charts/ddns-updater/templates/_helpers.tpl (1)

46-56: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Selector-label keys are duplicated instead of derived from ddns-updater.selectorLabels.

The reserved keys app.kubernetes.io/name / app.kubernetes.io/instance are hardcoded here, duplicating the same keys already defined in the ddns-updater.selectorLabels template (Lines 29-32). If the selector labels are ever extended, this validation could silently miss new reserved keys.

♻️ Suggested refactor: derive reserved keys from the labels template output

 {{- define "ddns-updater.validate" -}}
 {{- if and .Values.ingress.enabled (not .Values.ingress.hosts) -}}
 {{- fail "ingress.hosts must contain at least one rule when ingress.enabled=true" -}}
 {{- end -}}
+{{- $selectorLabels := fromYaml (include "ddns-updater.selectorLabels" .) -}}
 {{- range $key, $_ := .Values.podLabels -}}
-{{- if or (eq $key "app.kubernetes.io/name") (eq $key "app.kubernetes.io/instance") -}}
+{{- if hasKey $selectorLabels $key -}}
 {{- fail (printf "podLabels must not override selector label %q" $key) -}}
 {{- end -}}
 {{- end -}}
 {{- end -}}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/ddns-updater/templates/_helpers.tpl` around lines 46 - 56, The
validation in ddns-updater.validate hardcodes reserved pod label keys instead of
deriving them from ddns-updater.selectorLabels. Update the podLabels check to
reuse the selector label set generated by ddns-updater.selectorLabels so any
future selector-label additions are automatically enforced. Keep the existing
fail behavior, but replace the duplicated key list with logic that compares
against the selector labels template output.

charts/ddns-updater/tests/validation_test.yaml (1)

19-25: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Missing test for the app.kubernetes.io/instance override branch.

Only the app.kubernetes.io/name override is tested; the sibling condition for app.kubernetes.io/instance (in the ddns-updater.validate helper) is untested.

✅ Suggested additional test case

   - it: should fail when podLabels override selector labels
     set:
       podLabels:
         app.kubernetes.io/name: custom
     asserts:
       - failedTemplate:
           errorMessage: 'podLabels must not override selector label "app.kubernetes.io/name"'
+
+  - it: should fail when podLabels override the instance selector label
+    set:
+      podLabels:
+        app.kubernetes.io/instance: custom
+    asserts:
+      - failedTemplate:
+          errorMessage: 'podLabels must not override selector label "app.kubernetes.io/instance"'

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/ddns-updater/tests/validation_test.yaml` around lines 19 - 25, Add a
validation test that covers the sibling selector-label override branch in
ddns-updater.validate for app.kubernetes.io/instance, since only
app.kubernetes.io/name is currently asserted. Mirror the existing failedTemplate
pattern in validation_test.yaml by setting podLabels.app.kubernetes.io/instance
to a custom value and expecting the corresponding error message that podLabels
must not override selector label "app.kubernetes.io/instance".

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes