mirror of https://github.com/helm/helm
Signed-off-by: Idryss Bourdier <thegogolplex@gmail.com>pull/32497/head
Idryss Bourdier
2 months ago
parent
a8ab76e86f
commit
132f5d4fff
@ -0,0 +1,283 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package action
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"slices"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/prometheus/common/expfmt"
|
||||
"github.com/prometheus/common/model"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
|
||||
chart "helm.sh/helm/v4/pkg/chart/v2"
|
||||
)
|
||||
|
||||
// featureGateMetricName is the Prometheus gauge every Kubernetes component
|
||||
// built on k8s.io/component-base exposes on its own /metrics endpoint,
|
||||
// recording the enablement state of every feature gate known to that
|
||||
// process. See:
|
||||
// https://kubernetes.io/docs/tasks/administer-cluster/configure-feature-gates/#check-via-metrics-endpoint
|
||||
const featureGateMetricName = "kubernetes_feature_enabled"
|
||||
|
||||
// defaultKubeletPort is used when a Node does not report a kubelet port.
|
||||
const defaultKubeletPort = 10250
|
||||
|
||||
// featureGateFetchTimeout bounds each network call in this file: rendering
|
||||
// happens outside the window helm's --timeout flag covers.
|
||||
const featureGateFetchTimeout = 10 * time.Second
|
||||
|
||||
// supportedKubeFeatureGateComponents are the components this version of Helm
|
||||
// can actively verify feature gates for. Components accepted by chart
|
||||
// validation (chart.KubeFeatureGateComponents) but not listed here are only
|
||||
// ever warned about, never enforced: checking them requires machinery Helm
|
||||
// does not have today (pod discovery plus a port-forward/exec tunnel), and
|
||||
// they are unreachable on most managed Kubernetes offerings regardless.
|
||||
var supportedKubeFeatureGateComponents = map[string]bool{
|
||||
"apiserver": true,
|
||||
"kubelet": true,
|
||||
}
|
||||
|
||||
// mergedKubeFeatureGates collects the kubeFeatureGates requirements declared
|
||||
// by chrt and all of its dependencies (recursively) into a single map, so a
|
||||
// component is only ever polled once regardless of how many chart levels
|
||||
// declare requirements for it. Conflicting requirements for the same gate
|
||||
// from different chart levels are a chart authoring error, not a cluster
|
||||
// state to warn about, so they fail immediately.
|
||||
func mergedKubeFeatureGates(chrt *chart.Chart) (map[string]map[string]bool, error) {
|
||||
type declaration struct {
|
||||
chart string
|
||||
want bool
|
||||
}
|
||||
declaredBy := map[string]map[string]declaration{}
|
||||
|
||||
var walk func(c *chart.Chart) error
|
||||
walk = func(c *chart.Chart) error {
|
||||
for component, gates := range c.Metadata.KubeFeatureGates {
|
||||
if declaredBy[component] == nil {
|
||||
declaredBy[component] = map[string]declaration{}
|
||||
}
|
||||
for gate, want := range gates {
|
||||
if prior, ok := declaredBy[component][gate]; ok && prior.want != want {
|
||||
return fmt.Errorf("chart %q requires kubeFeatureGates.%s.%s=%t but chart %q requires %t", c.Name(), component, gate, want, prior.chart, prior.want)
|
||||
}
|
||||
declaredBy[component][gate] = declaration{chart: c.Name(), want: want}
|
||||
}
|
||||
}
|
||||
for _, dep := range c.Dependencies() {
|
||||
if err := walk(dep); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
if err := walk(chrt); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
merged := make(map[string]map[string]bool, len(declaredBy))
|
||||
for component, gates := range declaredBy {
|
||||
g := make(map[string]bool, len(gates))
|
||||
for gate, d := range gates {
|
||||
g[gate] = d.want
|
||||
}
|
||||
merged[component] = g
|
||||
}
|
||||
return merged, nil
|
||||
}
|
||||
|
||||
// checkKubeFeatureGates verifies that the feature gates required by the
|
||||
// chart (keyed by component name, then by gate name) match the state
|
||||
// reported by the cluster. A component missing from wanted is not checked at
|
||||
// all.
|
||||
//
|
||||
// A component this version of Helm does not yet support checking is only
|
||||
// logged as a warning and does not block installation. For a component Helm
|
||||
// does support (apiserver, kubelet), any failure to positively confirm a
|
||||
// required gate -- RBAC denied, component unreachable, timeout, a parse
|
||||
// error, or the gate simply not being reported -- blocks installation, the
|
||||
// same as a definitive mismatch.
|
||||
func (cfg *Configuration) checkKubeFeatureGates(ctx context.Context, wanted map[string]map[string]bool) error {
|
||||
components := make([]string, 0, len(wanted))
|
||||
for component := range wanted {
|
||||
components = append(components, component)
|
||||
}
|
||||
slices.Sort(components)
|
||||
|
||||
var problems []string
|
||||
for _, component := range components {
|
||||
gates := wanted[component]
|
||||
if len(gates) == 0 {
|
||||
continue
|
||||
}
|
||||
|
||||
if !supportedKubeFeatureGateComponents[component] {
|
||||
cfg.Logger().Warn(
|
||||
"chart requires kubeFeatureGates for a component Helm cannot yet verify; skipping",
|
||||
slog.String("component", component),
|
||||
)
|
||||
continue
|
||||
}
|
||||
|
||||
actual, err := cfg.fetchComponentFeatureGates(ctx, component)
|
||||
if err != nil {
|
||||
problems = append(problems, fmt.Sprintf("%s: could not verify feature gates: %s", component, err))
|
||||
continue
|
||||
}
|
||||
|
||||
gateNames := make([]string, 0, len(gates))
|
||||
for gate := range gates {
|
||||
gateNames = append(gateNames, gate)
|
||||
}
|
||||
slices.Sort(gateNames)
|
||||
|
||||
for _, gate := range gateNames {
|
||||
want := gates[gate]
|
||||
got, known := actual[gate]
|
||||
if !known {
|
||||
problems = append(problems, fmt.Sprintf("%s.%s: not reported by the cluster", component, gate))
|
||||
continue
|
||||
}
|
||||
if got != want {
|
||||
problems = append(problems, fmt.Sprintf("%s.%s=%t (cluster reports %t)", component, gate, want, got))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if len(problems) > 0 {
|
||||
return fmt.Errorf("chart requires kubeFeatureGates that could not be satisfied or verified: %s", strings.Join(problems, ", "))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// fetchComponentFeatureGates retrieves and parses the feature gate state
|
||||
// reported by the given component's /metrics endpoint.
|
||||
func (cfg *Configuration) fetchComponentFeatureGates(ctx context.Context, component string) (map[string]bool, error) {
|
||||
if cfg.RESTClientGetter == nil {
|
||||
return nil, errors.New("no Kubernetes cluster is configured")
|
||||
}
|
||||
|
||||
clientset, err := cfg.KubernetesClientSet()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var raw []byte
|
||||
switch component {
|
||||
case "apiserver":
|
||||
apiserverCtx, cancel := context.WithTimeout(ctx, featureGateFetchTimeout)
|
||||
defer cancel()
|
||||
raw, err = clientset.CoreV1().RESTClient().Get().RequestURI("/metrics").Do(apiserverCtx).Raw()
|
||||
case "kubelet":
|
||||
raw, err = fetchKubeletMetrics(ctx, clientset)
|
||||
default:
|
||||
return nil, fmt.Errorf("component %q is not supported", component)
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return parseFeatureGateMetrics(raw)
|
||||
}
|
||||
|
||||
// fetchKubeletMetrics polls the /metrics endpoint of a single representative
|
||||
// Ready node, via the API server's node proxy subresource. kubelet feature
|
||||
// gates are technically per-node; Helm treats one Ready node as
|
||||
// representative of the cluster rather than polling every node.
|
||||
func fetchKubeletMetrics(ctx context.Context, clientset kubernetes.Interface) ([]byte, error) {
|
||||
listCtx, cancelList := context.WithTimeout(ctx, featureGateFetchTimeout)
|
||||
defer cancelList()
|
||||
nodes, err := clientset.CoreV1().Nodes().List(listCtx, metav1.ListOptions{})
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("listing nodes: %w", err)
|
||||
}
|
||||
|
||||
node, ok := firstReadyNode(nodes.Items)
|
||||
if !ok {
|
||||
return nil, errors.New("no Ready node found to check kubelet feature gates against")
|
||||
}
|
||||
|
||||
port := node.Status.DaemonEndpoints.KubeletEndpoint.Port
|
||||
if port == 0 {
|
||||
port = defaultKubeletPort
|
||||
}
|
||||
|
||||
metricsCtx, cancelMetrics := context.WithTimeout(ctx, featureGateFetchTimeout)
|
||||
defer cancelMetrics()
|
||||
return clientset.CoreV1().RESTClient().Get().
|
||||
Resource("nodes").
|
||||
SubResource("proxy").
|
||||
Name(fmt.Sprintf("%s:%d", node.Name, port)).
|
||||
Suffix("metrics").
|
||||
Do(metricsCtx).Raw()
|
||||
}
|
||||
|
||||
// firstReadyNode returns the first node in the list reporting a True Ready
|
||||
// condition.
|
||||
func firstReadyNode(nodes []corev1.Node) (corev1.Node, bool) {
|
||||
for _, node := range nodes {
|
||||
for _, cond := range node.Status.Conditions {
|
||||
if cond.Type == corev1.NodeReady && cond.Status == corev1.ConditionTrue {
|
||||
return node, true
|
||||
}
|
||||
}
|
||||
}
|
||||
return corev1.Node{}, false
|
||||
}
|
||||
|
||||
// parseFeatureGateMetrics parses the raw Prometheus text exposition format
|
||||
// scraped from a component's /metrics endpoint and extracts the enablement
|
||||
// state of every feature gate it reports.
|
||||
func parseFeatureGateMetrics(raw []byte) (map[string]bool, error) {
|
||||
// kubernetes_feature_enabled and its labels always use the classic
|
||||
// Prometheus name character set; expfmt.TextParser requires an explicit
|
||||
// scheme (its zero value is invalid) since it added UTF-8 name support.
|
||||
parser := expfmt.NewTextParser(model.LegacyValidation)
|
||||
families, err := parser.TextToMetricFamilies(bytes.NewReader(raw))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("parsing metrics: %w", err)
|
||||
}
|
||||
|
||||
family, ok := families[featureGateMetricName]
|
||||
if !ok {
|
||||
return map[string]bool{}, nil
|
||||
}
|
||||
|
||||
gates := make(map[string]bool, len(family.Metric))
|
||||
for _, m := range family.Metric {
|
||||
var name string
|
||||
for _, label := range m.Label {
|
||||
if label.GetName() == "name" {
|
||||
name = label.GetValue()
|
||||
break
|
||||
}
|
||||
}
|
||||
if name == "" || m.Gauge == nil {
|
||||
continue
|
||||
}
|
||||
gates[name] = m.Gauge.GetValue() != 0
|
||||
}
|
||||
return gates, nil
|
||||
}
|
||||
@ -0,0 +1,257 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package action
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"k8s.io/apimachinery/pkg/api/meta"
|
||||
"k8s.io/client-go/discovery"
|
||||
"k8s.io/client-go/rest"
|
||||
)
|
||||
|
||||
// fakeRESTClientGetter is a minimal RESTClientGetter that only supports
|
||||
// ToRESTConfig, enough to exercise code paths that build a Kubernetes
|
||||
// clientset directly against a local httptest server.
|
||||
type fakeRESTClientGetter struct {
|
||||
restConfig *rest.Config
|
||||
}
|
||||
|
||||
func (f *fakeRESTClientGetter) ToRESTConfig() (*rest.Config, error) {
|
||||
return f.restConfig, nil
|
||||
}
|
||||
|
||||
func (f *fakeRESTClientGetter) ToDiscoveryClient() (discovery.CachedDiscoveryInterface, error) {
|
||||
return nil, errors.New("not implemented")
|
||||
}
|
||||
|
||||
func (f *fakeRESTClientGetter) ToRESTMapper() (meta.RESTMapper, error) {
|
||||
return nil, errors.New("not implemented")
|
||||
}
|
||||
|
||||
// poisonRESTClientGetter fails the test if any of its methods are called,
|
||||
// used to prove a code path never contacts the cluster.
|
||||
type poisonRESTClientGetter struct {
|
||||
t *testing.T
|
||||
}
|
||||
|
||||
func (p *poisonRESTClientGetter) ToRESTConfig() (*rest.Config, error) {
|
||||
p.t.Fatal("ToRESTConfig should not be called")
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func (p *poisonRESTClientGetter) ToDiscoveryClient() (discovery.CachedDiscoveryInterface, error) {
|
||||
p.t.Fatal("ToDiscoveryClient should not be called")
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func (p *poisonRESTClientGetter) ToRESTMapper() (meta.RESTMapper, error) {
|
||||
p.t.Fatal("ToRESTMapper should not be called")
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
const sampleFeatureGateMetrics = `# HELP kubernetes_feature_enabled [BETA] This metric records the data about the stage and enablement of a k8s feature.
|
||||
# TYPE kubernetes_feature_enabled gauge
|
||||
kubernetes_feature_enabled{name="ClusterTrustBundle",stage="BETA"} 0
|
||||
kubernetes_feature_enabled{name="SidecarContainers",stage=""} 1
|
||||
`
|
||||
|
||||
func TestParseFeatureGateMetrics(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
raw string
|
||||
want map[string]bool
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "parses enabled and disabled gates",
|
||||
raw: sampleFeatureGateMetrics,
|
||||
want: map[string]bool{
|
||||
"ClusterTrustBundle": false,
|
||||
"SidecarContainers": true,
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "metric family absent",
|
||||
raw: "# HELP unrelated_metric a metric we don't care about\n# TYPE unrelated_metric gauge\nunrelated_metric 1\n",
|
||||
want: map[string]bool{},
|
||||
},
|
||||
{
|
||||
name: "malformed input",
|
||||
raw: "kubernetes_feature_enabled{name=\"X\" 1\n",
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
got, err := parseFeatureGateMetrics([]byte(tt.raw))
|
||||
if tt.wantErr {
|
||||
require.Error(t, err)
|
||||
return
|
||||
}
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.want, got)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// newFeatureGateTestServer returns an httptest server whose /metrics handler
|
||||
// serves sampleFeatureGateMetrics, standing in for kube-apiserver.
|
||||
func newFeatureGateTestServer(t *testing.T) *httptest.Server {
|
||||
t.Helper()
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/metrics", func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.Header().Set("Content-Type", "text/plain; version=0.0.4")
|
||||
_, _ = w.Write([]byte(sampleFeatureGateMetrics))
|
||||
})
|
||||
server := httptest.NewServer(mux)
|
||||
t.Cleanup(server.Close)
|
||||
return server
|
||||
}
|
||||
|
||||
func TestCheckKubeFeatureGates(t *testing.T) {
|
||||
t.Run("no component declared is a no-op", func(t *testing.T) {
|
||||
cfg := actionConfigFixture(t)
|
||||
require.NoError(t, cfg.checkKubeFeatureGates(t.Context(), nil))
|
||||
})
|
||||
|
||||
t.Run("unsupported component only warns, never blocks", func(t *testing.T) {
|
||||
cfg := actionConfigFixture(t)
|
||||
// actionConfigFixture never sets RESTClientGetter; if this component were
|
||||
// (incorrectly) treated as supported, fetching would fail loudly instead
|
||||
// of being skipped outright.
|
||||
err := cfg.checkKubeFeatureGates(t.Context(), map[string]map[string]bool{
|
||||
"scheduler": {"ComponentFlagz": false},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
})
|
||||
|
||||
t.Run("no cluster configured blocks with a clear error", func(t *testing.T) {
|
||||
cfg := actionConfigFixture(t)
|
||||
err := cfg.checkKubeFeatureGates(t.Context(), map[string]map[string]bool{
|
||||
"apiserver": {"SidecarContainers": true},
|
||||
})
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "apiserver: could not verify feature gates")
|
||||
})
|
||||
|
||||
server := newFeatureGateTestServer(t)
|
||||
cfg := actionConfigFixture(t)
|
||||
cfg.RESTClientGetter = &fakeRESTClientGetter{restConfig: &rest.Config{Host: server.URL}}
|
||||
|
||||
t.Run("matching gate state passes", func(t *testing.T) {
|
||||
err := cfg.checkKubeFeatureGates(t.Context(), map[string]map[string]bool{
|
||||
"apiserver": {
|
||||
"ClusterTrustBundle": false,
|
||||
"SidecarContainers": true,
|
||||
},
|
||||
})
|
||||
require.NoError(t, err)
|
||||
})
|
||||
|
||||
t.Run("mismatching gate state blocks with a clear error", func(t *testing.T) {
|
||||
err := cfg.checkKubeFeatureGates(t.Context(), map[string]map[string]bool{
|
||||
"apiserver": {"ClusterTrustBundle": true},
|
||||
})
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "apiserver.ClusterTrustBundle=true (cluster reports false)")
|
||||
})
|
||||
|
||||
t.Run("gate absent from scraped output blocks with a clear error", func(t *testing.T) {
|
||||
// Covers the issue's primary scenario: an older cluster (or one
|
||||
// predating the gate) that doesn't report it at all must not be
|
||||
// treated as satisfying the requirement.
|
||||
err := cfg.checkKubeFeatureGates(t.Context(), map[string]map[string]bool{
|
||||
"apiserver": {"SomeGateThisServerDoesNotReport": true},
|
||||
})
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "apiserver.SomeGateThisServerDoesNotReport: not reported by the cluster")
|
||||
})
|
||||
}
|
||||
|
||||
func TestCheckKubeFeatureGates_ClusterPredatesFeatureGateMetric(t *testing.T) {
|
||||
// Simulates a Kubernetes version older than 1.26, which doesn't expose
|
||||
// kubernetes_feature_enabled at all -- the issue's primary scenario of a
|
||||
// lower K8s version must not be treated as satisfying the requirement.
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/metrics", func(w http.ResponseWriter, _ *http.Request) {
|
||||
w.Header().Set("Content-Type", "text/plain; version=0.0.4")
|
||||
_, _ = w.Write([]byte("# HELP unrelated_metric a metric with nothing to do with feature gates\n# TYPE unrelated_metric gauge\nunrelated_metric 1\n"))
|
||||
})
|
||||
server := httptest.NewServer(mux)
|
||||
t.Cleanup(server.Close)
|
||||
|
||||
cfg := actionConfigFixture(t)
|
||||
cfg.RESTClientGetter = &fakeRESTClientGetter{restConfig: &rest.Config{Host: server.URL}}
|
||||
|
||||
err := cfg.checkKubeFeatureGates(t.Context(), map[string]map[string]bool{
|
||||
"apiserver": {"SidecarContainers": true},
|
||||
})
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "apiserver.SidecarContainers: not reported by the cluster")
|
||||
}
|
||||
|
||||
func TestMergedKubeFeatureGates(t *testing.T) {
|
||||
t.Run("no dependencies returns the root chart's own requirements", func(t *testing.T) {
|
||||
ch := buildChart(withKubeFeatureGates(map[string]map[string]bool{
|
||||
"apiserver": {"SidecarContainers": true},
|
||||
}))
|
||||
merged, err := mergedKubeFeatureGates(ch)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, map[string]map[string]bool{"apiserver": {"SidecarContainers": true}}, merged)
|
||||
})
|
||||
|
||||
t.Run("combines root and dependency requirements for different gates", func(t *testing.T) {
|
||||
ch := buildChart(
|
||||
withKubeFeatureGates(map[string]map[string]bool{"apiserver": {"SidecarContainers": true}}),
|
||||
withDependency(withName("sub"), withKubeFeatureGates(map[string]map[string]bool{"kubelet": {"NodeSwap": false}})),
|
||||
)
|
||||
merged, err := mergedKubeFeatureGates(ch)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, map[string]map[string]bool{
|
||||
"apiserver": {"SidecarContainers": true},
|
||||
"kubelet": {"NodeSwap": false},
|
||||
}, merged)
|
||||
})
|
||||
|
||||
t.Run("agreeing requirements for the same gate from multiple levels are fine", func(t *testing.T) {
|
||||
ch := buildChart(
|
||||
withKubeFeatureGates(map[string]map[string]bool{"apiserver": {"SidecarContainers": true}}),
|
||||
withDependency(withName("sub"), withKubeFeatureGates(map[string]map[string]bool{"apiserver": {"SidecarContainers": true}})),
|
||||
)
|
||||
merged, err := mergedKubeFeatureGates(ch)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, map[string]map[string]bool{"apiserver": {"SidecarContainers": true}}, merged)
|
||||
})
|
||||
|
||||
t.Run("conflicting requirements for the same gate error out", func(t *testing.T) {
|
||||
ch := buildChart(
|
||||
withName("root"),
|
||||
withKubeFeatureGates(map[string]map[string]bool{"apiserver": {"SidecarContainers": true}}),
|
||||
withDependency(withName("sub"), withKubeFeatureGates(map[string]map[string]bool{"apiserver": {"SidecarContainers": false}})),
|
||||
)
|
||||
_, err := mergedKubeFeatureGates(ch)
|
||||
require.Error(t, err)
|
||||
assert.Contains(t, err.Error(), "apiserver.SidecarContainers")
|
||||
})
|
||||
}
|
||||
Loading…
Reference in new issue