespace metadata
-		capsuletenant.SyncNamespaceMetadata(tenant, ns)
-		return nil
+		// sync namespace metadata
+		capsuletenant.SyncNamespaceMetadata(tenant, ns)
+	        marshaled, err := json.Marshal(ns)
+	        if err != nil {
+		  response := admission.Errored(http.StatusInternalServerError, err)
+		  return &response
+	        }
+	        response := admission.PatchResponseFromRaw(req.Object.Raw, marshaled)
+	        return &response

feat: namespace metadata sync on creation #1378 #1379

feat: namespace metadata sync on creation #1378 #1379

Uh oh!

Conversation

CharlieR-o-o-t commented Feb 16, 2025

Uh oh!

netlify bot commented Feb 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for capsule-documentation canceled.

Uh oh!

oliverbaehler commented Feb 18, 2025

Uh oh!

CharlieR-o-o-t commented Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CharlieR-o-o-t commented Mar 6, 2025

Uh oh!

CharlieR-o-o-t commented Mar 6, 2025

Uh oh!

Svarrogh1337 commented Apr 11, 2025

Uh oh!

CharlieR-o-o-t commented Apr 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oliverbaehler Apr 29, 2025

Choose a reason for hiding this comment

Uh oh!

CharlieR-o-o-t Apr 29, 2025

Choose a reason for hiding this comment

Uh oh!

CharlieR-o-o-t May 5, 2025

Choose a reason for hiding this comment

Uh oh!

oliverbaehler commented May 5, 2025

Uh oh!

CharlieR-o-o-t commented May 6, 2025

Uh oh!

oliverbaehler May 8, 2025

Choose a reason for hiding this comment

Uh oh!

oliverbaehler May 8, 2025

Choose a reason for hiding this comment

Uh oh!

CharlieR-o-o-t May 8, 2025

Choose a reason for hiding this comment

Uh oh!

oliverbaehler commented May 8, 2025

Uh oh!

Uh oh!

CharlieR-o-o-t commented May 8, 2025

Uh oh!

oliverbaehler left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

CharlieR-o-o-t commented May 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oliverbaehler commented May 26, 2025

Uh oh!

CharlieR-o-o-t commented May 26, 2025

Uh oh!

oliverbaehler commented May 26, 2025

Uh oh!

Uh oh!

netlify bot commented Feb 16, 2025 •

edited

Loading

CharlieR-o-o-t commented Mar 6, 2025 •

edited

Loading

CharlieR-o-o-t commented Apr 27, 2025 •

edited

Loading

CharlieR-o-o-t commented May 26, 2025 •

edited

Loading