Skip to content

s3: Filter S3 profiles to only those used by the application - #503

Draft
parikshithb wants to merge 1 commit into
RamenDR:mainfrom
parikshithb:validate_app_muti_pair
Draft

s3: Filter S3 profiles to only those used by the application#503
parikshithb wants to merge 1 commit into
RamenDR:mainfrom
parikshithb:validate_app_muti_pair

Conversation

@parikshithb

@parikshithb parikshithb commented Aug 11, 2026

Copy link
Copy Markdown
Member

Problem

When a hub is shared by multiple managed clusters, validate and gather
application commands access all S3 profiles from the hub configmap,
causing failures for profiles unrelated to the application.

Solution

Add ramen.ApplicationProfiles() that filters hub configmap profiles to
only those referenced by the primary VRG's spec.s3Profiles. One-line
change in each caller to use it instead of ClusterProfiles().

Fixes DFBUGS-9708

@parikshithb
parikshithb marked this pull request as draft August 11, 2026 18:55
@coderabbitai

coderabbitai Bot commented Aug 11, 2026

Copy link
Copy Markdown

Review Change Stack

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f38a6b29-1f74-494a-a33b-d30f94f3727c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Summary by CodeRabbit

  • Improvements
    • S3 information is now scoped to the relevant application, ensuring only associated profiles and data are retrieved.
    • S3 prefixes are generated consistently from application details.
    • Failed-test processing now identifies and includes S3 data for affected applications.
  • Bug Fixes
    • Improved handling and reporting when required application, cluster, or S3 configuration information is unavailable.
    • Unreadable or missing resources during failed-test processing are safely skipped.

Walkthrough

S3 discovery now reads application profile references from the primary VRG. It derives prefixes from the VRG namespace and DRPC name. Gathering, validation, and failed-test reporting filter S3 secrets to application-associated profiles.

Changes

Application-specific S3 discovery

Layer / File(s) Summary
S3 prefix and profile helpers
pkg/ramen/ramen.go
ApplicationS3Prefix formats prefixes directly. ApplicationS3Profiles reads and validates profile names from a VRG.
Application gather and validation flow
pkg/gather/command.go, pkg/validate/application/command.go
Both flows resolve DRPC metadata, the VRG namespace, and the primary cluster. They retrieve only the application’s referenced S3 profiles and derive the prefix directly.
Failed-test S3 discovery
pkg/test/command.go
Failed-test processing collects application profile names and prefixes. It logs and skips missing or unreadable resources, then filters stored S3 profiles.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

  • RamenDR/ramenctl issue 499 — The change filters application-specific S3 profiles from the primary VRG for validation and reporting.

Suggested reviewers: nirs

Sequence Diagram(s)

sequenceDiagram
  participant ApplicationCommand
  participant DRPC
  participant PrimaryVRG
  participant S3Profiles
  participant S3Secrets

  ApplicationCommand->>DRPC: Read application DRPC
  ApplicationCommand->>PrimaryVRG: Resolve VRG namespace and primary cluster
  ApplicationCommand->>S3Profiles: Read referenced profile names
  ApplicationCommand->>S3Secrets: Retrieve matching S3 secrets
  ApplicationCommand->>ApplicationCommand: Derive prefix from VRG namespace and DRPC name
Loading
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly summarizes the primary change: filtering S3 profiles to those used by the application.
Description check ✅ Passed The description directly explains the problem and solution addressed by the changeset.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@parikshithb
parikshithb requested a review from nirs August 11, 2026 18:55

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/gather/command.go`:
- Around line 406-408: In pkg/gather/command.go lines 406-408, validate that
every appProfiles entry has a matching hub profile before filtering and fail the
inspection when any are missing. Apply the same pre-gather validation in
pkg/validate/application/command.go lines 312-314. In pkg/test/command.go lines
267-269, log the missing profile names and skip or mark the affected
application’s S3 gathering as incomplete so gathering cannot proceed with an
empty profile list.

In `@pkg/test/command.go`:
- Around line 490-491: Update the profile and prefix collection around
appProfiles and prefixes so each application’s profiles remain associated with
its own ramen.ApplicationS3Prefix value instead of building independent unions.
Adjust the data passed to s3.Gather to preserve these per-application
associations and prevent profiles from receiving unrelated prefixes.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e658c3db-a917-4316-b891-2283456f9c32

📥 Commits

Reviewing files that changed from the base of the PR and between e945659 and 9cb325b.

📒 Files selected for processing (4)
  • pkg/gather/command.go
  • pkg/ramen/ramen.go
  • pkg/test/command.go
  • pkg/validate/application/command.go
📜 Review details
⏰ Context from checks skipped due to timeout. (12)
  • GitHub Check: Build (linux, arm64)
  • GitHub Check: Build (windows, amd64)
  • GitHub Check: Test (ubuntu-24.04)
  • GitHub Check: Build (darwin, amd64)
  • GitHub Check: Build (linux, amd64)
  • GitHub Check: Test (macos-15)
  • GitHub Check: Go compatibility
  • GitHub Check: Build (darwin, arm64)
  • GitHub Check: Test (ubuntu-24.04-arm)
  • GitHub Check: Test (macos-15-intel)
  • GitHub Check: Lint
  • GitHub Check: Test (windows-latest)
🧰 Additional context used
📓 Path-based instructions (1)
**/*.go

📄 CodeRabbit inference engine (.cursor/rules/project.mdc)

**/*.go: Use proper punctuation in comments - end sentences with periods
All Go files need SPDX license headers - check existing files for the format
Check existing code for error formatting conventions in Go

Files:

  • pkg/test/command.go
  • pkg/ramen/ramen.go
  • pkg/validate/application/command.go
  • pkg/gather/command.go
🔇 Additional comments (4)
pkg/ramen/ramen.go (1)

375-391: LGTM!

pkg/gather/command.go (1)

364-396: LGTM!

Also applies to: 420-420

pkg/validate/application/command.go (1)

270-302: LGTM!

Also applies to: 326-326

pkg/test/command.go (1)

254-256: LGTM!

Also applies to: 448-488, 492-494

Comment thread pkg/gather/command.go Outdated
Comment thread pkg/test/command.go Outdated
Comment thread pkg/ramen/ramen.go
Comment thread pkg/gather/command.go
Comment thread pkg/ramen/ramen.go Outdated
Comment thread pkg/test/command.go Outdated
Comment thread pkg/test/command.go
Comment thread pkg/test/command.go Outdated

func (c *Command) s3PrefixesToGather(reader gathering.OutputReader) []string {
// s3InfoToGather returns the S3 profile names and prefixes for failed tests,
// reading the DRPC and VRG once per test.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keep the previous code - the only difference is the profiles used to gather. The old code gathered from all profiles, we need to gather only from the application profiles for each application.

The simplest way is to do the gather per failed application instead of single gather for all applications:

for app in failed appes:
    get the prefix for tha app
    get the profiles for the app
    gather s3 data for profiles and prefix

But since we use the same drpolicy for all test apps - we will have the same profiles names for every app - so we can do:

 get prefixes for all apps
 get profiles for all apps (removing duplicates)
 gather s3 data from profiles and prefixes

Comment thread pkg/validate/application/command.go Outdated
@parikshithb
parikshithb force-pushed the validate_app_muti_pair branch from 9cb325b to 6f903e3 Compare August 13, 2026 10:44

@nirs nirs left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need deeper review, added few comments for now.

Comment thread pkg/gather/command.go
storeProfiles, err := ramen.ClusterProfiles(reader, configMapName, configMapNamespace)
storeProfiles, err := ramen.ApplicationProfiles(
c, reader, c.outputReader, configMapName, configMapNamespace,
c.opts.DRPCName, c.opts.DRPCNamespace)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a good start - change the function we call to get the application profiles instead of all profiles!

But we pass 2 many arguments like configMapName and configMapNamespace - this values comes from ramen package, so ramen already know them, so no need to pass them.

Need rethink passing these arguments:

  • c - the command - is it for the logger? we should pass the logger instead.
  • reader
  • c.outputReader - would be better to implement this in the ramen package and not pass functions like this
  • configMapName, configMapNamespace - ramen already know these.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nirs

  1. ctx is used not for logging. It's needed currently for PrimaryCluster(ctx, drpc) which calls ctx.Env().GetCluster()
  2. c.outputReader: not sure how, add OutputReader(string) to the ramen.Context interface?
  3. configmap:
    • configmap Name: Yes, but existing configMapName := ramen.HubOperatorConfigMapName is passed from caller, refactor this code to directly use?
    • Configmap ns: this comes from user config config.Namespaces.RamenHubNamespace varies between k8s and ocp

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ctx is good - matching how we pass commands everywhere - keep it.

The hub reader is already used in other functions, but current coded needed single cluster, and here we need to read form 2 clusters. Reading clusters requires the command dataDir(), so we added outputDir() since it was used only in the command command. Passing it to the ramen code works but not great.

If we add OutputReader(string) to the context interface, ramen code can create readers from the context so we don't need to pass the hub and the outputReader function. This seems useful since ramen package need to read stuff from the output directory.

The ramen package knows the ramen hub config map name so we don't need to pass it.

The context has the config, so the ramen package can find the config namespace.

With these changes the call will become:

storeProfiles, err := ramen.ApplicationProfiles(c, c.opts.DRPCName, c.opts.DRPCNamespace)

Lets try do this:

  1. commit 1: Add OuptutReader to ramen context
  2. commit 2: Add ApplicationS3Profiles (this commit)

If adding OutputReader() is too big we can pass the function and let ramen.ApplicationS3Profiles create the readers.

We can change ramen.ApplicationS3Prefix() to accept a context later for creating the reader instead of passing the reader. This can be a followup PR in main. release 0.23 will have less consistent code.

@nirs

nirs commented Aug 13, 2026

Copy link
Copy Markdown
Member

@parikshithb Please link to the downstream bug so we have easy way to find it, or create a new upstream issue linking to this bug.

When a hub is shared by multiple managed clusters, the ramen
configmap contains S3 profiles for all DR pairs. Previously,
validate and gather commands processed all profiles from the
configmap, causing failures for profiles unrelated to the
application being validated.

Add ramen.ApplicationProfiles() that reads the primary VRG's
spec.s3Profiles and filters the configmap profiles to only
those referenced by the application. This replaces the
ClusterProfiles() call in both validate application and gather
application commands.

Assisted-by: Opus 4.6
Signed-off-by: Parikshith <parikshithb@gmail.com>
@parikshithb
parikshithb force-pushed the validate_app_muti_pair branch from 6f903e3 to f1fbf4a Compare August 13, 2026 12:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants