Skip to content

chore: deprecate old profiletypes in favor of containerprofiles - #168

Open
entlein wants to merge 5 commits into
kubescape:mainfrom
k8sstormcenter:migrate/sbob
Open

chore: deprecate old profiletypes in favor of containerprofiles#168
entlein wants to merge 5 commits into
kubescape:mainfrom
k8sstormcenter:migrate/sbob

Conversation

@entlein

@entlein entlein commented Jul 30, 2026

Copy link
Copy Markdown
  • feat(incluster): remove AP/NN handling; ContainerProfile only
  • Fix stale watch-resource expectation in config test

Overview

Summary by CodeRabbit

  • New Features

    • Added synchronization support for ContainerProfiles, including listing, watching, retrieval, creation, updates, patching, verification, and deletion.
    • Updated in-cluster configuration to synchronize ContainerProfiles.
  • Bug Fixes

    • Improved resource handling so ContainerProfiles are synchronized through the appropriate path while other resources continue to function correctly.
  • Tests

    • Expanded unit and integration coverage for ContainerProfile synchronization, filtering, reconciliation, retries, and storage consistency.

@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c1491d4-e461-40f2-accc-9c851c8617c2

📥 Commits

Reviewing files that changed from the base of the PR and between c54f1c9 and e5da282.

📒 Files selected for processing (1)
  • tests/synchronizer_integration_test.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • tests/synchronizer_integration_test.go

📝 Walkthrough

Walkthrough

ContainerProfile replaces ApplicationProfile and NetworkNeighborhood in configured in-cluster synchronization. Typed routing, client behavior tests, filtering fixtures, dependencies, and end-to-end Kubernetes, storage, Postgres, and S3 scenarios are updated.

Changes

ContainerProfile synchronization

Layer / File(s) Summary
ContainerProfile routing and configuration
adapters/incluster/v1/client.go, config/config_test.go, configuration/client/config.json, go.mod
Typed list, watch, and get operations route ContainerProfiles through storage, with matching configuration and dependency updates.
ContainerProfile client synchronization tests
adapters/incluster/v1/client_cp_test.go
Cluster-free tests cover routing, CRUD, patching, checksum verification, deletion, storage synchronization, reconciliation, and watch retry behavior.
ContainerProfile filtering coverage
adapters/incluster/v1/client_test.go, adapters/incluster/v1/testdata/containerProfileFiltered.json
Filtering and marshaling coverage uses ContainerProfile selectors and DNS egress definitions.
End-to-end ContainerProfile scenarios
tests/synchronizer_integration_test.go
Integration setup and test cases use ContainerProfiles across Kubernetes, storage, Postgres, and S3 synchronization flows.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Kubernetes
  participant InClusterClient
  participant StorageClient
  participant Postgres
  participant S3

  Kubernetes->>InClusterClient: Create or update ContainerProfile
  InClusterClient->>StorageClient: List, watch, or get ContainerProfile
  InClusterClient->>Postgres: Write synchronization metadata
  InClusterClient->>S3: Write ContainerProfile payload
  InClusterClient->>Kubernetes: Reconcile or delete ContainerProfile
Loading
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: replacing legacy profile handling with ContainerProfile synchronization.
Docstring Coverage ✅ Passed Docstring coverage is 84.62% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Entlein added 4 commits July 30, 2026 21:21
The ApplicationProfile/NetworkNeighborhood CRDs are removed upstream, so drop
their cases from chooseLister/chooseWatcher/getResource and the client config;
the synchronizer watches and ships ContainerProfile only. (Dead AP/NN test
fixtures remain until the storage dependency is bumped past the removal.)

Signed-off-by: entlein <einentlein@gmail.com>
The in-cluster watch config was migrated to containerprofiles but the config
test's expected value still asserted applicationprofiles.

Signed-off-by: entlein <einentlein@gmail.com>
The non-test synchronizer already syncs only containerprofiles; the tests still
referenced the removed ApplicationProfile / NetworkNeighborhood types and would
not compile against the migrated storage. Move the filter and integration tests
(and the filtered-output testdata) to ContainerProfile, mapping the old
NetworkNeighborhood per-container egress onto the flat ContainerProfile spec.
Pin storage v0.0.290.

Signed-off-by: entlein <einentlein@gmail.com>
Give the CP sync path a local safety net (previously covered only by the
separate-module, private-dep, cluster-required integration suite): routing of
the containerprofiles resource through chooseLister/chooseWatcher/getResource,
the reconcile/put/patch/delete flow via fake dynamic+storage clients, and
watchRetry's CP branch via the fake storage watcher (no production seam needed).

Signed-off-by: entlein <einentlein@gmail.com>
@entlein
entlein marked this pull request as ready for review July 30, 2026 19:21

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
adapters/incluster/v1/client_cp_test.go (1)

460-502: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low value

Intentional long-lived goroutines in TestCP_WatchRetry_ViaFakeStorageWatcher.

Both the watchRetry goroutine and the CP-creation loop keep running for the remainder of the test binary's process life (never canceled/closed), per the documented tradeoff to avoid the os.Exit(1) giveup path. Locally scoped and non-blocking for other tests, but worth keeping in mind if this pattern is reused elsewhere in the suite.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@adapters/incluster/v1/client_cp_test.go` around lines 460 - 502, The test
leaves both the watchRetry goroutine and CP-creation loop running beyond the
test scope. Update TestCP_WatchRetry_ViaFakeStorageWatcher to use cancellable
context and coordinated cleanup, ensuring goroutines exit when the test
completes while avoiding the watchRetry os.Exit(1) give-up path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/synchronizer_integration_test.go`:
- Around line 1295-1302: Handle the error returned by
ContainerProfiles(namespace).Create immediately in the setup before calling
waitForObjectInPostgres or json.Marshal. Fail the test through the existing
testing mechanism when creation fails, preserving createdContainerProfileObj for
subsequent serialization only after successful creation.

---

Nitpick comments:
In `@adapters/incluster/v1/client_cp_test.go`:
- Around line 460-502: The test leaves both the watchRetry goroutine and
CP-creation loop running beyond the test scope. Update
TestCP_WatchRetry_ViaFakeStorageWatcher to use cancellable context and
coordinated cleanup, ensuring goroutines exit when the test completes while
avoiding the watchRetry os.Exit(1) give-up path.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b03df2bd-3bc4-4f90-8cbe-fd170905ee19

📥 Commits

Reviewing files that changed from the base of the PR and between cd11d8e and c54f1c9.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (9)
  • adapters/incluster/v1/client.go
  • adapters/incluster/v1/client_cp_test.go
  • adapters/incluster/v1/client_test.go
  • adapters/incluster/v1/testdata/containerProfileFiltered.json
  • adapters/incluster/v1/testdata/networkNeighborhoodFiltered.json
  • config/config_test.go
  • configuration/client/config.json
  • go.mod
  • tests/synchronizer_integration_test.go
💤 Files with no reviewable changes (1)
  • adapters/incluster/v1/testdata/networkNeighborhoodFiltered.json

Comment thread tests/synchronizer_integration_test.go Outdated
Signed-off-by: entlein <einentlein@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: WIP

Development

Successfully merging this pull request may close these issues.

2 participants