feat: namespace-scoped application family

.dmtlint.yaml

@@ -4,20 +4,16 @@ linters-settings:
       enum:
         - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.sts.properties.provider"
         - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.provider"
-        - "spec.versions[1].schema.openAPIV3Schema.properties.spec.properties.provider"
-        - "spec.versions[1].schema.openAPIV3Schema.properties.spec.properties.sts.properties.provider"
         - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.upgrade.properties.remediation.properties.strategy.properties"
         - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.uninstall.properties.deletionPropagation"
         - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.driftDetection.properties.mode"
         - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.upgrade.properties.remediation.properties.strategy"
         - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.chart.properties.spec.properties.verify.properties.provider"
         - "spec.versions[0].schema.openAPIV3Schema.properties.status.properties.lastAttemptedReleaseAction"
-        - "spec.versions[1].schema.openAPIV3Schema.properties.spec.properties.chart.properties.spec.properties.verify.properties.provider"
-        - "spec.versions[1].schema.openAPIV3Schema.properties.spec.properties.driftDetection.properties.mode"
-        - "spec.versions[1].schema.openAPIV3Schema.properties.spec.properties.postRenderers.items.properties.kustomize.properties.patchesJson6902.items.properties.patch.items.properties.op"
-        - "spec.versions[1].schema.openAPIV3Schema.properties.spec.properties.uninstall.properties.deletionPropagation"
-        - "spec.versions[1].schema.openAPIV3Schema.properties.spec.properties.upgrade.properties.remediation.properties.strategy"
-        - "spec.versions[1].schema.openAPIV3Schema.properties.status.properties.lastAttemptedReleaseAction"
+        - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.upgrade.properties.serverSideApply"
+        - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.rollback.properties.serverSideApply"
+        - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.waitStrategy.properties.name"
+        - "spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.postRenderStrategy"
         - "properties.logLevel"
         - "properties.logFormat"
   rbac:

.github/workflows/lint.yaml

@@ -23,25 +23,53 @@ jobs:
         env:
           DMT_METRICS_URL: ${{ secrets.DMT_METRICS_URL }}
           DMT_METRICS_TOKEN: ${{ secrets.DMT_METRICS_TOKEN }}
-# waiting for golangci-lint for go 1.26
-  # lint:
-  #   runs-on: [self-hosted, large]
-  #   name: Lint
-  #   steps:
-  #     - name: Set up Go ${{ vars.GO_VERSION }}
-  #       uses: actions/setup-go@v6
-  #       with:
-  #         go-version: "${{ vars.GO_VERSION }}"
-
-  #     - uses: actions/checkout@v6
-
-  #     - name: Install Task
-  #       uses: arduino/setup-task@v2
-  #       with:
-  #         repo-token: ${{ secrets.GITHUB_TOKEN }}
-
-  #     - name: Install golangci-lint
-  #       run: task --yes deps:install:golangci-lint
-
-  #     - name: Run linters
-  #       run: task --yes lint
+
+  generated_files:
+    runs-on: [self-hosted, large]
+    name: Generated files
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          cache: true
+          go-version-file: api/go.mod
+
+      - name: Install Task
+        uses: arduino/setup-task@v2
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # Regenerates the clients and the CRDs, then fails if anything moved. The
+      # prettier pass over the CRDs runs in a container, so the runner needs Docker.
+      - name: Verify the generated files are committed
+        run: task --yes ci:generate:api
+
+      - name: Verify the internal definitions are committed
+        run: task --yes ci:generate:internal-crds
+
+  lint:
+    runs-on: [self-hosted, large]
+    name: Lint
+    steps:
+      - uses: actions/checkout@v6
+
+      # The modules do not all declare the same Go version; the controllers ask
+      # for the newest one, and a toolchain that satisfies them satisfies the rest.
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          cache: true
+          go-version-file: images/operator-helm-controller/go.mod
+
+      - name: Install Task
+        uses: arduino/setup-task@v2
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # The linter is built from source by the lint task itself, so there is no
+      # separate install step: the shared one could not fetch a release new enough
+      # to read a module targeting this repository's Go version.
+      - name: Run linters
+        run: task --yes lint

.github/workflows/tests.yaml

@@ -0,0 +1,36 @@
+name: Unit tests
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+  push:
+    branches:
+      - main
+      - release-*
+
+env:
+  TASK_X_REMOTE_TASKFILES: 1
+
+jobs:
+  unit_tests:
+    runs-on: [self-hosted, large]
+    name: Unit tests
+    steps:
+      # The modules do not all declare the same Go version; the controllers ask
+      # for the newest one, and a toolchain that satisfies them satisfies the rest.
+      - uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          cache: true
+          go-version-file: images/operator-helm-controller/go.mod
+
+      - name: Install Task
+        uses: arduino/setup-task@v2
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run unit tests
+        run: task --yes test:unit

.helmignore

@@ -21,5 +21,6 @@ LICENSE
 tests/
 Taskfile.yaml
 CHANGELOG/
+bin/
 build/
 requirements.lock

Taskfile.yaml

@@ -6,8 +6,14 @@ vars:
   deckhouse_lib_helm_ver: 1.71.2
   target: ""
   VALIDATION_FILES: "tools/validation/{main,messages,diff,doc_changes}.go"
-  golangciLintVersion: "v2.8.0"
-
+  golangciLintVersion: "v2.13.2"
+
+# Only the modules this repository authors are listed, including tools/internalcrds.
+# images/kube-api-rewriter is a separate upstream module vendored in for the build, and
+# images/helm-controller and images/source-controller carry nothing but their werf
+# files, so none of them is ours to lint, format or test here. The one exception is
+# the rewriter's operatornelm package, which is this module's own rule table: its
+# tests run from test:rewrite-rules below.
 includes:
   api:
     taskfile: ./api/Taskfile.dist.yaml
@@ -18,12 +24,15 @@ includes:
   hooks:
     taskfile: ./images/hooks/Taskfile.dist.yaml
     dir: ./images/hooks
-  artifact:
+  operator-helm-controller:
     taskfile: ./images/operator-helm-controller/Taskfile.dist.yaml
     dir: ./images/operator-helm-controller
-  chart-values-artifact:
+  chart-values-controller:
     taskfile: ./images/chart-values-controller/Taskfile.dist.yaml
     dir: ./images/chart-values-controller
+  internalcrds:
+    taskfile: ./tools/internalcrds/Taskfile.dist.yaml
+    dir: ./tools/internalcrds
 
   deps:
     taskfile: https://raw.githubusercontent.com/werf/common-ci/refs/heads/main/Taskfile.deps.yml
@@ -55,6 +64,94 @@ tasks:
     cmds:
       - task: api:ci:generate
 
+  generate:internal-crds:
+    desc: "Regenerate the internal CustomResourceDefinitions from upstream flux."
+    cmds:
+      - |
+        set -eu
+        helmControllerTag=$(sed -n 's/^ *helm-controller: *//p' build/components/versions.yml)
+        sourceControllerTag=$(sed -n 's/^ *source-controller: *//p' build/components/versions.yml)
+        work=$(mktemp -d)
+        trap 'rm -rf "$work"' EXIT
+        git clone --quiet --depth 1 --branch "$helmControllerTag" \
+          https://github.com/fluxcd/helm-controller "$work/helm-controller"
+        git clone --quiet --depth 1 --branch "$sourceControllerTag" \
+          https://github.com/fluxcd/source-controller "$work/source-controller"
+        cd tools/internalcrds
+        go run . -out ../../crds/embedded/helm-controller.yaml \
+          "$work/helm-controller/config/crd/bases"
+        go run . -out ../../crds/embedded/source-controller.yaml \
+          "$work/source-controller/config/crd/bases"
+
+  check-flux-tags:
+    desc: "Verify the upstream flux tags pinned in werf.inc.yaml match build/components/versions.yml."
+    cmds:
+      - |
+        set -eu
+        helmControllerTag=$(sed -n 's/^ *helm-controller: *//p' build/components/versions.yml)
+        sourceControllerTag=$(sed -n 's/^ *source-controller: *//p' build/components/versions.yml)
+        helmWerfTag=$(sed -n 's/.*\$helmControllerTag := "\(.*\)".*/\1/p' images/helm-controller/werf.inc.yaml)
+        sourceWerfTag=$(sed -n 's/.*\$sourceControllerTag := "\(.*\)".*/\1/p' images/source-controller/werf.inc.yaml)
+        for pin in "$helmControllerTag" "$sourceControllerTag" "$helmWerfTag" "$sourceWerfTag"; do
+          if [ -z "$pin" ]; then
+            echo "a version pin came out empty: build/components/versions.yml has '$helmControllerTag' and '$sourceControllerTag', the werf files have '$helmWerfTag' and '$sourceWerfTag'" >&2
+            exit 1
+          fi
+        done
+        if [ "$helmControllerTag" != "$helmWerfTag" ]; then
+          echo "images/helm-controller/werf.inc.yaml pins helm-controller $helmWerfTag but build/components/versions.yml pins $helmControllerTag" >&2
+          exit 1
+        fi
+        if [ "$sourceControllerTag" != "$sourceWerfTag" ]; then
+          echo "images/source-controller/werf.inc.yaml pins source-controller $sourceWerfTag but build/components/versions.yml pins $sourceControllerTag" >&2
+          exit 1
+        fi
+    silent: true
+
+  ci:generate:internal-crds:
+    desc: "Regenerate the internal CustomResourceDefinitions and verify they are committed."
+    cmds:
+      - task: check-flux-tags
+      - task: generate:internal-crds
+      - |
+        git diff --exit-code crds/embedded || (echo "Please run task generate:internal-crds and commit changes" && exit 1)
+
+  # The shared deps task installs golangci-lint through the upstream install.sh,
+  # whose checksum lookup is an unanchored grep: releases now ship an SBOM entry
+  # next to the archive, both lines match, and the verification fails for every
+  # version past v2.8.0. Building the binary with the toolchain already present
+  # sidesteps the download and keeps the linter new enough to read a module that
+  # targets this repository's Go version.
+  install:golangci-lint:
+    desc: "Install golangci-lint binary to bin/golangci-lint-<version>."
+    status:
+      - test -x bin/golangci-lint-{{.golangciLintVersion}}
+    cmds:
+      - mkdir -p bin
+      - GOBIN="$(pwd)/bin" go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@{{.golangciLintVersion}}
+      - mv bin/golangci-lint bin/golangci-lint-{{.golangciLintVersion}}
+
+  test:unit:
+    desc: "Run the unit tests of every module."
+    cmds:
+      - task: api:test:unit
+      - task: hooks:test:unit
+      - task: operator-helm-controller:test:unit
+      - task: chart-values-controller:test:unit
+      - task: e2e:test:unit
+      - task: internalcrds:test:unit
+      - task: test:rewrite-rules
+
+  # The rule table and the generated definitions are two halves of one
+  # agreement, and only a live cluster reports a disagreement: a request the
+  # proxy renames to a group, kind or resource type no definition declares is
+  # answered "not found". The test compares the two, and reads the definitions
+  # from outside its own module, which the test cache does not track.
+  test:rewrite-rules:
+    desc: "Check the proxy rewrite rules against the generated definitions."
+    cmds:
+      - cd images/kube-api-rewriter && go test -count=1 ./pkg/operatornelm/...
+
   test:e2e:setup:
     desc: "Setup environment for e2e tests."
     cmds:
@@ -116,17 +213,21 @@ tasks:
     cmds:
       - task: api:format
       - task: hooks:format
-      - task: artifact:format
-      - task: chart-values-artifact:format
+      - task: operator-helm-controller:format
+      - task: chart-values-controller:format
       - task: e2e:format
+      - task: internalcrds:format
 
   lint:
+    deps:
+      - install:golangci-lint
     cmds:
       - task: api:lint
       - task: hooks:lint
-      - task: artifact:lint
-      - task: chart-values-artifact:lint
+      - task: operator-helm-controller:lint
+      - task: chart-values-controller:lint
       - task: e2e:lint
+      - task: internalcrds:lint
       - task: lint:doc-ru
 
   lint:doc-ru:

api/Taskfile.dist.yaml

@@ -10,12 +10,17 @@ includes:
       gciPrefix: '{{.gciPrefix | default "github.com/deckhouse/"}}'
       golangciConfigPath: '{{.golangciConfigPath | default "./.golangci.yaml"}}'
       golangciLintBinDir: '{{.golangciLintBinDir | default "../bin"}}'
-      golangciLintVersion: '{{.golangciLintVersion | default "v2.8.0"}}'
+      golangciLintVersion: '{{.golangciLintVersion | default "v2.13.2"}}'
       golangciPaths: '{{.golangciPaths | default "./..."}}'
       paths: '{{.paths | default "."}}'
       prettierPattern: '../crds/*.yaml'
 
 tasks:
+  test:unit:
+    desc: "Run the unit tests of this module."
+    cmds:
+      - go test ./...
+
   generate:
     desc: "Regenerate all"
     cmds: