Skip to content

HYPERFLEET-1108 - feat: Add e2e.hyperfleet.io/run-id label for e2e-gcp environment, label resources created by adapters #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mliptak0 wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

HYPERFLEET-1108 - feat: Add e2e.hyperfleet.io/run-id label for e2e-gcp environment, label resources created by adapters #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,7 +292,7 @@ check-jq: ## Verify jq is installed
@echo "OK: jq found"

.PHONY: check-helmfile-env
check-helmfile-env: check-helmfile check-kubectl-context check-helmfile-env-generated ## Verify kubectl context and generated values directory exists
check-helmfile-env: check-helmfile check-kubectl-context check-helmfile-env-generated check-e2e-run-id ## Verify kubectl context and generated values directory exists

.PHONY: check-helmfile-env-generated
check-helmfile-env-generated: ## Check that the generated directory exists based on HELMFILE_ENV
Expand All @@ -315,6 +315,17 @@ check-kubectl-context: check-kubectl ## Verify kubectl context matches HELMFILE_
echo "OK: kubectl context matches HELMFILE_ENV=$(HELMFILE_ENV)"; \
fi;

.PHONY: check-e2e-run-id
check-e2e-run-id: ## Verify E2E_RUN_ID is set for e2e-gcp environment
@if [ "$(HELMFILE_ENV)" = "e2e-gcp" ]; then \
if [ -z "$(E2E_RUN_ID)" ]; then \
echo "ERROR: E2E_RUN_ID must be set when HELMFILE_ENV=e2e-gcp"; \
echo " Usage: E2E_RUN_ID=<run-id> make install-hyperfleet"; \
exit 1; \
fi; \
echo "OK: E2E_RUN_ID=$(E2E_RUN_ID)"; \
fi;
Comment on lines +320 to +327

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Enforce Kubernetes label-value validation for E2E_RUN_ID (CWE-20).

Current check only rejects empty values. Invalid label values (illegal chars/length) still pass here and fail later when applied as metadata.labels.

Suggested fix 
 check-e2e-run-id: ## Verify E2E_RUN_ID is set for e2e-gcp environment
 	`@if` [ "$(HELMFILE_ENV)" = "e2e-gcp" ]; then \
 		if [ -z "$(E2E_RUN_ID)" ]; then \
 			echo "ERROR: E2E_RUN_ID must be set when HELMFILE_ENV=e2e-gcp"; \
 			echo "       Usage: E2E_RUN_ID=<run-id> make install-hyperfleet"; \
 			exit 1; \
 		fi; \
+		if ! printf '%s' "$(E2E_RUN_ID)" | grep -Eq '^[A-Za-z0-9]([A-Za-z0-9._-]{0,61}[A-Za-z0-9])?$$'; then \
+			echo "ERROR: E2E_RUN_ID must be a valid Kubernetes label value (1-63 chars, alnum boundaries, [A-Za-z0-9._-] allowed)"; \
+			exit 1; \
+		fi; \
 		echo "OK: E2E_RUN_ID=$(E2E_RUN_ID)"; \
 	fi;

As per path instructions, "Validate input at system boundaries (HTTP handlers, CLI parsers, webhook receivers)."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@if [ "$(HELMFILE_ENV)" = "e2e-gcp" ]; then \
if [ -z "$(E2E_RUN_ID)" ]; then \
echo "ERROR: E2E_RUN_ID must be set when HELMFILE_ENV=e2e-gcp"; \
echo " Usage: E2E_RUN_ID=<run-id> make install-hyperfleet"; \
exit 1; \
fi; \
echo "OK: E2E_RUN_ID=$(E2E_RUN_ID)"; \
fi;
`@if` [ "$(HELMFILE_ENV)" = "e2e-gcp" ]; then \
if [ -z "$(E2E_RUN_ID)" ]; then \
echo "ERROR: E2E_RUN_ID must be set when HELMFILE_ENV=e2e-gcp"; \
echo " Usage: E2E_RUN_ID=<run-id> make install-hyperfleet"; \
exit 1; \
fi; \
if ! printf '%s' "$(E2E_RUN_ID)" | grep -Eq '^[A-Za-z0-9]([A-Za-z0-9._-]{0,61}[A-Za-z0-9])?$$'; then \
echo "ERROR: E2E_RUN_ID must be a valid Kubernetes label value (1-63 chars, alnum boundaries, [A-Za-z0-9._-] allowed)"; \
exit 1; \
fi; \
echo "OK: E2E_RUN_ID=$(E2E_RUN_ID)"; \
fi;
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Makefile` around lines 320 - 327, The E2E_RUN_ID check in the Makefile only
blocks empty values, but it should also reject strings that are not valid
Kubernetes label values before they reach metadata.labels. Update the
install-hyperfleet validation block to verify E2E_RUN_ID against Kubernetes
label-value rules (allowed characters, length, and format) in addition to the
existing non-empty check, and fail fast with a clear error message when invalid.
Keep the logic in the same HELMFILE_ENV=e2e-gcp guard so the validation happens
at the system boundary before any Helm/Kubernetes apply step.

Source: Path instructions


.PHONY: check-terraform
check-terraform: ## Verify terraform is installed
@command -v terraform >/dev/null 2>&1 || { echo "ERROR: terraform is not installed"; exit 1; }
Expand Down
4 changes: 4 additions & 0 deletions helmfile/configs/e2e/adapters/cl-deployment/adapter-task-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ params:
source: "event.id"
type: "string"
required: true
- name: "e2eRunId"
source: "env.E2E_RUN_ID"
type: "string"
required: false
Comment on lines +9 to +12

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Enforce label-safe validation for E2E_RUN_ID before templating.

e2eRunId is sourced from env and later stamped into Kubernetes labels. Current gating only checks non-empty, so invalid characters can break manifests or inject malformed YAML/labels (CWE-20, CWE-74). Add strict label-value regex validation at the boundary.

As per path instructions, “Validate input at system boundaries (HTTP handlers, CLI parsers, webhook receivers).”

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@helmfile/configs/e2e/adapters/cl-deployment/adapter-task-config.yaml` around
lines 9 - 12, The e2eRunId input is only checked for non-empty, but it is later
used as a Kubernetes label value, so invalid characters can still reach
templating. Update the boundary handling for the e2eRunId mapping sourced from
env.E2E_RUN_ID to enforce a strict label-safe regex before it is rendered or
stamped into manifests. Keep the validation close to the adapter-task-config
input definition so invalid values are rejected early and cannot flow into label
generation.

Source: Path instructions


# Preconditions with valid operators and CEL expressions
preconditions:
Expand Down
2 changes: 2 additions & 0 deletions helmfile/configs/e2e/adapters/cl-deployment/adapter-task-resource-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ metadata:
labels:
hyperfleet.io/cluster-id: "{{ .clusterId }}"
hyperfleet.io/resource-type: "deployment"
e2e.hyperfleet.io/run-id: "{{ .e2eRunId }}"
annotations:
hyperfleet.io/generation: "{{ .generationSpec }}"
spec:
Expand All @@ -20,6 +21,7 @@ spec:
labels:
app: test
hyperfleet.io/cluster-id: "{{ .clusterId }}"
e2e.hyperfleet.io/run-id: "{{ .e2eRunId }}"
spec:
containers:
- name: test
Expand Down
4 changes: 4 additions & 0 deletions helmfile/configs/e2e/adapters/cl-job/adapter-task-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ params:
source: "event.id"
type: "string"
required: true
- name: "e2eRunId"
source: "env.E2E_RUN_ID"
type: "string"
required: false

# Preconditions with valid operators and CEL expressions
preconditions:
Expand Down
26 changes: 15 additions & 11 deletions helmfile/configs/e2e/adapters/cl-job/adapter-task-resource-job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,22 +8,26 @@ metadata:
hyperfleet.io/cluster-id: "{{ .clusterId }}"
hyperfleet.io/resource-type: "job"
app: test-job
e2e.hyperfleet.io/run-id: "{{ .e2eRunId }}"
annotations:
hyperfleet.io/generation: "{{ .generationSpec }}"
spec:
backoffLimit: 0
template:
metadata:
labels:
e2e.hyperfleet.io/run-id: "{{ .e2eRunId }}"
spec:
restartPolicy: Never
containers:
- name: hello-world
image: alpine:3.19
imagePullPolicy: IfNotPresent
command: ["/bin/sh", "-c", "echo 'Hello, World!'"]
resources:
requests:
memory: "32Mi"
cpu: "50m"
limits:
memory: "64Mi"
cpu: "100m"
- name: hello-world
image: alpine:3.19
imagePullPolicy: IfNotPresent
command: ["/bin/sh", "-c", "echo 'Hello, World!'"]
resources:
requests:
memory: "32Mi"
cpu: "50m"
limits:
memory: "64Mi"
cpu: "100m"
5 changes: 5 additions & 0 deletions helmfile/configs/e2e/adapters/cl-maestro/adapter-task-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@ params:
source: "env.NAMESPACE"
type: "string"

- name: "e2eRunId"
source: "env.E2E_RUN_ID"
type: "string"
required: false

# Preconditions with valid operators and CEL expressions
preconditions:
- name: "clusterStatus"
Expand Down
203 changes: 103 additions & 100 deletions helmfile/configs/e2e/adapters/cl-maestro/adapter-task-resource-manifestwork.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ metadata:
hyperfleet.io/component: "infrastructure"
hyperfleet.io/generation: "{{ .generation }}"
hyperfleet.io/resource-group: "cluster-setup"
e2e.hyperfleet.io/run-id: "{{ .e2eRunId }}"

# Maestro-specific labels
maestro.io/source-id: "{{ .adapter.name }}"
Expand All @@ -27,26 +28,26 @@ metadata:
app.kubernetes.io/part-of: "hyperfleet"
app.kubernetes.io/managed-by: "cl-maestro"
app.kubernetes.io/created-by: "{{ .adapter.name }}"
{{ if .platformType }}
hyperfleet.io/platform-type: "{{ .platformType }}"
{{ end }}
{{ if .platformType }}
hyperfleet.io/platform-type: "{{ .platformType }}"
{{ end }}

# Annotations for metadata and operational information
annotations:
# Tracking and lifecycle
hyperfleet.io/created-by: "cl-maestro-framework"
hyperfleet.io/managed-by: "{{ .adapter.name }}"
hyperfleet.io/generation: "{{ .generation }}"
hyperfleet.io/cluster-id: "{{ .clusterId }}"
hyperfleet.io/cluster-name: "{{ .clusterName }}"
hyperfleet.io/deployment-time: "{{ .timestamp }}"
# Annotations for metadata and operational information
annotations:
# Tracking and lifecycle
hyperfleet.io/created-by: "cl-maestro-framework"
hyperfleet.io/managed-by: "{{ .adapter.name }}"
hyperfleet.io/generation: "{{ .generation }}"
hyperfleet.io/cluster-id: "{{ .clusterId }}"
hyperfleet.io/cluster-name: "{{ .clusterName }}"
hyperfleet.io/deployment-time: "{{ .timestamp }}"

# Maestro-specific annotations
maestro.io/applied-time: "{{ .timestamp }}"
maestro.io/source-adapter: "{{ .adapter.name }}"
# Maestro-specific annotations
maestro.io/applied-time: "{{ .timestamp }}"
maestro.io/source-adapter: "{{ .adapter.name }}"

# Documentation
description: "Complete cluster setup including namespace, configuration, and RBAC"
# Documentation
description: "Complete cluster setup including namespace, configuration, and RBAC"
Comment on lines +31 to +50

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file='helmfile/configs/e2e/adapters/cl-maestro/adapter-task-resource-manifestwork.yaml'

echo "== outline =="
ast-grep outline "$file" --view expanded || true

echo
echo "== numbered excerpt (1-220) =="
cat -n "$file" | sed -n '1,220p'

Repository: openshift-hyperfleet/hyperfleet-infra

Length of output: 7552

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file='helmfile/configs/e2e/adapters/cl-maestro/adapter-task-resource-manifestwork.yaml'

echo "== outline =="
ast-grep outline "$file" --view expanded || true

echo
echo "== numbered excerpt (1-220) =="
cat -n "$file" | sed -n '1,220p'

Repository: openshift-hyperfleet/hyperfleet-infra

Length of output: 7552

Fix the YAML indentation regression

hyperfleet.io/platform-type, annotations, the ConfigMap data conditionals, and the ConfigMap metadata block are dedented out of their parent mappings, so the template now renders invalid YAML and the manifest can’t be parsed (CWE-20). Also applies to 77-99.

🧰 Tools
🪛 YAMLlint (1.37.1)

[error] 32-32: syntax error: could not find expected ':'

(syntax)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@helmfile/configs/e2e/adapters/cl-maestro/adapter-task-resource-manifestwork.yaml`
around lines 31 - 50, The YAML template in the manifestwork adapter has an
indentation regression that breaks the parent mappings and produces invalid
YAML. Re-indent the `hyperfleet.io/platform-type` conditional, the `annotations`
block, the ConfigMap `data` conditionals, and the ConfigMap `metadata` block so
they remain nested under the correct `metadata`/resource sections in this
template. Use the surrounding manifest structure in
`adapter-task-resource-manifestwork.yaml` to keep the `annotations`, `data`, and
`metadata` keys aligned with their parent objects.

Source: Linters/SAST tools


# ManifestWork specification
spec:
Expand All @@ -56,89 +57,91 @@ spec:
workload:
# Kubernetes manifests array - injected by framework from business logic config
manifests:
- apiVersion: v1
kind: Namespace
metadata:
name: "{{ .clusterId | lower }}-{{ .adapter.name }}-namespace"
labels:
app.kubernetes.io/component: adapter-task-config
app.kubernetes.io/instance: "{{ .adapter.name }}"
app.kubernetes.io/name: cl-maestro
app.kubernetes.io/transport: maestro
annotations:
hyperfleet.io/generation: "{{ .generation }}"
- apiVersion: v1
kind: ConfigMap
data:
cluster_id: "{{ .clusterId }}"
cluster_name: "{{ .clusterName }}"
{{ if eq .platformType "gcp" }}
platform_tier: "cloud"
{{ else }}
platform_tier: "onprem"
{{ end }}
{{ range $i, $subnet := .subnets }}
subnet_{{ $subnet.id }}_name: "{{ $subnet.name }}"
subnet_{{ $subnet.id }}_cidr: "{{ $subnet.cidr }}"
subnet_{{ $subnet.id }}_role: "{{ $subnet.role }}"
{{ end }}
metadata:
name: "{{ .clusterId | lower }}-{{ .adapter.name }}-configmap"
namespace: "{{ .clusterId | lower }}-{{ .adapter.name }}-namespace"
labels:
app.kubernetes.io/component: adapter-task-config
app.kubernetes.io/instance: "{{ .adapter.name }}"
app.kubernetes.io/name: cl-maestro
app.kubernetes.io/version: 1.0.0
app.kubernetes.io/transport: maestro
annotations:
hyperfleet.io/generation: "{{ .generation }}"
- apiVersion: v1
kind: Namespace
metadata:
name: "{{ .clusterId | lower }}-{{ .adapter.name }}-namespace"
labels:
app.kubernetes.io/component: adapter-task-config
app.kubernetes.io/instance: "{{ .adapter.name }}"
app.kubernetes.io/name: cl-maestro
app.kubernetes.io/transport: maestro
e2e.hyperfleet.io/run-id: "{{ .e2eRunId }}"
annotations:
hyperfleet.io/generation: "{{ .generation }}"
- apiVersion: v1
kind: ConfigMap
data:
cluster_id: "{{ .clusterId }}"
cluster_name: "{{ .clusterName }}"
{{ if eq .platformType "gcp" }}
platform_tier: "cloud"
{{ else }}
platform_tier: "onprem"
{{ end }}
{{ range $i, $subnet := .subnets }}
subnet_{{ $subnet.id }}_name: "{{ $subnet.name }}"
subnet_{{ $subnet.id }}_cidr: "{{ $subnet.cidr }}"
subnet_{{ $subnet.id }}_role: "{{ $subnet.role }}"
{{ end }}
metadata:
name: "{{ .clusterId | lower }}-{{ .adapter.name }}-configmap"
namespace: "{{ .clusterId | lower }}-{{ .adapter.name }}-namespace"
labels:
app.kubernetes.io/component: adapter-task-config
app.kubernetes.io/instance: "{{ .adapter.name }}"
app.kubernetes.io/name: cl-maestro
app.kubernetes.io/version: 1.0.0
app.kubernetes.io/transport: maestro
e2e.hyperfleet.io/run-id: "{{ .e2eRunId }}"
annotations:
hyperfleet.io/generation: "{{ .generation }}"

# ============================================================================
# Delete Options - How resources should be removed
# ============================================================================
deleteOption:
# Propagation policy for resource deletion
# - "Foreground": Wait for dependent resources to be deleted first
# - "Background": Delete immediately, let cluster handle dependents
# - "Orphan": Leave resources on cluster when ManifestWork is deleted
propagationPolicy: "Foreground"
# ============================================================================
# Delete Options - How resources should be removed
# ============================================================================
deleteOption:
# Propagation policy for resource deletion
# - "Foreground": Wait for dependent resources to be deleted first
# - "Background": Delete immediately, let cluster handle dependents
# - "Orphan": Leave resources on cluster when ManifestWork is deleted
propagationPolicy: "Foreground"

# Grace period for graceful deletion (seconds)
gracePeriodSeconds: 30
# Grace period for graceful deletion (seconds)
gracePeriodSeconds: 30

# ============================================================================
# Manifest Configurations - Per-resource settings for update and feedback
# ============================================================================
manifestConfigs:
- resourceIdentifier:
group: "" # Core API group (empty for v1 resources)
resource: "namespaces" # Resource type
name: "{{ .clusterId | lower }}-{{ .adapter.name }}-namespace" # Specific resource name
updateStrategy:
type: "ServerSideApply" # Use server-side apply for namespaces
feedbackRules:
- type: "JSONPaths" # Use JSON path expressions for status feedback
jsonPaths:
- name: "phase"
path: ".status.phase"
# ========================================================================
# Configuration for ConfigMap resources
# ========================================================================
- resourceIdentifier:
group: "" # Core API group (empty for v1 resources)
resource: "configmaps" # Resource type
name: "{{ .clusterId | lower }}-{{ .adapter.name }}-configmap" # Specific resource name
namespace: "{{ .clusterId | lower }}-{{ .adapter.name }}-namespace"
updateStrategy:
type: "ServerSideApply" # Use server-side apply for namespaces
serverSideApply:
fieldManager: "cl-maestro" # Field manager name for conflict resolution
force: false # Don't force conflicts (fail on conflicts)
feedbackRules:
- type: "JSONPaths" # Use JSON path expressions for status feedback
jsonPaths:
- name: "data"
path: ".data"
- name: "resourceVersion"
path: ".metadata.resourceVersion"
# ============================================================================
# Manifest Configurations - Per-resource settings for update and feedback
# ============================================================================
manifestConfigs:
- resourceIdentifier:
group: "" # Core API group (empty for v1 resources)
resource: "namespaces" # Resource type
name: "{{ .clusterId | lower }}-{{ .adapter.name }}-namespace" # Specific resource name
updateStrategy:
type: "ServerSideApply" # Use server-side apply for namespaces
feedbackRules:
- type: "JSONPaths" # Use JSON path expressions for status feedback
jsonPaths:
- name: "phase"
path: ".status.phase"
# ========================================================================
# Configuration for ConfigMap resources
# ========================================================================
- resourceIdentifier:
group: "" # Core API group (empty for v1 resources)
resource: "configmaps" # Resource type
name: "{{ .clusterId | lower }}-{{ .adapter.name }}-configmap" # Specific resource name
namespace: "{{ .clusterId | lower }}-{{ .adapter.name }}-namespace"
updateStrategy:
type: "ServerSideApply" # Use server-side apply for namespaces
serverSideApply:
fieldManager: "cl-maestro" # Field manager name for conflict resolution
force: false # Don't force conflicts (fail on conflicts)
feedbackRules:
- type: "JSONPaths" # Use JSON path expressions for status feedback
jsonPaths:
- name: "data"
path: ".data"
- name: "resourceVersion"
path: ".metadata.resourceVersion"
7 changes: 3 additions & 4 deletions helmfile/configs/e2e/adapters/cl-namespace/adapter-task-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,10 @@ params:
source: "event.id"
type: "string"
required: true
- name: "testRunId"
source: "env.TEST_RUN_ID"
- name: "e2eRunId"
source: "env.E2E_RUN_ID"
type: "string"
required: false
default: "TEST_RUN_ID"
- name: "ci"
source: "env.CI"
type: "string"
Expand Down Expand Up @@ -64,7 +63,7 @@ resources:
labels:
hyperfleet.io/cluster-id: "{{ .clusterId }}"
hyperfleet.io/cluster-name: "{{ .clusterName }}"
e2e.hyperfleet.io/test-run-id: "{{ .testRunId }}"
e2e.hyperfleet.io/run-id: "{{ .e2eRunId }}"
e2e.hyperfleet.io/ci: "{{ .ci }}"
e2e.hyperfleet.io/managed-by: "test-framework"
annotations:
Expand Down
3 changes: 3 additions & 0 deletions helmfile/helmfile.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ environments:
- projectId: {{ env "PROJECT_ID" | default "hcm-hyperfleet" }}
brokerType: googlepubsub
serviceType: {{ env "API_SERVICE_TYPE" | default "LoadBalancer" }}
e2eRunId: {{ env "E2E_RUN_ID" }}
labels:
e2e.hyperfleet.io/run-id: {{ env "E2E_RUN_ID" }}
Comment on lines +30 to +32

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== helmfile references =="
rg -n 'E2E_RUN_ID|e2e\.hyperfleet\.io/run-id|e2eRunId|requiredEnv "E2E_RUN_ID"|env "E2E_RUN_ID"' helmfile . || true

echo
echo "== nearby context in helmfile/helmfile.yaml.gotmpl =="
nl -ba helmfile/helmfile.yaml.gotmpl | sed -n '1,80p'

Repository: openshift-hyperfleet/hyperfleet-infra

Length of output: 5082

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== adapter references =="
rg -n 'testRunId|run-id|E2E_RUN_ID|TEST_RUN_ID|e2e\.hyperfleet\.io/(run-id|test-run-id)' . || true

Repository: openshift-hyperfleet/hyperfleet-adapter

Length of output: 437

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== architecture docs references =="
rg -n 'test-run-id|run-id|E2E_RUN_ID|TEST_RUN_ID|e2e\.hyperfleet\.io/(run-id|test-run-id)' hyperfleet/docs/e2e-testing || true

Repository: openshift-hyperfleet/architecture

Length of output: 2602

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '20,38p' helmfile/helmfile.yaml.gotmpl
echo
sed -n '1,90p' helmfile/values/base-adapter.yaml.gotmpl
echo
sed -n '312,328p' Makefile

Repository: openshift-hyperfleet/hyperfleet-infra

Length of output: 2577

🏁 Script executed (no clone):

python3 - <<'PY'
import yaml, json, textwrap
doc = yaml.safe_load(textwrap.dedent("""
labels:
  e2e.hyperfleet.io/run-id: 123
"""))
print(type(doc["labels"]["e2e.hyperfleet.io/run-id"]).__name__, doc["labels"]["e2e.hyperfleet.io/run-id"])
PY

Length of output: 133

Quote the run-id label value (CWE-20).
e2eRunId is re-quoted downstream, but labels.e2e.hyperfleet.io/run-id is later serialized via toYaml and can become a non-string YAML scalar if E2E_RUN_ID is numeric, which breaks Kubernetes label rendering.

Suggested fix 
-          e2e.hyperfleet.io/run-id: {{ env "E2E_RUN_ID" }}
+          e2e.hyperfleet.io/run-id: {{ env "E2E_RUN_ID" | quote }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
e2eRunId: {{ env "E2E_RUN_ID" }}
labels:
e2e.hyperfleet.io/run-id: {{ env "E2E_RUN_ID" }}
e2eRunId: {{ env "E2E_RUN_ID" }}
labels:
e2e.hyperfleet.io/run-id: {{ env "E2E_RUN_ID" | quote }}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@helmfile/helmfile.yaml.gotmpl` around lines 30 - 32, The run-id label value
is being emitted unquoted in the helmfile template, which can let a numeric
E2E_RUN_ID be serialized as a non-string scalar and break Kubernetes label
rendering. Update the helmfile.yaml.gotmpl entry for
labels.e2e.hyperfleet.io/run-id so the value is always quoted as a string, while
keeping e2eRunId consistent with the downstream string handling.

Source: Path instructions

- environments/e2e-gcp/adapter-configs.yaml.gotmpl
- environments/e2e-gcp/sentinel-configs.yaml
e2e-kind:
Expand Down
10 changes: 10 additions & 0 deletions helmfile/values/base-adapter.yaml.gotmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,20 @@ broker:
rabbitmq:
url: {{ env "RABBITMQ_URL" | default "amqp://guest:guest@rabbitmq:5672" }}
{{ end }}

{{- if hasKey .Values "labels" }}
labels:
{{- toYaml .Values.labels | nindent 2 }}
{{- end }}

env:
- name: SIMULATE_RESULT
value: success
- name: NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
{{- if hasKey .Values "e2eRunId" }}
- name: E2E_RUN_ID
value: {{ .Values.e2eRunId | quote }}
{{- end }}
Loading