feat(components): every component honours its own toggle - #226
Merged
Conversation
Seven templates were marked "core: cannot be disabled" and ignored the components map entirely. Five of them — argocd, cert-manager, kyverno, external-secrets, cnpg — already HAD a key in that map, documented as a toggle and defaulting to true. Nothing read it. The consequence is only visible when it matters: bringing a platform up on a new provider, where the whole point is to enable one component at a time and verify it before the next. With eleven Applications rendering regardless of every toggle being false, the first sync installs a set nobody chose. Now each reads its own key. Three that had no key of their own follow what they cannot work without rather than gaining one: cluster-secret-store and platform-secrets on external-secrets, since a ClusterSecretStore and an ExternalSecret are its custom resources; kyverno-exceptions on kyverno, for the same reason with PolicyExceptions. resource-quotas gets a key, because it had none and was the one component nothing could switch off. That key is excluded from componentsForwarding. Forwarding it would add an entry to the map the network-policies and resource-quotas child charts consume, changing rendered output on deployments that changed nothing — and one of those charts is the thing being toggled. Every default stays true, so rendering for aws and azure is byte-identical to v0.73.0: 2719 and 2823 lines, zero diff. With all toggles false a DigitalOcean deployment now renders zero Applications; with only argocd true, exactly one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sete templates eram marcados
core: cannot be disablede ignoravam o mapacomponentspor completo. Cinco deles já tinham chave nesse mapa —argocd,cert-manager,kyverno,external-secrets,cnpg— documentada como toggle e com defaulttrue. Ninguém a lia.Por que isso importa
A consequência só aparece quando conta: subir a plataforma num provider novo, onde o objetivo inteiro é ligar um componente por vez e verificar antes do próximo. Com onze Applications renderizando independentemente de todos os toggles estarem
false, o primeiro sync instala um conjunto que ninguém escolheu.O que muda
Cada um passa a ler a própria chave. Os três sem chave própria seguem aquilo sem o que não funcionam, em vez de ganhar uma:
cluster-secret-storeeplatform-secrets→external-secrets(um ClusterSecretStore e um ExternalSecret são custom resources dele)kyverno-exceptions→kyverno(PolicyExceptions, mesmo raciocínio)resource-quotasganha chave, porque não tinha nenhuma e era o único componente que nada conseguia desligar.Essa chave é excluída do
componentsForwarding: repassá-la adicionaria uma entrada ao mapa que os charts filhos denetwork-policieseresource-quotasconsomem, mudando output renderizado em deployments que não mudaram nada — e um desses charts é justamente o que está sendo ligado/desligado.Sem regressão
Todos os defaults seguem
true:Os 4 AppProjects seguem renderizando: são o andaime que toda Application referencia (
project: platform), não workload.