Skip to content

Commit b9222c7

Browse files
myasnikovdaniilmyasnikovdaniil
committed
refactor(kubernetes): drop unused helpers and correct stale comments
kubernetes.fullname, its fullnameOverride read, kubernetes.positiveDuration and the Bitnami resources.preset in _resources.tpl have no caller: the first is a helm-create leftover, the duration check moved with the worker pools to the kubernetes-nodes chart, which carries its own copy because a named template does not cross releases, and resource presets come from cozy-lib. A reader who finds them assumes they are in use. The template and test comments described the pre-split chart: phases of a rollout, worker objects at document indices this chart no longer renders, cross-references to files that live in the other chart, and a claim that the cluster CIDRs are kept in one place while the pool chart and the CoreDNS release carry copies. Only Helm comments and test comments change; the chart renders the same bytes for its test values, and the pinned bootstrap-token Job hash is unchanged. Assisted-by: LLM Signed-off-by: Myasnikov Daniil <[email protected]>
1 parent fb8a7ef commit b9222c7

11 files changed

Lines changed: 36 additions & 126 deletions

File tree

‎packages/apps/kubernetes/templates/_helpers.tpl‎

Lines changed: 0 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -5,24 +5,6 @@ Expand the name of the chart.
55
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
66
{{- end }}
77

8-
{{/*
9-
Create a default fully qualified app name.
10-
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11-
If release name contains chart name it will be used as a full name.
12-
*/}}
13-
{{- define "kubernetes.fullname" -}}
14-
{{- if .Values.fullnameOverride }}
15-
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16-
{{- else }}
17-
{{- $name := default .Chart.Name .Values.nameOverride }}
18-
{{- if contains $name .Release.Name }}
19-
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20-
{{- else }}
21-
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22-
{{- end }}
23-
{{- end }}
24-
{{- end }}
25-
268
{{/*
279
Create chart name and version as used by the chart label.
2810
*/}}
@@ -185,29 +167,6 @@ never boots.
185167
{{- printf "has(claims.groups) && dyn(claims.groups).exists(g, g in [\"%s-view\", \"%s-use\", \"%s-admin\", \"%s-super-admin\"])" $ns $ns $ns $ns -}}
186168
{{- end }}
187169

188-
{{- /*
189-
Validates and returns a duration destined for a consumer that does not reject
190-
a bad value: the cluster-autoscaler parses its annotation with
191-
time.ParseDuration and silently falls back to its built-in default on a value
192-
it cannot parse, and the CAPI webhook does not validate unhealthyConditions
193-
timeouts at all, so a zero or negative one applies and remediates a Machine the
194-
moment its condition flips. The values schema types these fields as strings and
195-
stops there, which lets "30" and "-5m" reach the template. The accepted shape
196-
is narrower than Go's duration grammar on purpose, because that grammar also
197-
admits a value large enough to overflow the parser -- the silent fallback again
198-
-- and a fraction small enough to round to zero. The first segment must be
199-
positive; later segments may be zero, so the canonical rendering of a duration
200-
("20m0s", "1h0m0s" -- what metav1.Duration serializes to) round-trips. Every
201-
string this admits parses to a positive duration.
202-
*/ -}}
203-
{{- define "kubernetes.positiveDuration" -}}
204-
{{- $value := toString .value -}}
205-
{{- if not (regexMatch "^[1-9][0-9]{0,4}[smh]([0-9]{1,5}[smh]){0,2}$" $value) -}}
206-
{{- fail (printf "%s must be a whole number of s, m or h (e.g. 30m, 1h30m), got %q" .field $value) -}}
207-
{{- end -}}
208-
{{- $value -}}
209-
{{- end -}}
210-
211170
{{/*
212171
The two kube-apiserver flags the tenant control plane owns that have a
213172
KamajiControlPlane field it renders them from, keyed to that field.

‎packages/apps/kubernetes/templates/_resources.tpl‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎packages/apps/kubernetes/templates/cluster.yaml‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -40,20 +40,23 @@
4040
*/}}
4141
{{- /* Worker node pools (KubevirtMachineTemplate, MachineDeployment,
4242
MachineHealthCheck, worker WorkloadMonitor) and the Talos
43-
reconcile Job that produces each pool's TalosConfigTemplate now
44-
live in the separate `kubernetes-nodes` chart (one HelmRelease
45-
per pool). This chart renders the control plane only. The
46-
reconcile Job in the kubernetes-nodes release still re-patches
47-
this KamajiControlPlane's apiserver-Service ClusterIP-SAN and
48-
owns each TalosConfigTemplate via an ownerReference to this KCP,
49-
so garbage collection on control-plane uninstall is unchanged. */}}
43+
reconcile Job that produces each pool's TalosConfigTemplate are
44+
rendered by the `kubernetes-nodes` chart (one HelmRelease per
45+
pool). This chart renders the control plane only. The reconcile
46+
Job in the kubernetes-nodes release re-patches this
47+
KamajiControlPlane's apiserver-Service ClusterIP-SAN and owns
48+
each TalosConfigTemplate via an ownerReference to this KCP, so
49+
uninstalling the control plane garbage-collects them. */}}
5050
{{- /*
5151
Cluster pod/service CIDRs MUST match between the CAPI Cluster
5252
spec.clusterNetwork below and the Talos worker machineconfig's
5353
cluster.network — Talos surfaces overlaps against the host pod CIDR
5454
as a diagnostic at boot, and divergence between CAPI and Talos would
55-
manifest as silently broken kube-proxy / Cilium routing. Keep them
56-
in one place here.
55+
manifest as silently broken kube-proxy / Cilium routing. The worker
56+
side is a copy of these two literals in
57+
packages/apps/kubernetes-nodes/templates/_talosconfigtemplate.tpl, and
58+
templates/helmreleases/coredns.yaml pins the DNS Service IP inside the
59+
service CIDR, so a change here is a change in all three places.
5760
*/}}
5861
{{- $podCIDR := "10.243.0.0/16" }}
5962
{{- $serviceCIDR := "10.95.0.0/16" }}
@@ -78,7 +81,7 @@ data:
7881
to reconcile - this HelmRelease will pick up the DataStore on its next
7982
5m reconcile loop and provision the cluster.
8083
{{- else }}
81-
{{- /* Phase 2 worker-pool adoption guard. Worker pools now live in per-pool
84+
{{- /* Worker-pool adoption guard. Worker pools live in per-pool
8285
kubernetes-nodes releases; the platform migration adopts each pre-split
8386
pool's live objects onto its child release (re-annotating
8487
meta.helm.sh/release-name, pinning helm.sh/resource-policy=keep) as a

‎packages/apps/kubernetes/templates/helmreleases/ingress-nginx.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,8 @@ ingress-nginx:
2323
{{- if and .Values.addons.ingressNginx.enabled .Values._namespace.etcd }}
2424
{{- /* The ingress-nginx controller DaemonSet pins itself to nodes labelled
2525
node-role.kubernetes.io/ingress-nginx (see cozystack.defaultIngressValues
26-
nodeSelector). Since Phase 2 moved worker pools into the separate
27-
kubernetes-nodes chart, that label is produced by a KubernetesNodes pool
28-
with roles: [ingress-nginx]. If no such pool exists the DaemonSet simply
26+
nodeSelector). That label is produced by a KubernetesNodes pool with
27+
roles: [ingress-nginx]. If no such pool exists the DaemonSet simply
2928
schedules nothing (degraded, not failed) — the requirement is documented
3029
in NOTES.txt and the release note rather than enforced at render time, so
3130
an existing cluster is never flipped from Ready to Failed on upgrade. */}}

‎packages/apps/kubernetes/templates/oidc-authn-config.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
/etc/kubernetes/authentication-config/config.yaml and consumed via
77
--authentication-config=. Compared to the legacy `--oidc-*` flags,
88
the file form supports multiple issuers (the `jwt` block is a list)
9-
and inline private-CA PEM, so future BYO and Phase-2 issuers extend
10-
the same Secret instead of fighting the chart shape.
9+
and inline private-CA PEM, so further issuers extend the same Secret
10+
instead of fighting the chart shape.
1111

1212
System mode:
1313
Single JWT entry built from `_cluster.root-host` (the cozy realm

‎packages/apps/kubernetes/templates/oidc-keycloak.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- /*
2-
Phase 1 — System mode: render one per-cluster Keycloak client and a
2+
System mode: render one per-cluster Keycloak client and a
33
per-cluster audience client scope inside the platform `cozy` realm.
44

55
The clientId is namespace-prefixed so it is globally unique across the

‎packages/apps/kubernetes/templates/talos/bootstrap-token-tenant-job.yaml‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,9 @@
88
kube-system, which the management cluster can only reach via the
99
Kamaji-issued admin kubeconfig stored as <release>-admin-kubeconfig.
1010

11-
Why a main-phase resource and not a Helm post-install/post-upgrade hook
12-
(the earlier shape): the hook is unreliable on the very failure it was
13-
meant to cover. This release carries
14-
release.cozystack.io/helm-install-disable-wait: "true" (cozystack-api
11+
Why a main-phase resource and not a Helm post-install/post-upgrade hook:
12+
the hook is unreliable on the very failure it was meant to cover. This
13+
release carries release.cozystack.io/helm-install-disable-wait: "true" (cozystack-api
1514
sets it on both Install.DisableWait and Upgrade.DisableWait), so there
1615
is NO main-resource wait phase in front of the hooks — a post-install
1716
hook is not gated on MachineDeployment Ready and does fire on a fresh
@@ -25,9 +24,9 @@
2524
<release>-admin-kubeconfig (materialised by Kamaji after the
2625
KamajiControlPlane is applied) is not yet available.
2726

28-
As an ordinary main-phase resource (mirroring talos-reconcile-job.yaml)
29-
the Job is applied on every install and every reconcile regardless of
30-
hook phase. It lands together with the KamajiControlPlane and
27+
As an ordinary main-phase resource (like talos-reconcile-job.yaml in the
28+
kubernetes-nodes chart) the Job is applied on every install and every
29+
reconcile regardless of hook phase. It lands together with the KamajiControlPlane and
3130
talos-secrets; a wait-for-kubeconfig init container holds the Pod until
3231
Kamaji publishes the admin kubeconfig Secret (the Secret volume is
3332
optional so kubelet does not FailedMount in the meantime), then the
@@ -40,9 +39,9 @@
4039
upgrade that lands while the Job is live (or inside
4140
ttlSecondsAfterFinished) with `spec.template: field is immutable`, and
4241
RetryOnFailure would loop on it. The Job therefore carries a
43-
content-hash name suffix over its whole rendered spec (mirrors
44-
talos-reconcile-job.yaml and the KubevirtMachineTemplate idiom in
45-
cluster.yaml): an identical render keeps the name and Helm no-ops it;
42+
content-hash name suffix over its whole rendered spec (the idiom of
43+
talos-reconcile-job.yaml and the KubevirtMachineTemplate name in the
44+
kubernetes-nodes chart): an identical render keeps the name and Helm no-ops it;
4645
any change that flows into the spec — notably a new images/kubectl.tag —
4746
yields a new name so a fresh Job runs and Helm prunes the old one. The
4847
hash also folds in the looked-up bootstrap token — both halves,

‎packages/apps/kubernetes/tests/control_plane_only_test.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
suite: control-plane-only cluster.yaml render (worker pools moved to kubernetes-nodes)
1+
suite: control-plane-only cluster.yaml render (worker pools are kubernetes-nodes releases)
22

3-
# Phase 2 moved the worker node pools (KubevirtMachineTemplate, MachineDeployment,
3+
# The worker node pools (KubevirtMachineTemplate, MachineDeployment,
44
# MachineHealthCheck, worker WorkloadMonitor) and the per-pool talos-reconcile Job
5-
# into the separate kubernetes-nodes chart. cluster.yaml now renders the control
5+
# are rendered by the kubernetes-nodes chart. cluster.yaml renders the control
66
# plane only, in source order: Cluster (0), KamajiControlPlane (1), the
77
# control-plane WorkloadMonitor (2), KubevirtCluster (3). This suite pins that
88
# surface so a regression that re-introduces pool objects into the parent chart

‎packages/apps/kubernetes/tests/oidc_test.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
1-
suite: tenant kube-apiserver OIDC (Phase 1)
1+
suite: tenant kube-apiserver OIDC
22

33
values:
44
- values/common.yaml
55

66
# In cluster.yaml the KamajiControlPlane is document index 1
7-
# (0: Cluster, 1: KamajiControlPlane, 2: WorkloadMonitor, 3: KubevirtCluster, ...).
8-
# Documents at higher indices are KubevirtMachineTemplate, MachineDeployment,
9-
# MachineHealthCheck, WorkloadMonitor per node group.
7+
# (0: Cluster, 1: KamajiControlPlane, 2: WorkloadMonitor, 3: KubevirtCluster);
8+
# tests/control_plane_only_test.yaml pins that there are no others.
109

1110
tests:
1211
###############################################

‎packages/apps/kubernetes/tests/values/common.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ controlPlane:
1919
server:
2020
resources: {}
2121
resourcesPreset: "micro"
22-
# Worker pools are managed via KubernetesNodes resources since the Phase 2 split;
23-
# the kubernetes chart renders the control plane only.
22+
# Worker pools are KubernetesNodes resources; the kubernetes chart renders the
23+
# control plane only.

0 commit comments

Comments
 (0)