fix(docker-to-sealos): enforce KubeBlocks database workloads (#47)

Author: yangchuansheng

skills/docker-to-sealos/references/database-templates.md

@@ -614,6 +614,8 @@ Redis default account secrets usually contain:
 - `username`
 - `password`
 
+Redis and MongoDB account secrets can appear after the first component pods report progress. During deployment validation, wait for the KubeBlocks Cluster to reach `Running`/Ready and then poll for the expected account Secret before judging application initialization. For Redis, the Sentinel component may become ready before the primary `redis` component and `${{ defaults.app_name }}-redis-redis-account-default`; validate the final Redis Service FQDN `${{ defaults.app_name }}-redis-redis-redis.${{ SEALOS_NAMESPACE }}.svc.cluster.local` plus business registration/login behavior. For MongoDB, poll `${{ defaults.app_name }}-mongo-mongodb-account-root` or the matching `${{ defaults.app_name }}-mongodb-mongodb-account-root` name when the Cluster uses the `mongodb` suffix.
+
 ### Environment Variable Configuration Examples
 
 ```yaml

skills/docker-to-sealos/references/rules-registry.yaml

@@ -77,7 +77,7 @@ rules:
     description: Database cluster component resources must use limits cpu=500m/memory=512Mi and requests cpu=50m/memory=51Mi.
     severity: error
   - id: R039
-    description: Database services must use KubeBlocks Cluster resources instead of raw Deployment or StatefulSet workloads.
+    description: Database services must use KubeBlocks Cluster resources instead of raw Kubernetes resources.
     severity: error
   - id: R038
     description: Managed workload container resources must use allowed Sealos limits ladder values and derive requests from limits.

skills/docker-to-sealos/scripts/check_consistency_rules_app.py

@@ -97,6 +97,10 @@
     "timescaledb",
     "valkey",
 }
+DATABASE_RAW_WORKLOAD_KINDS = {"Deployment", "StatefulSet", "DaemonSet", "Job", "CronJob"}
+DATABASE_RAW_RESOURCE_KINDS = DATABASE_RAW_WORKLOAD_KINDS | {"Service"}
+DATABASE_CLIENT_JOB_TOKENS = {"init", "migrate", "migration", "bootstrap", "setup", "seed", "backup", "restore"}
+DATABASE_RESOURCE_NAME_TOKENS = {"postgres", "postgresql", "mysql", "mariadb", "mongo", "mongodb", "redis", "kafka"}
 OFFICIAL_HEALTH_HTTP_EXPECTATIONS: Dict[str, Dict[str, str]] = {
     "goauthentik/server": {
         "liveness_path": "/-/health/live/",
@@ -1509,14 +1513,88 @@ def _is_database_image(image: str) -> bool:
     return _image_repository_basename(image) in DATABASE_WORKLOAD_IMAGE_NAMES
 
 
+def _normalize_database_token(value: Any) -> str:
+    return re.sub(r"[^a-z0-9]+", "-", str(value).lower()).strip("-")
+
+
+def _iter_mapping_values(value: Any) -> Iterable[str]:
+    if isinstance(value, dict):
+        for key, item in value.items():
+            if isinstance(key, str):
+                yield key
+            yield from _iter_mapping_values(item)
+    elif isinstance(value, list):
+        for item in value:
+            yield from _iter_mapping_values(item)
+    elif isinstance(value, str):
+        yield value
+
+
+def _matches_database_resource_name(value: Any) -> bool:
+    return _normalize_database_token(value) in DATABASE_RESOURCE_NAME_TOKENS
+
+
+def _contains_any_database_token(value: Any, tokens: Set[str]) -> bool:
+    normalized = _normalize_database_token(value)
+    if not normalized:
+        return False
+    return bool(set(normalized.split("-")) & tokens)
+
+
+def _is_database_client_job(doc) -> bool:
+    if not isinstance(doc.data, dict) or doc.data.get("kind") not in {"Job", "CronJob"}:
+        return False
+
+    metadata = doc.data.get("metadata")
+    names: List[Any] = []
+    if isinstance(metadata, dict):
+        names.append(metadata.get("name"))
+    for container in iter_containers(doc.data):
+        names.append(container.get("name"))
+
+    return any(_contains_any_database_token(name, DATABASE_CLIENT_JOB_TOKENS) for name in names)
+
+
 def _is_database_like_workload(doc) -> bool:
-    if not is_app_workload_document(doc) or not isinstance(doc.data, dict):
+    if not isinstance(doc.data, dict):
+        return False
+    if doc.data.get("kind") not in DATABASE_RAW_WORKLOAD_KINDS:
+        return False
+    if _is_database_client_job(doc):
         return False
 
     for container in iter_containers(doc.data):
         image = container.get("image")
         if isinstance(image, str) and _is_database_image(image):
             return True
+        if _matches_database_resource_name(container.get("name")):
+            return True
+
+    return False
+
+
+def _is_database_like_service(doc) -> bool:
+    if not isinstance(doc.data, dict) or doc.data.get("kind") != "Service":
+        return False
+
+    metadata = doc.data.get("metadata")
+    if isinstance(metadata, dict):
+        for value in _iter_mapping_values(
+            {
+                "name": metadata.get("name"),
+                "labels": metadata.get("labels"),
+            }
+        ):
+            if _matches_database_resource_name(value):
+                return True
+
+    spec = doc.data.get("spec")
+    if isinstance(spec, dict):
+        selector = spec.get("selector")
+        if isinstance(selector, dict):
+            for value in _iter_mapping_values(selector):
+                if _matches_database_resource_name(value):
+                    return True
 
     return False
 
@@ -1610,18 +1688,21 @@ def check_database_services_use_clusters(context: ScanContext) -> List[Violation
             continue
         if not isinstance(doc.data, dict):
             continue
-        if doc.data.get("kind") not in {"Deployment", "StatefulSet"}:
+        kind = doc.data.get("kind")
+        if kind not in DATABASE_RAW_RESOURCE_KINDS:
             continue
-        if not _is_database_like_workload(doc):
+
+        is_database_resource = _is_database_like_service(doc) if kind == "Service" else _is_database_like_workload(doc)
+        if not is_database_resource:
             continue
 
         add_doc_violation(
             violations,
             rule_id="R039",
             doc=doc,
-            pattern=r"^\s*kind\s*:\s*(?:Deployment|StatefulSet)\s*$",
+            pattern=r"^\s*kind\s*:\s*(?:Deployment|StatefulSet|DaemonSet|Job|CronJob|Service)\s*$",
             default_pattern=r"^\s*kind\s*:",
-            message="database services must use KubeBlocks Cluster resources, not raw Deployment/StatefulSet workloads",
+            message="database services require KubeBlocks Cluster resources; raw Kubernetes resources are invalid",
         )
 
     return violations

skills/docker-to-sealos/scripts/check_must_coverage.py

@@ -144,6 +144,9 @@ def resolve_path(value: str, base: Path) -> Path:
     path = Path(value)
     if path.is_absolute():
         return path
+    cwd_path = path.resolve()
+    if cwd_path.exists():
+        return cwd_path
     return (base / path).resolve()
 
 

skills/docker-to-sealos/scripts/test_check_consistency.py

@@ -3877,6 +3877,93 @@ def test_detects_raw_database_statefulset_in_artifact(self):
             )
             self.assertTrue(any(item.rule_id == "R039" for item in violations))
 
+    def test_detects_raw_database_resources_across_supported_kinds(self):
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            skill = root / "SKILL.md"
+            refs_dir = root / "references"
+            refs_file = refs_dir / "sample.md"
+            rules_file = refs_dir / "rules-registry.yaml"
+            artifact_file = root / "template" / "demo" / "index.yaml"
+
+            write_file(skill, "# no yaml snippets\n")
+            write_file(refs_file, "# refs\n")
+            write_registry(rules_file)
+            write_file(
+                artifact_file,
+                """
+                apiVersion: apps/v1
+                kind: StatefulSet
+                metadata:
+                  name: redis
+                  labels:
+                    app: redis
+                spec:
+                  template:
+                    spec:
+                      containers:
+                        - name: redis
+                          image: redis:7.2.7
+                          imagePullPolicy: IfNotPresent
+                ---
+                apiVersion: apps/v1
+                kind: Deployment
+                metadata:
+                  name: postgres
+                spec:
+                  template:
+                    spec:
+                      containers:
+                        - name: postgres
+                          image: postgres:16.4
+                          imagePullPolicy: IfNotPresent
+                ---
+                apiVersion: apps/v1
+                kind: DaemonSet
+                metadata:
+                  name: mysql
+                spec:
+                  template:
+                    spec:
+                      containers:
+                        - name: mysql
+                          image: mysql:8.0.35
+                          imagePullPolicy: IfNotPresent
+                ---
+                apiVersion: batch/v1
+                kind: Job
+                metadata:
+                  name: kafka
+                spec:
+                  template:
+                    spec:
+                      containers:
+                        - name: kafka
+                          image: bitnami/kafka:3.3.2
+                          imagePullPolicy: IfNotPresent
+                ---
+                apiVersion: v1
+                kind: Service
+                metadata:
+                  name: mongo
+                spec:
+                  selector:
+                    app: mongo
+                  ports:
+                    - name: tcp-27017
+                      port: 27017
+                      targetPort: 27017
+                """,
+            )
+
+            violations = CHECKER.run_checks(
+                skill,
+                refs_dir,
+                rules_file,
+                additional_include_paths=["template/demo/index.yaml"],
+            )
+            self.assertGreaterEqual(len([item for item in violations if item.rule_id == "R039"]), 5)
+
     def test_allows_stateful_application_workload_in_artifact(self):
         with tempfile.TemporaryDirectory() as temp_dir:
             root = Path(temp_dir)
@@ -3973,6 +4060,127 @@ def test_allows_database_named_non_database_image_workload(self):
             )
             self.assertFalse(any(item.rule_id == "R039" for item in violations))
 
+    def test_allows_kubeblocks_redis_cluster_and_app_statefulset_dependency(self):
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            skill = root / "SKILL.md"
+            refs_dir = root / "references"
+            refs_file = refs_dir / "sample.md"
+            rules_file = refs_dir / "rules-registry.yaml"
+            artifact_file = root / "template" / "demo" / "index.yaml"
+
+            write_file(skill, "# no yaml snippets\n")
+            write_file(refs_file, "# refs\n")
+            write_registry(rules_file)
+            write_file(
+                artifact_file,
+                """
+                apiVersion: apps.kubeblocks.io/v1alpha1
+                kind: Cluster
+                metadata:
+                  name: demo-redis
+                  labels:
+                    kb.io/database: redis-7.2.7
+                    sealos-db-provider-cr: demo-redis
+                    clusterdefinition.kubeblocks.io/name: redis
+                spec:
+                  componentSpecs:
+                    - name: redis
+                      resources:
+                        requests:
+                          cpu: 50m
+                          memory: 51Mi
+                        limits:
+                          cpu: 500m
+                          memory: 512Mi
+                    - name: redis-sentinel
+                      resources:
+                        requests:
+                          cpu: 50m
+                          memory: 51Mi
+                        limits:
+                          cpu: 500m
+                          memory: 512Mi
+                ---
+                apiVersion: apps/v1
+                kind: StatefulSet
+                metadata:
+                  name: demo-data
+                  labels:
+                    app: demo-data
+                    cloud.sealos.io/app-deploy-manager: demo-data
+                spec:
+                  revisionHistoryLimit: 1
+                  template:
+                    spec:
+                      automountServiceAccountToken: false
+                      containers:
+                        - name: demo
+                          image: ghcr.io/example/demo:1.0.0
+                          imagePullPolicy: IfNotPresent
+                          env:
+                            - name: REDIS_HOST
+                              value: demo-redis-redis-redis.default.svc.cluster.local
+                            - name: REDIS_PASSWORD
+                              valueFrom:
+                                secretKeyRef:
+                                  name: demo-redis-redis-account-default
+                                  key: password
+                  volumeClaimTemplates:
+                    - metadata:
+                        name: data
+                      spec:
+                        resources:
+                          requests:
+                            storage: 1Gi
+                """,
+            )
+
+            violations = CHECKER.run_checks(
+                skill,
+                refs_dir,
+                rules_file,
+                additional_include_paths=["template/demo/index.yaml"],
+            )
+            self.assertFalse(any(item.rule_id == "R039" for item in violations))
+
+    def test_allows_database_client_init_jobs(self):
+        with tempfile.TemporaryDirectory() as temp_dir:
+            root = Path(temp_dir)
+            skill = root / "SKILL.md"
+            refs_dir = root / "references"
+            refs_file = refs_dir / "sample.md"
+            rules_file = refs_dir / "rules-registry.yaml"
+            artifact_file = root / "template" / "demo" / "index.yaml"
+
+            write_file(skill, "# no yaml snippets\n")
+            write_file(refs_file, "# refs\n")
+            write_registry(rules_file)
+            write_file(
+                artifact_file,
+                """
+                apiVersion: batch/v1
+                kind: Job
+                metadata:
+                  name: demo-pg-init
+                spec:
+                  template:
+                    spec:
+                      containers:
+                        - name: pg-init
+                          image: postgres:16-alpine
+                          imagePullPolicy: IfNotPresent
+                """,
+            )
+
+            violations = CHECKER.run_checks(
+                skill,
+                refs_dir,
+                rules_file,
+                additional_include_paths=["template/demo/index.yaml"],
+            )
+            self.assertFalse(any(item.rule_id == "R039" for item in violations))
+
     def test_detects_invalid_managed_workload_resource_ladder(self):
         with tempfile.TemporaryDirectory() as temp_dir:
             root = Path(temp_dir)