@@ -4,18 +4,17 @@
 #
 # `update` refetches a package's vendored upstream manifests, and several
 # recipes open by deleting templates/ to guarantee a clean slate. That is safe
-# only while every file under templates/ comes back from the recipe. templates/
-# is an ordinary chart directory, so a package can also keep first-party
-# manifests there -- kubevirt-cdi keeps the CDI upload-proxy Ingress and
-# TLSRoute -- and the recipe knows nothing about those. The wipe takes them and
-# `make update` exits 0, so the deletion lands in the diff with nothing marking
-# it. Whether anything downstream notices depends on the package carrying a
-# helm-unittest suite that names the file, and where none does the loss is
-# silent all the way to a cluster. That is a property of the package, not of
-# the tree, so it is worth re-deriving rather than reading: at the time of
-# writing kubevirt-cdi has such a suite and a deletion there fails `make test`
-# as well, while some packages that clear their own templates/ declare no
-# `test` target at all (#3631 tracks packages without one).
+# only while every file under templates/ comes back from the recipe.
+# templates/ is an ordinary chart directory, so a package can also keep
+# first-party manifests there, and the recipe knows nothing about them. The
+# wipe takes them and `make update` exits 0, so the deletion lands in the diff
+# with nothing marking it. Whether anything downstream notices depends on the
+# package carrying a helm-unittest suite that names the file, and where none
+# does the loss is silent all the way to a cluster. That is a property of the
+# package, not of the tree, so it is worth re-deriving rather than reading: at
+# the time of writing kubevirt-cdi has such a suite and a deletion there fails
+# `make test` as well, while some packages that clear their own templates/
+# declare no `test` target at all (#3631 tracks packages without one).
 #
 # The invariant: a recipe that clears templates/ must NAME every file tracked
 # under it. Both halves are approximations of the shell the recipe would run,
@@ -269,9 +268,8 @@ unnamed_templates() {
 
     # A tab-indented comment inside the recipe is not shell. A recipe that
     # deliberately does not clear templates/ tends to carry a line saying why,
-    # and searching that line would fail that very package. Both
-    # spellings are pinned because make accepts both and the tree writes both:
-    # `@#` in kubevirt-operator's own update recipe, bare `#` everywhere else.
+    # and searching that line would fail that very package. Both spellings
+    # are pinned because make accepts both and the tree writes both.
     for lead in '#' '@#'; do
         printf 'update:\n\tmkdir -p templates\n\t%s deliberately no rm -rf templates here: the upload-proxy files are ours\n' \
             "$lead" > "$tmp/pkg/Makefile"
@@ -341,10 +339,10 @@ unnamed_templates() {
         exit 1
     fi
 
-    # The other order, and the one this tree actually writes: kubevirt-cdi puts
-    # `test:` below its `update:` recipe. Above, `r` is still 0 and the gate
-    # does the work; here the recipe has already started and only the
-    # terminator can stop it, so without this case that half is unpinned.
+    # The other order, and one the tree writes: a `test:` below the `update:`
+    # recipe. Above, `r` is still 0 and the gate does the work; here the recipe
+    # has already started and only the terminator can stop it, so without this
+    # case that half is unpinned.
     printf 'update:\n\tmkdir -p templates\nclean:\n\trm -rf templates\n' \
         > "$tmp/pkg/Makefile"
     if [ -n "$(wipe_command "$tmp/pkg/Makefile")" ]; then
@@ -383,8 +381,8 @@ unnamed_templates() {
         exit 1
     fi
 
-    # And the shape kubevirt-cdi moved to switches the check off, so the scan
-    # is measuring the removal rather than the package.
+    # And a recipe that only creates the directory switches the check off, so
+    # the scan is measuring the removal rather than the package.
     printf 'update:\n\tmkdir -p templates\n\twget -O templates/fetched.yaml https://example.invalid/f.yaml\n' \
         > "$tmp/pkg/Makefile"
     if [ -n "$(wipe_command "$tmp/pkg/Makefile")" ]; then
 
@@ -0,0 +1,3 @@
+# `update` fetches here to check the pin, and keeps the file on a mismatch.
+# The recipe's error text says why.
+/cdi-cr.yaml.download
@@ -1,27 +1,81 @@
 export NAME=kubevirt-cdi
 export NAMESPACE=cozy-$(NAME)
 
+# The CDI release templates/cdi-cr.yaml is reconciled against. Moving to a
+# newer CDI is an edit to this line. What the platform actually deploys is set
+# by ../kubevirt-cdi-operator, so this line does not track that one: it has to
+# be pointed at it by hand, and `update` fails while the two disagree.
+# Deriving this from the sibling manifest instead would end the pin: the point
+# is that a human chooses which release this object is reconciled against, and
+# a computed value hides that choice from the diff. A check leaves the choice
+# here and only refuses to call a stale one current.
+RELEASE = v1.66.1
+
+# sha256 of the cdi-cr.yaml release asset as published. Upstream publishes no
+# checksum for it, so the pin is taken from a download rather than fetched
+# alongside one: it detects an asset that moved under its tag, and it is not
+# authenticity verification.
+CR_SHA256 = a497f90de608c1df26f9ee4095289373f17132d74a2042ca03e00c17c964f8a7
+
+# sha256sum is not everywhere: current macOS carries a native one in /sbin,
+# older releases carry only shasum(1). Both print "<digest>  <path>", so field
+# 1 is the digest whichever gets picked.
+SHA256SUM = $(shell command -v sha256sum >/dev/null 2>&1 && echo sha256sum || echo 'shasum -a 256')
+
 include ../../../hack/package.mk
 
-# hack/package.mk defines no `test` target and hack/helm-unit-tests.sh only runs
-# a package whose `make -n test` resolves, so a tests/ directory without this
-# line is collected by nothing and the suite is skipped in silence.
+# Phony because hack/package.mk's .PHONY line lists only the targets that file
+# defines: with neither name declared, a path named `test` or `update` next to
+# this Makefile would make that target up to date and skip the recipe.
+.PHONY: test update
+
+# hack/package.mk defines no `test` target and hack/helm-unit-tests.sh only
+# runs a package whose `make -n test` resolves, so a tests/ directory with no
+# `test:` target is collected by nothing and the suite is skipped in silence.
 test:
 	helm unittest .
 
-# Nothing under templates/ here is purely vendored. The upload-proxy Ingress
-# and TLSRoute are ours and no fetch recreates them, so clearing the directory
-# would lose them outright. It is not needed either: wget -O truncates the one
-# file it writes and leaves the rest.
+# templates/cdi-cr.yaml is ours, not upstream's: it adds to upstream's bare CDI
+# object, and what it adds is pinned under tests/ rather than restated here.
+# The delta is a fact about one release and not a standing property of CDI:
+# upstream carried WebhookPvcRendering from v1.63.0 through v1.65.0 and dropped
+# it by v1.66.0, and this object never carried it at all, so the difference ran
+# both ways for three releases and one way after. Re-derive it at each bump
+# instead of inheriting it.
 #
-# cdi-cr.yaml is ours too, despite being named after an upstream asset: it
-# carries Helm templating and RBAC that no fetch reproduces. The fetch below
-# still overwrites it, so a CDI bump means diffing it against the upstream
-# asset and re-applying whatever is local by hand.
+# So nothing here writes under templates/: fetching the release the object is
+# derived from confirms the bytes still hash to the pin. What that catches is
+# an edit to RELEASE without a matching digest, and an asset that moved under a
+# tag that should be immutable. Moving RELEASE is therefore the step that
+# forces someone to reconcile this object by hand, which is the point. The
+# recipe then compares RELEASE with the cdi-operator image tag that
+# ../kubevirt-cdi-operator vendors, because that package can move to a new
+# release without touching this file, and a success line naming RELEASE would
+# then report a release the platform no longer runs. RELEASE is checked by
+# `update` rather than by `test`, because helm-unittest reads rendered output
+# and this object renders no version string.
 update:
-	mkdir -p templates
-	export VERSION=$$(basename $$(curl -s -w %{redirect_url} https://github.com/kubevirt/containerized-data-importer/releases/latest)) && \
-	wget https://github.com/kubevirt/containerized-data-importer/releases/download/$$VERSION/cdi-cr.yaml -O templates/cdi-cr.yaml
-
-test:
-	helm unittest .
+	wget https://github.com/kubevirt/containerized-data-importer/releases/download/$(RELEASE)/cdi-cr.yaml -O cdi-cr.yaml.download || { rm -f cdi-cr.yaml.download; exit 1; }
+	@# Kept on a mismatch rather than deleted; the error below says why.
+	@actual=$$($(SHA256SUM) cdi-cr.yaml.download | awk '{print $$1}'); \
+	if [ "$$actual" != "$(CR_SHA256)" ]; then \
+	  echo "ERROR: cdi-cr.yaml for $(RELEASE) hashed $$actual," >&2; \
+	  echo "       expected $(CR_SHA256). The download is kept as" >&2; \
+	  echo "       cdi-cr.yaml.download." >&2; \
+	  echo "       If RELEASE just moved, diff it against templates/cdi-cr.yaml," >&2; \
+	  echo "       carry over what belongs there and update CR_SHA256. If RELEASE" >&2; \
+	  echo "       did not change, the asset moved under a tag that should be" >&2; \
+	  echo "       immutable: find out why first." >&2; \
+	  exit 1; \
+	fi; \
+	rm -f cdi-cr.yaml.download
+	@deployed=$$(grep -oE 'quay\.io/kubevirt/cdi-operator:[^"[:space:]]+' ../kubevirt-cdi-operator/templates/cdi-operator.yaml | head -n 1); \
+	deployed=$${deployed##*:}; \
+	if [ "$$deployed" != "$(RELEASE)" ]; then \
+	  echo "ERROR: RELEASE is $(RELEASE), but ../kubevirt-cdi-operator vendors" >&2; \
+	  echo "       CDI $${deployed:-<no cdi-operator image found>}, and that package decides what the" >&2; \
+	  echo "       platform deploys. Reconcile templates/cdi-cr.yaml against the" >&2; \
+	  echo "       release it vendors, then move RELEASE and CR_SHA256 to it." >&2; \
+	  exit 1; \
+	fi
+	@echo "upstream cdi-cr.yaml for $(RELEASE) matches the pin; templates/cdi-cr.yaml is maintained by hand and was left alone."
@@ -0,0 +1,148 @@
+suite: cozy-kubevirt-cdi local templates
+release:
+  name: kubevirt-cdi
+  namespace: cozy-kubevirt-cdi
+# Both route cases run against this block; the TLSRoute case overrides the
+# gate alone. Emission is gated on expose-services and gateway-enabled, so
+# without a matching expose-services entry neither route renders and both
+# fail on "no manifest found" rather than on the assertion they are about.
+# root-host is not part of that gate and no assertion reads it: it is set
+# because the hostname is built from it, and without it the TLSRoute renders
+# "cdi-uploadproxy.%!s(<nil>)". tests/standalone_render_test.yaml covers the
+# opposite case, that the chart renders with nothing injected at all.
+set:
+  _cluster:
+    root-host: example.com
+    expose-services: cdi-uploadproxy
+    gateway-enabled: "false"
+tests:
+  # Each list and map is pinned whole rather than by membership or by leaf:
+  # `contains` answers "is ours still here" and cannot answer "has anything
+  # been added beside it", and an assert per leaf cannot answer "has a key
+  # appeared". Both directions matter for a file whose whole maintenance model
+  # is a hand reconciliation at each bump. Pinning featureGates whole also
+  # pins HonorWaitForFirstConsumer, which is upstream's rather than ours; that
+  # is a side effect of the shape, not a claim that the upstream half is
+  # covered.
+  - it: keeps the local additions to the CDI object
+    template: cdi-cr.yaml
+    documentSelector:
+      path: kind
+      value: CDI
+      matchMany: false
+    asserts:
+      - equal:
+          path: spec.config.featureGates
+          value:
+            - HonorWaitForFirstConsumer
+            - ExpandDisks
+      - equal:
+          path: spec.infra.tolerations
+          value:
+            - key: CriticalAddonsOnly
+              operator: Exists
+      - equal:
+          path: spec.config.podResourceRequirements
+          value:
+            limits:
+              cpu: 750m
+              memory: 600M
+            requests:
+              cpu: 100m
+              memory: 60M
+
+  # The default is the empty string, so the block renders nothing and an
+  # assertion on the default value would pass against a template that had
+  # stopped rendering the block. Setting it is what makes this able to fail.
+  - it: renders the upload-proxy URL override when one is set
+    template: cdi-cr.yaml
+    documentSelector:
+      path: kind
+      value: CDI
+      matchMany: false
+    set:
+      uploadProxyURL: https://cdi-uploadproxy.example.com
+    asserts:
+      - equal:
+          path: spec.config.uploadProxyURLOverride
+          value: https://cdi-uploadproxy.example.com
+
+  # What lets a tenant service account clone from the golden-image namespace.
+  # `any: true` on both: a bare containsDocument holds every document in the
+  # template to the match, and this template renders three.
+  - it: keeps the golden-image clone RBAC
+    template: cdi-cr.yaml
+    asserts:
+      - containsDocument:
+          apiVersion: rbac.authorization.k8s.io/v1
+          kind: ClusterRole
+          name: cdi-copy-dv
+          any: true
+      - containsDocument:
+          apiVersion: rbac.authorization.k8s.io/v1
+          kind: RoleBinding
+          name: cdi-clone-dv
+          namespace: cozy-public
+          any: true
+
+  # containsDocument reaches this document's identity and nothing inside it,
+  # so what the role grants needs a case of its own. Widening verbs to ["*"]
+  # hands every service account in the cluster whatever the binding reaches.
+  - it: grants create on datavolumes/source and nothing else
+    template: cdi-cr.yaml
+    documentSelector:
+      path: metadata.name
+      value: cdi-copy-dv
+    asserts:
+      - equal:
+          path: rules
+          value:
+            - apiGroups:
+                - cdi.kubevirt.io
+              resources:
+                - datavolumes/source
+              verbs:
+                - create
+
+  # roleRef and subjects decide who may clone out of cozy-public, so each is
+  # pinned whole rather than field by field. An assert on subjects[0] answers
+  # "was the Group replaced by something narrower" and cannot answer "was a
+  # second subject appended", and appending is the direction that widens
+  # access: pinning the list is what makes both reachable.
+  - it: binds exactly the service-account Group to the copy role
+    template: cdi-cr.yaml
+    documentSelector:
+      path: metadata.name
+      value: cdi-clone-dv
+    asserts:
+      - equal:
+          path: roleRef
+          value:
+            kind: ClusterRole
+            name: cdi-copy-dv
+            apiGroup: rbac.authorization.k8s.io
+      - equal:
+          path: subjects
+          value:
+            - kind: Group
+              name: system:serviceaccounts
+              apiGroup: rbac.authorization.k8s.io
+
+  # Addressed as a `template:` because helm-unittest fails outright on one it
+  # cannot find, which makes a deleted file loud rather than a smaller render.
+  - it: renders the upload-proxy Ingress when the gateway is off
+    template: cdi-uploadproxy-ingress.yaml
+    asserts:
+      - equal:
+          path: metadata.annotations["nginx.ingress.kubernetes.io/ssl-passthrough"]
+          value: "true"
+
+  - it: renders the upload-proxy TLSRoute when the gateway is on
+    template: cdi-uploadproxy-tlsroute.yaml
+    set:
+      _cluster:
+        gateway-enabled: "true"
+    asserts:
+      - equal:
+          path: spec.parentRefs[0].sectionName
+          value: tls-cdi-uploadproxy
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	+# `update` fetches here to check the pin, and keeps the file on a mismatch.
	`2`	`+# The recipe's error text says why.`
	`3`	`+/cdi-cr.yaml.download`