Repository navigation
fix(infra): pin the kubelet serving certificate approver to release v0.12.1 - #265
Conversation
…0.12.1 The Hetzner overlay installed the approver from the upstream project's main branch, including the moving `:main` image, so two renders of the same template commit could install different code. Vendor the v0.12.1 release's HA manifest (2 leader-elected replicas, hostname anti-affinity) one document per file with the upstream bytes unchanged, add a drain-safe PDB, and pin the image by tag and digest. Fixes #264 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@coderabbitai review |
✅ Action performed
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Linked Issues check |  |
Issue #264 requires a reviewed, pinned manifest and green Hetzner render plus ksail workload validate. The new kustomization vendors the v0.12.1 HA resources and pins `ghcr.io/alex1989hu/kubelet-ser… |
Provide reviewable successful results for the Hetzner render and ksail workload validate before deciding compliance with the second acceptance criterion. |
-
Check name Status Explanation Title check The title clearly and concisely identifies the main change: pinning the kubelet serving certificate approver to release v0.12.1. Description check The description directly explains the change from an upstream development branch to a reviewed, high-availability release with a pinned image and disruption budget. Out of Scope Changes check The changes stay within the kubelet serving certificate approver component requested by issue #264. The added RBAC resources, HA Deployment, PodDisruptionBudget, Service, namespace, and vendored kusto…Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Full details: Out of Scope Changes check
-
Explanation
The changes stay within the kubelet serving certificate approver component requested by issue
#264. The added RBAC resources, HA Deployment, PodDisruptionBudget, Service, namespace, and vendored kustomization resources support the pinned installation. No unrelated change is shown.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (12 skipped: 12 unsupported.)
-
Full details: Linked Issues check
-
Explanation
Issue
#264requires a reviewed, pinned manifest and green Hetzner render plusksail workload validate. The new kustomization vendors the v0.12.1 HA resources and pinsghcr.io/alex1989hu/kubelet-serving-cert-approverto tag0.12.1and digestsha256:445a8e5584f659701092d2ec8b625da8929dc75fe4d45274333bd9fe6db8fb75. The reviewed evidence does not include results for the Hetzner render orksail workload validate.Resolution
Provide reviewable successful results for the Hetzner render and
ksail workload validatebefore deciding compliance with the second acceptance criterion.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
🔧 Checkov (3.3.25)
-
k8s/providers/hetzner/infrastructure/controllers/kubelet-serving-cert-approver/deployment.yaml
-
Checkov retry budget exhausted before isolating this batch
k8s/providers/hetzner/infrastructure/controllers/kubelet-serving-cert-approver/kustomization.yaml
-
Checkov retry budget exhausted before isolating this batch
k8s/providers/hetzner/infrastructure/controllers/kubelet-serving-cert-approver/namespace.yaml
-
Checkov retry budget exhausted before isolating this batch
-
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Ready for merge at
|
Why
New platforms built from this template installed the component that approves kubelet serving certificates straight from the upstream project's development branch, including a moving image. What a new platform got could change whenever upstream pushed, with no review here.
What
The production overlay now carries a reviewed copy of one upstream release, in its high-availability form (two replicas, one active and one on standby on different nodes), with a disruption budget so node drains stay safe, and the image pinned to an exact build. This matches how the reference platform runs it.
Fixes #264
🤖 Generated with Claude Code