feat(kustomize): vendor the clickhouse-operator crds - #187
Open
Nageshbansal wants to merge 21 commits into
Open
Conversation
The tooler package godoc states the contract: verb classes, the checks every tooler answers, and how output, approval and signals are handled. Invoke holds the shared spawn mechanics (argv only, environment untouched, no chdir, output tailed) and Resolve the PATH lookup. domain.Release is the deployable unit every tooler completes with its own tool vocabulary. Approval is stamped once at the entrypoint from --yes and read from the context by the verbs that change infrastructure. Foundry forwards no signals: the kernel delivers the interrupt to the exec'd tool directly and foundry survives its own copy to keep reading the streams. The planner and casting contracts now speak Toolers alone, and gauge checks one reach surface.
Each tool gets one package under internal/tooler: dockercompose, dockerswarm, kubectl, systemd, terraform, helm and aws. Exec toolers memoize a proven dialect through probe and spawn only through Invoke; helm is the SDK reference and honors the context instead. Mutating verbs run the same order, Validate then probe then verify then Invoke, and read ownership back through the tool's own labels before destroying anything. The gauge-only toolers are gone with the tools they guarded now driven by a verb, and the runner tree they were being replaced by is folded in here.
The registry lists a tooler per deployment: compose, swarm, systemd, kustomize and helm, and terraform for ecs. Gauge and the casting are handed the same objects, so the tools checked and the tools used cannot drift. Every casting that deploys now uncasts too. The kustomize casting applies the clickhouse operator CRDs as part of one release and deletes only what the kustomize root declares. The systemd casting keeps its own provisioning and checks for the component binaries itself, the binary tooler having done nothing more.
The registry lists the compose and swarm toolers, and both castings deploy and remove the agent stack through them.
Gauge loops planners like Forge and Cast do, so a failure is logged under the casting that wanted the tool, and returns the tooler's own error instead of a join of names: a missing tool now reports its own install hint and its own type. A tool is still proven once, keyed by name across documents, since proving one is a statement about the machine rather than about a document. Toolers take t as their receiver, the last of the runner naming. The infrastructure planner stops recursing into itself, and the installation registry drops the claim that gauge and cast share tooler objects: planners are built per verb, so they never did. Drops the tooler tests that assert a literal against itself, the one holding helm's empty Gauge in place, and the statement checks that passed whether or not the verb validated its release. The authoring skill carried the rule that generated them and now names what a test has to do instead.
Nageshbansal
changed the title
The registry named a terraform tooler for the ecs/ec2 deployment and the planner never read it, so every Infrastructure casting reached Cast with an empty set and refused: the terraform tooler is not registered for this casting. The installation and collectionagent planners already fetch theirs. refactor(tooler/terraform): write the plan instead of printing it terraform apply -auto-approve prints the whole diff before it does anything, so every cast buried its progress under a wall of resource attributes. A plan is a document about a change that has not happened yet, not a log of one. Apply now plans to a file and applies that file, which is terraform's own two step. Applying a written plan reports only what it does, and the plan stays in the root as tfplan for terraform show to read. Destroy takes the same path. Reading the world is not changing it, so the steps that only read go through query, which keeps just enough output to explain a failure; run still streams, and both hand the same invocation the mode it should use. chore(tooler): drop the eks tooler Nothing reaches it. No registry lists it, no casting looks it up, and the kube connection work it was written for is designed but unbuilt, so it has been a package that only its own test could call. It was also the only thing importing the AWS SDK, which leaves the module with five fewer direct dependencies and ten fewer indirect ones. The design record stands; when the connection work lands, so can a tooler for it. test(tooler): drop a test that proved nothing and gate the rest on a table TestNew asserted that a composite literal is not nil and that a promoted Name returns what its constructor was handed: the language working, not the tooler. No other tooler carries one. TestRenderUnstatedRoot was the invalid half of TestRender written as its own function. The two are one table now, which is what the pass gate is for, and the helm verb test became a table for the same reason rather than two bare assertions in a row. The live tests stay as they are. A single end to end scenario is not a matrix of inputs, and a table around one case reads worse than the case. test(tooler): assert what the verbs promise, not that they returned something The kubernetes gauge test could not fail: its own skip gate resolves the rest config and skips when that errors, and resolving the rest config is all Gauge does. It asserted the gate. The owner guards are the suite's load-bearing tests and were its weakest assertions: any error passed one, including the tool being absent. They now name the refusal they are there to prove. Helm asserted that two hand-picked releases error, which a connection failure would satisfy just as well. It has a Validate table now, per field, like the one kubernetes already had. Terraform had no test file, alone among the toolers, while carrying the only enforcement of --yes in the repo: both mutation verbs refuse an unapproved context before invoking anything, and nothing said so. Approval itself was untested too, though every mutation verb asks it.
Nageshbansal
force-pushed
the
fix/casting/kustomize-runner
branch
from
September 1, 2026 09:21
d3bd531 to
8453bd1
Compare
Nageshbansal
force-pushed
the
fix/casting/kustomize-runner
branch
from
September 3, 2026 14:27
8453bd1 to
ae04845
Compare
Nageshbansal
force-pushed
the
feat/runner
branch
2 times, most recently
from
September 3, 2026 15:57
9e86648 to
52024fb
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #177
Features
crds/clickhouse-operator/v0.25.3/. Forge and cast no longer reach raw.githubusercontent.com; bumping the operator means re-vendoring the files under a new version directory.Refactors
Related: #185