Add an env var that allows excluding containers by name#466
Add an env var that allows excluding containers by name#466Avi-Robusta merged 3 commits intomainfrom
Conversation
Useful for containers that have memory spike that is too fast to be captured by krr (prometheus)
WalkthroughAdds EXCLUDED_CONTAINERS parsing from environment to enforcer/env_vars.py, integrates it into enforcer/patch_manager.py to skip patching containers listed, reorders ENFORCER_SSL_CERT_FILE assignment, and updates README with documentation for the new env var. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Caller
participant PM as PatchManager
participant EV as EnvVars
Caller->>PM: patch_container_resources(container)
PM->>EV: Read EXCLUDED_CONTAINERS
alt container.name in EXCLUDED_CONTAINERS
PM-->>Caller: Log "Skipping excluded container {name}" and return []
else not excluded
PM->>PM: Perform resource diffing and validation
PM-->>Caller: Return generated patches
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
enforcer/env_vars.py (1)
26-27: Normalize and Precompute EXCLUDED_CONTAINERS for O(1), Case-Insensitive LookupsI verified that
EXCLUDED_CONTAINERSis defined only in enforcer/env_vars.py and used once in enforcer/patch_manager.py (membership check) and nowhere else (viarg -nC2 '\bEXCLUDED_CONTAINERS(_SET)?\b'). The following optional refactor will:
- Keep the original list for iteration/debugging
- Add a lowercase-normalized
frozensetfor constant-time membership tests- Preserve backward compatibility (no existing code breaks)
Key locations:
- enforcer/env_vars.py: definition site
- enforcer/patch_manager.py: import & membership check
Proposed diff:
--- a/enforcer/env_vars.py +++ b/enforcer/env_vars.py @@ -24,4 +24,10 @@ ENFORCER_SSL_CERT_FILE = os.environ.get("ENFORCER_SSL_CERT_FILE", "") _raw_excluded = os.environ.get("EXCLUDED_CONTAINERS", "") -EXCLUDED_CONTAINERS = [container_name.strip() for container_name - in _raw_excluded.split(",") if container_name.strip()] +EXCLUDED_CONTAINERS = [ + name.strip() + for name in _raw_excluded.split(",") + if name.strip() +] +# Normalized, constant-time membership set (lowercase) +EXCLUDED_CONTAINERS_SET = frozenset(name.lower() for name in EXCLUDED_CONTAINERS)--- a/enforcer/patch_manager.py +++ b/enforcer/patch_manager.py @@ -5,7 +5,7 @@ from enforcer.model import ContainerRecommendation -from enforcer.env_vars import UPDATE_THRESHOLD, EXCLUDED_CONTAINERS +from enforcer.env_vars import UPDATE_THRESHOLD, EXCLUDED_CONTAINERS, EXCLUDED_CONTAINERS_SET logger = logging.getLogger() @@ -243,7 +243,8 @@ def patch_container(container: Dict[str, Any]) -> List[Dict[str, Any]]: container_name = container.get("name") - if container_name and container_name in EXCLUDED_CONTAINERS: + # Use lowercase set for O(1), case-insensitive membership + if container_name and container_name.lower() in EXCLUDED_CONTAINERS_SET: logging.info(f"Skipping excluded container {container_name}") return patchesLet me know if you’d like a short README/Helm values snippet added to document
EXCLUDED_CONTAINERSwith examples.enforcer/patch_manager.py (2)
5-6: Import of EXCLUDED_CONTAINERS is OK; consider importing the normalized set if addedThis aligns with the new env var. If you adopt EXCLUDED_CONTAINERS_SET as suggested in env_vars.py, import it here to avoid per-call normalization.
If you add the set, update the import like:
-from enforcer.env_vars import UPDATE_THRESHOLD, EXCLUDED_CONTAINERS +from enforcer.env_vars import UPDATE_THRESHOLD, EXCLUDED_CONTAINERS, EXCLUDED_CONTAINERS_SET
245-249: Use the module logger consistently; optionally make exclusion check case-insensitiveEverything else looks good. Two tweaks:
- Consistency: the file defines logger = logging.getLogger() but this block uses logging.info.
- Optional: case-insensitive membership avoids surprises if the env var has mixed case.
Minimal fix for logging:
- if container_name and container_name in EXCLUDED_CONTAINERS: - logging.info(f"Skipping excluded container {container_name}") + if container_name and container_name in EXCLUDED_CONTAINERS: + logger.info(f"Skipping excluded container {container_name}")If you added EXCLUDED_CONTAINERS_SET in env_vars.py:
- if container_name and container_name in EXCLUDED_CONTAINERS: + if container_name and container_name.lower() in EXCLUDED_CONTAINERS_SET: logger.info(f"Skipping excluded container {container_name}") return patchesAlternatively, without changing env_vars.py (micro-optimization trade-off: computes set per call):
- if container_name and container_name in EXCLUDED_CONTAINERS: + if container_name and container_name.lower() in {n.lower() for n in EXCLUDED_CONTAINERS}: logger.info(f"Skipping excluded container {container_name}") return patchesIf you want the skip to be logged even when there’s no recommendation (today it returns earlier), consider moving this block above the “if not recommendation” check. Verify desired verbosity before changing.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
enforcer/env_vars.py(1 hunks)enforcer/patch_manager.py(2 hunks)
🧰 Additional context used
🧬 Code graph analysis (1)
enforcer/patch_manager.py (1)
enforcer/model.py (1)
get(62-63)
🔇 Additional comments (1)
enforcer/env_vars.py (1)
24-24: No-op move of ENFORCER_SSL_CERT_FILE is fineReordering within the constants block has no behavioral impact. Keeping SSL-related vars adjacent is clearer.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
enforcer/README.md (1)
105-113: Clarify comma-separated format, matching semantics, and quote YAML value.Hyphenate “comma-separated”, remove the extra comma, and note exact, case-sensitive matching. Quote the YAML value to avoid ambiguity.
Please confirm: matching is exact and case-sensitive against the container.name field (including init containers and sidecars), and whitespace around names is trimmed.
-You can do that by adding an environment variable named `EXCLUDED_CONTAINERS`, with a list of comma separated container names that should be excluded. -For example: +You can do that by adding an environment variable named `EXCLUDED_CONTAINERS` with a comma-separated list of container names to exclude (exact, case-sensitive; surrounding whitespace is ignored). +Example: @@ additionalEnvVars: ... - name: EXCLUDED_CONTAINERS - value: my-spiky-container, java-init-container + value: "my-spiky-container, java-init-container"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
enforcer/README.md(1 hunks)
🧰 Additional context used
🪛 LanguageTool
enforcer/README.md
[grammar] ~102-~102: There might be a mistake here.
Context: ...forcement`, across all Deployments/Pods. For example, if you have some init conta...
(QB_NEW_EN)
[grammar] ~105-~105: There might be a mistake here.
Context: ...container names that should be excluded. For example: ```yaml additionalEnvVars:...
(QB_NEW_EN)
2 participants
Useful for containers that have memory spike that is too fast to be captured by krr (prometheus)