Skip to content

Harden resource-history debug output & make debug env var case-insensitive - #1137

Open
sameerforge wants to merge 4 commits into
carvel-dev:v0.65.xfrom
sameerforge:topic/sameerkh/compliance-fixes
Open

sameerforge wants to merge 4 commits into
carvel-dev:v0.65.xfrom
sameerforge:topic/sameerkh/compliance-fixes

Conversation

@sameerforge

@sameerforge sameerforge commented Oct 6, 2026 •

Copy link
Copy Markdown

Summary

  • KAPP_DEBUG_RESOURCE_WITH_HISTORY debug output no longer prints resource diffs, which can contain secret values. It now prints only the resource description and MD5 hashes.
  • KAPP_DEBUG_RESOURCE_WITH_HISTORY is now case-insensitive, so TRUE and True enable debug mode.
  • Several user-facing error messages are reworded for grammar and consistency. kapp completion help and errors now list powershell.
  • Unit tests cover each of these behaviors.

Commits

  1. Make debug env var case-insensitive and stop printing resource diffs: resource_with_history.go prints only hashes under the debug flag. The flag is compared with strings.ToLower. recalculateLastAppliedChange no longer returns the unused diff string.
  2. Improve error message grammar and clarity: grammar and capitalization fixes in 8 files:
    • completion.go: lists powershell, and Unsupported shell type is now capitalized
    • profiling.go: Unknown profile
    • namespace_flags.go: Expected namespace name to be non-empty
    • rename.go: or/and becomes or
    • app_filter_flags.go and resource_filter_flags.go: parseable becomes a valid time.Duration
    • appchange/list.go: Unrecognized time format, and earlier than replaces less than
    • labeled_resources.go: Disallowed label errors
  3. ci: install latest kind via Go and reorder checkout step: unrelated CI fix. Drop this line if it isn't part of the PR.
  4. Add tests for debug env var parsing and reworded error messages: table-style tests for the debug flag, completion, time parsing, age filters and disallowed labels. The env var check is extracted into a one-line debugEnabled helper so it can be tested.

Notes

  • Only message text changes in commit 2. Validation logic is unchanged, and no tests, docs or workflows reference the old strings.
  • Debug output is smaller. Normal logging and the --debug flag are unchanged.
  • Not covered by tests: the earlier than message in list.go (needs a cluster) and the debug output omitting diffs.

Testing

  • golangci-lint run: 0 issues
  • go build ./... and go test ./pkg/...: pass
  • The new tests fail on the previous code and pass now.

- Compare KAPP_DEBUG_RESOURCE_WITH_HISTORY case-insensitively
- Debug output no longer prints resource diffs, which can contain
  secret values; only the resource description and MD5 hashes are printed
- Drop the now-unused expected diff return value

Signed-off-by: Sameer Khan <sameer.khan@broadcom.com>
@carvel-bot carvel-bot added this to Carvel Oct 6, 2026

@aroradaman aroradaman left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dont' we need any test case change here?

- completion.go: Add powershell to supported shells list and capitalize "Unsupported shell type" error
- profiling.go: Capitalize "Unknown profile" error message
- namespace_flags.go: Fix grammar: "Expected namespace name to be non-empty"
- rename.go: Fix awkward conjunction: "or" instead of "or/and"
- resource_filter_flags.go: Use standard terminology: "a valid time.Duration"
- app_filter_flags.go: Use standard terminology: "a valid time.Duration"
- appchange/list.go: Capitalize "Unrecognized time format"
- appchange/list.go: Clarify temporal ordering: "earlier than" instead of "less than"
- labeled_resources.go: Fix plural form: "Disallowed label errors"

These improvements enhance user experience and provide clearer error guidance.

Signed-off-by: Sameer Khan <sameer.khan@broadcom.com>
Fixes a failure during the "Create Kind Cluster" step when testing against
recent Kubernetes releases (v1.36+). The previous `helm/kind-action@v1`
installed an older `kind` binary that generated `kubeadm.k8s.io/v1beta3`
configurations, which are deprecated and rejected by newer `kubeadm` binaries
requiring `v1beta4`.

Changes made in test-gh.yml:
- Moved `actions/checkout@v4` to the beginning of the workflow so that
  `actions/setup-go@v5` can locate `go.mod` via `go-version-file`.
- Replaced `helm/kind-action` with `go install sigs.k8s.io/kind@latest`
  to dynamically build the latest release of `kind`. This ensures compatibility
  with newer Kubernetes versions without requiring manual action version updates.

Signed-off-by: Sameer Khan <sameer.khan@broadcom.com>
@sameerforge
sameerforge force-pushed the topic/sameerkh/compliance-fixes branch from 5375295 to f066c09 Compare October 6, 2026 09:12
- Extract debugEnabled so the case-insensitive comparison of
  KAPP_DEBUG_RESOURCE_WITH_HISTORY can be tested directly
- Cover completion for each supported shell, including powershell, and
  the unsupported shell error
- Cover time parsing errors for app change list
- Cover invalid age errors for app and resource filter flags
- Cover the disallowed label error

Signed-off-by: Sameer Khan <sameer.khan@broadcom.com>
@sameerforge
sameerforge force-pushed the topic/sameerkh/compliance-fixes branch from f066c09 to 9c5a102 Compare October 6, 2026 09:14
@sameerforge

Copy link
Copy Markdown
Author

Dont' we need any test case change here?

Added tests for debug env var parsing and reworded error messages

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

3 participants