Repository navigation
feat(components): add ComponentStability contract to proto and CRD admission - #1538
Conversation
There was a problem hiding this comment.
Code Review
This pull request introduces component stability levels (EXPERIMENTAL, PREVIEW, STABLE) to the Component API and CRD, requiring explicit administrator acknowledgement to enable experimental components. It also adds corresponding CEL validation rules and admission tests. Feedback on the changes suggests refining the CEL validation rule in the Helm template to avoid redundant boolean comparisons and prevent potential evaluation errors by guarding the optional acknowledgeExperimental field with has().
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a component stability maturity model by adding stability and acknowledge_experimental fields to the component specification, along with a CEL validation rule in the CRD to enforce administrator acknowledgement when enabling experimental components. Feedback on the changes suggests using DryRun options in the integration tests to prevent potential flakiness from AlreadyExists errors during CRD updates, and simplifying the CEL validation rule in the Helm template to improve readability.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a component stability contract by adding a ComponentStability enum and stability-related fields to the component specifications. It also implements a Kubernetes CEL validation rule in the CRD to ensure that enabling an experimental component requires explicit administrator acknowledgement. The feedback highlights that the test helper stripCRDStabilityFields blindly removes all x-kubernetes-validations under spec, which is fragile and could unintentionally strip other future validation rules; it is recommended to selectively filter out only the stability-related validation rule instead.
There was a problem hiding this comment.
🤖 Incremental PR Approval
PR author is a code owner and changes since last approval (2 lines) are within the 50-line grace delta.
Preserving prior approval by @janzak-dev on commit 247c58e.
…mission Define ComponentStability (UNSPECIFIED, EXPERIMENTAL, PREVIEW, STABLE) and acknowledge_experimental in ComponentSpec, enforce admission-level CEL validation on Component.xmc.dev when enabling EXPERIMENTAL components, and add envtest coverage. TAG=agy CONV=bfd7efa2-aaa4-46db-a3f1-59cc171656b6
…mission probe Simplify the Component CRD CEL validation rule for EXPERIMENTAL acknowledgement to avoid double negation and guard acknowledgeExperimental with has(), and pass DryRunAll to the CRD update readiness probe in TestCRDPreExistingCROmittedStabilityFieldsUpdate. TAG=agy CONV=bfd7efa2-aaa4-46db-a3f1-59cc171656b6
…lityFields Selectively filters out x-kubernetes-validations rules referencing stability when simulating a pre-upgrade CRD schema in TestCRDPreExistingCROmittedStabilityFieldsUpdate. TAG=agy CONV=bfd7efa2-aaa4-46db-a3f1-59cc171656b6
…sion rule Adds the ComponentStability contract table (STABLE, PREVIEW, EXPERIMENTAL) and CRD CEL admission documentation to pkg/components/README.md and cmd/xmc_bridge/README.md. TAG=agy CONV=bfd7efa2-aaa4-46db-a3f1-59cc171656b6
…ity migration test
Update deploy/profiles/stable-2026a/README.md to document only the Kubernetes CRD CEL admission check in Layer 1 (PR #1538); xmc-bridge and component-linter enforcement are documented in PRs #1539 and #1540. Comment link: #1538 (comment) Fixes bug 580941989 TAG=agy CONV=bfd7efa2-aaa4-46db-a3f1-59cc171656b6
c205671 to
edf6abe
Compare
There was a problem hiding this comment.
🤖 Incremental PR Approval
PR author is a code owner and changes since last approval (2 lines) are within the 50-line grace delta.
Preserving prior approval by @janzak-dev on commit 247c58e.
Summary
Introduces the
ComponentStabilitycontract (COMPONENT_STABILITY_UNSPECIFIED,COMPONENT_STABILITY_EXPERIMENTAL,COMPONENT_STABILITY_PREVIEW,COMPONENT_STABILITY_STABLE) andacknowledge_experimentalfield inComponentSpec(Layer 1 of 4 forb/580941989). Enforces Kubernetes CRD CEL admission validation oncomponents.xmc.devso enabling anEXPERIMENTALcomponent requires explicitspec.acknowledgeExperimental: true.Motivation & Context
The AI Components platform ships components across three maturity levels (
EXPERIMENTAL,PREVIEW,STABLE). WhileSTABLEandPREVIEWcomponents can be enabled without extra confirmation,EXPERIMENTALcomponents may change incompatibly or lose data across upgrades and therefore require explicit administrator acknowledgement before activation. Enforcing this contract at Kubernetes API server admission (x-kubernetes-validations) prevents unacknowledgedEXPERIMENTALcomponents from being enabled viakubectl applyorhelm upgrade, while still allowing disabled (spec.enabled: false)EXPERIMENTALcomponents to ship in profiles.Key Changes
api/protos/components/v1alpha1/components.proto: AddedComponentStabilityenum (UNSPECIFIED = 0,EXPERIMENTAL = 1,PREVIEW = 2,STABLE = 3),stability(field 11) andacknowledge_experimental(field 12) onComponentSpec, andstability(field 4) onComponentPredicate.deploy/helm/templates/components/crd.yaml: Addedspec.stability(enum: [EXPERIMENTAL, PREVIEW, STABLE]),spec.acknowledgeExperimental(type: boolean, default: false), and the CEL rule!(self.enabled && has(self.stability) && self.stability == 'EXPERIMENTAL') || self.acknowledgeExperimental == true.pkg/components/bridge/components_admission_test.go: Added envtest suites (TestCRDStabilityValidation,TestCRDPreExistingCROmittedStabilityFieldsUpdate) covering invalid enum values, enabled unacknowledgedEXPERIMENTALrejection, disabledEXPERIMENTALadmission, acknowledgedEXPERIMENTALadmission,PREVIEW/STABLEadmission, and in-place CRD upgrades for pre-existing CRs.Assumptions
COMPONENT_STABILITY_EXPERIMENTAL,COMPONENT_STABILITY_PREVIEW,COMPONENT_STABILITY_STABLE) to satisfybuflint and package scoping rules, while the Kubernetes CRDcomponents.xmc.devuses Kubernetes-idiomatic unprefixed enum strings (EXPERIMENTAL,PREVIEW,STABLE).enable_components=true; deployments withenable_components=falseare unaffected.Verification & Testing
bazel test //api/... //pkg/components/bridge:bridge_test./.githooks/pre-commit(92/92 affected Bazel test targets passed)...withenable_components: true):...viapython3 tools/dev_env/dev_env.py gke-upgradeand verifieddeploy/ctk_v2/verify_xmc.py(17/17 pods1/1 Running, all 3 catalogComponentCRsReady=True, Synced=True)....)kubectl applyComponentwithenabled: true, stability: EXPERIMENTALspec.acknowledgeExperimental must be set to true when enabling an EXPERIMENTAL component (spec.stability == 'EXPERIMENTAL')kubectl applyComponentwithenabled: false, stability: EXPERIMENTALCOMPONENT_STATE_DISABLEDkubectl applyComponentwithenabled: true, stability: EXPERIMENTAL, acknowledgeExperimental: truexmc-bridgeclickhouse,redpanda,ingestion-gatewayCRsspec.stability: STABLEand remainReady=TrueRelated Issues / Bugs
Fixes bug 580941989
TAG=agy
CONV=bfd7efa2-aaa4-46db-a3f1-59cc171656b6
Stack created with GitHub Stacks CLI • Give Feedback 💬