Skip to content

fix(setup): make Temporal namespace creation idempotent via describe#3679

Merged
shayan1995 merged 1 commit into
NVIDIA:mainfrom
shayan1995:snamaghi/issue-2768-temporal-namespace-errors
Jul 21, 2026
Merged

fix(setup): make Temporal namespace creation idempotent via describe#3679
shayan1995 merged 1 commit into
NVIDIA:mainfrom
shayan1995:snamaghi/issue-2768-temporal-namespace-errors

Conversation

@shayan1995

Copy link
Copy Markdown
Contributor

Temporal namespace creation in helm-prereqs/setup.sh used to suppress all errors (2>/dev/null || true), which #2768 flagged as masking TLS/auth/connectivity faults. Most of that was since fixed on main (#2546, #2675): create output is captured, "already exists" is tolerated, genuine errors propagate, and _verify_temporal_namespaces double-checks the result.

This PR closes the remaining gap from the issue's expected behaviour: _create_temporal_namespace now checks existence with temporal operator namespace describe and skips creation when the namespace already exists, instead of relying on the create call failing with "already exists". Any describe failure (not-found or transient) simply falls through to create, which already propagates real errors with diagnostics — so no new error-message parsing is introduced.

Related issues

Fixes #2768

Type of Change

  • Add - New feature or capability
  • Change - Changes in existing functionality
  • Fix - Bug fixes
  • Remove - Removed features or deprecated functionality
  • Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

  • This PR contains breaking changes

Testing

  • Unit tests added/updated
  • Integration tests added/updated
  • Manual testing performed
  • No testing required (docs, internal refactor, etc.)

bash -n clean. Behavioural safety net is unchanged: even if the describe fast-path misjudges, the existing create path and _verify_temporal_namespaces still catch and report real failures. (TODO before submitting: run setup.sh phase 7f against a cluster twice to confirm the skip path logs "already exists".)

@shayan1995
shayan1995 requested a review from a team as a code owner July 17, 2026 18:27
@copy-pr-bot

copy-pr-bot Bot commented Jul 17, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3d6bfd63-73db-491b-ad5f-fdf803b44edf

📥 Commits

Reviewing files that changed from the base of the PR and between dcfef03 and ea6ef0d.

📒 Files selected for processing (1)
  • helm-prereqs/setup.sh
🚧 Files skipped from review as they are similar to previous changes (1)
  • helm-prereqs/setup.sh

Summary by CodeRabbit

  • Bug Fixes
    • Improved prerequisite setup handling for existing Temporal namespaces.
    • Setup now checks whether the Temporal namespace already exists before attempting creation.
    • If the namespace is present, setup exits early; real creation failures are still surfaced clearly.

Walkthrough

The Temporal namespace setup now checks whether the target namespace exists before creating it. Existing namespaces return through an idempotent fast path, while other outcomes continue through the existing creation and error-handling logic.

Changes

Temporal namespace setup

Layer / File(s) Summary
Namespace existence check
helm-prereqs/setup.sh
_create_temporal_namespace describes the target namespace in the temporal-admintools pod and returns early when it exists; otherwise, it proceeds with namespace creation and preserves error handling.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title is concise and accurately summarizes the idempotent namespace creation change.
Description check ✅ Passed The description directly explains the Temporal namespace fix and its relation to issue #2768.
Linked Issues check ✅ Passed The change adds a describe-based idempotency check and preserves diagnostic error propagation, matching #2768.
Out of Scope Changes check ✅ Passed The PR stays within the requested setup.sh namespace-creation fix without unrelated changes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@shayan1995

Copy link
Copy Markdown
Contributor Author

/ok to test dcfef03

@github-actions

Copy link
Copy Markdown

🔍 Container Scan Summary

Service Total Critical High Medium Low Other
boot-artifacts-aarch64 3 0 0 3 0 0
boot-artifacts-x86_64 3 0 0 3 0 0
forge-admin-cli-x86_64 259 16 29 79 7 128
machine-validation-runner 532 39 113 184 15 181
machine_validation 532 39 113 184 15 181
machine_validation-aarch64 532 39 113 184 15 181
nvmetal-carbide 532 39 113 184 15 181
TOTAL 2393 172 481 821 67 852

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.

Most of NVIDIA#2768 (error suppression, missing diagnostics) was already
addressed on main by NVIDIA#2546 and NVIDIA#2675: namespace create output is
captured, "already exists" is tolerated, genuine errors are propagated,
and _verify_temporal_namespaces double-checks the result.

This closes the remaining gap from the issue's expected behaviour:
check namespace existence with 'temporal operator namespace describe'
and skip creation when it already exists, instead of relying on the
create call failing with "already exists". Any describe failure
(not-found or transient) simply falls through to create, which already
propagates real errors (TLS, auth, connectivity) with diagnostics.

Fixes NVIDIA#2768

Signed-off-by: Shayan Namaghi <snamaghi@nvidia.com>
@shayan1995
shayan1995 force-pushed the snamaghi/issue-2768-temporal-namespace-errors branch from dcfef03 to ea6ef0d Compare July 21, 2026 17:05
@github-actions

Copy link
Copy Markdown

@shayan1995
shayan1995 merged commit 564c4a3 into NVIDIA:main Jul 21, 2026
62 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

helm-prereqs/setup.sh: Temporal namespace creation silently suppresses all errors

2 participants