[dmt] feat: module rbac.yaml declaration, skeleton (merge only with #480)

.golangci.yml

@@ -10,6 +10,7 @@ linters:
     - ineffassign
     - misspell
     - musttag
+    - nolintlint
     - nonamedreturns
     - prealloc
     - revive
@@ -22,6 +23,12 @@ linters:
     - whitespace
     - wsl_v5
   settings:
+    nolintlint:
+      # Whether a directive is still needed depends on the golangci-lint version (CI and
+      # developers differ); what every directive must have is a named linter and a reason.
+      allow-unused: true
+      require-explanation: true
+      require-specific: true
     depguard:
       rules:
         logger:

cmd/dmt/main.go

@@ -113,5 +113,9 @@ func runLint(ctx context.Context, src manager.Source) error {
 		return errors.New("critical errors found")
 	}
 
+	if flags.Fix && mng.HasFailedFixes() {
+		return errors.New("some fixes did not close their findings; see AutofixError")
+	}
+
 	return nil
 }

internal/manager/manager.go

@@ -440,6 +440,11 @@ func (m *Manager) HasCriticalErrors() bool {
 	return m.errors.ContainsErrors()
 }
 
+// HasFailedFixes reports whether --fix left a finding open with the reason in its FixError.
+func (m *Manager) HasFailedFixes() bool {
+	return m.errors.ContainsFailedFixes()
+}
+
 // ApplyFixes is the single entry point for the --fix flag. It runs every fix
 // attached to a collected finding. Findings whose fix succeeds are marked Fixed
 // and subsequently dropped by GetErrors; findings whose fix fails are kept, and

internal/metrics/metrics_test.go

@@ -22,7 +22,7 @@ func Test_SetLinterWarningsMetrics_AddsWarningsForAllLinters(t *testing.T) {
 			Module:        global.ModuleLinterConfig{},
 			NoCyrillic:    global.LinterConfig{Impact: pkg.Warn.String()},
 			OpenAPI:       global.OpenAPILinterConfig{LinterConfig: global.LinterConfig{Impact: pkg.Warn.String()}},
-			Rbac:          global.LinterConfig{Impact: pkg.Warn.String()},
+			Rbac:          global.RBACLinterConfig{LinterConfig: global.LinterConfig{Impact: pkg.Warn.String()}},
 			Templates:     global.TemplatesLinterConfig{},
 			Documentation: global.DocumentationLinterConfig{},
 		},

internal/modules/module.go

@@ -229,10 +229,35 @@ func mapRuleSettings(linterSettings *pkg.LintersSettings, configSettings *config
 	// OpenAPI rules (uses global rule config + local fallback)
 	mapOpenAPIRules(linterSettings, configSettings, globalConfig)
 
+	// RBAC declaration rules (uses global rule config + local fallback); the four original rbac
+	// rules keep the linter level (see mapSimpleLinterRules)
+	mapRBACRules(linterSettings, configSettings, globalConfig)
+
 	// Other linter rules (use local linter-level impact)
 	mapSimpleLinterRules(linterSettings, configSettings)
 }
 
+// mapRBACRules configures the per-rule levels of the rbac rules added for the module RBAC
+// declaration. As for every dmt linter, a per-rule level is read from the root configuration only
+// and wins over the linter's impact; a rule the root leaves unset falls back to the linter's impact
+// -- the module's, if it sets one -- but never above warn, the level these rules start at.
+func mapRBACRules(linterSettings *pkg.LintersSettings, configSettings *config.LintersSettings, globalConfig *global.Linters) {
+	// The declaration rules are new to every tree: a module without rbac.yaml sees only contract,
+	// and the platform tree still carries six dead rbac.yaml files of an older shape and rules the
+	// contract flags. They therefore start at warn wherever nothing sets them -- like the style
+	// rules of the documentation linter -- and are raised to error per tree in its root
+	// .dmtlint.yaml once its modules are clean. The linter-level impact is intentionally not the
+	// fallback: impact: error on rbac means the four original rules, as it always did.
+	fallback := pkg.Warn.String()
+	if impact := configSettings.Rbac.Impact; impact != "" && pkg.ParseStringToLevel(impact) < pkg.Warn {
+		fallback = impact
+	}
+
+	linterSettings.RBAC.Rules.CoverageRule.SetLevel(globalConfig.Rbac.Rules.CoverageRule.Impact, fallback)
+	linterSettings.RBAC.Rules.SyncRule.SetLevel(globalConfig.Rbac.Rules.SyncRule.Impact, fallback)
+	linterSettings.RBAC.Rules.ContractRule.SetLevel(globalConfig.Rbac.Rules.ContractRule.Impact, fallback)
+}
+
 // mapContainerRules configures Container linter rules
 func mapContainerRules(linterSettings *pkg.LintersSettings, configSettings *config.LintersSettings, globalConfig *global.Linters) {
 	linterSettings.Container.Rules.RecommendedLabelsRule.SetLevel(
@@ -582,6 +607,9 @@ func mapRBACExclusions(linterSettings *pkg.LintersSettings, configSettings *conf
 	excludes.BindingSubject = pkg.StringRuleExcludeList(configExcludes.BindingSubject)
 	excludes.Placement = configExcludes.Placement.Get()
 	excludes.Wildcards = configExcludes.Wildcards.Get()
+	excludes.Coverage = pkg.StringRuleExcludeList(configExcludes.Coverage)
+	excludes.Contract = configExcludes.Contract.Get()
+	excludes.Sync = configExcludes.Sync.Get()
 }
 
 // mapHooksSettings maps Hooks linter settings

internal/modules/rbac_rules_config_test.go

@@ -0,0 +1,85 @@
+/*
+Copyright 2026 Flant JSC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package modules
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/deckhouse/dmt/pkg"
+	"github.com/deckhouse/dmt/pkg/config"
+	"github.com/deckhouse/dmt/pkg/config/global"
+)
+
+// The rules added for the module RBAC declaration read their own impact from the root
+// configuration; the four original rbac rules keep the linter level whatever the root says.
+func TestRemapLinterSettings_RBACDeclarationRules(t *testing.T) {
+	t.Run("per-rule levels from the root configuration, warn as the fallback", func(t *testing.T) {
+		settings := remapLinterSettings(
+			&config.LintersSettings{Rbac: config.RbacSettings{Impact: pkg.Error.String()}},
+			&global.Linters{Rbac: global.RBACLinterConfig{
+				LinterConfig: global.LinterConfig{Impact: pkg.Error.String()},
+				Rules: global.RBACRules{
+					CoverageRule: global.RuleConfig{Impact: pkg.Warn.String()},
+					SyncRule:     global.RuleConfig{Impact: pkg.Ignored.String()},
+				},
+			}},
+		)
+
+		require.Equal(t, pkg.Warn, *settings.RBAC.Rules.CoverageRule.GetLevel())
+		require.Equal(t, pkg.Ignored, *settings.RBAC.Rules.SyncRule.GetLevel())
+		require.Equal(t, pkg.Warn, *settings.RBAC.Rules.ContractRule.GetLevel(), "unset starts at warn, whatever the linter level says")
+
+		// SC5: the original rules are untouched by the per-rule block.
+		for _, rule := range []*pkg.RuleConfig{
+			&settings.RBAC.Rules.UserAuthRule, &settings.RBAC.Rules.BindingRule, &settings.RBAC.Rules.PlacementRule, &settings.RBAC.Rules.WildcardsRule,
+		} {
+			require.Equal(t, pkg.Error, *rule.GetLevel())
+		}
+	})
+
+	t.Run("the linter's impact is the fallback below warn, and the root's per-rule level wins", func(t *testing.T) {
+		settings := remapLinterSettings(
+			&config.LintersSettings{Rbac: config.RbacSettings{Impact: pkg.Ignored.String()}},
+			&global.Linters{Rbac: global.RBACLinterConfig{Rules: global.RBACRules{
+				SyncRule: global.RuleConfig{Impact: pkg.Error.String()},
+			}}},
+		)
+
+		require.Equal(t, pkg.Ignored, *settings.RBAC.Rules.CoverageRule.GetLevel(), "impact: ignored on the linter silences an unset rule")
+		require.Equal(t, pkg.Error, *settings.RBAC.Rules.SyncRule.GetLevel(), "a module cannot lower what the root sets")
+
+		settings = remapLinterSettings(&config.LintersSettings{Rbac: config.RbacSettings{Impact: pkg.Error.String()}}, &global.Linters{})
+		require.Equal(t, pkg.Warn, *settings.RBAC.Rules.ContractRule.GetLevel(), "error on the linter does not raise the unset rules above warn")
+	})
+
+	t.Run("module-level exclusions for the three rules", func(t *testing.T) {
+		settings := remapLinterSettings(
+			&config.LintersSettings{Rbac: config.RbacSettings{ExcludeRules: config.RBACExcludeRules{
+				Coverage: config.StringRuleExcludeList{"deckhouse.io/internals"},
+				Contract: config.KindRuleExcludeList{{Kind: "ClusterRole", Name: "d8:namespace-capability:x:view"}},
+				Sync:     config.KindRuleExcludeList{{Kind: "ClusterRole", Name: "d8:user-authz:x:user"}},
+			}}},
+			&global.Linters{},
+		)
+
+		require.Equal(t, pkg.StringRuleExcludeList{"deckhouse.io/internals"}, settings.RBAC.ExcludeRules.Coverage)
+		require.Len(t, settings.RBAC.ExcludeRules.Contract.Get(), 1)
+		require.Len(t, settings.RBAC.ExcludeRules.Sync.Get(), 1)
+	})
+}

internal/modules/render.go

@@ -46,6 +46,7 @@ func RunRender(m *Module, vals chartutil.Values, objectStore *storage.Unstructur
 		Values:           vals,
 		ExtraAPIVersions: render.ExtraAPIVersions(),
 		OnDrop: func(templatePath, cause string) {
+			objectStore.MarkDropped(templatePath, cause)
 			errorList.WithModule(m.GetName()).WithFilePath(templatePath).WithValue(cause).
 				Warnf("template %q failed to render and was skipped; the rest of the chart was still linted", templatePath)
 		},

internal/storage/storage.go

@@ -383,10 +383,22 @@ func (s *StoreObject) Identity() string {
 
 type UnstructuredObjectStore struct {
 	Storage map[ResourceIndex]StoreObject
+	// Dropped holds the templates the tolerant render skipped, by path relative to the module, with
+	// the render error. Their objects are missing from Storage without being absent from the chart.
+	Dropped map[string]string
 }
 
 func NewUnstructuredObjectStore() *UnstructuredObjectStore {
-	return &UnstructuredObjectStore{Storage: make(map[ResourceIndex]StoreObject)}
+	return &UnstructuredObjectStore{Storage: make(map[ResourceIndex]StoreObject), Dropped: make(map[string]string)}
+}
+
+// MarkDropped records a template the render skipped.
+func (s *UnstructuredObjectStore) MarkDropped(path, cause string) {
+	if s.Dropped == nil {
+		s.Dropped = make(map[string]string)
+	}
+
+	s.Dropped[path] = cause
 }
 
 func (s *UnstructuredObjectStore) Put(path, shortPath string, object map[string]any, raw []byte) error {
@@ -431,6 +443,7 @@ func (s *UnstructuredObjectStore) Close() {
 // does not drop the backing map, which is what makes reuse cheap.
 func (s *UnstructuredObjectStore) Reset() {
 	clear(s.Storage)
+	clear(s.Dropped)
 }
 
 func NewSHA256(data []byte) string {

pkg/config.go

@@ -244,12 +244,18 @@ type RBACLinterRules struct {
 	BindingRule   RuleConfig
 	PlacementRule RuleConfig
 	WildcardsRule RuleConfig
+	CoverageRule  RuleConfig
+	SyncRule      RuleConfig
+	ContractRule  RuleConfig
 }
 
 type RBACExcludeRules struct {
 	BindingSubject StringRuleExcludeList
 	Placement      KindRuleExcludeList
 	Wildcards      KindRuleExcludeList
+	Coverage       StringRuleExcludeList
+	Contract       KindRuleExcludeList
+	Sync           KindRuleExcludeList
 }
 type HooksLinterConfig struct {
 	LinterConfig

pkg/config/global/global.go

@@ -30,7 +30,7 @@ type Linters struct {
 	Module        ModuleLinterConfig        `mapstructure:"module"`
 	NoCyrillic    LinterConfig              `mapstructure:"no-cyrillic"`
 	OpenAPI       OpenAPILinterConfig       `mapstructure:"openapi"`
-	Rbac          LinterConfig              `mapstructure:"rbac"`
+	Rbac          RBACLinterConfig          `mapstructure:"rbac"`
 	Templates     TemplatesLinterConfig     `mapstructure:"templates"`
 	Documentation DocumentationLinterConfig `mapstructure:"documentation"`
 }
@@ -71,6 +71,21 @@ type ContainerRules struct {
 	SysCgroupMountRule           RuleConfig `mapstructure:"sys-cgroup-mount"`
 }
 
+// RBACLinterConfig carries the linter-level impact of rbac and the per-rule impacts of the rules
+// added for the module RBAC declaration. The four original rules (user-authz, binding-subject,
+// placement, wildcards) have never had per-rule levels and keep the linter's: wiring them up
+// would change the severity of existing findings.
+type RBACLinterConfig struct {
+	LinterConfig `mapstructure:",squash"`
+	Rules        RBACRules `mapstructure:"rules"`
+}
+
+type RBACRules struct {
+	CoverageRule RuleConfig `mapstructure:"coverage"`
+	SyncRule     RuleConfig `mapstructure:"sync"`
+	ContractRule RuleConfig `mapstructure:"contract"`
+}
+
 type ImagesLinterConfig struct {
 	LinterConfig `mapstructure:",squash"`
 	Rules        ImageRules `mapstructure:"rules"`

pkg/config/linters_settings.go

@@ -222,6 +222,10 @@ type RBACExcludeRules struct {
 	BindingSubject StringRuleExcludeList `mapstructure:"binding-subject"`
 	Placement      KindRuleExcludeList   `mapstructure:"placement"`
 	Wildcards      KindRuleExcludeList   `mapstructure:"wildcards"`
+	// Coverage lists "group/resource" keys of CRDs the declaration deliberately leaves out.
+	Coverage StringRuleExcludeList `mapstructure:"coverage"`
+	Contract KindRuleExcludeList   `mapstructure:"contract"`
+	Sync     KindRuleExcludeList   `mapstructure:"sync"`
 }
 
 type TemplatesSettings struct {