opendefensecloud / solution-arsenal / 27404628011

75%

Build Type

push

github

Committed by web-flow

Commit Message

feat: implemented artifact cleanup (#554)

## What
Clean up rendered OCI artifacts and `RenderTask`s when SolAr API
resources are deleted.
Closes #358

## Why
Deleting a `ReleaseBinding` or `Target` previously left orphaned
`RenderTask` objects and OCI images in the render registry. This
implements the full deletion lifecycle.

## Testing
- Unit tests: `RenderArtifactReconciler` covered with fake client +
injected `DeleteTag` stub (`pkg/controller`)
- Unit tests: `TargetReconciler` extended for `ensureRenderArtifact`,
`ensureRenderBinding`, and `deleteStaleRenderBindings`
- `pkg/ociregistry.DeleteTag` tested for success and error paths
- E2E:
  - 1 artifact + 1 binding created on first render
- Same artifact reused (2 bindings) when a second Target renders the
same release
  - Artifact survives removal of one binding while another remains
- Artifact GC'd and OCI tag deleted after last binding removed via
Target deletion (finalizer path)
- Artifact GC'd and OCI tag deleted after last ReleaseBinding deleted
directly (stale-binding path)


## Notes for reviewers
**New API resources (CRD-equivalent, served via extension apiserver):**
- `RenderArtifact` records OCI coordinates of a pushed chart artifact;
carries a finalizer; reconciled by `RenderArtifactReconciler`
- `RenderBinding` ref-count record linking a Target to a
`RenderArtifact`; drives GC when the last binding is removed

**Helm chart:** top-level `caBundle` block added to mount a CA bundle
`ConfigMap` into the controller-manager pod (`SSL_CERT_FILE`), required
for TLS to self-signed registries in cluster.

## Checklist
- [x] Tests added/updated
- [x] No breaking changes (or upgrade path documented above)
- [x] Readable commit history (squashed and cleaned up as desired)
- [x] AI code review considered and comments resolved


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added RenderArtifact and RenderBinding CRDs, typed
... (continued)

Coverage Stats

312 of 425 new or added lines in 6 files covered. (73.41%)

2 existing lines in 1 file now uncovered.

2964 of 3983 relevant lines covered (74.42%)

41.55 hits per line