Label the Knative overlays with the knative release unit.

Serving-core and Kourier each carry the Deployments that exist in that upstream file. The render test expects the label and still rejects any other drift.

RELREG-WP-0002-T01

Assistant: grok
Assistant-Session: 01a15f9f-3d77-7d21-911b-d93c86f9d14f

install/knative/overlays/kourier/kustomization.yaml

@@ -9,3 +9,4 @@ patches:
   - path: cpu-requests.patch.yaml
   - path: hpa-caps.patch.yaml
   - path: service-clusterip.patch.yaml
+  - path: release-unit.patch.yaml

install/knative/overlays/kourier/release-unit.patch.yaml

@@ -0,0 +1,18 @@
+# Same label as rail-knative/substrate/v1.22.0/release-unit.patch.yaml.
+# These two Deployments ship in kourier.yaml. Serving-core Deployments stay
+# on the serving-core overlay.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: net-kourier-controller
+  namespace: knative-serving
+  labels:
+    railiance.io/release-unit: knative
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: 3scale-kourier-gateway
+  namespace: kourier-system
+  labels:
+    railiance.io/release-unit: knative

install/knative/overlays/serving-core/kustomization.yaml

@@ -8,3 +8,4 @@ resources:
 patches:
   - path: cpu-requests.patch.yaml
   - path: hpa-caps.patch.yaml
+  - path: release-unit.patch.yaml

install/knative/overlays/serving-core/release-unit.patch.yaml

@@ -0,0 +1,34 @@
+# Same label as rail-knative/substrate/v1.22.0/release-unit.patch.yaml.
+# Serving-core Deployments only. Kourier's controller and gateway are on the
+# kourier overlay, because they are not in serving-core.yaml.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: activator
+  namespace: knative-serving
+  labels:
+    railiance.io/release-unit: knative
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: autoscaler
+  namespace: knative-serving
+  labels:
+    railiance.io/release-unit: knative
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller
+  namespace: knative-serving
+  labels:
+    railiance.io/release-unit: knative
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: webhook
+  namespace: knative-serving
+  labels:
+    railiance.io/release-unit: knative

tests/test_knative_render.py

@@ -2,9 +2,10 @@
 
 Runs install/knative/render.sh (download + SHA-256 verification + kustomize;
 no cluster contact) and compares the result with the upstream assets: the six
-declared CPU requests and HPA maxReplicas change, the Kourier Service is ClusterIP, the gateway
-image is the pinned Envoy digest, and nothing else differs. Skips when the
-upstream assets cannot be fetched or kubectl is missing.
+declared CPU requests and HPA maxReplicas change, each of those Deployments
+carries railiance.io/release-unit=knative, the Kourier Service is ClusterIP,
+the gateway image is the pinned Envoy digest, and nothing else differs.
+Skips when the upstream assets cannot be fetched or kubectl is missing.
 """
 from __future__ import annotations
 
@@ -39,6 +40,14 @@ DECLARED_HPA = {  # (namespace, hpa) -> maxReplicas
     ("knative-serving", "webhook"): 2,
     ("kourier-system", "3scale-kourier-gateway"): 3,
 }
+DECLARED_RELEASE_UNIT = {  # (namespace, deployment) -> label
+    ("knative-serving", "activator"): "knative",
+    ("knative-serving", "autoscaler"): "knative",
+    ("knative-serving", "controller"): "knative",
+    ("knative-serving", "webhook"): "knative",
+    ("knative-serving", "net-kourier-controller"): "knative",
+    ("kourier-system", "3scale-kourier-gateway"): "knative",
+}
 
 
 def lock() -> dict[str, str]:
@@ -67,6 +76,13 @@ def patch_hpa_caps(path: Path) -> dict[tuple, int]:
     return {(d["metadata"]["namespace"], d["metadata"]["name"]): d["spec"]["maxReplicas"] for d in load(path)}
 
 
+def patch_release_unit(path: Path) -> dict[tuple, str]:
+    return {
+        (d["metadata"]["namespace"], d["metadata"]["name"]): d["metadata"]["labels"]["railiance.io/release-unit"]
+        for d in load(path)
+    }
+
+
 @unittest.skipIf(yaml is None, "PyYAML not installed")
 class DeclarationTests(unittest.TestCase):
     def test_overlays_carry_the_declared_requests(self) -> None:
@@ -98,6 +114,16 @@ class DeclarationTests(unittest.TestCase):
         self.assertEqual(DECLARED, patch_requests(source))
         self.assertEqual(DECLARED_HPA, patch_hpa_caps(source.with_name("hpa-caps.patch.yaml")))
 
+    def test_release_unit_label_matches_rail_knative(self) -> None:
+        source = RAIL_KNATIVE / "substrate" / "v1.22.0" / "release-unit.patch.yaml"
+        if not source.exists():
+            self.skipTest(f"rail-knative not checked out at {RAIL_KNATIVE}")
+        got = {}
+        for overlay in ("serving-core", "kourier"):
+            got.update(patch_release_unit(KNATIVE / "overlays" / overlay / "release-unit.patch.yaml"))
+        self.assertEqual(DECLARED_RELEASE_UNIT, got)
+        self.assertEqual(DECLARED_RELEASE_UNIT, patch_release_unit(source))
+
 
 @unittest.skipIf(yaml is None or shutil.which("kubectl") is None, "needs PyYAML and kubectl")
 class RenderTests(unittest.TestCase):
@@ -124,6 +150,10 @@ class RenderTests(unittest.TestCase):
         for k, (up, out) in self.compare(upstream_file, rendered_file).items():
             expected = copy.deepcopy(up)
             if k[1] == "Deployment":
+                if (k[2], k[3]) in DECLARED_RELEASE_UNIT:
+                    labels = expected.setdefault("metadata", {}).get("labels") or {}
+                    labels["railiance.io/release-unit"] = DECLARED_RELEASE_UNIT[(k[2], k[3])]
+                    expected["metadata"]["labels"] = labels
                 for c in expected["spec"]["template"]["spec"]["containers"]:
                     ident = (k[2], k[3], c["name"])
                     if ident in DECLARED: