fix(plugins): Validate selector during k8s reconciliation

[adityathebe]

...
status:
  conditions:
  - lastTransitionTime: "2026-05-22T10:29:13Z"
    message: 'plugin postgres: invalid spec.selector: failed to convert labels to
      selector: unable to parse requirement: <nil>: Invalid value: "missionControl/connection-type":
      prefix part a lowercase RFC 1123 subdomain must consist of lower case alphanumeric
      characters, ''-'' or ''.'', and must start and end with an alphanumeric character
      (e.g. ''example.com'', regex used for validation is ''[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'')'
    observedGeneration: 3
    reason: PersistFailed
    status: "False"
    type: Ready
  installedPath: /Users/aditya/projects/flanksource/local-setup/plugins/postgres
  observedGeneration: 2
  pluginVersion: v1.0.0+ede4db8e built 2026-05-19 09:54:00

Summary by CodeRabbit

• Bug Fixes
  • Enhanced validation for plugin selectors during installation to catch invalid configurations earlier and provide clearer error messages.

[coderabbitai]

Walkthrough

This PR adds selector validation to the plugin reconciliation process. A new helper function validatePluginSelector converts plugin selectors to PEG grammar representation and validates them by parsing. The validator is called early in PersistPluginFromCRD before registry operations, returning plugin-scoped errors for invalid selectors.

Changes

Plugin Selector Validation

Layer / File(s)	Summary
Selector validation implementation and integration plugin/registry/reconciler.go	New PEG grammar import enables validatePluginSelector helper that conditionally validates p.Spec.Selector by converting to PEG and parsing. Validator is called early in PersistPluginFromCRD before plugin installation, returning plugin-scoped errors on invalid selector/PEG forms.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding selector validation to the plugin reconciliation process during Kubernetes reconciliation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/plugins-error

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/plugins-error

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@plugin/registry/reconciler.go`:
- Around line 48-50: validatePluginSelector currently returns raw fmt.Errorf for
invalid spec.selector and is called from PersistPluginFromCRD without a context;
update validatePluginSelector to accept the existing ctx parameter used in
PersistPluginFromCRD (thread ctx into the call in
PersistPluginFromCRD/PersistPluginFromCRD callers) and replace any
fmt.Errorf(...) error returns with ctx.Oops().Code(dutyAPI.EINVALID).Wrapf(...)
to produce a typed validation error; also add the import for
github.com/flanksource/duty/api as dutyAPI so the constant dutyAPI.EINVALID is
available and ensure all call sites of validatePluginSelector pass the ctx.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a09d0b81-7837-4dd2-beb2-cc8ea961f9df

📥 Commits

Reviewing files that changed from the base of the PR and between a99f388 and 7f07007.

📒 Files selected for processing (1)

• plugin/registry/reconciler.go