Skip to content

fix(controller): align APPLICATIONS_NAMESPACE validation across reconcile paths - #81

Merged
jstourac merged 1 commit into
opendatahub-io:mainfrom
harshad16:fix/pr77-review-followups
Jul 30, 2026
Merged

jstourac merged 1 commit into
opendatahub-io:mainfrom
harshad16:fix/pr77-review-followups

Conversation

@harshad16

@harshad16 harshad16 commented Jul 30, 2026 •

Copy link
Copy Markdown
Member

Unify APPLICATIONS_NAMESPACE DNS-1123 validation across reconcile and ConfigMap watch paths, remove an unused ensureGeneratedNamespace parameter, and tighten envtest cleanup for invalid-namespace fallback tests.

Description

Follow-up to #77 addressing post-merge review feedback from @jstourac:

  • Unify APPLICATIONS_NAMESPACE validation — introduce platform.ValidApplicationsNamespace() and configuredApplicationsNamespace() so resolveOperandNamespace() and platformConfigWatchNamespaces() apply the same DNS-1123 rules. Previously, an invalid env value caused reconcile to fall back to platform defaults while the ConfigMap watch still pointed at the bad namespace.
  • Remove unused parameter — drop the unused Workbenches argument from ensureGeneratedNamespace().
  • Tighten test cleanup — the invalid-ApplicationsNamespace envtest now also cleans up the fallback opendatahub namespace it labels during reconcile.

Startup validation in cmd/main.go now uses the same shared helper.
Related: opendatahub-io/opendatahub-operator#3890
JIRA: https://redhat.atlassian.net/browse/RHOAIENG-79812

How Has This Been Tested?

  • go test ./internal/platform/...
  • go test ./cmd/... -run TestResolveApplicationsNamespace
  • go test ./internal/controller/... -run TestPlatformConfigWatchNamespaces
  • make unit-test

Merge criteria:

  • The commits are squashed in a cohesive manner and have meaningful messages.
  • Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
  • The developer has manually tested the changes and verified that the changes work

Summary by CodeRabbit

  • Bug Fixes
    • Improved validation for the applications namespace setting.
    • Invalid, empty, or whitespace-only values now safely fall back to platform defaults.
    • Valid namespace values may include surrounding whitespace, which is removed automatically.
    • Reconciliation and namespace monitoring now use the same fallback behavior consistently.
  • Tests
    • Added coverage for invalid, empty, whitespace-only, trimmed, and supported namespace values.
    • Verified fallback behavior across platform defaults.

@openshift-ci
openshift-ci Bot requested review from jstourac and thaorell July 30, 2026 07:06
@coderabbitai

coderabbitai Bot commented Jul 30, 2026 •

Copy link
Copy Markdown

Warning

Review limit reached

@harshad16, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 237e0e68-5d88-4a41-b8f8-00189a2d424e

📥 Commits

Reviewing files that changed from the base of the PR and between 427a817 and b040287.

📒 Files selected for processing (6)
  • cmd/main.go
  • internal/controller/platform_config_predicate_test.go
  • internal/controller/workbenches_controller.go
  • internal/controller/workbenches_controller_test.go
  • internal/platform/platform.go
  • internal/platform/suite_test.go
📝 Walkthrough

Walkthrough

The change adds platform.ValidApplicationsNamespace, which trims input and accepts only DNS-1123 labels. Startup namespace resolution and controller namespace selection use this validator, returning empty values for invalid input so platform defaults apply. Controller watch tests cover invalid namespace fallback, and reconciliation cleanup now targets the fallback namespace. Tests cover empty, whitespace, invalid, valid, and trimmed inputs.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 10
✅ Passed checks (10 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Contribution Quality And Spam Detection ✅ Passed Focused bugfix across 6 files with targeted tests and linked issue/Jira; no second-category spam or security-theater signal.
No Hardcoded Secrets ✅ Passed No hardcoded credentials, embedded-creds URLs, or long base64 literals in the diff; no CWE-798/CWE-259 evidence.
No Weak Cryptography ✅ Passed No banned primitives or secret comparisons in the patch; changes are namespace validation only. No CWE-327 or CWE-208 findings.
No Injection Vectors ✅ Passed No CWE-78/89/94/502/79 sinks found in changed production files; namespace input is DNS-1123 validated before use.
No Privileged Containers ✅ Passed No manifests, Helm templates, or Dockerfiles changed; security keyword scan found no CWE-250/CWE-269 privilege flags in the touched files.
No Sensitive Data In Logs ✅ Passed PASS: No CWE-532 issue found; new logs only emit APPLICATIONS_NAMESPACE/namespace labels, and the helper validates DNS-1123 labels before logging.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: unifying APPLICATIONS_NAMESPACE validation across reconcile paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov-commenter

codecov-commenter commented Jul 30, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 88.23529% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.14%. Comparing base (e637646) to head (b040287).

Files with missing lines Patch % Lines
internal/controller/workbenches_controller.go 75.00% 0 Missing and 2 partials ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main      #81      +/-   ##
==========================================
+ Coverage   65.04%   65.14%   +0.10%     
==========================================
  Files          21       21              
  Lines        2406     2413       +7     
==========================================
+ Hits         1565     1572       +7     
  Misses        661      661              
  Partials      180      180              
Flag Coverage Δ
unit-tests 65.14% <88.23%> (+0.10%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
cmd/main.go 21.26% <100.00%> (ø)
internal/platform/platform.go 80.00% <100.00%> (+4.00%) ⬆️
internal/controller/workbenches_controller.go 73.40% <75.00%> (+0.11%) ⬆️
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/controller/workbenches_controller_test.go`:
- Around line 443-446: The cleanup registered in the fallback test must not
unconditionally delete the shared applications namespace. Update the
DeferCleanup block around cleanupWorkbenches and cleanupNamespace so it only
removes namespaces created exclusively by this test, or isolate the test and
recreate the namespace for all dependent specs; preserve cleanup of test-owned
resources while keeping the suite-wide applicationsNamespace available.

In `@internal/controller/workbenches_controller.go`:
- Around line 679-685: Update ensureGeneratedNamespace calls in the Workbench
reconciliation flow, including the applications and legacy workbench namespace
paths, so namespaces created outside the resolved operand cleanup scope are not
labeled as generated. Separate namespace creation from generated-namespace
ownership, preserving the existing cleanup label only where
cleanupManagedResources and deletion permissions cover that namespace.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 87c8b702-42ed-4419-bc9b-80757da2881c

📥 Commits

Reviewing files that changed from the base of the PR and between e637646 and 427a817.

📒 Files selected for processing (6)
  • cmd/main.go
  • internal/controller/platform_config_predicate_test.go
  • internal/controller/workbenches_controller.go
  • internal/controller/workbenches_controller_test.go
  • internal/platform/platform.go
  • internal/platform/suite_test.go

Comment thread internal/controller/workbenches_controller_test.go Outdated
Comment thread internal/controller/workbenches_controller.go
@harshad16 harshad16 changed the title fix(controller): address PR #77 review follow-ups for namespace handling fix(controller): align APPLICATIONS_NAMESPACE validation across reconcile paths Jul 30, 2026
…cile paths

Unify APPLICATIONS_NAMESPACE DNS-1123 validation across reconcile and
ConfigMap watch paths, remove an unused ensureGeneratedNamespace parameter,
and tighten envtest cleanup for invalid-namespace fallback tests.

Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Harshad Reddy Nalla <hnalla@redhat.com>
@harshad16
harshad16 force-pushed the fix/pr77-review-followups branch from 427a817 to b040287 Compare July 30, 2026 07:18

@jstourac jstourac left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

thank you for this followup 💯 🎉

@openshift-ci

openshift-ci Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: harshad16, jstourac

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jstourac
jstourac merged commit bc2629a into opendatahub-io:main Jul 30, 2026
18 of 19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants