Skip to content

fix(setup): make Temporal namespace creation idempotent via describe#3679

Open
shayan1995 wants to merge 1 commit into
NVIDIA:mainfrom
shayan1995:snamaghi/issue-2768-temporal-namespace-errors
Open

fix(setup): make Temporal namespace creation idempotent via describe#3679
shayan1995 wants to merge 1 commit into
NVIDIA:mainfrom
shayan1995:snamaghi/issue-2768-temporal-namespace-errors

Conversation

@shayan1995

Copy link
Copy Markdown
Contributor

Temporal namespace creation in helm-prereqs/setup.sh used to suppress all errors (2>/dev/null || true), which #2768 flagged as masking TLS/auth/connectivity faults. Most of that was since fixed on main (#2546, #2675): create output is captured, "already exists" is tolerated, genuine errors propagate, and _verify_temporal_namespaces double-checks the result.

This PR closes the remaining gap from the issue's expected behaviour: _create_temporal_namespace now checks existence with temporal operator namespace describe and skips creation when the namespace already exists, instead of relying on the create call failing with "already exists". Any describe failure (not-found or transient) simply falls through to create, which already propagates real errors with diagnostics — so no new error-message parsing is introduced.

Related issues

Fixes #2768

Type of Change

  • Add - New feature or capability
  • Change - Changes in existing functionality
  • Fix - Bug fixes
  • Remove - Removed features or deprecated functionality
  • Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

  • This PR contains breaking changes

Testing

  • Unit tests added/updated
  • Integration tests added/updated
  • Manual testing performed
  • No testing required (docs, internal refactor, etc.)

bash -n clean. Behavioural safety net is unchanged: even if the describe fast-path misjudges, the existing create path and _verify_temporal_namespaces still catch and report real failures. (TODO before submitting: run setup.sh phase 7f against a cluster twice to confirm the skip path logs "already exists".)

Most of NVIDIA#2768 (error suppression, missing diagnostics) was already
addressed on main by NVIDIA#2546 and NVIDIA#2675: namespace create output is
captured, "already exists" is tolerated, genuine errors are propagated,
and _verify_temporal_namespaces double-checks the result.

This closes the remaining gap from the issue's expected behaviour:
check namespace existence with 'temporal operator namespace describe'
and skip creation when it already exists, instead of relying on the
create call failing with "already exists". Any describe failure
(not-found or transient) simply falls through to create, which already
propagates real errors (TLS, auth, connectivity) with diagnostics.

Fixes NVIDIA#2768

Signed-off-by: Shayan Namaghi <snamaghi@nvidia.com>
@shayan1995
shayan1995 requested a review from a team as a code owner July 17, 2026 18:27
@copy-pr-bot

copy-pr-bot Bot commented Jul 17, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 82e6c4b2-13fa-433a-aec1-19c49e8a01d2

📥 Commits

Reviewing files that changed from the base of the PR and between 0cd8acb and dcfef03.

📒 Files selected for processing (1)
  • helm-prereqs/setup.sh

Summary by CodeRabbit

  • Bug Fixes
    • Improved prerequisite setup handling for existing Temporal namespaces.
    • Setup now detects an existing namespace before attempting creation, avoiding unnecessary operations.
    • Namespace creation errors continue to be reported clearly when setup cannot complete.

Walkthrough

The Temporal namespace setup now checks whether the target namespace exists before creating it. Existing namespaces return through an idempotent fast path, while other outcomes continue to the existing creation and error-handling logic.

Changes

Temporal namespace setup

Layer / File(s) Summary
Namespace existence check
helm-prereqs/setup.sh
_create_temporal_namespace describes the target namespace in the temporal-admintools pod and returns early when it exists; otherwise, it proceeds with namespace creation and preserves error handling.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: idempotent Temporal namespace creation using describe.
Description check ✅ Passed The description matches the code change and links it to issue #2768.
Linked Issues check ✅ Passed The change implements the issue's describe-before-create idempotency and preserves real error propagation.
Out of Scope Changes check ✅ Passed No unrelated code changes are indicated beyond the namespace idempotency fix.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@shayan1995

Copy link
Copy Markdown
Contributor Author

/ok to test dcfef03

@github-actions

Copy link
Copy Markdown

🔍 Container Scan Summary

Service Total Critical High Medium Low Other
boot-artifacts-aarch64 3 0 0 3 0 0
boot-artifacts-x86_64 3 0 0 3 0 0
forge-admin-cli-x86_64 259 16 29 79 7 128
machine-validation-runner 532 39 113 184 15 181
machine_validation 532 39 113 184 15 181
machine_validation-aarch64 532 39 113 184 15 181
nvmetal-carbide 532 39 113 184 15 181
TOTAL 2393 172 481 821 67 852

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

helm-prereqs/setup.sh: Temporal namespace creation silently suppresses all errors

1 participant