Fix merging labels

AGENTS.md

@@ -0,0 +1,84 @@
+# AI Agent Instructions
+
+This document provides guidelines for AI agents reviewing or modifying this Helm chart repository.
+
+## Testing Requirements
+
+### Running Tests
+
+```bash
+./test.sh
+```
+
+This runs:
+1. Unit tests via `helm-unittest`
+2. Template rendering tests for all cloud providers
+3. Helm lint
+
+### When to Add Tests
+
+- Any new template that uses label merging must have corresponding isolation tests
+- New features should have unit test coverage
+- Test fixtures are in `braintrust/tests/__fixtures__/`
+
+### Test File Naming
+
+- Template tests: `<template-name>_test.yaml`
+- Cross-template tests: `<toplic>-*_test.yaml`
+
+## Template Guidelines
+
+### Cloud Provider Conditionals
+
+This chart supports multiple cloud providers. Use conditionals appropriately:
+
+```yaml
+{{- if eq .Values.cloud "google" }}
+# Google-specific configuration
+{{- end }}
+
+{{- if eq .Values.cloud "azure" }}
+# Azure-specific configuration
+{{- end }}
+
+{{- if eq .Values.cloud "aws" }}
+# AWS-specific configuration
+{{- end }}
+```
+
+### Required Values
+
+Use `required` for values that must be set for specific configurations:
+
+```yaml
+{{ required "brainstore.serviceAccount.googleServiceAccount is required when cloud is google" .Values.brainstore.serviceAccount.googleServiceAccount }}
+```
+
+### Namespace Handling
+
+Always use the namespace helper:
+
+```yaml
+namespace: {{ include "braintrust.namespace" . }}
+```
+
+## Review guidelines
+
+When reviewing PRs, verify:
+
+- [ ] Any `merge` on dicts uses `deepCopy` wrapper to ensure the original dict is not mutated
+- [ ] New templates follow existing patterns
+- [ ] Tests are added for new functionality
+- [ ] Cloud-specific code is properly conditioned
+
+## File Structure
+
+```
+braintrust/
+├── templates/           # Kubernetes manifest templates
+├── tests/              # helm-unittest test files
+│   └── __fixtures__/   # Test value fixtures
+├── ci/                 # CI value files for different clouds
+├── values.yaml         # Default values
+└── Chart.yaml          # Chart metadata
+```

braintrust/templates/api-configmap.yaml

@@ -4,7 +4,7 @@ kind: ConfigMap
 metadata:
   name: {{ .Values.api.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.api.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.api.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}

braintrust/templates/api-deployment.yaml

@@ -3,7 +3,7 @@ kind: Deployment
 metadata:
   name: {{ .Values.api.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.api.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.api.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}
@@ -31,7 +31,7 @@ spec:
         {{- if and (eq .Values.cloud "google") .Values.api.enableGcsAuth }}
         gke-workload-identity/use: "true"
         {{- end }}
-        {{- with (merge .Values.global.labels .Values.api.labels) }}
+        {{- with (merge (deepCopy .Values.global.labels) .Values.api.labels) }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
       annotations:

braintrust/templates/api-service.yaml

@@ -3,7 +3,7 @@ kind: Service
 metadata:
   name: {{ .Values.api.service.name | default .Values.api.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.api.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.api.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}

braintrust/templates/api-serviceaccount.yaml

@@ -3,7 +3,7 @@ kind: ServiceAccount
 metadata:
   name: {{ .Values.api.serviceAccount.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.api.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.api.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}

braintrust/templates/brainstore-reader-configmap.yaml

@@ -4,7 +4,7 @@ kind: ConfigMap
 metadata:
   name: {{ .Values.brainstore.reader.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.brainstore.reader.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.brainstore.reader.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}

braintrust/templates/brainstore-reader-deployment.yaml

@@ -3,7 +3,7 @@ kind: Deployment
 metadata:
   name: {{ .Values.brainstore.reader.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.brainstore.reader.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.brainstore.reader.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}
@@ -31,7 +31,7 @@ spec:
         {{- if eq .Values.cloud "google" }}
         gke-workload-identity/use: "true"
         {{- end }}
-        {{- with (merge .Values.global.labels .Values.brainstore.reader.labels) }}
+        {{- with (merge (deepCopy .Values.global.labels) .Values.brainstore.reader.labels) }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
       annotations:

braintrust/templates/brainstore-reader-service.yaml

@@ -3,7 +3,7 @@ kind: Service
 metadata:
   name: {{ .Values.brainstore.reader.service.name | default .Values.brainstore.reader.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.brainstore.reader.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.brainstore.reader.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}

braintrust/templates/brainstore-serviceaccount.yaml

@@ -3,7 +3,7 @@ kind: ServiceAccount
 metadata:
   name: {{ .Values.brainstore.serviceAccount.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.brainstore.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.brainstore.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}

braintrust/templates/brainstore-writer-configmap.yaml

@@ -4,7 +4,7 @@ kind: ConfigMap
 metadata:
   name: {{ .Values.brainstore.writer.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.brainstore.writer.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.brainstore.writer.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}

braintrust/templates/brainstore-writer-deployment.yaml

@@ -3,7 +3,7 @@ kind: Deployment
 metadata:
   name: {{ .Values.brainstore.writer.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.brainstore.writer.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.brainstore.writer.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}
@@ -31,7 +31,7 @@ spec:
         {{- if eq .Values.cloud "google" }}
         gke-workload-identity/use: "true"
         {{- end }}
-        {{- with (merge .Values.global.labels .Values.brainstore.writer.labels) }}
+        {{- with (merge (deepCopy .Values.global.labels) .Values.brainstore.writer.labels) }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
       annotations:

braintrust/templates/brainstore-writer-service.yaml

@@ -3,7 +3,7 @@ kind: Service
 metadata:
   name: {{ .Values.brainstore.writer.service.name | default .Values.brainstore.writer.name }}
   namespace: {{ include "braintrust.namespace" . }}
-  {{- with (merge .Values.global.labels .Values.brainstore.writer.labels) }}
+  {{- with (merge (deepCopy .Values.global.labels) .Values.brainstore.writer.labels) }}
   labels:
     {{- toYaml . | nindent 4 }}
   {{- end }}

braintrust/tests/labels-merge-configmaps_test.yaml

@@ -0,0 +1,77 @@
+suite: test label merge isolation for configmaps (deepCopy fix)
+templates:
+  - api-configmap.yaml
+  - brainstore-reader-configmap.yaml
+  - brainstore-writer-configmap.yaml
+tests:
+  # These tests verify the deepCopy fix for configmaps.
+  # Without deepCopy, labels would bleed between components due to merge mutation.
+
+  - it: should give API configmap only global and api-specific labels
+    values:
+      - __fixtures__/base-values.yaml
+    set:
+      global.labels.shared: "global-cm"
+      api.labels.api-specific: "api-cm"
+      brainstore.reader.labels.reader-specific: "reader-cm"
+      brainstore.writer.labels.writer-specific: "writer-cm"
+    release:
+      namespace: "braintrust"
+    template: api-configmap.yaml
+    asserts:
+      - equal:
+          path: metadata.labels.shared
+          value: global-cm
+      - equal:
+          path: metadata.labels["api-specific"]
+          value: api-cm
+      - isNull:
+          path: metadata.labels["reader-specific"]
+      - isNull:
+          path: metadata.labels["writer-specific"]
+
+  - it: should give Reader configmap only global and reader-specific labels
+    values:
+      - __fixtures__/base-values.yaml
+    set:
+      global.labels.shared: "global-cm"
+      api.labels.api-specific: "api-cm"
+      brainstore.reader.labels.reader-specific: "reader-cm"
+      brainstore.writer.labels.writer-specific: "writer-cm"
+    release:
+      namespace: "braintrust"
+    template: brainstore-reader-configmap.yaml
+    asserts:
+      - equal:
+          path: metadata.labels.shared
+          value: global-cm
+      - equal:
+          path: metadata.labels["reader-specific"]
+          value: reader-cm
+      - isNull:
+          path: metadata.labels["api-specific"]
+      - isNull:
+          path: metadata.labels["writer-specific"]
+
+  - it: should give Writer configmap only global and writer-specific labels
+    values:
+      - __fixtures__/base-values.yaml
+    set:
+      global.labels.shared: "global-cm"
+      api.labels.api-specific: "api-cm"
+      brainstore.reader.labels.reader-specific: "reader-cm"
+      brainstore.writer.labels.writer-specific: "writer-cm"
+    release:
+      namespace: "braintrust"
+    template: brainstore-writer-configmap.yaml
+    asserts:
+      - equal:
+          path: metadata.labels.shared
+          value: global-cm
+      - equal:
+          path: metadata.labels["writer-specific"]
+          value: writer-cm
+      - isNull:
+          path: metadata.labels["api-specific"]
+      - isNull:
+          path: metadata.labels["reader-specific"]