Skip to content

fix(countly): align template validation standards#655

Merged
mberlofa merged 2 commits into
mainfrom
fix/countly-template-standards
Jul 6, 2026
Merged

fix(countly): align template validation standards#655
mberlofa merged 2 commits into
mainfrom
fix/countly-template-standards

Conversation

@mberlofa

@mberlofa mberlofa commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Summary

  • add centralized countly values validation through templates/validate.yaml
  • add helm-unittest coverage for MongoDB, ingress, Gateway API, External Secrets, backup, selector labels, dual-stack, and hostless Ingress behavior
  • make k3d CI fixtures self-contained for external MongoDB, External Secrets, Gateway API, and dual-stack runtime validation

Validation

  • make template-standards-check CHART=countly
  • helm unittest charts/countly
  • helm lint --strict charts/countly
  • make standards-check CHART=countly
  • make validate-chart CHART=countly TIMEOUT=1200: FULLY VALIDATED (17 layers)
  • make site-sync-check CHART=countly
  • make release-check REPO=charts
  • make attribution-check REPO=charts

Site PR: helmforgedev/site#334
Issue: #633

Summary by CodeRabbit

  • New Features

    • Added chart validation for common configuration mistakes, helping catch issues earlier during deployment.
  • Bug Fixes

    • Improved ingress handling for hostless routes.
    • Refined service settings for dual-stack networking.
    • Updated MongoDB-related deployment scenarios to work more reliably across setups.
    • Strengthened checks for backup and secret configuration.

@coderabbitai

coderabbitai Bot commented Jul 3, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b0e0fab-093f-4c61-a500-67b1df14e072

📥 Commits

Reviewing files that changed from the base of the PR and between 2513dd0 and 0eea12e.

📒 Files selected for processing (3)
  • charts/countly/templates/_helpers.tpl
  • charts/countly/tests/deployment_test.yaml
  • charts/countly/tests/validation_test.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
  • charts/countly/tests/validation_test.yaml
  • charts/countly/templates/_helpers.tpl

📝 Walkthrough

Walkthrough

Adds a Helm render-time countly.validate helper enforcing configuration requirements for externalMongodb, ingress, gateway, externalSecrets, backup, and podLabels; updates countly.mongodbHost to key off mongodb.enabled; adjusts ingress host rendering; updates CI scenario values; and adds corresponding test coverage.

Changes

Countly chart template standards alignment

Layer / File(s) Summary
Validation helper and template wiring
charts/countly/templates/_helpers.tpl, charts/countly/templates/validate.yaml
Adds countly.validate fail-checks for externalMongodb, ingress, gateway, externalSecrets, backup, and podLabels overrides; extends countly.backupEnabled; wires validation via new validate.yaml template.
MongoDB host resolution
charts/countly/templates/_helpers.tpl
countly.mongodbHost now derives hostname from mongodb.enabled and Release.Name, replacing prior externalMongodb.enabled gating.
Ingress hostless rule rendering
charts/countly/templates/ingress.yaml
Host field is rendered only when .host is present, using a conditional block.
CI scenario value updates
charts/countly/ci/dual-stack.yaml, charts/countly/ci/external-mongodb-values.yaml, charts/countly/ci/external-secrets.yaml, charts/countly/ci/gateway-api.yaml
Simplifies dual-stack config to rely on ipFamilyPolicy; switches external-mongodb CI to use bundled MongoDB with new URI/credentials and Service manifest; updates external-secrets CI to a fake secret store, root password, and generated Secret/Service manifests; removes MongoDB config from gateway-api CI.
Deployment, ingress, and service test coverage
charts/countly/tests/deployment_test.yaml, charts/countly/tests/ingress_test.yaml, charts/countly/tests/service_test.yaml
Adds tests verifying no wait-for-mongodb init container when external MongoDB uses bundled host, hostless catch-all ingress rules, and dual-stack Service field rendering.
Validation test suite
charts/countly/tests/validation_test.yaml
New suite asserting fail messages for missing externalMongodb URI/secret, empty ingress hosts, missing gateway parentRefs, externalSecrets misconfigurations, missing mongodb-uri mapping, backup S3 gaps, backup URI injection failure, and podLabels overriding selector labels.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant HelmRender
  participant ValidateTemplate
  participant CountlyValidate

  HelmRender->>ValidateTemplate: render validate.yaml with chart context
  ValidateTemplate->>CountlyValidate: invoke countly.validate
  CountlyValidate->>CountlyValidate: check externalMongodb, ingress, gateway, externalSecrets, podLabels
  CountlyValidate->>CountlyValidate: check backup.enabled and backup.s3 fields
  alt invalid configuration
    CountlyValidate-->>HelmRender: fail with error message
  else valid configuration
    CountlyValidate-->>HelmRender: no output
  end
Loading

Related issues: None specified.

Related PRs: None specified.

Suggested labels: helm, validation, ci

Suggested reviewers: None specified.

🐰 A rabbit checks each field with care,
Mongo, ingress, secrets laid bare,
If labels clash or hosts are bare,
A fail message floats on the air,
Then hops through tests without a scare.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: adding and aligning Countly template validation standards.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/countly-template-standards

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Standards Check (GR-079) — PASS

Every changed chart fully passes standards-check.

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

🟢 Security Scan: countly

Framework Score
MITRE + NSA + SOC2 72.72727%

✅ Security posture acceptable.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
charts/countly/templates/_helpers.tpl (1)

102-119: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Reuse countly.mongodbHost in countly.mongodbUri.
The bundled MongoDB subchart follows the same contains fullname convention, so release names like mongodb or my-mongodb-app make the host helper and URI diverge; the URI still appends -mongodb and points at a nonexistent service.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/countly/templates/_helpers.tpl` around lines 102 - 119, The MongoDB
URI helper is duplicating host naming logic instead of reusing the existing
countly.mongodbHost helper, which can make the URI point to a different service
name. Update countly.mongodbUri to call countly.mongodbHost for the bundled
MongoDB case, so it follows the same contains-based fullname behavior as
countly.mongodbHost and stays consistent for release names like mongodb or
my-mongodb-app.
🧹 Nitpick comments (2)
charts/countly/tests/validation_test.yaml (1)

155-161: 📐 Maintainability & Code Quality | 🔵 Trivial

Missing test for app.kubernetes.io/instance selector-label override.

Only the app.kubernetes.io/name override path is tested; the guard also checks app.kubernetes.io/instance (Line 96 in _helpers.tpl) but that branch is untested.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/countly/tests/validation_test.yaml` around lines 155 - 161, Add a
validation test that covers podLabels overriding the app.kubernetes.io/instance
selector label, since only app.kubernetes.io/name is currently asserted. Update
the tests in validation_test.yaml alongside the existing podLabels override
case, and make the new assertion expect the same failedTemplate behavior and the
instance-specific error message from the selector-label guard in _helpers.tpl.
charts/countly/templates/deployment.yaml (1)

42-47: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Verify bundled MongoDB is always deployed when mongodb.enabled=true, even alongside externalMongodb.enabled=true.

With the simplified condition, whenever mongodb.enabled=true the init container always waits on countly.mongodbHost (the bundled subchart hostname), regardless of externalMongodb.enabled. Per the env block below (Line 60), when externalMongodb.enabled=true the app actually connects to externalMongodb.uri/secret instead of the bundled instance. This means enabling both flags simultaneously deploys a bundled MongoDB the app doesn't use, wasting resources, and only "works" correctly when the external URI happens to alias back to the bundled subchart's host (as done in the CI fixtures). This is confirmed intentional by the test should wait for bundled MongoDB when external URI targets the subchart, but worth flagging as a potentially confusing coupling for chart consumers who set both flags with an unrelated external host.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/countly/templates/deployment.yaml` around lines 42 - 47, The init
container logic in deployment template is coupled only to mongodb.enabled, so it
always waits on the bundled subchart host even when externalMongodb.enabled is
also set. Update the condition around the wait-for-mongodb initContainer in the
deployment template to match the actual MongoDB target selected by the
env/config block, using the existing helpers like countly.mongodbHost and the
externalMongodb flags so the wait behavior aligns with the database the app will
really use.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/countly/templates/_helpers.tpl`:
- Around line 78-94: The backup validation logic in countly.validate is
duplicated and should be delegated to the existing helpers instead of rechecked
inline. Update countly.validate to call countly.backupEnabled and
countly.backupMongodbUri so the backup.s3 and backup.database.uri requirements
live in one place. Keep the existing fail behavior/messages in those helper
templates and remove the duplicated conditional blocks from countly.validate.

---

Outside diff comments:
In `@charts/countly/templates/_helpers.tpl`:
- Around line 102-119: The MongoDB URI helper is duplicating host naming logic
instead of reusing the existing countly.mongodbHost helper, which can make the
URI point to a different service name. Update countly.mongodbUri to call
countly.mongodbHost for the bundled MongoDB case, so it follows the same
contains-based fullname behavior as countly.mongodbHost and stays consistent for
release names like mongodb or my-mongodb-app.

---

Nitpick comments:
In `@charts/countly/templates/deployment.yaml`:
- Around line 42-47: The init container logic in deployment template is coupled
only to mongodb.enabled, so it always waits on the bundled subchart host even
when externalMongodb.enabled is also set. Update the condition around the
wait-for-mongodb initContainer in the deployment template to match the actual
MongoDB target selected by the env/config block, using the existing helpers like
countly.mongodbHost and the externalMongodb flags so the wait behavior aligns
with the database the app will really use.

In `@charts/countly/tests/validation_test.yaml`:
- Around line 155-161: Add a validation test that covers podLabels overriding
the app.kubernetes.io/instance selector label, since only app.kubernetes.io/name
is currently asserted. Update the tests in validation_test.yaml alongside the
existing podLabels override case, and make the new assertion expect the same
failedTemplate behavior and the instance-specific error message from the
selector-label guard in _helpers.tpl.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 53b56ed7-01cc-4eb6-8830-2b58b229e6e6

📥 Commits

Reviewing files that changed from the base of the PR and between 870b4c7 and 4b32673.

📒 Files selected for processing (12)
  • charts/countly/ci/dual-stack.yaml
  • charts/countly/ci/external-mongodb-values.yaml
  • charts/countly/ci/external-secrets.yaml
  • charts/countly/ci/gateway-api.yaml
  • charts/countly/templates/_helpers.tpl
  • charts/countly/templates/deployment.yaml
  • charts/countly/templates/ingress.yaml
  • charts/countly/templates/validate.yaml
  • charts/countly/tests/deployment_test.yaml
  • charts/countly/tests/ingress_test.yaml
  • charts/countly/tests/service_test.yaml
  • charts/countly/tests/validation_test.yaml
💤 Files with no reviewable changes (1)
  • charts/countly/ci/gateway-api.yaml

Comment thread charts/countly/templates/_helpers.tpl
@mberlofa mberlofa force-pushed the fix/countly-template-standards branch from 4b32673 to ce2c3c9 Compare July 3, 2026 12:24
@mberlofa mberlofa force-pushed the fix/countly-template-standards branch from ce2c3c9 to 2513dd0 Compare July 4, 2026 16:30
@mberlofa

mberlofa commented Jul 5, 2026

Copy link
Copy Markdown
Contributor Author

Reviewed all CodeRabbit feedback in review threads and review-summary comments.

Changes:

  • Added validation coverage for podLabels overriding app.kubernetes.io/instance.
  • Updated selector-label validation to derive guarded keys from countly.selectorLabels instead of duplicating key names.
  • Aligned wait-for-mongodb with the actual MongoDB target selected by the app: the initContainer now waits for bundled MongoDB only when mongodb.enabled=true and externalMongodb.enabled=false.
  • Updated the deployment test so enabling external MongoDB suppresses the bundled wait initContainer even if the bundled subchart is also enabled for CI/service backing.

Validation:

  • make validate-chart CHART=countly passed
  • Result: countly: FULLY VALIDATED (17 layers), including k3d GR-027 for external MongoDB and ExternalSecrets scenarios
  • make release-check REPO=charts passed with only the expected post-merge release confirmation warning
  • make attribution-check REPO=charts passed
  • git diff --check passed

Note: the two latest CodeRabbit items were posted in the review summary/body, not as active review threads, so there are no thread IDs to reply to or resolve for them. The existing inline CodeRabbit thread is already resolved.

@mberlofa mberlofa merged commit 097d37b into main Jul 6, 2026
17 checks passed
@mberlofa mberlofa deleted the fix/countly-template-standards branch July 6, 2026 08:26
mberlofa added a commit to helmforgedev/site that referenced this pull request Jul 6, 2026
## Summary
- add countly to the Helm values playground eligibility map required by
the chart sync check

## Validation
- make site-sync-check CHART=countly
- npm run lint
- npm run format:check
- npm run build
- make release-check REPO=site
- make attribution-check REPO=site

Chart PR: helmforgedev/charts#655
Issue: helmforgedev/charts#633

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added the Countly chart to the playground’s available chart list,
making it visible even when it isn’t marked as stable.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant