fix: close all critical YAML validation gaps from deep audit - #58
Merged
Conversation
Four agents validated every resource in all 4 rendered YAML files
(67 resources total). Critical fixes:
Superset (saas-platform):
- Create admin Secret (was referenced but never created → pod crash)
- Create DB credentials Secret when password is provided
- Fix Redis host: OT-Container-Kit creates <name>-master, not <name>
- Fix DB_HOST: use FQDN for cross-namespace (analytics-db-rw.saas.svc)
- Fix DB_NAME: match CNPG initdb database name (analytics-db, not analytics)
- Change adminSecret prop to admin: { password } | { existingSecret }
Loki (monitoring-stack):
- Create loki-storage Secret (S3 creds) referenced by LokiStack
Auth TLS (web-shop + saas):
- Add tls prop to Auth so Keycloak gets HTTPS, not plain HTTP
Database URL (saas):
- Fix DATABASE_URL: match CNPG database name (platform-db, not platform)
VaultStaticSecret:
- Fix apiVersion inconsistency (v1alpha1 → v1beta1 for hashicorp)
ServiceMonitor:
- Add comment clarifying it monitors an external Service
All 426 tests green. r8s validate passes on all 3 examples (only
remaining warning: auth-service is operator-managed by Keycloak).
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses manifest correctness issues found via deep YAML validation across rendered examples and components, focusing on missing/incorrect Secrets, service name conventions, and CRD apiVersion consistency to prevent runtime failures and validation errors.
Changes:
- Add Superset Secret creation logic for admin secret key and optional DB password secret; align managed Redis service DNS name with operator conventions.
- Unify
VaultStaticSecretapiVersion usage inDnsProvider, and add TLS config toAuthusage in examples. - Fix example manifests for Superset DB connection parameters and add missing Loki S3 credentials Secret.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/superset/src/index.ts | Creates missing Superset Secrets and updates managed Redis host naming. |
| packages/superset/tests/superset.test.ts | Updates test expectations for newly rendered Secret and Redis host naming. |
| packages/recipes/src/dns-provider.tsx | Bumps StaticSecret apiVersion for TSIG Secret rendering. |
| examples/web-shop/index.tsx | Adds TLS configuration to the Auth (Keycloak) example. |
| examples/saas-platform/index.tsx | Fixes Superset DB host/name and API DATABASE_URL; adds Auth TLS and Superset secret inputs. |
| examples/monitoring-stack/index.tsx | Adds missing loki-storage Secret and clarifies ServiceMonitor example comment. |
Suppressed comments (1)
examples/saas-platform/index.tsx:83
- This example commits a plaintext Superset admin secret key (
admin.password). Consider using an${env:...}placeholder to avoid encouraging hard-coded secrets in source control.
redis={{ create: true }}
admin={{ password: 'superset-admin-password' }}
tls={{ secretName: 'superset-tls', clusterIssuer: 'letsencrypt-prod' }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+124
to
+128
| metadata: { name: database.passwordSecret, namespace }, | ||
| type: 'Opaque', | ||
| stringData: { | ||
| password: database.password, | ||
| }, |
Comment on lines
+33
to
+36
| /** Admin credentials. If `existingSecret` is set, that Secret must | ||
| * already exist (with a `secretKey` key). Otherwise a Secret named | ||
| * `<name>-admin` is created with a generated secret key. */ | ||
| admin: { existingSecret: string } | { password?: string } |
Comment on lines
174
to
178
| const SecretKind = secrets.backend === 'openbao' ? 'OpenBaoStaticSecret' : 'VaultStaticSecret' | ||
| resources.push( | ||
| jsx(SecretKind, { | ||
| apiVersion: 'secrets.hashicorp.com/v1alpha1', | ||
| apiVersion: 'secrets.hashicorp.com/v1beta1', | ||
| kind: SecretKind, |
| database: 'analytics-db', | ||
| user: 'superset', | ||
| passwordSecret: 'superset-db-credentials', | ||
| password: 'superset-db-password', |
Comment on lines
18
to
+23
| it('should render Namespace, ConfigMap, Deployment, Service and Ingress', () => { | ||
| const result = render(jsx(Superset, baseProps)) | ||
|
|
||
| expect(result.resources).toHaveLength(5) | ||
| expect(result.resources).toHaveLength(6) | ||
| const kinds = result.resources.map((r) => r.kind) | ||
| expect(kinds).toEqual(['Namespace', 'ConfigMap', 'Deployment', 'Service', 'Ingress']) | ||
| expect(kinds).toEqual(['Namespace', 'Secret', 'ConfigMap', 'Deployment', 'Service', 'Ingress']) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Four agents deep-validated every resource in all 4 rendered YAML files (67 resources total). Found and fixed 6 critical issues + 2 warnings.
Critical fixes
Warnings fixed
Verified
r8s validatepasses on all 3 examples (only remaining warning: auth-service is operator-managed by Keycloak — documented)