[Backport release-1.5] fix(tenant): inherit full ancestor label chain from parent namespace by github-actions[bot] · Pull Request #3191 · cozystack/cozystack

github-actions · 2026-07-03T13:12:44Z

Description

Backport of #2912 to release-1.5.

github-actions · 2026-07-03T13:12:46Z

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-2912-to-release-1.5
git worktree add --checkout .worktree/backport-2912-to-release-1.5 backport-2912-to-release-1.5
cd .worktree/backport-2912-to-release-1.5
git reset --hard HEAD^
git cherry-pick -x 59964043e390a7830f79c838cd754d7da0d066d4
git push --force-with-lease

gemini-code-assist · 2026-07-15T09:38:47Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a critical issue where nested tenant namespaces were failing to inherit the full chain of ancestor labels, breaking network policies that rely on these labels for cross-tenant communication. By shifting to a deterministic label derivation based on namespace naming conventions and providing a backfill migration, the changes ensure consistent network reachability across the tenant hierarchy.

Highlights

Deterministic Ancestor Labeling: Implemented a new Helm helper tenant.ancestorTenantLabels that deterministically derives the full ancestor label chain from the namespace name, ensuring all tenants correctly inherit labels from their parent hierarchy regardless of reconciliation order.
Migration 46: Added a migration script to backfill missing ancestor labels on existing tenant namespaces, ensuring immediate cluster health without requiring manual re-reconciliation of every tenant.
Regression Testing: Introduced comprehensive unit tests for namespace ancestor labels to verify that tenants at various depths correctly receive the full chain of ancestor labels.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request improves how tenant namespace ancestor labels are derived by computing the full ancestor chain directly from the namespace name, resolving an issue where nested tenants at depth >= 2 dropped the tenant-root label and broke network policies. It also adds unit tests, updates the namespace template to support offline rendering, and introduces a migration script to backfill labels on existing namespaces. Feedback on this PR highlights a compatibility issue in the migration script, where set -o pipefail is used with a #!/bin/sh shebang (which will fail on systems using dash as the default shell), and notes that the PR description is missing the required release-note block specified in the style guide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-07-15T09:40:44Z

+# kubectl label --overwrite only adds/refreshes the listed labels and never
+# removes others.
+
+set -euo pipefail


Using set -o pipefail (or set -euo pipefail) is a non-POSIX extension supported by shells like bash, zsh, and ksh, but it is not supported by standard POSIX sh (such as dash, which is the default /bin/sh on Debian/Ubuntu systems). Since the shebang of this script is #!/bin/sh, running this script on systems where /bin/sh is dash will result in a startup failure like set: Illegal option -o pipefail, which would block the entire platform migration.

Since there are no other pipelines in this script where pipefail is needed (the only pipeline at line 34-36 already has || true at the end), we can safely change this to set -eu to ensure POSIX compatibility.

Suggested change

set -euo pipefail

set -eu

gemini-code-assist · 2026-07-15T09:40:44Z

  enabled: false
  image: ghcr.io/cozystack/cozystack/platform-migrations:v1.5.2@sha256:5d601b0709c578945f2e04d655b77d29008c94666a4350e67960c9f6bf9d2bde
-  targetVersion: 45
+  targetVersion: 46


The pull request description is missing the required release-note block. According to the Repository Style Guide, every PR must contain a release note block in its body to document changes for the changelog.

Please update the PR description to include the following block:

```release-note fix(tenant): inherit full ancestor label chain from parent namespace

<details> <summary>References</summary> 1. PR body must contain a release note block: ```release-note ... ```. Flag any PR whose commits lack the Conventional Commits format or signoff, or whose body has no release-note block. <sup>([link](https://github.com/cozystack/cozystack/blob/main/.gemini/styleguide.md))</sup> </details>

Backfill tenant.cozystack.io/<ancestor> labels on existing tenant namespaces so clusters heal on upgrade without waiting on each tenant HelmRelease to re-reconcile (#2810/#2171). Backport of migration 49 from #2912, adapted for release-1.5: - migration file 49 -> 46. The existing backport PR #3191 renumbered it to 45, but the SeaweedFS repair migration backported alongside it (#3339 / #3370) claims 45 too, so the two collide. Whichever of those two PRs merges second has to take 46; here the SeaweedFS one keeps 45 because it is what the 1.5.x line is being cut for. - targetVersion 45 -> 47, covering both new migrations. #3191 alone bumps it to 46, and because the two backports agree on that value git merges them without a conflict — leaving targetVersion one short of the highest migration, which run-migrations.sh silently skips (its loop stops at TARGET-1). release-1.5 has no `migrations-target-check` to catch it; that guard arrived on main after v1.5.2 and was never backported. - stamp via the inline labeled-ConfigMap apply used by release-1.5 migrations, since lib/cozystack-version.sh does not exist on this branch Best-effort and idempotent: kubectl label --overwrite adds only the listed labels, and per-namespace failures are tolerated so a transient apiserver error cannot abort the platform upgrade. (cherry picked from commit 50f78ce) Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> (cherry picked from commit aee9fa85b65d96dae1dff7e5044fd26ce710797e)

The tenant.cozystack.io/<ancestor> namespace labels drive the <ancestor>-egress CiliumClusterwideNetworkPolicy, which lets an ancestor tenant reach a descendant namespace only when the descendant carries tenant.cozystack.io/<ancestor>. namespace.yaml derived that chain by splitting .Release.Namespace, which only reached one level up: a direct child of tenant-root got tenant-root, but a grandchild (tenant-ktj-htdev under tenant-ktj) got only tenant-ktj and dropped tenant-root entirely. The root ingress controller in tenant-root then could not reach nested tenants, surfacing as upstream timeouts. Derive the chain deterministically from the namespace name instead. Every tenant descends from tenant-root, and tenant.name builds each child as <parent-namespace>-<word>, so every progressive dash-prefix of the name is a real ancestor namespace. This needs no cluster lookup, renders offline (so it is unit-testable), and converges on every reconcile regardless of parent/child HelmRelease ordering. The ownerReference lookup is made non-fatal so the template still renders when the parent namespace lookup is empty; in a real reconcile the parent always exists and the ownerReference is always emitted. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com> (cherry picked from commit 1ac9398) (cherry picked from commit 6ce0907) (cherry picked from commit ac7176257b517cbb09fc1792f90ce1f2a18d89be)

myasnikovdaniil · 2026-08-04T09:10:38Z

Rebased onto current release-1.5 and reduced to the chart fix. Two changes from what was here before.

The seaweedfs commits are gone. This branch carried four of them because it was stacked on the seaweedfs backport; those landed via #3370, so the rebase dropped them as already-applied. What remains is the tenant change this PR is actually about: _helpers.tpl, namespace.yaml, and the unit test.

Migration 46 and the targetVersion bump are dropped deliberately. They would have sprung the forward-upgrade trap described in docs/release.md under "Backporting code that touches monotonic counters". Slot 46 on release-1.6 holds the kuberneteses.apps.cozystack.io spec.version bump from v1.30 to v1.31; claiming slot 46 here and raising targetVersion to 47 would mean a cluster that takes this patch and then upgrades to 1.6 walks seq 47 53 and never runs it, leaving tenants on v1.30 — which the 1.6 chart refuses to render at all, via an explicit fail() guard in templates/_versions.tpl. That turns a missing label into a blocked upgrade.

Dropping the backfill costs little, on the migration's own terms: it exists only so clusters heal "without waiting on each tenant HelmRelease to re-reconcile", it is "best-effort by design", and it states that if a relabel is skipped the worst case "is strictly no worse than the status quo". The chart fix does the real work — every tenant namespace self-computes its full ancestor chain from its own name on the next reconcile. So on this branch the labels converge as tenant releases reconcile instead of being backfilled in one pass, and slot 46 stays aligned with release-1.6.

helm unittest passes 20/20 in packages/apps/tenant.

github-actions Bot mentioned this pull request Jul 3, 2026

fix(tenant): inherit full ancestor label chain from parent namespace #2912

Merged

6 tasks

myasnikovdaniil force-pushed the backport-2912-to-release-1.5 branch from c17b64b to 50f78ce Compare July 8, 2026 04:39

github-actions Bot added size/L This PR changes 100-499 lines, ignoring generated files area/release Issues or PRs related to release tooling (changelog, backport, release pipeline) kind/bug Categorizes issue or PR as related to a bug labels Jul 8, 2026

myasnikovdaniil marked this pull request as ready for review July 15, 2026 09:35

myasnikovdaniil requested review from IvanHunters, Andrey Kolkov (androndo), Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners July 15, 2026 09:35

dosubot Bot added the backport Should change be backported on previous release label Jul 15, 2026

gemini-code-assist Bot reviewed Jul 15, 2026

View reviewed changes

dosubot Bot mentioned this pull request Jul 29, 2026

OIDC access fails for sub-tenant clusters due to missing Cilium egress rule #3486

Open

myasnikovdaniil force-pushed the backport-2912-to-release-1.5 branch from 50f78ce to 3b7c67d Compare July 31, 2026 05:28

github-actions Bot added size/XXL This PR changes 1000+ lines, ignoring generated files area/tenant Issues or PRs related to the tenant chart and multi-tenancy and removed size/L This PR changes 100-499 lines, ignoring generated files labels Jul 31, 2026

myasnikovdaniil force-pushed the backport-2912-to-release-1.5 branch from 3b7c67d to 55d6a5d Compare August 4, 2026 09:10

github-actions Bot added size/L This PR changes 100-499 lines, ignoring generated files and removed size/XXL This PR changes 1000+ lines, ignoring generated files labels Aug 4, 2026

myasnikovdaniil merged commit 71ff099 into release-1.5 Aug 4, 2026
7 of 8 checks passed

myasnikovdaniil deleted the backport-2912-to-release-1.5 branch August 4, 2026 09:48

Navigation Menu

Uh oh!

[Backport release-1.5] fix(tenant): inherit full ancestor label chain from parent namespace - #3191

[Backport release-1.5] fix(tenant): inherit full ancestor label chain from parent namespace#3191
myasnikovdaniil merged 1 commit into
release-1.5from
backport-2912-to-release-1.5

github-actions Bot commented Jul 3, 2026

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

gemini-code-assist Bot commented Jul 15, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jul 15, 2026

Uh oh!

gemini-code-assist Bot Jul 15, 2026

Uh oh!

myasnikovdaniil commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

github-actions Bot commented Jul 3, 2026

Description

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

gemini-code-assist Bot commented Jul 15, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

myasnikovdaniil commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants