Skip to content

HYPERFLEET-839 - fix: require explicit NAMESPACE to prevent Pub/Sub c… #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
May 11, 2026
+66 −45
Merged

HYPERFLEET-839 - fix: require explicit NAMESPACE to prevent Pub/Sub c… #86

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions deploy-scripts/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,10 @@
# cp .env.example .env

# Kubernetes Configuration
export NAMESPACE="${NAMESPACE:-hyperfleet-e2e}"

# NAMESPACE must be unique to prevent GCP Pub/Sub topic/subscription collisions.
# GCP resources are named using the namespace (e.g., ${NAMESPACE}-clusters),
# so multiple users sharing the same namespace will interfere with each other's tests.
export NAMESPACE="${NAMESPACE:-hyperfleet-e2e-$(echo ${USER:-default} | tr '[:upper:]' '[:lower:]')}"

# Provider Configuration
export GCP_PROJECT_ID="${GCP_PROJECT_ID:-hcm-hyperfleet}"
Expand Down
41 changes: 21 additions & 20 deletions deploy-scripts/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,14 +39,14 @@ Ensure you have:
Install all components with default settings:

```bash
./deploy-scripts/deploy-clm.sh --action install --namespace hyperfleet-e2e
./deploy-scripts/deploy-clm.sh --action install --namespace <unique_namespace>
```

Install with custom image tags:

```bash
./deploy-scripts/deploy-clm.sh --action install \
--namespace my-test-env \
--namespace <unique_namespace> \
--api-image-tag v1.2.0 \
--sentinel-image-tag v1.2.0 \
--adapter-image-tag v1.2.0
Expand All @@ -55,7 +55,7 @@ Install with custom image tags:
Uninstall all components:

```bash
./deploy-scripts/deploy-clm.sh --action uninstall --namespace hyperfleet-e2e
./deploy-scripts/deploy-clm.sh --action uninstall --namespace <unique_namespace>
```

### Option 2: Using .env File (Recommended for Complex Configurations)
Expand All @@ -74,7 +74,7 @@ For easier management of deployment parameters, use a `.env` file:
```

Key parameters you can configure:
- `NAMESPACE` - Kubernetes namespace (default: `hyperfleet-e2e`)
- `NAMESPACE` - Kubernetes namespace (default: `hyperfleet-e2e-$USER`)
- `IMAGE_REGISTRY` - Container image registry
- `API_IMAGE_TAG`, `SENTINEL_IMAGE_TAG`, `ADAPTER_IMAGE_TAG` - Image tags
- `GCP_PROJECT_ID` - Google Cloud Project ID for Pub/Sub
Expand Down Expand Up @@ -114,7 +114,7 @@ For basic usage, see [Quick Start](#quick-start) section above.

| Flag | Description | Default |
|------|-------------|---------|
| `--namespace <namespace>` | Kubernetes namespace for deployment | `hyperfleet-e2e` |
| `--namespace <namespace>` | Kubernetes namespace for deployment | `hyperfleet-e2e-$USER` |
| `--dry-run` | Print commands without executing | `false` |
| `--verbose` | Enable verbose logging | `false` |
| `--help` | Show help message | - |
Expand Down Expand Up @@ -151,7 +151,7 @@ For basic usage, see [Quick Start](#quick-start) section above.
#### 1. Install with Default Settings

```bash
./deploy-scripts/deploy-clm.sh --action install --namespace hyperfleet-e2e
./deploy-scripts/deploy-clm.sh --action install --namespace <unique_namespace>
```

This installs all three components (API, Sentinel, Adapter) with default configurations.
Expand All @@ -160,15 +160,15 @@ This installs all three components (API, Sentinel, Adapter) with default configu

```bash
./deploy-scripts/deploy-clm.sh --action install \
--namespace test-env \
--namespace <unique_namespace> \
--skip-adapter
```

#### 3. Install with Custom Image Tags

```bash
./deploy-scripts/deploy-clm.sh --action install \
--namespace staging \
--namespace <unique_namespace> \
--api-image-tag v1.2.0 \
--sentinel-image-tag v1.2.0 \
--adapter-image-tag v1.2.0
Expand All @@ -178,7 +178,7 @@ This installs all three components (API, Sentinel, Adapter) with default configu

```bash
./deploy-scripts/deploy-clm.sh --action install \
--namespace dev-test \
--namespace <unique_namespace> \
--api-image-repo myregistry.io/hyperfleet-api \
--api-image-tag pr-123
```
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Expand All @@ -187,7 +187,7 @@ This installs all three components (API, Sentinel, Adapter) with default configu

```bash
./deploy-scripts/deploy-clm.sh --action install \
--namespace test \
--namespace <unique_namespace> \
--dry-run \
--verbose
```
Expand All @@ -199,7 +199,7 @@ This simulates the installation without making any actual changes.
#### 1. Uninstall All Components

```bash
./deploy-scripts/deploy-clm.sh --action uninstall --namespace hyperfleet-e2e
./deploy-scripts/deploy-clm.sh --action uninstall --namespace <unique_namespace>
```

This removes all Helm releases.
Expand All @@ -208,7 +208,7 @@ This removes all Helm releases.

```bash
./deploy-scripts/deploy-clm.sh --action uninstall \
--namespace test-env \
--namespace <unique_namespace> \
--dry-run \
--verbose
```
Expand All @@ -217,7 +217,7 @@ This removes all Helm releases.

```bash
./deploy-scripts/deploy-clm.sh --action uninstall \
--namespace test-env \
--namespace <unique_namespace> \
--skip-api \
--skip-sentinel
```
Expand Down Expand Up @@ -251,15 +251,16 @@ The script leverages Helm's built-in namespace management:

- **Installation**: Namespace is automatically created by Helm using the `--create-namespace` flag
- **Uninstallation**: Resources are removed by `helm uninstall`, but the namespace is **not deleted**
- **Uniqueness**: Each deployment requires a unique namespace to prevent GCP Pub/Sub resource collisions.

If you want to completely remove the namespace after uninstallation:

```bash
# Uninstall components
./deploy-scripts/deploy-clm.sh --action uninstall --namespace test-env
./deploy-scripts/deploy-clm.sh --action uninstall --namespace <unique_namespace>

# Manually delete namespace if desired
kubectl delete namespace test-env
kubectl delete namespace <unique_namespace>
```

This design allows you to:
Expand All @@ -275,7 +276,7 @@ Use `--dry-run --verbose` flags to see what the script would do without making c

```bash
./deploy-scripts/deploy-clm.sh --action install \
--namespace test \
--namespace <unique_namespace> \
--dry-run \
--verbose
```
Expand All @@ -291,7 +292,7 @@ kubectl logs -n <namespace> <pod-name>
View script execution with bash trace:

```bash
bash -x deploy-scripts/deploy-clm.sh --action install --namespace test
bash -x deploy-scripts/deploy-clm.sh --action install --namespace <unique_namespace>
```

## Integration with E2E Tests
Expand All @@ -302,10 +303,10 @@ Before running E2E tests, deploy the CLM components:

```bash
# Deploy test environment
./deploy-scripts/deploy-clm.sh --action install --namespace e2e-test
./deploy-scripts/deploy-clm.sh --action install --namespace <unique_namespace>

# Configure E2E test API URL
EXTERNAL_IP=$(kubectl get svc hyperfleet-api -n $NAMESPACE_NAME -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
EXTERNAL_IP=$(kubectl get svc hyperfleet-api -n $NAMESPACE -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
export HYPERFLEET_API_URL="http://${EXTERNAL_IP}:8000"

# Run E2E tests
Expand All @@ -317,7 +318,7 @@ export HYPERFLEET_API_URL="http://${EXTERNAL_IP}:8000"
After tests complete:

```bash
./deploy-scripts/deploy-clm.sh --action uninstall --namespace e2e-test
./deploy-scripts/deploy-clm.sh --action uninstall --namespace <unique_namespace>
```

## Script Output
Expand Down
64 changes: 41 additions & 23 deletions deploy-scripts/deploy-clm.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,11 @@
# (API, Sentinel, and Adapters) using Helm for E2E testing environments.
#
# Usage:
# ./deploy-clm.sh --action install --namespace hyperfleet-e2e
# ./deploy-clm.sh --action uninstall --namespace hyperfleet-e2e --dry-run
# ./deploy-clm.sh --action install
# ./deploy-clm.sh --action uninstall --dry-run --namespace <unique_namespace>
#
# Set NAMESPACE in .env file or use --namespace flag.
# Each deployment requires a unique namespace to prevent GCP Pub/Sub resource collisions.

set -euo pipefail

Expand Down Expand Up @@ -38,7 +41,7 @@ fi
# ============================================================================

ACTION="${ACTION:-}"
NAMESPACE="${NAMESPACE:-hyperfleet-e2e}"
NAMESPACE="${NAMESPACE:-}"
DRY_RUN="${DRY_RUN:-false}"
VERBOSE="${VERBOSE:-false}"

Expand Down Expand Up @@ -124,13 +127,16 @@ Automated deployment script for HyperFleet CLM components (API, Sentinel, Adapte

CONFIGURATION:
This script loads configuration from ${SCRIPT_DIR}/.env file.
You can override any .env value using command-line flags.
Command-line flags override .env values.

NAMESPACE should be unique to prevent GCP Pub/Sub collisions.
Recommended: set NAMESPACE=hyperfleet-e2e-\$USER in .env file.

Comment on lines +132 to 134
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Align the help-text recommendation with the canonical .env default.

Line 133 recommends NAMESPACE=hyperfleet-e2e-$USER, which can drift from the .env.example behavior and lead users to values later rejected by validation. Please point users to the .env.example default expression (lowercased user) or to --namespace <unique_namespace>.

Suggested doc tweak 
-    Recommended: set NAMESPACE=hyperfleet-e2e-\$USER in .env file.
+    Recommended: use the default in .env.example (hyperfleet-e2e-<lowercased-user>)
+    or pass --namespace <unique_namespace>.

As per coding guidelines, "deploy-scripts/.env.example ... should remain the canonical place for the default namespace behavior that deploy-clm.sh expects users to use."

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deploy-scripts/deploy-clm.sh` around lines 132 - 134, Update the help text in
deploy-clm.sh that currently recommends setting NAMESPACE=hyperfleet-e2e-$USER
so it instead references the canonical default in deploy-scripts/.env.example
(which uses the lowercased user expression) or suggests using the --namespace
<unique_namespace> flag; modify the NAMESPACE recommendation string and any
related usage/help output in deploy-clm.sh to match the .env.example behavior
(lowercase user expression) and/or mention the --namespace option to avoid
validation mismatches.

REQUIRED FLAGS:
--action <action> Action to perform: install or uninstall

OPTIONAL FLAGS:
--namespace <namespace> Kubernetes namespace (default: hyperfleet-e2e)
--namespace <namespace> Kubernetes namespace (default from .env: ${NAMESPACE})

# Component Selection
--skip-api Skip API installation
Expand Down Expand Up @@ -187,38 +193,37 @@ ENVIRONMENT VARIABLES:
- API_ADAPTERS_NODEPOOL Adapters for API nodepool config (set per test case)

EXAMPLES:
# Install all components with default settings
${0##*/} --action install --namespace hyperfleet-e2e
# Install with .env defaults
${0##*/} --action install

# Install with explicit namespace
${0##*/} --action install --namespace <unique_namespace>

# Install with custom image tags
${0##*/} --action install \\
--namespace test-env \\
--namespace <unique_namespace> \\
--api-image-tag v1.0.0 \\
--sentinel-image-tag v1.0.0 \\
--adapter-image-tag v1.0.0

# Install only API and Sentinel
${0##*/} --action install --skip-adapter
${0##*/} --action install --namespace <unique_namespace> --skip-adapter

# Dry-run uninstallation
${0##*/} --action uninstall --namespace hyperfleet-e2e --dry-run --verbose
# Dry-run to preview actions
${0##*/} --action uninstall --namespace <unique_namespace> --dry-run --verbose

# Delete Kubernetes resources (Helm releases + namespace)
${0##*/} --action uninstall --namespace hyperfleet-e2e --delete-k8s-resources
# Delete Kubernetes resources
${0##*/} --action uninstall --namespace <unique_namespace> --delete-k8s-resources

# Delete GCP Pub/Sub resources (topics and subscriptions)
${0##*/} --action uninstall --namespace hyperfleet-e2e --delete-cloud-resources
# Delete GCP Pub/Sub resources
${0##*/} --action uninstall --namespace <unique_namespace> --delete-cloud-resources

# Complete cleanup: delete everything (k8s + cloud resources)
${0##*/} --action uninstall --namespace hyperfleet-e2e --all
# Complete cleanup: delete everything
${0##*/} --action uninstall --namespace <unique_namespace> --all

# Or explicitly specify both
${0##*/} --action uninstall --namespace hyperfleet-e2e \\
--delete-k8s-resources \\
--delete-cloud-resources

# Install with custom image repositories
# Install with custom image repository
${0##*/} --action install \\
--namespace <unique_namespace> \\
--api-image-repo myregistry.io/hyperfleet-api \\
--api-image-tag dev-123

Expand Down Expand Up @@ -352,6 +357,19 @@ parse_arguments() {
exit 1
fi

# Validate NAMESPACE variable is set
if [[ -z "${NAMESPACE}" ]]; then
log_error "Missing required flag: --namespace or env variable NAMESPACE"
echo
print_usage
exit 1
fi
Comment thread
coderabbitai[bot] marked this conversation as resolved.

if (( ${#NAMESPACE} > 63 )) || [[ ! "${NAMESPACE}" =~ ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ ]]; then
log_error "Invalid namespace: '${NAMESPACE}'. Must match DNS-1123 label format and be <= 63 chars."
exit 1
fi

if [[ "${ACTION}" != "install" && "${ACTION}" != "uninstall" ]]; then
log_error "Invalid action: ${ACTION}. Must be 'install' or 'uninstall'"
exit 1
Expand Down