feat(chart): fullnameOverride, with the completeness guard that makes it safe (backend#2626)

Makefile

@@ -390,7 +390,8 @@ DRIFT_GUARDS := scripts/gen-manifest.sh --check|\
   bash scripts/tests/auto-upgrade-inflight-vs-wedge.sh|\
   bash scripts/tests/hostpath-reads-guarded.sh|\
   bash scripts/tests/jobs-manager-waits-for-mysql.sh|\
-  bash scripts/tests/control-plane-footprint.sh
+  bash scripts/tests/control-plane-footprint.sh|\
+  bash scripts/tests/fullname-override-completeness.sh
 
 # EXPORTED, not interpolated. The recipe reads $$DRIFT_GUARDS from the
 # environment; it used to do `guards='$(DRIFT_GUARDS)'`, which Make expands

client/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: client
 description: A unified Helm chart for tracebloc on AKS, EKS, bare-metal, and OpenShift
 type: application
-version: 1.9.92
-appVersion: "1.9.92"
+version: 1.9.93
+appVersion: "1.9.93"
 keywords:
   - tracebloc
   - kubernetes

client/templates/NOTES.txt

@@ -3,7 +3,7 @@
 {{ "\033[1;36m" }}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━{{ "\033[0m" }}
 
 {{ "\033[1;35m" }}Components:{{ "\033[0m" }}
-  - {{ "\033[1;34m" }}Jobs Manager:{{ "\033[0m" }}            {{ "\033[0;33m" }}{{ .Release.Name }}-jobs-manager{{ "\033[0m" }}
+  - {{ "\033[1;34m" }}Jobs Manager:{{ "\033[0m" }}            {{ "\033[0;33m" }}{{ include "tracebloc.fullname" . }}-jobs-manager{{ "\033[0m" }}
   - {{ "\033[1;34m" }}MySQL Host:{{ "\033[0m" }}                   {{ "\033[0;33m" }}mysql-client{{ "\033[0m" }}
 {{- if ne .Values.resourceMonitor false }}
   - {{ "\033[1;34m" }}Resource Monitor (DS):{{ "\033[0m" }}   {{ "\033[0;33m" }}{{ include "tracebloc.resourceMonitorName" . }}{{ "\033[0m" }}
@@ -21,10 +21,10 @@
   {{ "\033[1;34m" }}Storage:{{ "\033[0m" }}          {{ "\033[0;33m" }}dynamic PVC ({{ include "tracebloc.storageClassName" . }}){{ "\033[0m" }}
 {{- end }}
 {{- if .Values.openshift.scc.enabled }}
-  {{ "\033[1;34m" }}OpenShift SCC:{{ "\033[0m" }}    {{ "\033[0;33m" }}tracebloc-resource-monitor-{{ .Release.Name }}{{ "\033[0m" }}
+  {{ "\033[1;34m" }}OpenShift SCC:{{ "\033[0m" }}    {{ "\033[0;33m" }}tracebloc-resource-monitor-{{ include "tracebloc.fullname" . }}{{ "\033[0m" }}
 {{- end }}
 {{- if .Values.autoUpgrade.enabled }}
-  {{ "\033[1;34m" }}Auto-upgrade:{{ "\033[0m" }}     {{ "\033[1;32m" }}ON{{ "\033[0m" }} {{ "\033[0;90m" }}(CronJob {{ .Release.Name }}-auto-upgrade, schedule "{{ .Values.autoUpgrade.schedule }}", repo {{ .Values.autoUpgrade.repoUrl }}){{ "\033[0m" }}
+  {{ "\033[1;34m" }}Auto-upgrade:{{ "\033[0m" }}     {{ "\033[1;32m" }}ON{{ "\033[0m" }} {{ "\033[0;90m" }}(CronJob {{ include "tracebloc.autoUpgradeName" . }}, schedule "{{ .Values.autoUpgrade.schedule }}", repo {{ .Values.autoUpgrade.repoUrl }}){{ "\033[0m" }}
 {{- else }}
   {{ "\033[1;34m" }}Auto-upgrade:{{ "\033[0m" }}     {{ "\033[1;33m" }}OFF{{ "\033[0m" }} {{ "\033[0;90m" }}(release pinned to chart {{ .Chart.Version }}; set autoUpgrade.enabled=true to receive future fixes automatically){{ "\033[0m" }}
 {{- end }}
@@ -34,6 +34,21 @@
   - {{ "\033[0;36m" }}{{ include "tracebloc.clientLogsPvc" . }}{{ "\033[0m" }}  {{ "\033[0;90m" }}({{ include "tracebloc.clientLogsStorage" . }}){{ "\033[0m" }}
   - {{ "\033[0;36m" }}{{ include "tracebloc.mysqlPvc" . }}{{ "\033[0m" }}       {{ "\033[0;90m" }}({{ include "tracebloc.mysqlStorage" . }}){{ "\033[0m" }}
 
+{{- /* GATED ON hostPath ALONE, and the WORDING carries the condition rather
+   than the gate (Bugbot, Low). Gating on `fullnameOverride` being SET would
+   go quiet on the A->unset rename, which is the same hazard -- so the block
+   states a STANDING PROPERTY of every hostPath release ("these PVs are named
+   through the override and are not kept") instead of telling a first-time
+   installer they just renamed something. */ -}}
+{{- if (default dict .Values.hostPath).enabled }}
+
+{{ "\033[1;33m" }}hostPath PersistentVolumes:{{ "\033[0m" }} {{ "\033[0;90m" }}these PV OBJECTS are named through fullnameOverride and carry NO helm.sh/resource-policy: keep, unlike the PVCs. So CHANGING OR CLEARING fullnameOverride on a live release recreates them under the new name and leaves the retained PVCs Bound to the objects that went away. An upgrade that would do it is now REFUSED at template time, so you cannot reach it silently -- but after any such change, confirm the PVCs are still Bound.{{ "\033[0m" }}
+  - {{ "\033[0;36m" }}{{ include "tracebloc.mysqlPvName" . }}{{ "\033[0m" }}
+  - {{ "\033[0;36m" }}{{ include "tracebloc.clientDataPvName" . }}{{ "\033[0m" }}
+  - {{ "\033[0;36m" }}{{ include "tracebloc.clientLogsPvName" . }}{{ "\033[0m" }}
+  {{ "\033[1;32m" }}${{ "\033[0m" }} kubectl get pvc -n {{ "\033[0;33m" }}{{ .Release.Namespace }}{{ "\033[0m" }}
+{{- end }}
+
 {{ "\033[1;35m" }}Verify the deployment:{{ "\033[0m" }}
   {{ "\033[1;32m" }}${{ "\033[0m" }} kubectl get pods -n {{ "\033[0;33m" }}{{ .Release.Namespace }}{{ "\033[0m" }} -l app.kubernetes.io/instance={{ "\033[0;36m" }}{{ .Release.Name }}{{ "\033[0m" }}
   {{ "\033[1;32m" }}${{ "\033[0m" }} kubectl get pods -n {{ "\033[0;33m" }}{{ .Release.Namespace }}{{ "\033[0m" }} -l app={{ "\033[0;36m" }}manager{{ "\033[0m" }}

client/templates/_helpers.tpl

@@ -17,8 +17,51 @@ app.kubernetes.io/name: {{ .Chart.Name }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
+{{/*
+  tracebloc.fullname — the prefix every resource name this chart creates is built
+  from. backend#2626.
+
+  DEFAULTS TO `.Release.Name` VERBATIM, and verbatim is load-bearing: no `trunc`,
+  no `trimSuffix`, no normalisation. Those are defensible in a fresh chart and
+  wrong here, because the whole migration-safety argument is that an UNSET
+  override renders byte-identical to the chart before this existed. A `trunc 63`
+  firing only for release names over 63 characters is a behaviour change hiding
+  behind a default nobody exercises until it breaks an install.
+
+  WHAT MAY USE IT is not a style question -- backend#2621 was reverted over
+  exactly this. The release name appears ~174 times across these templates and is
+  at least six different things:
+
+    MAY follow the override -- names of resources THIS CHART CREATES, and
+    anything referencing one of those names (an env naming a Deployment to
+    restart; a log glob matching pod directories, because pod directories are
+    named after the DaemonSet).
+
+    MUST NOT follow it:
+      * `app.kubernetes.io/instance`     Helm convention: it IS the release
+      * `meta.helm.sh/release-name`      Helm's own ownership bookkeeping
+      * `RELEASE_NAME` / `RELEASE` env   a HELM IDENTITY -- `helm status`,
+                                         `helm rollback`. Rename it and
+                                         auto-upgrade hunts a release that does
+                                         not exist and fails every tick: that is
+                                         backend#2620, re-introduced by the fix
+                                         for backend#2621.
+      * on-disk paths                    a LOCATION, not a name. Renaming
+                                         orphans a tenant's data.
+      * `.Release.Namespace`             unrelated
+
+  `scripts/tests/fullname-override-completeness.sh` keeps that table true: it
+  renders with a distinctive override and fails on any resource name still
+  carrying the release name, and in the same pass on any exception that STOPPED
+  carrying it. Both halves are required -- without the second, the guard is
+  satisfied by breaking auto-upgrade.
+*/}}
+{{- define "tracebloc.fullname" -}}
+{{- default .Release.Name .Values.fullnameOverride -}}
+{{- end -}}
+
 {{- define "tracebloc.secretName" -}}
-{{ .Release.Name }}-secrets
+{{ include "tracebloc.fullname" . }}-secrets
 {{- end }}
 
 {{/*
@@ -54,7 +97,7 @@ tracebloc.io/seal-check-name: {{ .name | quote }}
 {{- end }}
 
 {{- define "tracebloc.serviceAccountName" -}}
-{{ .Release.Name }}-jobs-manager
+{{ include "tracebloc.fullname" . }}-jobs-manager
 {{- end }}
 
 {{/*
@@ -80,19 +123,19 @@ tracebloc.io/seal-check-name: {{ .name | quote }}
   See the v1.2.0 release notes / tenant-d-prod migration case study.
 */}}
 {{- define "tracebloc.resourceMonitorName" -}}
-{{ .Release.Name }}-resource-monitor
+{{ include "tracebloc.fullname" . }}-resource-monitor
 {{- end }}
 
 {{- define "tracebloc.rbacName" -}}
-{{ .Release.Name }}-jobs-manager-rbac
+{{ include "tracebloc.fullname" . }}-jobs-manager-rbac
 {{- end }}
 
 {{- define "tracebloc.clientDataPvc" -}}
 client-pvc
 {{- end }}
 
 {{- define "tracebloc.clientDataPvName" -}}
-{{ .Release.Name }}-data-pv
+{{ include "tracebloc.fullname" . }}-data-pv
 {{- end }}
 
 {{- define "tracebloc.clientDataStorage" -}}
@@ -118,7 +161,7 @@ client-logs-pvc
 {{- end }}
 
 {{- define "tracebloc.clientLogsPvName" -}}
-{{ .Release.Name }}-logs-pv
+{{ include "tracebloc.fullname" . }}-logs-pv
 {{- end }}
 
 {{- define "tracebloc.clientLogsStorage" -}}
@@ -130,7 +173,7 @@ mysql-pvc
 {{- end }}
 
 {{- define "tracebloc.mysqlPvName" -}}
-{{ .Release.Name }}-mysql-pv
+{{ include "tracebloc.fullname" . }}-mysql-pv
 {{- end }}
 
 {{- define "tracebloc.mysqlStorage" -}}
@@ -165,15 +208,15 @@ mysql-pvc
   403 and stall auto-upgrade on every later tick.
 */}}
 {{- define "tracebloc.createdRegistrySecretName" -}}
-{{ .Release.Name }}-regcred
+{{ include "tracebloc.fullname" . }}-regcred
 {{- end }}
 
 {{- define "tracebloc.registrySecretName" -}}
 {{- $reg := .Values.dockerRegistry | default dict -}}
 {{- if $reg.existingSecret -}}
 {{ $reg.existingSecret }}
 {{- else -}}
-{{ .Release.Name }}-regcred
+{{ include "tracebloc.fullname" . }}-regcred
 {{- end -}}
 {{- end }}
 
@@ -212,7 +255,7 @@ nvidia-device-plugin-daemonset
   the SA by name, and the CronJob mounts the ConfigMap by name.
 */}}
 {{- define "tracebloc.autoUpgradeName" -}}
-{{ .Release.Name }}-auto-upgrade
+{{ include "tracebloc.fullname" . }}-auto-upgrade
 {{- end }}
 
 {{/*
@@ -225,7 +268,7 @@ nvidia-device-plugin-daemonset
   cluster-admin), and customers may reasonably disable one but not the other.
 */}}
 {{- define "tracebloc.imageRefreshName" -}}
-{{ .Release.Name }}-image-refresh
+{{ include "tracebloc.fullname" . }}-image-refresh
 {{- end }}
 
 {{/*
@@ -248,7 +291,7 @@ nvidia-device-plugin-daemonset
   grant.
 */}}
 {{- define "tracebloc.imageRefreshNodeAgentsName" -}}
-{{ .Release.Name }}-image-refresh-node-agents
+{{ include "tracebloc.fullname" . }}-image-refresh-node-agents
 {{- end }}
 
 {{/*
@@ -257,7 +300,7 @@ nvidia-device-plugin-daemonset
   release namespace.
 */}}
 {{- define "tracebloc.rbacNodeAgentsName" -}}
-{{ .Release.Name }}-jobs-manager-node-agents
+{{ include "tracebloc.fullname" . }}-jobs-manager-node-agents
 {{- end }}
 
 {{/*
@@ -280,7 +323,7 @@ nvidia-device-plugin-daemonset
   left for its own PR; a contract test pins the two sides here in the meantime.
 */}}
 {{- define "tracebloc.requestsProxyName" -}}
-{{ .Release.Name }}-requests-proxy
+{{ include "tracebloc.fullname" . }}-requests-proxy
 {{- end }}
 
 {{/*
@@ -443,7 +486,7 @@ Always
 */}}
 {{- define "tracebloc.storageClassName" -}}
 {{- if .Values.storageClass.create -}}
-{{ .Release.Name }}-storage-class
+{{ include "tracebloc.fullname" . }}-storage-class
 {{- else -}}
 {{ .Values.storageClass.name }}
 {{- end -}}
@@ -1000,7 +1043,7 @@ can be kept above the configured helm timeout.
   two releases on one cluster do not collide in the shared node-agents namespace.
 */}}
 {{- define "tracebloc.telemetryCollectorName" -}}
-{{- printf "%s-telemetry-collector" .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- printf "%s-telemetry-collector" (include "tracebloc.fullname" .) | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
 {{/*
@@ -1054,7 +1097,7 @@ tracebloc-telemetry-token
 {{- $tc := default (dict) .Values.telemetryCollector -}}
 {{- $name := (default (dict) $tc.tokenSecret).name | default "" -}}
 {{- if or (eq $name "") (eq $name (include "tracebloc.telemetryTokenLegacyName" .)) -}}
-{{- printf "%s-telemetry-token" .Release.Name -}}
+{{- printf "%s-telemetry-token" (include "tracebloc.fullname" .) -}}
 {{- else -}}
 {{- $name -}}
 {{- end -}}
@@ -1073,12 +1116,34 @@ tracebloc-telemetry-token
   until jobs-manager next re-authenticates, and refusing it would wedge exactly the
   edge that is already collecting.
 */}}
+{{/*
+  The token Secret's name BEFORE `fullnameOverride` was set — i.e. what a release
+  installed without one is still carrying (Bugbot, Medium, on client#911).
+
+  `telemetryTokenSecretName` follows the override, so on a renamed release the
+  lookup below missed the live Secret and `telemetryCollectorState` hard-FAILED
+  for an operator who had explicitly enabled the Collector: the token exists, it
+  is simply under `<release>-telemetry-token`. The legacy fallback did not cover
+  it either — that is a different, FIXED name (`tracebloc-telemetry-token`), not
+  the release-scoped one.
+
+  Accepted rather than refused, and that is deliberately the opposite call from
+  the credentials Secret. There, a name miss means SILENTLY MINTING a new
+  password against a datadir that holds the old one, so refusing is the only safe
+  answer. Here the token is server-side and re-derivable — jobs-manager writes it
+  (backend#2274) — so finding the existing one is both safe and what the operator
+  meant. Same reasoning as the legacy name this sits beside.
+*/}}
+{{- define "tracebloc.telemetryTokenPreOverrideName" -}}
+{{- printf "%s-telemetry-token" .Release.Name -}}
+{{- end -}}
+
 {{- define "tracebloc.telemetryTokenPresent" -}}
 {{- if not (lookup "v1" "Namespace" "" "kube-system") -}}
 unknown
 {{- else -}}
 {{- $ns := .Values.nodeAgents.namespace.name -}}
-{{- if or (lookup "v1" "Secret" $ns (include "tracebloc.telemetryTokenSecretName" .)) (lookup "v1" "Secret" $ns (include "tracebloc.telemetryTokenLegacyName" .)) -}}
+{{- if or (lookup "v1" "Secret" $ns (include "tracebloc.telemetryTokenSecretName" .)) (lookup "v1" "Secret" $ns (include "tracebloc.telemetryTokenLegacyName" .)) (lookup "v1" "Secret" $ns (include "tracebloc.telemetryTokenPreOverrideName" .)) -}}
 yes
 {{- else -}}
 no
@@ -1147,7 +1212,7 @@ no
 {{- if kindIs "bool" $tc.enabled -}}
 {{- if $tc.enabled -}}
 {{- if eq (include "tracebloc.telemetryTokenPresent" .) "no" -}}
-{{- fail (printf "telemetryCollector.enabled is true but its token Secret does not exist in namespace %q — looked for %q, and during migration the legacy %q. The Collector's exporter authenticates with it, and jobs-manager writes it (backend#2274). Create it, or set telemetryCollector.enabled: false — enabling without it buys a DaemonSet that spools to every node's disk and delivers nothing." .Values.nodeAgents.namespace.name (include "tracebloc.telemetryTokenSecretName" .) (include "tracebloc.telemetryTokenLegacyName" .)) -}}
+{{- fail (printf "telemetryCollector.enabled is true but its token Secret does not exist in namespace %q — looked for %q, the legacy %q, and the pre-fullnameOverride %q. The Collector's exporter authenticates with it, and jobs-manager writes it (backend#2274). IF YOU JUST CHANGED fullnameOverride FROM ONE VALUE TO ANOTHER, the token is under the PREVIOUS override's name and this render cannot guess it: nothing records what the last one was, and enumerating the namespace would be worse than guessing, because the Collector's volume and the RBAC's resourceNames both name ONLY the first Secret above, so a token found under any other name is one nothing is permitted to read. Two ways forward, and neither is a reinstall: copy the existing Secret to the first name above in that namespace (kubectl get secret <old> -o json | jq '.metadata.name=\"<new>\" | del(.metadata.uid,.metadata.resourceVersion,.metadata.creationTimestamp,.metadata.ownerReferences)' | kubectl apply -f -), or leave telemetryCollector.enabled unset for one upgrade and let jobs-manager re-mint it under the new name on its next re-authentication — the Collector's mount is optional, so it waits and buffers rather than crash-looping. Otherwise create it, or set telemetryCollector.enabled: false — enabling without it buys a DaemonSet that spools to every node's disk and delivers nothing." .Values.nodeAgents.namespace.name (include "tracebloc.telemetryTokenSecretName" .) (include "tracebloc.telemetryTokenLegacyName" .) (include "tracebloc.telemetryTokenPreOverrideName" .)) -}}
 {{- end -}}
 enabled
 {{- else -}}

client/templates/egress-enforcement-check.yaml

@@ -17,7 +17,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ .Release.Name }}-egress-enforcement-check
+  name: {{ include "tracebloc.fullname" . }}-egress-enforcement-check
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}

client/templates/egress-proxy-configmap.yaml

@@ -11,7 +11,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ .Release.Name }}-egress-proxy
+  name: {{ include "tracebloc.fullname" . }}-egress-proxy
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}

client/templates/egress-proxy-deployment.yaml

@@ -17,7 +17,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ .Release.Name }}-egress-proxy
+  name: {{ include "tracebloc.fullname" . }}-egress-proxy
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}
@@ -82,7 +82,7 @@ spec:
       volumes:
         - name: squid-config
           configMap:
-            name: {{ .Release.Name }}-egress-proxy
+            name: {{ include "tracebloc.fullname" . }}-egress-proxy
         - name: tmp
           emptyDir: {}
         - name: var-run

client/templates/egress-reachability-check.yaml

@@ -31,7 +31,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: {{ .Release.Name }}-egress-reachability-check
+  name: {{ include "tracebloc.fullname" . }}-egress-reachability-check
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}

client/templates/image-refresh-cronjob.yaml

@@ -789,7 +789,7 @@ spec:
                 - name: RELEASE_NAMESPACE
                   value: {{ .Release.Namespace | quote }}
                 - name: DEPLOYMENT_NAME
-                  value: {{ printf "%s-jobs-manager" .Release.Name | quote }}
+                  value: {{ printf "%s-jobs-manager" (include "tracebloc.fullname" .) | quote }}
                 # #569: the two additional workloads reconciled by `set image`.
                 - name: REQUESTS_PROXY_DEPLOYMENT
                   value: {{ include "tracebloc.requestsProxyName" . | quote }}

client/templates/ingestion-authz-configmap.yaml

@@ -10,7 +10,7 @@ metadata:
   # to a list of table-name prefixes. Omit `namespace` to default to the
   # release's namespace — the common case where the ingestor subchart is
   # installed alongside the tracebloc client.
-  name: {{ .Release.Name }}-ingestion-authz
+  name: {{ include "tracebloc.fullname" . }}-ingestion-authz
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}

client/templates/jobs-manager-deployment.yaml

@@ -6,7 +6,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ .Release.Name }}-jobs-manager
+  name: {{ include "tracebloc.fullname" . }}-jobs-manager
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}
@@ -908,5 +908,5 @@ spec:
             claimName: {{ include "tracebloc.clientLogsPvc" . }}
         - name: ingestion-authz
           configMap:
-            name: {{ .Release.Name }}-ingestion-authz
+            name: {{ include "tracebloc.fullname" . }}-ingestion-authz
       restartPolicy: Always

client/templates/jobs-manager-pdb.yaml

@@ -37,7 +37,7 @@
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
-  name: {{ .Release.Name }}-jobs-manager
+  name: {{ include "tracebloc.fullname" . }}-jobs-manager
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}

client/templates/network-policy-training.yaml

@@ -34,7 +34,7 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: {{ .Release.Name }}-training-egress
+  name: {{ include "tracebloc.fullname" . }}-training-egress
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "tracebloc.labels" . | nindent 4 }}