fix: forEach and child tracking for NetworkPolicy, ResourceQuota, LimitRange, ClusterRole, ClusterRoleBinding

[iAlexeze]

Summary

forEach: support for NetworkPolicy, ResourceQuota, LimitRange, ClusterRole, and ClusterRoleBinding was deferred from v0.7.8 when these types were first introduced. A declared forEach: block was silently dropped — no expansion, no error. None of these types appeared as tracked children in the CR detail view or Control Center Resources tab.

Also fixes a bug in pkg/merger where motif paths supplied as bare relative paths (e.g. motifs/01-namespaced/motif.yaml) were not recognised as file paths, causing ork validate -f <katalog> to fail when run from outside the katalog's directory.

Adds ork e2e --report-file <path> — a CI-agnostic flag that writes test results as a markdown table to a file in addition to stdout — and onFailure: diagnostics at both spec level and per-expectation level.

---

What changed

pkg/types/

• types_networkpolicy.go — ForEach *ForEachSpec added to NetworkPolicyTemplateSource
• types_resourcequota.go — ForEach *ForEachSpec added to ResourceQuotaTemplateSource
• types_limitrange.go — ForEach *ForEachSpec added to LimitRangeTemplateSource
• types_rbac.go — ForEach *ForEachSpec added to ClusterRoleTemplateSource and ClusterRoleBindingTemplateSource

pkg/children/

• gvr.go — ResourceQuotaGVR and LimitRangeGVR vars added; both added to ChildGVRs()
• foreach.go — ExpandForEachNetworkPolicies, ExpandForEachResourceQuotas, ExpandForEachLimitRanges, ExpandForEachClusterRoles, ExpandForEachClusterRoleBindings added
• read.go — NetworkPolicies added to both onCreate and onReconcile merge blocks in mergeTemplates
• names.go — networkPolicyNames, resourceQuotaNames, limitRangeNames, clusterRoleNames, clusterRoleBindingNames added
• children.go — read blocks for all five types added; resources now appear in the CR detail children map

pkg/children/fixtures/

Restructured from a single flat katalog into a motif-based fixture covering every child resource type, all using forEach:. Tenant CRD is cluster-scoped so owner references from namespaced children in different namespaces are valid and not GC'd.

• katalog.yaml — one katalog importing six focused motifs (one per resource group)
• crd.yaml — Tenant CRD (cluster-scoped) with spec.namespaces, spec.roles, and spec.apps array fields
• cr.yaml — sample Tenant CR with values for all three arrays
• motifs/01-namespaced/motif.yaml — Namespace, NetworkPolicy, ResourceQuota, LimitRange; all forEach over spec.namespaces
• motifs/02-rbac/motif.yaml — ClusterRole, ClusterRoleBinding (spec.roles); ServiceAccount, Role, RoleBinding (spec.namespaces); ClusterRoleBinding subjects use namespace: default
• motifs/03-workloads/motif.yaml — Deployment, StatefulSet, ReplicaSet, Pod, Job, CronJob; all forEach over spec.apps
• motifs/04-network/motif.yaml — Service, Ingress, HPA, PDB; all forEach over spec.apps
• motifs/05-config/motif.yaml — ConfigMap, Secret; forEach over spec.namespaces
• motifs/06-storage/motif.yaml — PV (spec.apps), PVC (spec.namespaces)
• README.md — why the fixture exists, coverage table, running locally, adding a new child type

pkg/merger/helper.go

• isFileMotif extended to recognise bare relative paths (e.g. motifs/foo/motif.yaml) as file paths. Previously only ./, ../, and absolute paths were matched; bare paths without a leading ./ were silently treated as OCI references and failed to resolve.

pkg/reconciler/

• run_template_reconcile.go — runner calls for all five types now pass slices through ExpandForEach* wrappers

pkg/e2e/

• result.go — Markdown() renders results as two GFM tables: passed (icon, test, time) and failed (icon, test, time, error); newlines in error messages replaced with .
• runner.go — terminal output split: passed cases first, then failed cases with full error indented line-by-line; ReportFile string in Options writes the markdown report to a file and prints Report written to <path>; runOnFailure called at spec level when any expectation fails, and per-expectation immediately when that checkpoint fails
• onfailure.go (new) — runOnFailure prints diagnostic kubectl and shell command output; never fails; printOnFailureKubectl mirrors the five read subcommands (get, logs, describe, events, exec); printDiag formats each entry with label and indented output
• pkg/types/e2e.go — E2EOnFailure type added; OnFailure *E2EOnFailure added to both E2ESpec (spec-level, runs once after all expectations) and E2EExpectation (per-expectation, runs immediately on that checkpoint's failure)

cmd/cli/e2e.go

• --report-file <path> flag added; wired through to e2e.Options.ReportFile

examples/use-cases/full-stack-app/

• 06-full-stack/katalog.yaml — managed-database CRD block commented out by default; uncomment when running this example in isolation
• 06-full-stack/README.md — Step 1 updated with uncomment instruction and expected two-CRD validate output
• README.md — Troubleshooting section added explaining the duplicate CRD error and fix

---

Root cause

forEach: support for the five v0.7.8 types was deferred — runners in pkg/resources/ and builtins in pkg/children/builtins.go were completed, but the pkg/children/ plumbing (ExpandForEach*, *Names, GVR vars, read blocks in mergeTemplates, child tracking in children.go) was not.

isFileMotif assumed all relative paths start with ./ or ../, which is not enforced when users write motif imports by hand.

---

Test plan

• ork validate -f pkg/children/fixtures/katalog.yaml — passes from repo root
• ork run -f pkg/children/fixtures/katalog.yaml — Tenant CR applied; all resource types created
• kubectl get namespaces — acme-dev and acme-staging appear
• kubectl get networkpolicies -A — deny-all policies in each namespace
• kubectl get resourcequotas -A — quotas in each namespace
• kubectl get limitranges -A — limit ranges in each namespace
• kubectl get clusterroles — acme-developer and acme-reviewer appear
• kubectl get clusterrolebindings — bindings appear
• kubectl get deployments -A — api and worker deployments appear
• CR detail in Control Center Resources tab shows all resource kinds as children
• ork e2e --report-file /tmp/results.md — Report written to /tmp/results.md printed; file contains two GFM tables (passed + failed with Error column)
• Failing e2e with spec.onFailure: — diagnostic output printed after all expectations complete
• Failing e2e with per-expectation onFailure: — diagnostic output printed immediately after that checkpoint fails