Repository navigation
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Dedicated cluster and task lifecycle Taskfile.yml, test/e2e/Taskfile-e2e.yml, test/e2e/cluster/*, test/e2e/setup/manifests/*, test/mutationlab/Taskfile-lab.yml, test/mutationlab/README.md, test/mutationlab/Dockerfile, test/mutationlab/swap-image.sh, hack/e2e/lab-port-forward.sh, docs/spec/*, docs/design/mutation-capture-lab-own-cluster.md, docs/tasks-overview.md, docs/proud.md |
The lab has separate bootstrap, capture, corpus-update, status, and cleanup tasks. Cluster creation can preserve the current kubeconfig context. The prior e2e image-swap tasks and lab port-forward script are removed. |
Lab deployment and capture sources test/mutationlab/deploy.sh, test/mutationlab/deploy/*, test/mutationlab/tools/lab-certs/*, test/mutationlab/port-forward.sh, test/mutationlab/e2e/*, cmd/mutation-capture-lab/main.go, internal/mutationlab/labserver/api.go |
The lab deployment adds separate webhook/API and audit Services, a validating webhook, and read-only watch permissions. The certificate command creates serving and client certificates and the audit kubeconfig. E2E checks probe audit, admission, conversion, watch, and aggregated API capture paths. |
Capture provenance and corpus updates test/mutationlab/e2e/cluster_provenance_test.go, test/mutationlab/corpus/*, test/mutationlab/selfcontained_test.go, docs/design/mutation-capture-lab-own-cluster.md |
The provenance test checks the cluster version against the image tag and can update the recorded image, version, and date. The corpus records impersonation metadata and Kubernetes output changes. Self-containment tests check task references and lab wiring. |
Scheduled capture workflow .github/workflows/mutation-lab.yml, docs/ci-overview.md, docs/design/mutation-capture-lab-own-cluster.md |
The workflow runs capture nightly or by manual dispatch with read-only permissions. On failure, it attempts to collect pod and deployment logs. CI documentation lists the workflow. |
Priority:
Estimated code review effort: 4 (Complex) | ~60 minutes
Change: Feature
Sequence Diagram(s)
sequenceDiagram
participant SourceTest as TestSourcesLive
participant Cluster as Kubernetes cluster
participant Lab as Mutation capture lab
participant Records as Records API
SourceTest->>Cluster: Create probes for capture sources
Cluster->>Lab: Send capture traffic
SourceTest->>Records: Poll for scenario records
Records-->>SourceTest: Return captured records
Merge Risk: 
7431e
-
No specific issue is established that would prevent merging the standalone lab change after normal checks.
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 43.90% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surv… Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Title check The title clearly and concisely describes the primary change: moving the mutation lab to its own cluster. Description check The description is detailed, directly related to the changes, and includes the motivation, implementation scope, compatibility details, and validation results. It does not use the template headings or… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Description check
-
Explanation
The description is detailed, directly related to the changes, and includes the motivation, implementation scope, compatibility details, and validation results. It does not use the template headings or checkbox sections for change type and checklist, but the substantive information is mostly complete.
-
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 43.90% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 41 functions across 14 files. (41 skipped: 41 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
-
Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
The lab swapped its image into the product's controller Deployment on the e2e cluster and borrowed its admission registration, serving certificate, and Service. fd6f693 removed the admission webhook, and the lab lost its admission source and the conversion webhook's CA while every check stayed green, because nothing ran the lab. The lab now runs on its own k3d cluster, gitops-reverser-capture-lab, with nothing of the product on it. Every source arrives through its real mechanism: the API server's audit webhook backend posts to a NodePort over mutual TLS (the lab now requires the client certificate), a ValidatingWebhookConfiguration of its own sends admission reviews, the Widget CRD's conversion webhook calls the lab's Service, the wardle sample API server serves flunders, and the lab watches with read-only RBAC. lab-certs issues the CA, serving certificate, and the API server's client certificate before the cluster exists, so the audit kubeconfig is final at startup and the node never restarts. The registration keeps the match rules and the name the corpus was captured under: the API server keys the recorder's audit annotation by the webhook's name, so renaming it changes 13 corpus rows. test/mutationlab/Taskfile-lab.yml carries lab-bootstrap, lab-capture, lab-corpus-update, lab-status, and lab-cleanup. The cluster can run beside e2e: its own stamps, lock, and port, and start-cluster.sh gains K3D_SWITCH_CONTEXT=false so creating it never moves the current context. lab-bootstrap ends with TestSourcesLive, which proves each of the five sources with a probe write; TestClusterProvenance fails a capture on another server version than CLUSTER.md records, and writes those rows on an update. selfcontained_test.go keeps the lab off product tasks, product resource names, and unshared paths, and mutation-lab.yml runs lab-capture nightly. lab-e2e, _lab-deployed, swap-image.sh, and hack/e2e/lab-port-forward.sh are removed. The sample API server gains a kustomization.yaml that both clusters apply; the e2e render is byte-identical. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…36.4 Same k3s version as before (v1.36.4+k3s1); only the delivery path changed. 19 of 21 scenarios reproduce byte for byte. The audit events of the impersonated actors in rows 8a and 19 (15 files) each gain authenticationMetadata.impersonationConstraint: impersonate:user-info; the ServiceAccount-token patch in row 8a does not. The field comes from the API server, not the new wiring: a plain k3s v1.36.1 and v1.36.4 cluster with an audit log backend and none of the lab's wiring records it for the same impersonated write. Why the committed rows, captured on the e2e cluster, lacked it is not known. The fact-index tests that replay these rows pass unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…'s version Only the Kubernetes version changed since the previous commit, so this diff is the 1.36.4 → 1.37.1 changelog for what the corpus records. Each change reproduced in a second capture: - deletecollection: the response's list resourceVersion is the last deleted object's own, where 1.36 returned a newer one, so the watch DELETED placeholders shift by one; - graceful pod delete: PodReadyToStartContainers gains reason PodSandboxNotReady and a message; - owner-ref cascade: the garbage collector's userAgent names v1.37.1. The fact-index tests that replay the corpus pass unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sunib
force-pushed
the
feat/mutation-capture-lab-own-cluster
branch
from
October 27, 2026 16:50
7431ea3 to
c7707d5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #456.
Implements docs/design/mutation-capture-lab-own-cluster.md.
Why
The mutation-capture lab swapped its image into the product's controller Deployment on the e2e cluster and borrowed its admission registration, serving certificate, and Service. When #456 removed the admission webhook (fd6f693), the lab lost its admission source and the CA its CRD conversion webhook used. Nothing noticed, because nothing ran the lab.
What
The lab now runs on its own k3d cluster,
gitops-reverser-capture-lab, with nothing of the product on it. Each source arrives through its real mechanism:ValidatingWebhookConfiguration, with the match rules and the name the corpus was captured underwardlemanifests e2e uses, through a newkustomization.yamltest/mutationlab/tools/lab-certsissues the CA, the serving certificate, and the API server's client certificate before the cluster exists. The audit kubeconfig is final at startup, so the node never restarts and one node is enough.test/mutationlab/Taskfile-lab.ymlprovideslab-bootstrap,lab-capture,lab-corpus-update,lab-status, andlab-cleanup.lab.lock, and port 18081.start-cluster.shgainsK3D_SWITCH_CONTEXT=false, so creating the lab cluster never moves the current context.TestSourcesLive(run bylab-bootstrap) proves all five sources with probe writes.TestClusterProvenancefails a capture when the cluster serves another version thanCLUSTER.mdrecords, and writes those rows on an update.test/mutationlab/selfcontained_test.go(intask test) fails on a lab task that calls a non-lab task, a product resource name, or an unshared path..github/workflows/mutation-lab.ymlrunslab-capturenightly and on dispatch.lab-e2e,_lab-deployed,swap-image.sh,hack/e2e/lab-port-forward.sh.Does it still capture the same thing?
The corpus was recaptured on the same k3s v1.36.4, in its own commit:
authenticationMetadata.impersonationConstraint: impersonate:user-info. The ServiceAccount-token patch in row 8a does not.The webhook rename taught one thing: the API server keys the recorder's audit annotation (
validate-all.configbutler.ai/scenario) by the webhook's name. The name is therefore part of the corpus and stays as it was.Then on v1.37.1
A third commit moves the pin to v1.37.1, the e2e cluster's version, so its diff is the Kubernetes change alone. Each change reproduced in a second capture:
PodReadyToStartContainersgainsreason: PodSandboxNotReadyand a message.userAgentnow names v1.37.1.Validation
task lintandtask testpass.task lab-capturepasses on v1.36.4 (25 tests), and twice on v1.37.1. It ran beside the running e2e cluster, which kept the current context.test/e2e/setup/manifestsis byte-identical.🤖 Generated with Claude Code
Summary by CodeRabbit