feat: add workload wiring for resource dependencies - #3404

- BuildResourceDependencyItem dispatches per-output on source kind: value -> literal env, secretKeyRef / configMapKeyRef -> valueFrom env, fileBindings -> volume + mount with subPath
- Deterministic volume names via r-{fnv1a32(ref:kind:name)} keep the namespace disjoint from configurations.toVolumes() (file-mount-*) and from sibling deps that share a Secret/ConfigMap
- Volume dedup per (dep.Ref, sourceKind, sourceName) so multiple files from the same Secret share one volume with multiple mounts
- ErrOutputNotResolved / ErrInvalidFileBinding sentinels let callers distinguish wait-for-resolve from permanent misconfiguration
- 20 unit tests covering dispatch matrix, dedup, deterministic ordering, length bounds, and r-/file-mount- prefix isolation

Signed-off-by: Miraj Abeysekara <[email protected]>

- Replace ConnectionEnvVar with corev1.EnvVar throughout pipeline-context so the merged dependencies.envVars can carry valueFrom-shaped resource outputs alongside literal endpoint env vars
- Extend ConnectionsContextData with Resources (per-resource view), VolumeMounts and Volumes (merged across resources); add Resources to ConnectionsData
- Extend RenderInput with ResourceDependencyItems and thread it through pipeline.go into ConnectionsData.Resources
- Update endpoint-side buildEnvVarsForConnection to return []corev1.EnvVar
- Update existing test sites (cel_extensions_test, builder_test) for the rename and the new dependency-shape keys
- Add 7 TestNewDependenciesContextData_ResourceMerge subtests covering per-item view, merged env vars, volume merging, empty/nil handling, and endpoint-only backward compat
- Update docs/templating/context.md to describe the EnvVar shape with valueFrom

Signed-off-by: Miraj Abeysekara <[email protected]>

- Add ConditionResourceDependenciesReady plus three reasons (AllResourceDependenciesReady, ResourceDependenciesPending, NoResourceDependencies) mirroring the endpoint-side ConnectionsResolved precedent
- Add IndexKeyResourceReleaseBindingOwnerEnv composite index over (project, resource, environment) on ResourceReleaseBinding, with MakeResourceReleaseBindingOwnerEnvKey and IndexResourceReleaseBindingOwnerEnv helpers, registered in SetupSharedIndexes
- Add pure helpers buildResourceDependencyTargets, allResourceDependenciesResolved, setResourceDependenciesCondition for the resolver and condition wiring that will land next; mirrors controller_connections.go shape
- 17 unit tests covering target derivation, resolved-gate semantics, condition branches, key-builder, and the round-trip invariant that the consumer-side target key matches what the index extracts from a provider RRB; empty-field guards on the index function

Signed-off-by: Miraj Abeysekara <[email protected]>

- resolveResourceDependency does the per-dep API hop via the (project, resource, environment) field index, gates on the provider's Ready condition using the typed resourcereleasebinding.ConditionReady, and dispatches outputs through BuildResourceDependencyItem to produce a ResourceDependencyItem
- resolveResourceDependencies orchestrates per-dep and aborts on the first transient API error so the caller requeues without acting on a partial view
- Failure modes surface as PendingResourceDependency entries with descriptive Reason: provider missing, multiple providers (defensive), provider not Ready, ErrOutputNotResolved, ErrInvalidFileBinding
- 9 fake-client subtests across TestResolveResourceDependency and TestResolveResourceDependencies cover each failure path including an interceptor-injected list error

Signed-off-by: Miraj Abeysekara <[email protected]>

…ator

- Extend setReadyCondition to find ConditionResourceDependenciesReady, treat it as optional (absent = pass, mirroring ConnectionsResolved), and fold it into the all-true gate
- Priority order when multiple sub-conditions are False: ConnectionsResolved -> ResourceDependenciesReady -> ResourcesReady; locked by two priority tests so a future reorder is caught
- 5 TestSetReadyConditionWithResourceDependencies subtests cover: deps False blocks Ready with its reason, deps True yields Ready, deps absent does not block (backward compat), connections wins over resource deps, resource deps wins over resources ready

Signed-off-by: Miraj Abeysekara <[email protected]>

…ncile

- Resolve resource dependencies after the existing connection resolution: populate Status.ResourceDependencyTargets and Status.PendingResourceDependencies, thread the resolved items into RenderInput.ResourceDependencyItems for the pipeline
- Add a resource-dep stability guard mirroring the connections guard: when any provider ResourceReleaseBinding is missing, not Ready, or has not yet populated a referenced output, set ConditionResourceDependenciesReady=False and return early without marking ReleaseSynced=True

Signed-off-by: Miraj Abeysekara <[email protected]>

- Add resourceDependencyTargetsIndex over ReleaseBinding.Status.ResourceDependencyTargets so consumer enqueue is O(1) by (namespace, project, resourceName, environment) key
- Add resourceReleaseBindingOutputsChangedPredicate that fires only on Status.Outputs changes and Ready condition flips; Synced and other status churn are filtered out so consumers are not re-enqueued for events they don't care about
- Add findConsumerReleaseBindingsForResourceReleaseBinding mapper with an empty-Owner guard mirroring IndexResourceReleaseBindingOwnerEnv
- Wire Watches(&ResourceReleaseBinding{}, ...) into SetupWithManager with a comment documenting why the two consumer-side watches don't form a cycle
- 19 subtests covering key builder, indexer (dedup, empty handling), mapper (positive, no consumers, wrong type, malformed RRB), predicate branches, and a round-trip test that locks consumer-side buildResourceDependencyTargets against the mapper's key construction

Signed-off-by: Miraj Abeysekara <[email protected]>

- Add EnvVarEntry, EnvVarSourceEntry, KeyRef typed structs that mirror corev1.EnvVar/EnvVarSource/KeyRef for the subset of shapes the platform emits; JSON-compatible so the rendered Pod spec is unchanged
- Switch ResourceDependencyItem, ConnectionItem, ConnectionsContextData fields and buildEnvVarsForConnection from corev1 types to the local EnvVarEntry / VolumeEntry / VolumeMountEntry. configurations.toX() and dependencies.toX() now return the same CEL element type so the canonical CCT shape ${configurations.toX() + dependencies.toX()} type-checks in the validation environment
- Add omitempty to VolumeMountEntry.SubPath so JSON serialization matches corev1.VolumeMount
- Lock the concat invariant with TestBuildComponentCELEnv_ConfigurationsDependenciesConcat covering toVolumes, toContainerVolumeMounts, and toContainerEnvs self-concat

Signed-off-by: Miraj Abeysekara <[email protected]>

- Extract populateResourceDependencyStatus helper to consolidate the three-step status-write dance for resource deps; keeps reconcileRelease readable. Add nolint:gocyclo on reconcileRelease (matches precedent on setResourcesReadyStatus and workflowrun's reconcile) since the chain is at threshold + 1 and the complexity is structural
- Drop unparam fields from newProviderRRB test helper; project always "proj" and environment always "dev" across all call sites, so hardcode them in the helper
- Switch mergedVolumeMounts and mergedVolumes in newDependenciesContextData from []T{} to make([]T, 0, len(data.Resources)) for prealloc

Signed-off-by: Miraj Abeysekara <[email protected]>

Ginkgo specs running against envtest go in _integration_test.go per
the convention used by 13 other controllers (Pattern B). Pure rename,
no content change.

Signed-off-by: Miraj Abeysekara <[email protected]>

- Add manager-backed cached client to the suite via ctrl.NewManager +
  controller.SetupSharedIndexes; covers the 6 types the shared indexes
  span. Direct k8sClient stays for existing read-after-write specs;
  k8sCachedClient is for the new field-index resolver-path specs.
- Add gate-engages spec: workload with dependencies.resources but no
  matching provider RRB engages the gate, populates Pending status,
  blocks ReleaseSynced.
- Add end-to-end env-var spec: provider RRB Ready with a value-kind
  output threads through to the rendered Deployment's container.env.
- Add concat-volumes coexistence spec: container.files +
  dependencies.fileBindings render side-by-side under
  configurations.toX() + dependencies.toX(); 3 volumes with disjoint
  file-mount-* and r-* prefixes; locks JSON-compat between the typed
  structs shared by both CEL helpers.

Signed-off-by: Miraj Abeysekara <[email protected]>

- Update getting-started CCTs (service, webapp, worker, scheduled-task) and the inline copies in all.yaml to render ${configurations.toX() + dependencies.toX()} for volumes and volumeMounts
- Update the two component-types samples (component-with-configs, component-with-embedded-traits) for consistency
- Without this, fileBindings on a resource dependency produces a Pod whose volumeMounts reference volume names absent from volumes
- No-op for samples without resource deps; the empty concat elides cleanly from the rendered manifest
- Live-validated on k3d-openchoreo: 3-volume Pod with mounts readable in the container, and url-shortener sample (4 components with endpoint deps) renders unchanged

Signed-off-by: Miraj Abeysekara <[email protected]>

Signed-off-by: Miraj Abeysekara <[email protected]>

Signed-off-by: Miraj Abeysekara <[email protected]>

Signed-off-by: Miraj Abeysekara <[email protected]>

- Add CEL XValidation on Workload.spec.dependencies.resources[].envBindings and .fileBindings rejecting empty map values at admission
- Regenerate CRDs (config/crd/bases + helm-shipped copies); embedded workload spec on ComponentRelease picks up the validation as expected

Signed-off-by: Miraj Abeysekara <[email protected]>

- isResourceReleaseBindingReady now requires cond.ObservedGeneration == rrb.Generation, so a stale Ready from a prior reconcile no longer gates the consumer's resolver while the provider is mid-reconcile
- Add TestIsResourceReleaseBindingReady covering ready+current, ready+stale, not-ready, and missing-condition

Signed-off-by: Miraj Abeysekara <[email protected]>

- Fix TraitContext dataplane subsection: drop the non-existent publicVirtualHost field and reference the ComponentContext dataplane shape, consistent with sibling subsections
- Expand ComponentContext dependencies: document the resources per-item view plus the merged volumeMounts and volumes lists; add ResourceDependencyItem, VolumeMount, and Volume tables; show valueFrom in the env-projection example; add a combined configurations + dependencies example
- Add helpers dependencies.toContainerVolumeMounts() and dependencies.toVolumes() to the helper-methods table
- Mirror the new shape in the TraitContext dependencies subsection

Signed-off-by: Miraj Abeysekara <[email protected]>

The XValidation rule on envBindings/fileBindings was rejected by kube-apiserver during CRD install: estimated rule cost exceeded the per-rule budget by 15.7x. Without an iteration cap, the cost estimator assumes worst-case map size.

- Add MaxProperties=50 to both maps (matches the existing MaxItems=50 cap on Resources []WorkloadResourceDependency)
- Tighten the XValidation rule to also reject empty map keys (output names), not just empty values. Empty keys would silently produce ambiguous bindings downstream. The combined rule doubles per-iteration work but stays well under budget with the new bound
- Regenerate CRDs (config/crd/bases + helm-shipped copies); the bound and rule flow through to the embedded workload spec on ComponentRelease as well

Signed-off-by: Miraj Abeysekara <[email protected]>

The previous predicate fired only on Status.Outputs change or Ready.Status flip. With isResourceReleaseBindingReady now requiring cond.ObservedGeneration == rrb.Generation, two new transitions need to re-enqueue consumers:

- A spec edit that bumps metadata.generation (Ready stays True but ObservedGeneration becomes stale → consumers gate off)
- A controller catch-up that advances Ready.ObservedGeneration without flipping Status (consumers were gated off and must re-evaluate)

Without these, consumers can stay ReleaseSynced=True against stale provider state until some unrelated event triggers reconcile.

- Add Generation comparison to the predicate's UpdateFunc
- Rename readyConditionStatusChanged to readyConditionChanged and extend it to compare ObservedGeneration as well
- Add fires_on_generation_change and fires_on_ready_observed_generation_change subtests

Signed-off-by: Miraj Abeysekara <[email protected]>

isResourceReleaseBindingReady now requires the Ready condition's ObservedGeneration to match rrb.Generation. envtest assigns Generation=1 on Create, but the integration fixtures left ObservedGeneration at 0, so the consumer resolver treated providers as not-ready and ReleaseSynced=True assertions timed out.

Signed-off-by: Miraj Abeysekara <[email protected]>

The example heading promised configurations + dependencies, but the body only injected dependency env vars. Configuration-derived envs land via envFrom (configMapRef + secretRef), so the projection needs both env (deps) and envFrom (configurations) to match the heading.

Signed-off-by: Miraj Abeysekara <[email protected]>