From f7900f09f18350042e8bbd25aa470301c43208db Mon Sep 17 00:00:00 2001 From: James Gilbert Date: Wed, 22 Jul 2026 16:03:15 +0100 Subject: [PATCH 1/2] feat(events): add trigger ttl policies --- charts/apps/Chart.yaml | 2 +- charts/apps/staging-values.yaml | 3 ++ charts/events/Chart.yaml | 2 +- charts/events/crds/trigger-crds.yaml | 7 +++ .../populate-trigger-clusterpolicy.yaml | 53 +++++++++++++++++++ 5 files changed, 65 insertions(+), 2 deletions(-) diff --git a/charts/apps/Chart.yaml b/charts/apps/Chart.yaml index 53a011662..7d3c3215e 100644 --- a/charts/apps/Chart.yaml +++ b/charts/apps/Chart.yaml @@ -2,4 +2,4 @@ apiVersion: v2 name: apps description: An argocd app to deploy apps inside the virtual cluster type: application -version: 0.5.10 +version: 0.5.11 diff --git a/charts/apps/staging-values.yaml b/charts/apps/staging-values.yaml index 50cfa3aea..c335f7629 100644 --- a/charts/apps/staging-values.yaml +++ b/charts/apps/staging-values.yaml @@ -37,6 +37,9 @@ kyverno: requests: cpu: 100m memory: 4Gi + cleanupController: + enabled: true + replicas: 1 sessionspaces: enabled: true diff --git a/charts/events/Chart.yaml b/charts/events/Chart.yaml index d30798049..aaec8fc91 100644 --- a/charts/events/Chart.yaml +++ b/charts/events/Chart.yaml @@ -3,7 +3,7 @@ name: events description: Data Analysis event triggering type: application -version: 0.3.3 +version: 0.3.4 dependencies: - name: argo-events diff --git a/charts/events/crds/trigger-crds.yaml b/charts/events/crds/trigger-crds.yaml index d8c8ed29d..176e5b57f 100644 --- a/charts/events/crds/trigger-crds.yaml +++ b/charts/events/crds/trigger-crds.yaml @@ -22,6 +22,9 @@ spec: spec: type: object properties: + lifetime: + type: string + pattern: '^(\d+[smh]|forever)$' enabled: type: boolean default: true @@ -81,6 +84,10 @@ spec: spec: type: object properties: + lifetime: + type: string + pattern: '^(\d+[smh]|forever)$' + default: 24h templateRef: type: string enabled: diff --git a/charts/events/templates/populate-trigger-clusterpolicy.yaml b/charts/events/templates/populate-trigger-clusterpolicy.yaml index fec331121..4d01c228e 100644 --- a/charts/events/templates/populate-trigger-clusterpolicy.yaml +++ b/charts/events/templates/populate-trigger-clusterpolicy.yaml @@ -40,6 +40,37 @@ spec: workflows.diamond.ac.uk/source: '{{`{{templateObject.metadata.labels."workflows.diamond.ac.uk/source"}}`}}' spec: "{{`{{templateObject.spec}}`}}" +--- +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: assign-trigger-ttl +spec: + rules: + - name: propagate-user-ttl + match: + resources: + kinds: + - workflows.diamond.ac.uk/v1alpha1/Trigger + operations: + - CREATE + context: + - name: lifetime + variable: + jmesPath: request.object.spec.lifetime || "" + + preconditions: + all: + - key: "{{`{{ lifetime }}`}}" + operator: AnyNotIn + value: + - "forever" + mutate: + patchStrategicMerge: + metadata: + labels: + cleanup.kyverno.io/ttl: "{{`{{ lifetime }}`}}" + --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -68,3 +99,25 @@ subjects: - kind: ServiceAccount name: kyverno-admission-controller namespace: kyverno +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: kyverno:delete-triggers +rules: + - apiGroups: ["workflows.diamond.ac.uk"] + resources: ["triggers"] + verbs: ["get", "list", "watch", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: kyverno:delete-triggers +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kyverno:delete-triggers +subjects: + - kind: ServiceAccount + name: kyverno-cleanup-controller + namespace: kyverno From d28e31c8e45be026b52857432835ed35446ed749 Mon Sep 17 00:00:00 2001 From: James Gilbert Date: Thu, 23 Jul 2026 15:54:52 +0100 Subject: [PATCH 2/2] test(events): add trigger ttl chainsaw tests --- .../assign-trigger-ttl/chainsaw-test.yaml | 114 ++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100644 charts/events/test-policy/assign-trigger-ttl/chainsaw-test.yaml diff --git a/charts/events/test-policy/assign-trigger-ttl/chainsaw-test.yaml b/charts/events/test-policy/assign-trigger-ttl/chainsaw-test.yaml new file mode 100644 index 000000000..6b553891c --- /dev/null +++ b/charts/events/test-policy/assign-trigger-ttl/chainsaw-test.yaml @@ -0,0 +1,114 @@ +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: assign-default-trigger-ttl +spec: + steps: + - try: + - create: + resource: + apiVersion: workflows.diamond.ac.uk/v1alpha1 + kind: Trigger + metadata: + name: test-template + labels: + workflows.diamond.ac.uk/source: test-source + workflows.diamond.ac.uk/beamline: test-beamline + spec: + enabled: true + eventName: test-eventname + workflow: + template: workflow-template + - assert: + resource: + apiVersion: workflows.diamond.ac.uk/v1alpha1 + kind: Trigger + metadata: + name: test-template + labels: + cleanup.kyverno.io/ttl: 24h + workflows.diamond.ac.uk/source: test-source + workflows.diamond.ac.uk/beamline: test-beamline + spec: + enabled: true + eventName: test-eventname + workflow: + template: workflow-template +--- +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: propagate-user-defined-trigger-expiration +spec: + steps: + - try: + - create: + resource: + apiVersion: workflows.diamond.ac.uk/v1alpha1 + kind: Trigger + metadata: + name: test-template + labels: + workflows.diamond.ac.uk/source: test-source + workflows.diamond.ac.uk/beamline: test-beamline + spec: + lifetime: 30m + enabled: true + eventName: test-eventname + workflow: + template: workflow-template + - assert: + resource: + apiVersion: workflows.diamond.ac.uk/v1alpha1 + kind: Trigger + metadata: + name: test-template + labels: + cleanup.kyverno.io/ttl: 30m + workflows.diamond.ac.uk/source: test-source + workflows.diamond.ac.uk/beamline: test-beamline + spec: + lifetime: 30m + enabled: true + eventName: test-eventname + workflow: + template: workflow-template +--- +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: allow-never-ending-trigger +spec: + steps: + - try: + - create: + resource: + apiVersion: workflows.diamond.ac.uk/v1alpha1 + kind: Trigger + metadata: + name: test-template + labels: + lifetime: forever + workflows.diamond.ac.uk/source: test-source + workflows.diamond.ac.uk/beamline: test-beamline + spec: + enabled: true + eventName: test-eventname + workflow: + template: workflow-template + - assert: + resource: + apiVersion: workflows.diamond.ac.uk/v1alpha1 + kind: Trigger + metadata: + name: test-template + labels: + lifetime: forever + workflows.diamond.ac.uk/source: test-source + workflows.diamond.ac.uk/beamline: test-beamline + spec: + enabled: true + eventName: test-eventname + workflow: + template: workflow-template +