[dmt] add NamespaceLabelsRule to container exclusion settings by riptide-01 · Pull Request #394 · deckhouse/dmt

riptide-01 · 2026-06-16T11:54:40Z

Description

The object-namespace-labels container rule could be documented as configurable, but excluding namespaces via .dmt.yaml had no effect.

This PR wires the exclude list through config and module mapping, applies KindRule.Enabled() in the rule implementation, fixes the global config mapstructure key (namespace-labels → object-namespace-labels), and adds e2e fixtures plus an expectPass assertion helper.

Before / After

Area	Before	After
Exclude config	`object-namespace-labels` under `linters-settings.container.exclude-rules` was ignored	Exclude entries are loaded and passed into `NamespaceLabelsRule`
Rule logic	Rule always ran for every `d8-*` namespace with `PrometheusRule` resources	Rule skips namespaces matched by `kind` + `name` exclude entries
Global config key	`mapstructure:"namespace-labels"` (mismatched name)	`mapstructure:"object-namespace-labels"` (consistent with rule ID)
Docs	Rule marked as not configurable (❌)	Marked configurable (✅) with exclude example
E2E	No coverage for this rule	Two fixtures: violation (`namespace-labels`) and excluded namespace (`ignore-namespace-labels`)
E2E framework	No way to assert a rule produces zero findings	New `expectPass` field with unit tests

Why do we need it, and what problem does it solve?

Some modules intentionally omit prometheus.deckhouse.io/rules-watcher-enabled on specific d8-* namespaces. Users tried to disable the check via exclude-rules, but it did not work because:

NamespaceLabelsRule was missing from the exclude-rules config structs and module mapping.
The rule never called Enabled() — unlike other container rules with exclude support.
The global config used the wrong YAML key (namespace-labels instead of object-namespace-labels).

E2e tests lock in both the positive case (missing label is reported) and the exclude case (configured namespace is ignored).

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

…ainerRules struct Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

- Introduced new test cases in `framework_test.go` to validate the behavior of the `Match` function with respect to expected lint findings and rules that should pass. - Enhanced the `framework.go` file to support the new `ExpectPass` feature, allowing specification of rules that must not produce any matching findings. - Updated the README to document the new `expectPass` functionality. - Added test data for a namespace that should be ignored by the container linter on the `object-namespace-labels` rule. This commit improves the testing framework for linting rules and ensures better compliance with expected behavior in various scenarios. Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

…iguration Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

…rom `.dmt.yaml` to `.dmtlint.yaml` across multiple linters. Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

Copilot

Pull request overview

This PR makes the container linter’s object-namespace-labels rule properly honor namespace exclusions configured via .dmtlint.yaml, and adds e2e coverage (including a new expectPass assertion) to prevent regressions.

Changes:

Wire object-namespace-labels exclude entries from module/global config through module mapping into NamespaceLabelsRule, and apply KindRule.Enabled() inside the rule.
Fix the global config mapstructure key for the rule (namespace-labels → object-namespace-labels).
Add e2e fixtures for both the “violation” and “excluded namespace” scenarios, plus an expectPass matcher and unit tests in the e2e framework.

Reviewed changes

Copilot reviewed 29 out of 29 changed files in this pull request and generated 30 comments.

Show a summary per file

File	Description
test/e2e/testdata/container/namespace-labels/module/templates/manifests.yaml	Adds a fixture namespace + PrometheusRule that should trigger `object-namespace-labels`.
test/e2e/testdata/container/namespace-labels/module/openapi/values.yaml	Minimal OpenAPI scaffold for the new e2e fixture module.
test/e2e/testdata/container/namespace-labels/module/openapi/config-values.yaml	Minimal OpenAPI scaffold for the new e2e fixture module.
test/e2e/testdata/container/namespace-labels/module/module.yaml	Declares the fixture module metadata.
test/e2e/testdata/container/namespace-labels/expected.yaml	Defines expected failing finding for `object-namespace-labels`.
test/e2e/testdata/container/ignore-namespace-labels/module/templates/manifests.yaml	Adds a fixture namespace + PrometheusRule that should be excluded from `object-namespace-labels`.
test/e2e/testdata/container/ignore-namespace-labels/module/openapi/values.yaml	Minimal OpenAPI scaffold for the exclusion fixture module.
test/e2e/testdata/container/ignore-namespace-labels/module/openapi/config-values.yaml	Minimal OpenAPI scaffold for the exclusion fixture module.
test/e2e/testdata/container/ignore-namespace-labels/module/module.yaml	Declares the exclusion fixture module metadata.
test/e2e/testdata/container/ignore-namespace-labels/module/.dmtlint.yaml	Configures `exclude-rules.object-namespace-labels` to ignore the fixture namespace.
test/e2e/testdata/container/ignore-namespace-labels/expected.yaml	Uses `expectPass` to assert the rule produces no matching findings.
test/e2e/README.md	Documents the new `expectPass` field and its matching semantics.
test/e2e/framework.go	Adds `ExpectPass` to case spec and enforces it in `Match()`.
test/e2e/framework_test.go	Adds unit tests for `expectPass` matching behavior.
pkg/linters/templates/README.md	Clarifies “Configurable” meaning and updates config filename references in examples.
pkg/linters/rbac/README.md	Updates “Configurable” wording and configuration examples (needs follow-up fixes).
pkg/linters/openapi/README.md	Updates “Configurable” wording and configuration examples (needs follow-up fixes).
pkg/linters/no-cyrillic/README.md	Updates “Configurable” wording and configuration examples (needs follow-up fixes).
pkg/linters/module/README.md	Updates “Configurable” wording (needs follow-up fixes).
pkg/linters/images/README.md	Updates “Configurable” wording (needs follow-up fixes).
pkg/linters/hooks/README.md	Updates “Configurable” wording and configuration examples (needs follow-up fixes).
pkg/linters/docs/README.md	Updates “Configurable” wording (needs follow-up fixes).
pkg/linters/container/rules/namespace_labels.go	Adds exclude support via embedded `KindRule` and checks `Enabled()` before running the rule.
pkg/linters/container/rules.go	Passes configured exclude list into `NewNamespaceLabelsRule(...)`.
pkg/linters/container/README.md	Marks rule configurable and documents exclusions (currently has multiple Markdown/YAML corruption issues to fix).
pkg/config/linters_settings.go	Adds `object-namespace-labels` to module-level `container.exclude-rules` settings mapping.
pkg/config/global/global.go	Fixes global mapstructure key to `object-namespace-labels`.
pkg/config.go	Adds `NamespaceLabelsRule` into runtime container exclude rules struct.
internal/module/module.go	Wires module config exclusions into the container linter config.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

 | [no-new-privileges](#no-new-privileges) | Validates containers don't allow privilege escalation | ✅ | enabled |
 | [seccomp-profile](#seccomp-profile) | Validates seccomp profile configuration | ✅ | enabled |

+"Configurable" means that this rule can be configured using the `.dmt.yaml` file, including customizing the rule's parameters and/or disabling the rule.


+Exclude specific `d8-*` namespaces from this check when the Prometheus watcher label is intentionally omitted:
+
+```yaml
+# .dmt.yaml


 ```

-✅ **Correct** - Non-root with deckhouse user:
+✅ .dmtlint.yaml** - Non-root with deckhouse user:



 ✅ **Correct** - Read-only filesystem:
-
+.dmtlint.yaml


 Pod running in hostNetwork and it's container port doesn't fit the range [4200,4299]
 ```
-
+.dmtlint.yaml


+### Configuration in M.dmtlint.yamlectory

 You can also place a `.dmt.yaml` configuration file directly in your module directory:
-
+.dmtlint.yaml
 ```yaml
 # modules/my-module/.dmt.yaml


 | [cyrillic-in-english](#cyrillic-in-english) | Validates English documentation doesn't contain cyrillic characters | ✅ | enabled |
 | [no-lang-key](#no-lang-key) | Validates documentation front matter doesn't contain `lang` key | ✅ | enabled |

+"Configurable" means that this rule can be configured using the `.dmt.yaml` file, including customizing the rule's parameters and/or disabling the rule.


 | [**package-yaml**](#package-yaml) | Validates `package.yaml` metadata and new requirements schema | ✅ Yes |
 | [**legacy-release-file**](#legacy-release-file) | Checks for deprecated `release.yaml` file | ❌ No |

+"Configurable" means that this rule can be configured using the `.dmt.yaml` file, including customizing the rule's parameters and/or disabling the rule.


 | [**werf**](#werf) | Validates werf.yaml configuration | ✅ Yes |
 | [**patches**](#patches) | Validates patch file structure and documentation | ✅ Yes |

+"Configurable" means that this rule can be configured using the `.dmt.yaml` file, including customizing the rule's parameters and/or disabling the rule.


 ```
 dnsPolicy must be `ClusterFirstWithHostNet` when hostNetwork is `true`
-```
+``.dmtlint.yaml


[dmt] add NamespaceLabelsRule to container exclusion settings

6ed686d

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

riptide-01 requested a review from ldmonster June 16, 2026 11:54

riptide-01 self-assigned this Jun 16, 2026

riptide-01 added 2 commits June 16, 2026 14:56

rm debug

229597c

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

Update NamespaceLabelsRule mapping to object-namespace-labels in Cont…

01475d2

…ainerRules struct Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

riptide-01 force-pushed the fix/exclude-container-namespace-linter branch from 26be33e to 01475d2 Compare June 16, 2026 12:07

riptide-01 added 4 commits June 16, 2026 15:09

Merge branch 'main' into fix/exclude-container-namespace-linter

b95fba8

add e2e

3f30eea

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

Update README to reflect changes in object-namespace-labels rule conf…

84a9740

…iguration Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

riptide-01 force-pushed the fix/exclude-container-namespace-linter branch from 3012031 to 84a9740 Compare June 16, 2026 15:32

riptide-01 added 5 commits June 18, 2026 11:23

Merge branch 'main' into fix/exclude-container-namespace-linter

7bffd26

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

framework from main

d864186

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

reimplement expecgtPass feature

9dac65c

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

fix lint

ae63b85

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

[doc] configurable means

a729d2e

Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

riptide-01 added enhancement New feature or request bug Something isn't working go Pull requests that update go code labels Jun 18, 2026

riptide-01 and others added 3 commits June 19, 2026 12:21

Update README files to reflect changes in configuration file naming f…

b9b0226

…rom `.dmt.yaml` to `.dmtlint.yaml` across multiple linters. Signed-off-by: Smyslov Maxim <maksim.smyslov@flant.com>

Merge branch 'main' into fix/exclude-container-namespace-linter

b9da296

Merge branch 'main' into fix/exclude-container-namespace-linter

d0743d7

ldmonster requested a review from Copilot June 29, 2026 17:05

Copilot started reviewing on behalf of ldmonster June 29, 2026 17:05 View session

Copilot AI reviewed Jun 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[dmt] add NamespaceLabelsRule to container exclusion settings#394

[dmt] add NamespaceLabelsRule to container exclusion settings#394
riptide-01 wants to merge 15 commits into
mainfrom
fix/exclude-container-namespace-linter

riptide-01 commented Jun 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

riptide-01 commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Before / After

Why do we need it, and what problem does it solve?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

riptide-01 commented Jun 16, 2026 •

edited

Loading