FR-0053: add chao.excludedNamespaces

[richbg]

What

Adds chao.excludedNamespaces, which passes -excluded_namespaces to the chao deployment. Inverse of chao.namespaces, for customers whose list of namespaces to skip is short and static while the list to include changes constantly.

Defaults to [], so nothing changes unless it is set. Chart 0.27.0 → 0.28.0.

Testing

gremlin/tests/chao_deployment_namespaces_test.yaml, 3 cases: no flags by default, exclusion rendered as a comma-separated list, and both flags together. Full suite helm unittest gremlin: 140 passed, helm lint clean.

Validated end-to-end against minikube with 57 namespaces (50 created for the test, each with a canary Service), 2 permitted (gremlin, fr53-07), 55 excluded. Built a chao image from the dependency PR, loaded it into minikube, installed from this chart, and recorded every payload the live pod pushed to a stand-in control plane:

Run	Namespaces reported
control, no exclusions	54
in-cluster chao, installed from this chart	2 — gremlin, fr53-07

The live pod's args carry -excluded_namespaces with all 55.

Dependency

Blocked on gremlin/chao#347 — the flag does not exist until that ships. Setting chao.excludedNamespaces against a chao image without it will crashloop on flag provided but not defined. Default installs are unaffected because the arg is only rendered when the value is non-empty.

Chart pins chaoimage.tag: latest, so no image bump is needed here, but do not release this chart before chao#347 is released.

[richbg]

Re-ran the minikube validation against the review changes and widened the helm unit tests.

Cluster validation (56 namespaces, 50 created for the test with a canary Service each)

Scenario	Result
control, no exclusions	54 namespaces reported
partial exclusion (54 excluded), local chao	2 — gremlin, fr53-07
partial exclusion, in-cluster pod from this chart	2 — gremlin, fr53-07
every namespace excluded, in-cluster pod	pod Running 90s, 0 restarts, Pending delta size for full update: 0
pre-fix binary, every namespace excluded	exit 1 — pending deltas not recorded in expected amount of time

That last pair is the crash loop @gremsam called out, reproduced live and then shown fixed.

helm template with both lists set fails with the expected message before rendering anything:

Error: execution error at (gremlin/templates/chao-deployment.yaml:2:4): chao.namespaces and chao.excludedNamespaces are mutually exclusive; set one or the other

Helm unit tests

tests/chao_deployment_namespaces_test.yaml is now 10 cases: default (no flags), comma-separated rendering, single entry without stray separators, order preservation, flag exclusivity in both directions, allowlist-only, two mutual-exclusion shapes, empty-list-is-not-a-conflict, and chao.create: false where the values are inert.

Mutation-checked rather than assumed: swapping the join separator fails 2 tests, removing the validation helper fails 2 tests. Full suite 147 passed, lint clean.

Cluster left as found (test namespaces removed, existing gremlin release untouched).

[Copilot]

🟢 Approval recommended

The core change is small, well-validated with template guards and unit tests, with only minor documentation nits noted.

Pull request overview

Adds support for scoping Chao by excluding namespaces via a new chao.excludedNamespaces chart value, rendering a corresponding -excluded_namespaces container arg and preventing ambiguous configuration when combined with the existing chao.namespaces allowlist.

Changes:

• Introduces chao.excludedNamespaces (default []) and renders -excluded_namespaces when non-empty.
• Adds a Helm template validation that fails install when both chao.namespaces and chao.excludedNamespaces are set (when chao.create renders the deployment).
• Adds helm-unittest coverage for default behavior, rendering behavior, and mutual exclusivity; bumps chart version to 0.28.0.

File summaries

File	Description
gremlin/values.yaml	Documents and adds the new chao.excludedNamespaces value.
gremlin/templates/chao-deployment.yaml	Renders -excluded_namespaces args and invokes namespace validation.
gremlin/templates/_helpers.tpl	Adds chaoNamespacesValidate mutual exclusivity guard.
gremlin/tests/chao_deployment_namespaces_test.yaml	Adds unit tests covering default rendering, formatting, and validation failures.
gremlin/README.md	Documents the new chart value in the configuration table.
gremlin/Chart.yaml	Bumps chart version 0.27.0 → 0.28.0.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.