Skip to content

feat: answer the gitops-api team's open asks - #445

Merged
sunib merged 5 commits into
chore/todo-release-gatefrom
feat/gitops-api-asks
Oct 25, 2026
Merged

sunib merged 5 commits into
chore/todo-release-gatefrom
feat/gitops-api-asks

Conversation

@sunib

@sunib sunib commented Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

Stacked on #444.

Answers the gitops-api team's open asks that are small enough for one PR (docs/future/gitops-api-open-asks.md).

claimed_resource_reconciled_total (ask #31)

This counter is labelled {applier_kind, claim_namespace, claim_name}. It counts every apply an applier claim did not start: a held Kustomization resumed, or a held Application's automated sync switched on. The ClaimedResourceReconciled Event already said this, but the API server folds identical Events together and expires them.

Documented in interpreting-metrics.md, with a suggested alert, and in both applier guides.

Troubleshooting row (ask #32)

The Flux guide gets a troubleshooting row for a recurring ClaimedResourceReconciled. The cause is a controller that writes the Kustomization's whole spec without spec.suspend, which SuspendOwnedElsewhere cannot report.

Deleter attribution (ask #23)

New fact-index tests pin that a terminating object's removal names its deleter. They cover a finalizer cleared by an UPDATE as well as a PATCH, with the controller's fact filed before or after the deletion's. #431's fix holds.

Not changed

Testing

  • task lint passes.
  • task test passes, with coverage at 80.1% against a baseline of 80.2% (tolerance 0.5%).
  • New tests:
    • counter assertions in the Flux and Argo CD resume tests
    • TestFactIndex_AFinalizerClearedByAControllerNamesTheDeleter
  • e2e: see the CI legs.

🤖 Generated with Claude Code

sunib and others added 4 commits October 24, 2026 21:10
Two instances can now share one config-plane cluster. --watch-namespaces
(Helm: controllerManager.watchNamespaces) confines the manager's cache to
the listed namespaces, so an instance reconciles the namespaced kinds
there only. A ClusterWatchRule is cluster-scoped, so every instance sees
it: the one serving its GitTarget's namespace reconciles it, and the
others write nothing to it, status included. A rule re-pointed out of the
served namespaces is dropped from the store.

The Namespace informer is narrowed by its name label, so a label change
elsewhere enqueues nothing, and ConfigMaps are also cached in the
controller's own namespace for the install-level known_hosts ConfigMap.
The chart scopes the admission webhook to the same namespaces. Empty, the
default, serves every namespace as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
claimed_resource_reconciled_total{applier_kind, claim_namespace,
claim_name} counts a held Kustomization resumed, or a held Application's
automated sync switched on, by somebody else. The ClaimedResourceReconciled
Event said so already, but the API server folds identical Events and
expires them, so it made a poor alarm.

The Flux guide's troubleshooting table gains the common cause of a
recurring one: a controller that writes the Kustomization's whole spec
without spec.suspend, which SuspendOwnedElsewhere cannot report.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…lizer

A terminating object's removal is credited to its deletion, never to the
write at its version. That write can be a finalizer cleared by an UPDATE
as well as a PATCH, and its fact can be filed before or after the
deletion's; pin all four.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
#32, #31, #23 and the first step of #28 are answered here; #11 shipped
in 0.41.0. #34's two side notes are answered as well.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: b401161a-aed0-4d3b-abd2-251f37103035
Commits

Reviewing files that changed from the base of the PR and between 7845f59 and f2146be.

Files selected for processing: 12
  • docs/TODO.md
  • docs/bi-directional-argocd.md
  • docs/bi-directional-flux.md
  • docs/future/gitops-api-open-asks.md
  • docs/interpreting-metrics.md
  • internal/controller/argocdclaim_hold.go
  • internal/controller/argocdclaim_hold_test.go
  • internal/controller/fluxclaim_hold.go
  • internal/controller/fluxclaim_hold_test.go
  • internal/queue/fact_index_removal_cause_test.go
  • internal/telemetry/apply_requests.go
  • internal/telemetry/exporter.go
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 90.90909% with 1 line in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
internal/controller/fluxclaim_hold.go 88.8% 1 Missing ⚠️

📢 Thoughts on this report? Let us know!

Reverts 6c4f389. Partitioning one cluster between two instances by
namespace removes only two of the four costs the ask lists: the CRDs and
the ClusterRole stay shared, so the instances keep one upgrade cadence
and one RBAC posture. It is not the HA mechanism either, and it adds a
second tenancy model beside one instance serving many namespaces through
grants. The team is not blocked: one shared instance works.

The asks doc records #28 as deferred and why; the restart cost behind it
belongs to the durable pending writes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@sunib
sunib added this pull request to stack #446 October 25, 2026 05:45
@sunib
sunib merged commit be991b8 into main Oct 25, 2026
23 checks passed
@sunib
sunib deleted the feat/gitops-api-asks branch October 25, 2026 21:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant