fix: ignore helm.sh(werf.io)/resource-policy: keep from cluster

.gitignore

@@ -14,3 +14,6 @@ node_modules/
 /pkg/ts/embed/*/*/deno.gz.*.tmp
 /.opencode/
 /.sisyphus
+
+# Regenerated by TestDependencyBuildCmdWithHelmV2Hash on every run (fresh mtimes)
+/pkg/helm/pkg/cmd/testdata/testcharts/issue-7233/charts/alpine-0.1.0.tgz

pkg/plan/resource_info.go

@@ -189,10 +189,9 @@ func buildInstallableResourceInfo(ctx context.Context, localRes *resource.Instal
 	}
 
 	var (
-		getMeta          *spec.ResourceMeta
-		dryApplyObj      *unstructured.Unstructured
-		dryApplyErr      error
-		resourcePolicies = localRes.ResourcePolicies
+		getMeta     *spec.ResourceMeta
+		dryApplyObj *unstructured.Unstructured
+		dryApplyErr error
 	)
 	if getErr == nil {
 		var err error
@@ -203,15 +202,14 @@ func buildInstallableResourceInfo(ctx context.Context, localRes *resource.Instal
 		}
 
 		getMeta = spec.NewResourceMetaFromUnstructured(getObj, releaseNamespace, localRes.FilePath)
-		resourcePolicies = resource.ResolveResourcePolicies(localRes, getMeta, releaseNamespace)
 
 		dryApplyObj, dryApplyErr = clientFactory.KubeClient().Apply(ctx, localRes.ResourceSpec, kube.KubeClientApplyOptions{
 			DefaultNamespace: releaseNamespace,
 			DryRun:           true,
 		})
 	}
 
-	installType, skippedByPolicy, err := resourceInstallType(ctx, localRes, getObj, dryApplyObj, dryApplyErr, opts.ExtraRuntimeAnnotations, opts.ExtraRuntimeLabels, resourcePolicies, diffPatches)
+	installType, skippedByPolicy, err := resourceInstallType(ctx, localRes, getObj, dryApplyObj, dryApplyErr, opts.ExtraRuntimeAnnotations, opts.ExtraRuntimeLabels, localRes.ResourcePolicies, diffPatches)
 	if err != nil {
 		return nil, fmt.Errorf("determine install type for resource %q: %w", localRes.IDHuman(), err)
 	}
@@ -222,7 +220,7 @@ func buildInstallableResourceInfo(ctx context.Context, localRes *resource.Instal
 		}
 	}
 
-	mustDeleteOnSuccess := mustDeleteOnSuccessfulDeploy(localRes, getMeta, installType, releaseNamespace, skippedByPolicy)
+	mustDeleteOnSuccess := mustDeleteOnSuccessfulDeploy(localRes, getMeta, installType, skippedByPolicy)
 	trackReadiness := mustTrackReadiness(localRes, installType, getObj != nil, prevRelFailed, mustDeleteOnSuccess, skippedByPolicy)
 
 	return lo.Map(stages, func(stg common.Stage, _ int) *InstallableResourceInfo {
@@ -232,7 +230,7 @@ func buildInstallableResourceInfo(ctx context.Context, localRes *resource.Instal
 			DryApplyResult:                 dryApplyObj,
 			GetResult:                      getObj,
 			LocalResource:                  localRes,
-			MustDeleteOnFailedInstall:      mustDeleteOnFailedDeploy(localRes, getMeta, installType, releaseNamespace, trackReadiness, skippedByPolicy),
+			MustDeleteOnFailedInstall:      mustDeleteOnFailedDeploy(localRes, installType, trackReadiness, skippedByPolicy),
 			MustDeleteOnSuccessfulInstall:  mustDeleteOnSuccess,
 			MustInstall:                    installType,
 			MustTrackReadiness:             trackReadiness,
@@ -383,12 +381,6 @@ func buildDeletableResourceInfo(ctx context.Context, localRes *resource.Deletabl
 
 	getMeta := spec.NewResourceMetaFromUnstructured(getObj, releaseNamespace, localRes.FilePath)
 
-	if err := resource.ValidateResourcePolicy(getMeta); err != nil {
-		return noDeleteInfo, nil
-	} else if lo.Contains(resource.ResourcePolicies(getMeta, releaseNamespace), common.ResourcePolicySkipDelete) {
-		return noDeleteInfo, nil
-	}
-
 	if orphaned(getMeta, releaseName, releaseNamespace) {
 		return noDeleteInfo, nil
 	}
@@ -686,7 +678,7 @@ func iterateInstallableResourceInfos(infos []*InstallableResourceInfo) {
 	}
 }
 
-func mustDeleteOnFailedDeploy(res *resource.InstallableResource, getMeta *spec.ResourceMeta, installType ResourceInstallType, releaseNamespace string, mustTrackReadiness, skippedByPolicy bool) bool {
+func mustDeleteOnFailedDeploy(res *resource.InstallableResource, installType ResourceInstallType, mustTrackReadiness, skippedByPolicy bool) bool {
 	if skippedByPolicy ||
 		!res.DeleteOnFailed ||
 		lo.Contains(res.ResourcePolicies, common.ResourcePolicySkipDelete) ||
@@ -695,32 +687,16 @@ func mustDeleteOnFailedDeploy(res *resource.InstallableResource, getMeta *spec.R
 		return false
 	}
 
-	if getMeta != nil {
-		if err := resource.ValidateResourcePolicy(getMeta); err != nil {
-			return false
-		} else if lo.Contains(resource.ResourcePolicies(getMeta, releaseNamespace), common.ResourcePolicySkipDelete) {
-			return false
-		}
-	}
-
 	return true
 }
 
-func mustDeleteOnSuccessfulDeploy(localRes *resource.InstallableResource, getMeta *spec.ResourceMeta, installType ResourceInstallType, releaseNamespace string, skippedByPolicy bool) bool {
+func mustDeleteOnSuccessfulDeploy(localRes *resource.InstallableResource, getMeta *spec.ResourceMeta, installType ResourceInstallType, skippedByPolicy bool) bool {
 	if skippedByPolicy ||
 		!localRes.DeleteOnSucceeded ||
 		lo.Contains(localRes.ResourcePolicies, common.ResourcePolicySkipDelete) {
 		return false
 	}
 
-	if getMeta != nil {
-		if err := resource.ValidateResourcePolicy(getMeta); err != nil {
-			return false
-		} else if lo.Contains(resource.ResourcePolicies(getMeta, releaseNamespace), common.ResourcePolicySkipDelete) {
-			return false
-		}
-	}
-
 	if installType == ResourceInstallTypeNone {
 		return getMeta != nil
 	}

pkg/plan/resource_policy_live_ai_test.go

@@ -0,0 +1,161 @@
+//go:build ai_tests
+
+package plan_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/suite"
+
+	"github.com/werf/nelm/pkg/common"
+	"github.com/werf/nelm/pkg/kube"
+	"github.com/werf/nelm/pkg/kube/fake"
+	"github.com/werf/nelm/pkg/plan"
+)
+
+type ResourcePolicyLiveAISuite struct {
+	suite.Suite
+
+	clientFactory    *fake.ClientFactory
+	releaseName      string
+	releaseNamespace string
+}
+
+func (s *ResourcePolicyLiveAISuite) SetupSubTest() {
+	var err error
+
+	s.clientFactory, err = fake.NewClientFactory(context.Background())
+	s.Require().NoError(err)
+}
+
+func (s *ResourcePolicyLiveAISuite) SetupSuite() {
+	s.releaseName = "test-release"
+	s.releaseNamespace = "test-namespace"
+}
+
+func (s *ResourcePolicyLiveAISuite) TestAI_ChartPolicyStillProtectsChartRemovedResource() {
+	s.Run("chart skip-delete keeps resource", func() {
+		s.createLiveResource(nil)
+
+		localRes := defaultDeletableResource(s.releaseName, s.releaseNamespace)
+		localRes.ResourcePolicies = []common.ResourcePolicy{common.ResourcePolicySkipDelete}
+
+		resInfo, err := plan.BuildDeletableResourceInfo(context.Background(), localRes, common.DeployTypeUninstall, s.releaseName, s.releaseNamespace, s.clientFactory)
+		s.Require().NoError(err)
+		s.Require().False(resInfo.MustDelete, "chart-side skip-delete must keep protecting the resource")
+	})
+}
+
+func (s *ResourcePolicyLiveAISuite) TestAI_ChartPolicyStillSuppressesDeleteOnSucceeded() {
+	s.Run("chart skip-delete suppresses delete-on-succeeded", func() {
+		s.createLiveResource(nil)
+
+		localRes := defaultInstallableResource(s.releaseName, s.releaseNamespace)
+		localRes.DeleteOnSucceeded = true
+		localRes.ResourcePolicies = []common.ResourcePolicy{common.ResourcePolicySkipDelete}
+
+		resInfos, err := plan.BuildInstallableResourceInfo(context.Background(), localRes, common.DeployTypeInitial, s.releaseNamespace, false, true, s.clientFactory, plan.BuildResourceInfosOptions{}, nil)
+		s.Require().NoError(err)
+		s.Require().NotEmpty(resInfos)
+		s.Require().False(resInfos[0].MustDeleteOnSuccessfulInstall, "chart-side skip-delete must still suppress delete-on-succeeded")
+	})
+}
+
+func (s *ResourcePolicyLiveAISuite) TestAI_LiveOnlyPolicyDoesNotProtectChartRemovedResource() {
+	livePolicies := []map[string]string{
+		{"helm.sh/resource-policy": "keep"},
+		{"werf.io/resource-policy": "keep"},
+		{"werf.io/resource-policy": "skip-delete"},
+		{"werf.io/resource-policy": "bogus"},
+	}
+
+	for _, policy := range livePolicies {
+		s.Run(policyName(policy), func() {
+			s.createLiveResource(policy)
+
+			localRes := defaultDeletableResource(s.releaseName, s.releaseNamespace)
+
+			resInfo, err := plan.BuildDeletableResourceInfo(context.Background(), localRes, common.DeployTypeUninstall, s.releaseName, s.releaseNamespace, s.clientFactory)
+			s.Require().NoError(err)
+			s.Require().True(resInfo.MustDelete, "chart-removed resource must be deleted despite live-only policy %v", policy)
+		})
+	}
+}
+
+func (s *ResourcePolicyLiveAISuite) TestAI_LiveOnlyPolicyDoesNotSuppressDeleteOnFailed() {
+	livePolicies := []map[string]string{
+		{"werf.io/resource-policy": "skip-delete"},
+		{"werf.io/resource-policy": "bogus"},
+	}
+
+	for _, policy := range livePolicies {
+		s.Run(policyName(policy), func() {
+			s.createLiveResource(policy)
+
+			localRes := updatedInstallableResource(&s.Suite, s.releaseName, s.releaseNamespace)
+			localRes.DeleteOnFailed = true
+
+			resInfos, err := plan.BuildInstallableResourceInfo(context.Background(), localRes, common.DeployTypeInitial, s.releaseNamespace, false, true, s.clientFactory, plan.BuildResourceInfosOptions{}, nil)
+			s.Require().NoError(err)
+			s.Require().NotEmpty(resInfos)
+			s.Require().Equal(plan.ResourceInstallTypeUpdate, resInfos[0].MustInstall)
+			s.Require().True(resInfos[0].MustDeleteOnFailedInstall, "delete-on-failed must not be suppressed by live-only policy %v", policy)
+		})
+	}
+}
+
+func (s *ResourcePolicyLiveAISuite) TestAI_LiveOnlyPolicyDoesNotSuppressDeleteOnSucceeded() {
+	livePolicies := []map[string]string{
+		{"werf.io/resource-policy": "skip-delete"},
+		{"werf.io/resource-policy": "bogus"},
+	}
+
+	for _, policy := range livePolicies {
+		s.Run(policyName(policy), func() {
+			s.createLiveResource(policy)
+
+			localRes := defaultInstallableResource(s.releaseName, s.releaseNamespace)
+			localRes.DeleteOnSucceeded = true
+
+			resInfos, err := plan.BuildInstallableResourceInfo(context.Background(), localRes, common.DeployTypeInitial, s.releaseNamespace, false, true, s.clientFactory, plan.BuildResourceInfosOptions{}, nil)
+			s.Require().NoError(err)
+			s.Require().NotEmpty(resInfos)
+			s.Require().Equal(plan.ResourceInstallTypeNone, resInfos[0].MustInstall)
+			s.Require().True(resInfos[0].MustDeleteOnSuccessfulInstall, "delete-on-succeeded must not be suppressed by live-only policy %v", policy)
+		})
+	}
+}
+
+func (s *ResourcePolicyLiveAISuite) createLiveResource(policyAnnotations map[string]string) {
+	resSpec := defaultResourceSpec(s.releaseName, s.releaseNamespace)
+
+	annotations := resSpec.Unstruct.GetAnnotations()
+	for k, v := range policyAnnotations {
+		annotations[k] = v
+	}
+
+	resSpec.SetAnnotations(annotations)
+
+	_, err := s.clientFactory.KubeClient().Create(context.Background(), resSpec, kube.KubeClientCreateOptions{
+		DefaultNamespace: s.releaseNamespace,
+	})
+	s.Require().NoError(err)
+}
+
+func TestAI_ResourcePolicyLiveSuite(t *testing.T) {
+	suite.Run(t, new(ResourcePolicyLiveAISuite))
+}
+
+func policyName(policy map[string]string) string {
+	if len(policy) == 0 {
+		return "no policy"
+	}
+
+	var name string
+	for k, v := range policy {
+		name += k + "=" + v
+	}
+
+	return name
+}

pkg/resource/resource.go

@@ -372,19 +372,3 @@ func BuildResources(ctx context.Context, deployType common.DeployType, releaseNa
 
 	return instResources, delResources, nil
 }
-
-func ResolveResourcePolicies(localRes *InstallableResource, liveMeta *spec.ResourceMeta, releaseNamespace string) []common.ResourcePolicy {
-	if len(localRes.ResourcePolicies) > 0 || liveMeta == nil {
-		return localRes.ResourcePolicies
-	}
-
-	// TODO(major): in the next major keep/skip-delete should also be read/respected only from the manifest, not the cluster.
-	livePolicies := lo.Filter(ResourcePolicies(liveMeta, releaseNamespace), func(p common.ResourcePolicy, _ int) bool {
-		return p == common.ResourcePolicySkipDelete
-	})
-	if len(livePolicies) == 0 {
-		return nil
-	}
-
-	return livePolicies
-}