Skip to content

ESO-541,ESO-551:Adds API changes for concurrent flag, replicas, and experimentalOverrides - #172

Open
siddhibhor-56 wants to merge 1 commit into
openshift:mainfrom
siddhibhor-56:eso-551
Open

ESO-541,ESO-551:Adds API changes for concurrent flag, replicas, and experimentalOverrides#172
siddhibhor-56 wants to merge 1 commit into
openshift:mainfrom
siddhibhor-56:eso-551

Conversation

@siddhibhor-56

@siddhibhor-56 siddhibhor-56 commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Adds ExternalSecretsConfig API fields for core controller scale and throughput:
    • spec.controllerConfig.concurrent (*int32, min 1 / max 100) for --concurrent=<N>
    • spec.controllerConfig.replicas (*int32, min 1 / max 10) for core controller Deployment replicas
  • Adds spec.controllerConfig.componentConfigs[].experimentalOverrides (*runtime.RawExtension)
  • Regenerates deepcopy, CRDs (config + bundle), and API reference docs; adds CRD validation tests for the new fields
    Implements the API surface from openshift/enhancements#2068 (ESO-540/ESO-550).

Summary by CodeRabbit

  • New Features
    • Added configuration for controller concurrency, supporting 1–100 concurrent reconciles.
    • Added controller replica configuration, supporting 1–10 replicas with leader-election behavior.
    • Added optional component deployment overrides for scheduling settings such as pod anti-affinity.
    • Invalid overrides and changes to operator-managed resources are rejected.
  • Documentation
    • Updated the API reference and configuration schema with defaults, limits, and override restrictions.
  • Bug Fixes
    • Added validation to reject unsupported concurrency and replica values.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown

Walkthrough

Changes

Configuration controls

Layer / File(s) Summary
Controller settings and validation
api/v1alpha1/external_secrets_config_types.go, config/crd/bases/..., bundle/manifests/..., api/v1alpha1/tests/..., docs/api_reference.md
Adds bounded concurrent and replicas settings, CRD schemas, API documentation, and creation tests.
Component deployment overrides
api/v1alpha1/external_secrets_config_types.go, config/crd/bases/..., bundle/manifests/..., api/v1alpha1/tests/..., docs/api_reference.md
Adds experimentalOverrides for deployment scheduling patches, documents rejected fields, and tests pod anti-affinity configuration.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: bharath-b-rh

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Test Structure And Quality ❓ Inconclusive Investigation is still in progress; no verdict has been submitted yet. Inspect the test harness and repository patterns before deciding.
✅ Passed checks (14 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR adds eight static YAML test names; none contains interpolation, generated identifiers, timestamps, node or namespace names, IPs, or other run-dependent values.
Microshift Test Compatibility ✅ Passed The PR adds only YAML CRD validation tests; no new Ginkgo e2e tests or MicroShift-incompatible OpenShift API references were added.
Single Node Openshift (Sno) Test Compatibility ✅ Passed Added tests are declarative API create/validation cases; the generator only creates and compares CRs, and the anti-affinity data is not used to schedule pods or require multiple nodes.
Topology-Aware Scheduling Compatibility ✅ Passed The diff changes only API types, generated deepcopy, CRDs, docs, and validation tests; it adds no deployment manifest or controller scheduling constraint.
Ote Binary Stdout Contract ✅ Passed The PR changes no process or suite setup code. Suite output uses GinkgoWriter, and the operator textlogger defaults to os.Stderr; no OTE stdout violation is present.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Added tests are declarative envtest API cases; they use only local CRD data and contain no IPv4 addresses, IP parsing, URLs, or external connectivity.
No-Weak-Crypto ✅ Passed The PR adds API fields, deepcopy logic, CRD schemas, tests, and docs; structural and exact-token scans found no weak crypto, custom crypto, or secret/token comparisons.
Container-Privileges ✅ Passed The PR adds zero privilege-sensitive lines; its override example only sets pod anti-affinity, while existing operator manifests keep restrictive security settings.
No-Sensitive-Data-In-Logs ✅ Passed The patch changes API types, generated deepcopy code, CRDs, tests, and docs only; it adds no logging calls or sensitive values.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the added API fields for concurrency, replicas, and experimental overrides.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@siddhibhor-56 siddhibhor-56 changed the title Adds API changes for concurrent flag, replicas, and experimentalOverrides ESO-541,ESO-551:Adds API changes for concurrent flag, replicas, and experimentalOverrides Aug 3, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 3, 2026
@openshift-ci-robot

openshift-ci-robot commented Aug 3, 2026

Copy link
Copy Markdown

@siddhibhor-56: This pull request references ESO-541 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

This pull request references ESO-551 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

  • Adds ExternalSecretsConfig API fields for core controller scale and throughput:
  • spec.controllerConfig.concurrent (*int32, min 1 / max 100) for --concurrent=<N>
  • spec.controllerConfig.replicas (*int32, min 1 / max 10) for core controller Deployment replicas
  • Adds spec.controllerConfig.componentConfigs[].experimentalOverrides (*runtime.RawExtension)
  • Regenerates deepcopy, CRDs (config + bundle), and API reference docs; adds CRD validation tests for the new fields
    Implements the API surface from openshift/enhancements#2068 (ESO-540/ESO-550).

Summary by CodeRabbit

  • New Features
  • Added configuration for controller concurrency, supporting 1–100 concurrent reconciles.
  • Added controller replica configuration, supporting 1–10 replicas with leader-election behavior.
  • Added optional component deployment overrides for scheduling settings such as pod anti-affinity.
  • Invalid overrides and changes to operator-managed resources are rejected.
  • Documentation
  • Updated the API reference and configuration schema with defaults, limits, and override restrictions.
  • Bug Fixes
  • Added validation to reject unsupported concurrency and replica values.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested review from TrilokGeer and mytreya-rh August 3, 2026 13:39
@openshift-ci

openshift-ci Bot commented Aug 3, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: siddhibhor-56
Once this PR has been reviewed and has the lgtm label, please assign swghosh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@api/v1alpha1/external_secrets_config_types.go`:
- Around line 155-167: Update the core controller Deployment rendering to use
ControllerConfig.Replicas for the Deployment replica count and
ControllerConfig.Concurrent for the --concurrent argument, falling back to 1
when either pointer is nil. Replace the hard-coded values in the renderer and
embedded Deployment while preserving the existing configuration flow.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fc08f376-7f54-47b8-b7bb-ad4fb9d0186f

📥 Commits

Reviewing files that changed from the base of the PR and between 65f39bd and d2b322a.

⛔ Files ignored due to path filters (1)
  • api/v1alpha1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
📒 Files selected for processing (5)
  • api/v1alpha1/external_secrets_config_types.go
  • api/v1alpha1/tests/externalsecretsconfig.operator.openshift.io/externalsecretsconfig.testsuite.yaml
  • bundle/manifests/operator.openshift.io_externalsecretsconfigs.yaml
  • config/crd/bases/operator.openshift.io_externalsecretsconfigs.yaml
  • docs/api_reference.md

Comment on lines +155 to +167
// concurrent sets the core controller --concurrent flag (max concurrent reconciles).
// When omitted, defaults to 1 for backward compatibility.
// +kubebuilder:validation:Minimum=1
// +kubebuilder:validation:Maximum=100
// +optional
Concurrent *int32 `json:"concurrent,omitempty"`

// replicas sets the desired replica count for the external-secrets core controller Deployment.
// When omitted, defaults to 1. When greater than 1, leader election keeps a single active reconciler.
// +kubebuilder:validation:Minimum=1
// +kubebuilder:validation:Maximum=10
// +optional
Replicas *int32 `json:"replicas,omitempty"`

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -u

# Locate Go files that consume ControllerConfig or construct controller arguments.
fd -e go . | while IFS= read -r file; do
  if rg -q '\bControllerConfig\b|\.Concurrent\b|\.Replicas\b|--concurrent' "$file"; then
    ast-grep outline "$file" --items all
    rg -n -C 5 '\bControllerConfig\b|\.Concurrent\b|\.Replicas\b|--concurrent|replicas:' "$file"
  fi
done

Repository: openshift/external-secrets-operator

Length of output: 50392


🏁 Script executed:

#!/bin/bash
set -u

# Restrict the search to tracked, non-vendored source and test files.
git ls-files '*.go' ':!:vendor/**' \
  | xargs -r rg -n -C 6 'ControllerConfig|\.Concurrent|\.Replicas|--concurrent|ExternalSecretsConfig' \
  | head -n 1200

Repository: openshift/external-secrets-operator

Length of output: 50391


🏁 Script executed:

#!/bin/bash
set -u

# Find the renderer and its focused tests without generated assets or vendor code.
for file in $(git ls-files '*.go' ':!:vendor/**' ':!:pkg/operator/assets/**'); do
  if rg -q 'ControllerConfig|\.Concurrent|\.Replicas|--concurrent' "$file"; then
    echo "===== $file ====="
    rg -n -C 12 'ControllerConfig|\.Concurrent|\.Replicas|--concurrent' "$file"
  fi
done

Repository: openshift/external-secrets-operator

Length of output: 50392


🏁 Script executed:

#!/bin/bash
set -u

echo '===== pkg/controller/external_secrets/deployments.go: deployment construction ====='
sed -n '1,430p' pkg/controller/external_secrets/deployments.go

echo '===== replica and concurrency assignments in source/tests ====='
rg -n -C 8 'Spec\.Replicas|Replicas:|--concurrent|updateContainerSpec|createOrApplyDeployment|CreateOrApplyDeployment' \
  pkg/controller/external_secrets api pkg/operator \
  -g '*.go' -g '!assets/**' | head -n 1200

Repository: openshift/external-secrets-operator

Length of output: 38149


🏁 Script executed:

#!/bin/bash
set -u

# Check the embedded core-controller Deployment template for its baseline replica count.
rg -n -C 12 'name: external-secrets$|kind: Deployment|replicas:' \
  pkg/operator/assets/bindata.go | head -n 500

Repository: openshift/external-secrets-operator

Length of output: 18410


Wire ControllerConfig.Replicas and ControllerConfig.Concurrent into the core controller Deployment. The renderer hard-codes --concurrent=1 and the embedded Deployment has replicas: 1, so configured values are ignored. Retain 1 when either field is omitted.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@api/v1alpha1/external_secrets_config_types.go` around lines 155 - 167, Update
the core controller Deployment rendering to use ControllerConfig.Replicas for
the Deployment replica count and ControllerConfig.Concurrent for the
--concurrent argument, falling back to 1 when either pointer is nil. Replace the
hard-coded values in the renderer and embedded Deployment while preserving the
existing configuration flow.

@openshift-ci

openshift-ci Bot commented Aug 3, 2026

Copy link
Copy Markdown

@siddhibhor-56: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants