Skip to content

feat: hearth controller — FournosCluster lifecycle operator #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MML-coder merged 10 commits into from
May 19, 2026
Merged

feat: hearth controller — FournosCluster lifecycle operator #1

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
3819320
feat: hearth controller — FournosCluster lifecycle operator
MML-coder May 14, 2026
4aa6b72
📝 CodeRabbit Chat: Implement requested code changes
coderabbitai[bot] May 14, 2026
0bcec9e
Merge pull request #2 from openshift-psap/coderabbitai/chat/3819320
MML-coder May 14, 2026
6348357
fix: address coderabbit review — RBAC scoping, error handling, CQ sync
MML-coder May 14, 2026
f764bd4
fix: apply ruff formatting and add execution_namespace setting
MML-coder May 15, 2026
d5a4d66
fix: add pytest-cov to dev dependencies
MML-coder May 15, 2026
48902d1
feat: add ArgoCD Application, AppProject, and ImageStream
MML-coder May 15, 2026
87b1c8c
fix: use plural resource name fournosclusters per K8s convention
MML-coder May 18, 2026
ca38f5e
fix: silence kubernetes client loggers to prevent secret leaks
MML-coder May 18, 2026
f45049e
fix: add secrets RBAC for hearth namespace
MML-coder May 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
name: CI

on:
push:
branches: [main]
pull_request:
branches: [main]

Comment on lines +1 to +8

@coderabbitai coderabbitai Bot May 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add explicit permissions to workflow jobs.

The workflow does not specify explicit permissions for either job. GitHub Actions best practice recommends setting least-privilege permissions to reduce the attack surface if the workflow is compromised.

Consider adding at the workflow or job level:

permissions:
  contents: read
  packages: write  # if pushing to GitHub Container Registry

For Quay.io, contents: read is sufficient since authentication uses external secrets.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yaml around lines 1 - 8, The workflow titled "CI" lacks
explicit GitHub Actions permissions; add a permissions block either at the
workflow top-level (under the existing "name: CI") or per-job to enforce
least-privilege, e.g., set contents: read and packages: write only if you push
to GitHub Container Registry, otherwise just contents: read for external
registries like Quay.io; ensure the permissions entry is present alongside the
existing on/push/pull_request configuration so jobs like the main CI job obey
least-privilege.

jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.12"

- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"

- name: Run linting
run: |
ruff check hearth/ tests/
ruff format --check hearth/ tests/

- name: Run tests
run: |
pytest tests/ -v --cov=hearth --cov-report=term-missing

build-and-push:
runs-on: ubuntu-latest
needs: test
steps:
- uses: actions/checkout@v4

- name: Build container
run: |
podman build -t hearth:${{ github.sha }} -f Containerfile .

- name: Login to Quay
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
run: |
echo "${{ secrets.QUAY_PASSWORD }}" | podman login -u "${{ secrets.QUAY_USERNAME }}" --password-stdin quay.io

- name: Push container
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
run: |
podman tag hearth:${{ github.sha }} quay.io/rh_perfscale/hearth:${{ github.sha }}
podman tag hearth:${{ github.sha }} quay.io/rh_perfscale/hearth:latest
podman push quay.io/rh_perfscale/hearth:${{ github.sha }}
podman push quay.io/rh_perfscale/hearth:latest
12 changes: 12 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
__pycache__/
*.pyc
*.egg-info/
dist/
build/
.eggs/
*.egg
.pytest_cache/
.coverage
htmlcov/
.mypy_cache/
.ruff_cache/
16 changes: 16 additions & 0 deletions Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
FROM registry.access.redhat.com/ubi10/python-312-minimal:10.1

WORKDIR /opt/app-root/src

COPY pyproject.toml ./
RUN mkdir -p hearth && touch hearth/__init__.py \
&& pip install --no-cache-dir --upgrade pip \
&& pip install --no-cache-dir . \
&& rm -rf hearth

COPY hearth/ hearth/
RUN pip install --no-cache-dir --no-deps .

USER 1001

ENTRYPOINT ["python", "-m", "hearth", "--liveness=http://0.0.0.0:8080/healthz"]
Loading
Loading