Skip to content

fix(#4770): Fix status-only startup without initializing the constraint client - #4780

Open
7487 wants to merge 3 commits into
open-policy-agent:masterfrom
7487:fix/issue-4770-fix-status-only-startup-without-initiali
Open

7487 wants to merge 3 commits into
open-policy-agent:masterfrom
7487:fix/issue-4770-fix-status-only-startup-without-initiali

Conversation

@7487

@7487 7487 commented Aug 25, 2026

Copy link
Copy Markdown

What this PR does / why we need it

HasValidationOperations currently classifies status as policy validation. A status-only process therefore constructs a constraint client without an audit or webhook enforcement point and fails during startup. It also starts validation ingestion controllers that status aggregation does not need.

This change:

  • scopes validation operations to audit and webhook;
  • registers only the Constraint and ConstraintTemplate status aggregators in status-only mode;
  • lets the Constraint status aggregator read from the API-backed manager client when there is no validation dynamic watch;
  • keeps the existing dynamic-watch path for audit/webhook combinations; and
  • adds the root package to native test targets so status-only controller setup remains covered.

Verification

  • TDD red phase: TestHasValidationOperations/status_only failed before the predicate fix.
  • go test ./pkg/operations ./pkg/controller/constraintstatus ./pkg/controller/constrainttemplate ./pkg/controller/constrainttemplatestatus
  • go test . -run TestSetupControllersStatusOnly with Kubernetes 1.33 envtest assets
  • make native-test
  • make native-race-test
  • golangci-lint v2.9.0 run . ./pkg/operations/... ./pkg/controller/constraintstatus/... ./pkg/controller/constrainttemplate/... (0 issues)
  • go vet ./...
  • go build ./...
  • direct manager and gator binary builds with the repository's version ldflag

Fixes #4770

Signed-off-by: 7487 <1042653432@qq.com>
@7487
7487 requested a review from a team as a code owner August 25, 2026 02:47
@linux-foundation-easycla

linux-foundation-easycla Bot commented Aug 25, 2026

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

  • ✅ login: 7487 / name: 7487 (f352b6d)

@7487

7487 commented Sep 1, 2026

Copy link
Copy Markdown
Author

/easycla

1 similar comment
@7487

7487 commented Sep 1, 2026

Copy link
Copy Markdown
Author

/easycla

7487 added 2 commits September 1, 2026 16:51
…x-status-only-startup-without-initiali

Signed-off-by: 7487 <1042653432@qq.com>
Signed-off-by: 7487 <1042653432@qq.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The test does not start the manager or verify the required status aggregation behavior.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Decouples status aggregation from validation initialization so status-only Gatekeeper instances can configure controllers without a constraint client.

Changes:

  • Limits validation operations to audit and webhook.
  • Registers status aggregators independently with API-backed reads in status-only mode.
  • Adds focused predicate and controller-setup tests.
File summaries
File Description
pkg/operations/operations.go Excludes status from validation operations.
pkg/operations/operations_test.go Tests operation combinations.
pkg/controller/constrainttemplate/constrainttemplate_controller.go Separates status-controller registration and optional watches.
pkg/controller/constraintstatus/constraintstatus_controller.go Supports API-backed status-only reconciliation.
main_test.go Adds status-only setup coverage.
Review details
  • Files reviewed: 5/5 changed files
  • Comments generated: 1
  • Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread main_test.go

setupFinished := make(chan struct{})
close(setupFinished)
if err := setupControllers(context.Background(), mgr, tracker, setupFinished); err != nil {
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fix status-only startup without initializing the constraint client

2 participants