task: encode various Jinja variables as JSON for manifests

We use Jinja2 to template our manifest files, but Jinja itself is
unaware of the output format (e.g., YAML). It simply renders text, so
it's up to us to ensure that variable values result in valid YAML.

In most cases, this means setting a Jinja variable to something that is
a valid YAML value. For example:

   name: {{ pod_name }}
   port: {{ ingress_port }}

YAML is a superset of JSON, so encoding simple values with json.dumps()
ensures they are safe and valid in most contexts.

However, not all uses are simple. Consider {{ port }} in different
roles:

  manifests/svc-cluster-ip.yaml.j2:    - name: tft-clusterip-service-udp-{{ port }}
  manifests/svc-cluster-ip.yaml.j2-      protocol: UDP
  manifests/svc-cluster-ip.yaml.j2:      port: {{ port }}
  manifests/svc-cluster-ip.yaml.j2-  selector:
  manifests/svc-cluster-ip.yaml.j2:    tft-port: "{{ port }}"

Here, "port" is used as a string fragment, a raw int, and a quoted
string—so no single encoding works everywhere.

This commit ensures that, where variables are used in simple,
well-defined ways, we encode them as JSON to reduce risk. We must still
reason about each template's context to set variables correctly.

Signed-off-by: Thomas Haller <thaller@redhat.com>

Author: thom311

manifests/allow-egress-mnp.yaml.j2

@@ -4,7 +4,7 @@ metadata:
   namespace: {{ name_space }}
   name: allow-egress-mnp
   labels:
-    tft-tests: "{{ index }}"
+    tft-tests: {{ label_tft_tests }}
   annotations:
     k8s.v1.cni.cncf.io/policy-for: {{ secondary_network_nad }}
 spec:

manifests/allow-ingress-mnp.yaml.j2

@@ -4,7 +4,7 @@ metadata:
   namespace: {{ name_space }}
   name: allow-ingress-mnp
   labels:
-    tft-tests: "{{ index }}"
+    tft-tests: {{ label_tft_tests }}
   annotations:
     k8s.v1.cni.cncf.io/policy-for: {{ secondary_network_nad }}
 spec:

manifests/host-pod.yaml.j2

@@ -2,17 +2,17 @@ apiVersion: v1
 kind: Pod
 metadata:
   namespace: {{ name_space }}
-  name: "{{ pod_name }}"
+  name: {{ pod_name }}
   labels:
-    tft-tests: "{{ index }}"
+    tft-tests: {{ label_tft_tests }}
     tft-port: "{{ port }}"
 spec:
   hostNetwork: true
   dnsPolicy: ClusterFirstWithHostNet
   nodeSelector:
-    kubernetes.io/hostname: "{{ node_name }}"
+    kubernetes.io/hostname: {{ node_name }}
   containers:
-  - name: "{{ pod_name }}"
+  - name: {{ pod_name }}
     image: {{ test_image }}
     command: {{ command }}
     args: {{ args }}

manifests/pod-secondary-network.yaml.j2

@@ -2,17 +2,17 @@ apiVersion: v1
 kind: Pod
 metadata:
   namespace: {{ name_space }}
-  name: "{{ pod_name }}"
+  name: {{ pod_name }}
   labels:
-    tft-tests: "{{ index }}"
+    tft-tests: {{ label_tft_tests }}
     tft-port: "{{ port }}"
   annotations:
     k8s.v1.cni.cncf.io/networks: {{ secondary_network_nad }}
 spec:
   nodeSelector:
-    kubernetes.io/hostname: "{{ node_name }}"
+    kubernetes.io/hostname: {{ node_name }}
   containers:
-  - name: "{{ pod_name }}"
+  - name: {{ pod_name }}
     image: {{ test_image }}
     command: {{ command }}
     args: {{ args }}

manifests/pod.yaml.j2

@@ -2,15 +2,15 @@ apiVersion: v1
 kind: Pod
 metadata:
   namespace: {{ name_space }}
-  name: "{{ pod_name }}"
+  name: {{ pod_name }}
   labels:
-    tft-tests: "{{ index }}"
+    tft-tests: {{ label_tft_tests }}
     tft-port: "{{ port }}"
 spec:
   nodeSelector:
-    kubernetes.io/hostname: "{{ node_name }}"
+    kubernetes.io/hostname: {{ node_name }}
   containers:
-  - name: "{{ pod_name }}"
+  - name: {{ pod_name }}
     image: {{ test_image }}
     command: {{ command }}
     args: {{ args }}

manifests/sriov-pod.yaml.j2

@@ -2,18 +2,18 @@ apiVersion: v1
 kind: Pod
 metadata:
   namespace: {{ name_space }}
-  name: "{{ pod_name }}"
+  name: {{ pod_name }}
   annotations: {% if not use_secondary_network %}
     v1.multus-cni.io/default-network: {{ default_network }} {% else %}
     k8s.v1.cni.cncf.io/networks: {{ secondary_network_nad }} {% endif %}
   labels:
-    tft-tests: "{{ index }}"
+    tft-tests: {{ label_tft_tests }}
     tft-port: "{{ port }}"
 spec:
   nodeSelector:
-    kubernetes.io/hostname: "{{ node_name }}"
+    kubernetes.io/hostname: {{ node_name }}
   containers:
-  - name: "{{ pod_name }}"
+  - name: {{ pod_name }}
     image: {{ test_image }}
     command: {{ command }}
     args: {{ args }}

manifests/svc-cluster-ip.yaml.j2

@@ -4,7 +4,7 @@ metadata:
   name: tft-clusterip-service
   namespace: {{ name_space }}
   labels:
-    tft-tests: "{{ index }}"
+    tft-tests: {{ label_tft_tests }}
 spec:
   type: ClusterIP
   ports:

manifests/svc-node-port.yaml.j2

@@ -4,7 +4,7 @@ metadata:
   name: tft-nodeport-service
   namespace: {{ name_space }}
   labels:
-    tft-tests: "{{ index }}"
+    tft-tests: {{ label_tft_tests }}
 spec:
   type: NodePort
   ports:

manifests/tools-pod.yaml.j2

@@ -2,15 +2,15 @@ apiVersion: v1
 kind: Pod
 metadata:
   namespace: {{ name_space }}
-  name: "{{ pod_name }}"
+  name: {{ pod_name }}
   labels:
-    tft-tests: "{{ index }}"
+    tft-tests: {{ label_tft_tests }}
 spec:
   nodeSelector:
-    kubernetes.io/hostname: "{{ node_name }}"
+    kubernetes.io/hostname: {{ node_name }}
   hostNetwork: true
   containers:
-  - name: "{{ pod_name }}"
+  - name: {{ pod_name }}
     image: {{ test_image }}
     command: {{ command }}
     args: {{ args }}

task.py

@@ -37,6 +37,8 @@
 from tftbase import TaskRole
 
 
+_j = json.dumps
+
 logger = common.ExtendedLogger("tft." + __name__)
 
 
@@ -336,20 +338,17 @@ def _fetch_default_resource_name(
 
     def get_template_args(self) -> dict[str, str | list[str]]:
         return {
-            "name_space": self.get_namespace(),
-            "test_image": tftbase.get_tft_test_image(),
-            "image_pull_policy": tftbase.get_tft_image_pull_policy(),
-            "command": ["/usr/bin/container-entry-point.sh"],
-            "args": self._get_template_args_args(),
-            "index": f"{self.index}",
-            "node_name": self.node_name,
-            "pod_name": self.pod_name,
+            "name_space": _j(self.get_namespace()),
+            "test_image": _j(tftbase.get_tft_test_image()),
+            "image_pull_policy": _j(tftbase.get_tft_image_pull_policy()),
+            "command": _j(["/usr/bin/container-entry-point.sh"]),
+            "args": _j(self._get_template_args_args()),
+            "label_tft_tests": _j(f"{self.index}"),
+            "node_name": _j(self.node_name),
+            "pod_name": _j(self.pod_name),
+            "privileged_pod": _j(self._get_template_args_privileged_pod()),
             "port": self._get_template_args_port(),
-            "privileged_pod": common.bool_to_str(
-                self._get_template_args_privileged_pod(),
-                format="true",
-            ),
-            "secondary_network_nad": self.ts.connection.effective_secondary_network_nad,
+            "secondary_network_nad": _j(self.ts.connection.effective_secondary_network_nad),
             "use_secondary_network": (
                 "1" if self.ts.connection.secondary_network_nad else ""
             ),
@@ -362,7 +361,7 @@ def get_template_args(self) -> dict[str, str | list[str]]:
                 )
                 or ""
             ),
-            "default_network": self.node.default_network,
+            "default_network": _j(self.node.default_network),
         }
 
     def _get_template_args_privileged_pod(self) -> bool:
@@ -545,7 +544,7 @@ def create_node_port_service(self, nodeport: int) -> str:
 
         template_args = {
             **self.get_template_args(),
-            "nodeport_svc_port": f"{nodeport}",
+            "nodeport_svc_port": _j(nodeport),
         }
 
         self.render_file(
@@ -567,7 +566,7 @@ def create_ingress_multi_network_policy(self, ingressPort: int) -> str:
 
         template_args = {
             **self.get_template_args(),
-            "ingress_port": f"{ingressPort}",
+            "ingress_port": _j(ingressPort),
         }
 
         self.render_file(
@@ -592,7 +591,7 @@ def create_egress_multi_network_policy(self, egressPort: int) -> str:
 
         template_args = {
             **self.get_template_args(),
-            "egress_port": f"{egressPort}",
+            "egress_port": _j(egressPort),
         }
 
         self.render_file(