fix(no-anti-affinity): support topology spread constraints

[mwozniakk]

Fixes #894.

Summary:

• Treats matching topologySpreadConstraints as satisfying the no-anti-affinity check.
• Requires the spread constraint to match the configured topology key and pod template labels.
• Adds unit tests for matching and non-matching topology spread constraints.
• Updates generated check docs.

Testing:

• go test ./pkg/templates/antiaffinity ./pkg/builtinchecks
• go test ./...

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 63f8f127-ffe7-4428-8c02-d788217f20bf

📥 Commits

Reviewing files that changed from the base of the PR and between ec6863f and 74fc46a.

📒 Files selected for processing (1)

• pkg/builtinchecks/yamls/no-anti-affinity.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/builtinchecks/yamls/no-anti-affinity.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Bug Fixes

  • Anti-affinity validation now recognizes matching topology spread constraints, reducing false warnings for workloads using topology spread rules.

• Documentation

  • Updated guidance to cover topology spread constraints alongside pod anti-affinity, including selector requirements, hostname configuration, and a reference to Kubernetes documentation.

Walkthrough

The anti-affinity checker now treats matching topologySpreadConstraints as sufficient. The check metadata documents this alternative. Tests cover matching, mismatching, and invalid selector cases.

Changes

Topology spread support

Layer / File(s)	Summary
Constraint evaluation and validation pkg/templates/antiaffinity/template.go, pkg/templates/antiaffinity/template_test.go	The check matches topology keys and label selectors before evaluating anti-affinity rules. Tests cover topology keys, selectors, unsatisfiable actions, replica counts, and invalid selectors.
Check metadata update pkg/builtinchecks/yamls/no-anti-affinity.yaml	The description and remediation now include topologySpreadConstraints and link to the topology spread constraints documentation.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: rhybrill

Merge Risk: ⚪ Minimal · up to 74fc4

The topology spread alternative is implemented and documented consistently with its intended best-effort scheduling behavior. No actionable merge risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: adding support for topology spread constraints in the no-anti-affinity check.
Description check	✅ Passed	The description directly explains the topology spread constraint support, matching requirements, documentation updates, and test coverage.
Linked Issues check	✅ Passed	Issue #894 requires no-anti-affinity to accept a matching Kubernetes topologySpreadConstraints entry. The implementation checks the configured topology key and matches the constraint selector agai…
Out of Scope Changes check	✅ Passed	The implementation, unit tests, and check documentation directly support issue #894. No unrelated change is established by the supplied pull request summary.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/templates/antiaffinity/template_test.go`:
- Around line 135-152: Add a focused test covering TopologySpreadConstraints
with WhenUnsatisfiable set to ScheduleAnyway in the AntiAffinityTestSuite
helpers and related deployment setup. The current
addDeploymentWithTopologySpreadConstraint path only exercises DoNotSchedule, so
extend the test suite with a case that uses ScheduleAnyway and asserts the
intended behavior in topologySpreadConstraintsMatchAgainstNodes and the
deployment validation flow. Use the existing
addDeploymentWithTopologySpreadConstraint, addDeploymentWithReplicas, and
ctx.ModifyDeployment helpers to keep the new case aligned with the current test
structure.

In `@pkg/templates/antiaffinity/template.go`:
- Around line 115-127: The helper topologySpreadConstraintsMatchAgainstNodes
currently treats every matching TopologySpreadConstraint as enforcing spread,
including soft preferences. Update this function to only return true when the
constraint’s WhenUnsatisfiable is DoNotSchedule, in addition to the existing
topologyKeyMatcher and labelSelector match. Keep the LabelSelectorAsSelector
error handling as-is, and add the new guard directly in the conditional so
ScheduleAnyway constraints are ignored.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8c1c8f5e-a8f2-43c2-a656-48d1c2fa212a

📥 Commits

Reviewing files that changed from the base of the PR and between 1521d3a and 20f4ba9.

⛔ Files ignored due to path filters (1)

• docs/generated/checks.md is excluded by !**/generated/**

📒 Files selected for processing (3)

• pkg/builtinchecks/yamls/no-anti-affinity.yaml
• pkg/templates/antiaffinity/template.go
• pkg/templates/antiaffinity/template_test.go

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 31.45%. Comparing base (dbd7529) to head (74fc46a).
⚠️ Report is 354 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1224       +/-   ##
===========================================
- Coverage   62.36%   31.45%   -30.91%     
===========================================
  Files         197      239       +42     
  Lines        4854     6572     +1718     
===========================================
- Hits         3027     2067      -960     
- Misses       1439     4328     +2889     
+ Partials      388      177      -211     

Flag	Coverage Δ
unit	31.45% <100.00%> (-30.91%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mwozniakk]

@rhybrillou Could you please take look at that? We are currently using the fork version but we would like to add this feature and use the official one

[rhybrillou]

Please adjust the source of the documentation file as well (my second suggestion).

[mwozniakk]

Please adjust the source of the documentation file as well (my second suggestion).

Tried to do it by using apply suggestion but all I got was
"Applying suggestions on deleted lines is currently not supported."
So I did it in separate commit.