k8s add snapshotter and snapshot-controller to tenant k8s - #1203

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

packages/system/volumesnapshot-crd-for-tenant-k8s/Chart.yaml (1)

1-3: Add basic chart metadata

The chart will fail a standard helm lint because mandatory informational fields are missing.
At minimum add:

description: VolumeSnapshot CRDs for tenant clusters
appVersion: "v8.2.1"          # matches controller image tag

Consider also bumping version to a sem-ver such as 0.1.0; a 0.0.0 placeholder can trip up flux/helm version comparators.

packages/apps/kubernetes/templates/csi/deploy.yaml (1)

162-171: No resource limits for snapshot components

Both snapshot containers run cluster-wide controllers; leaving resources empty can starve critical I/O paths on busy clusters.

resources:
  requests:
    cpu: 50m
    memory: 64Mi
  limits:
    cpu: 250m
    memory: 256Mi

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

packages/apps/kubernetes/templates/csi/deploy.yaml (1)

157-185: Socket path drift – side-cars can’t talk to the driver

The new csi-snapshotter uses /csi/csi.sock, while the driver and the other
side-cars mount /var/lib/csi/sockets/pluginproxy/csi.sock.
A mismatch causes gRPC connection failures and the snapshotter will crash-loop.

-  - --csi-address=$(ADDRESS)
-  ...
-  - name: ADDRESS
-    value: /csi/csi.sock
-  volumeMounts:
-  - mountPath: /csi
-    name: socket-dir
+  - --csi-address=$(ADDRESS)
+  ...
+  - name: ADDRESS
+    value: /var/lib/csi/sockets/pluginproxy/csi.sock
+  volumeMounts:
+  - mountPath: /var/lib/csi/sockets/pluginproxy
+    name: socket-dir

Mirror the same path in the liveness-probe (lines 139-145) or drop the
duplicate mount entirely.

packages/system/volumesnapshot-crd-for-tenant-k8s/templates/volumesnapshotcontents.yaml (2)

220-223: Broken CEL expression – use namespace, not __namespace__

self.__namespace__ is not a valid field and the CRD will be rejected by the
API server. Replace with the standard namespace.

-  rule: has(self.name) && has(self.__namespace__)
+  rule: has(self.name) && has(self.namespace)

---

452-457: status: must be stripped from CRD manifests

The status stanza is cluster-managed and forbidden on create/update.
Leaving it in causes invalid: status: Forbidden errors during installation.

-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

packages/system/volumesnapshot-crd-for-tenant-k8s/Makefile (1)

6-8: Add .PHONY + helper targets to satisfy checkmake and avoid accidental file collisions

all/clean/test are missing, triggering the static-analysis warnings and making the Makefile harder to use from CI.

+.PHONY: all update clean test
+
+all: update
+
+clean:
+	 rm -rf templates
+
+test:
+	@echo "Nothing to test – ensure CRDs render"  # stub

packages/apps/kubernetes/templates/helmreleases/volumesnapshot_crd.yaml (1)

4-4: Wrap template expressions in quotes to avoid YAML syntax errors

Unquoted {{ ... }} renders to e.g. tenant-volumesnapshot-crd-for-tenant-k8s.
If the release name ever contains a colon or other special chars, YAML will break.
Quoting also silences the YAML-lint error you’re seeing.

-  name: {{ .Release.Name }}-volumesnapshot-crd-for-tenant-k8s
+  name: "{{ .Release.Name }}-volumesnapshot-crd-for-tenant-k8s"

Apply the same quoting pattern to other unquoted template values (lines 20-26, 34-39).

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

Learnt from: lllamnyp
PR: cozystack/cozystack#1160
File: packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml:6-8
Timestamp: 2025-07-11T06:28:13.696Z
Learning: In Helm templates, the `{{-` directive chomps all leading whitespace including newlines back to the previous content, so `{{- toYaml .Values.something | nindent 2 }}` will render correctly even with apparent indentation issues. However, for better style, it's cleaner to put the template directive on the same line as the parent key (e.g., `rules: {{- toYaml .Values.serviceAccount.permissions | nindent 2 }}`).