Repository navigation
Documented no-KSail validation fallback validates zero base manifests #3151
Description
🤖 Generated by the Agentic Engineer
Evidence
AGENTS.md prescribes a no-KSail fallback for manifest validation, in both the Validation section
and the agent-facing Maintenance section:
Without KSail, both overlays MUST build:
kubectl kustomize k8s/clusters/local/and
kubectl kustomize k8s/clusters/prod/
That command does not validate manifests. Measured on main today:
$ kubectl kustomize k8s/clusters/local/ | yq -r '[.kind, .metadata.name] | join(" ")'
Kustomization apps
Kustomization bootstrap
Kustomization infrastructure
Kustomization infrastructure-controllers
$ kubectl kustomize k8s/clusters/local/ | grep -c 'auth-proxy\|oauth2-proxy\|cluster-policies'
0
It emits 4 documents — the Flux Kustomization wiring only — and zero base manifests. For
comparison, ksail workload validate on the same tree validates 465 files under bases/.
This is by design: k8s/clusters/ overlays only wire the four Flux Kustomizations, and the actual
manifests are delivered as an OCI artifact and reconciled by Flux. The build succeeding says nothing
about the files a change actually touched.
Impact
The failure is silent and points the wrong way. An agent or contributor without KSail installed edits
something under k8s/bases/**, runs the documented fallback, sees both overlays build, and concludes
the change is validated — when none of it was parsed. A malformed base manifest reaches CI (or a
reviewer) carrying an explicit local "validated" claim.
I hit this today on #2723: after editing k8s/bases/infrastructure/controllers/auth-proxy/config-map.yaml,
both overlays built cleanly and a grep for my own change in the rendered output returned 0. Only
running ksail workload validate and then grepping its log for the changed path proved the file was
actually covered.
Expected behaviour
The documented fallback should either validate the manifests it implies, or say plainly that it does
not and name what it does cover.
Acceptance criteria
-
AGENTS.mdno longer presentskubectl kustomize k8s/clusters/{local,prod}as validation of
changed manifests; it states that this builds only the Flux Kustomization wiring. - A no-KSail path that genuinely parses changed base manifests is documented (e.g. building the
provider overlay that actually includes them, and/orkubectl apply --dry-run=client -f <file>
per changed file, which the doc already mentions separately). - The guidance tells the reader to confirm coverage — grep the validator's output for the
changed path — rather than trusting a zero-exit. - Both the Validation and Maintenance sections are corrected (the claim appears in both).
Rough size: small — a documentation fix plus verifying the replacement command actually covers a
changed base file.
Activity
coderabbitai commentedon Aug 15, 2026
🔗 Related PRs
#2704 - fix(aws): constrain eks-ci KMS grant creation [merged]
#2738 - ci: verify ksail release downloads [merged]
#3037 - fix(cilium): refuse a zero-count gate release and correct the runbook order [merged]
#3103 - feat(security): assert the node image verifier can enforce at all [merged]
#3109 - fix(deploy): avoid redundant GHCR node reboots [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
devantler commentedon Aug 19, 2026
Independently re-discovered today, and #3165 is a duplicate of this — consolidating here
This cost an agent real time again on 2026-08-19, four days after it was filed, which is decent
evidence the guidance is actively misleading rather than merely imprecise.
Working a
vault-backupmanifest change, I followed the documented fallback. Both overlays builtclean, and
grep -c 'chmod 0640'on the rendered output returned 0 — reading exactly like "mychange is a no-op". What disambiguated it was running the unfiltered control:
grep -c vault-snapshotwas also 0, proving the workload is absent from that render entirely. Withoutthat control the natural conclusion is that the change is broken, and the natural "fix" is to go
change working code.
The correct target was
kubectl kustomize k8s/providers/hetzner/infrastructure, which renders bothwriters (
CronJob/vault-snapshot,Job/vault-snapshot-init).Folding in #3165's unique content before closing it
#3165 (filed a day later, same finding) adds two things worth keeping here:
kubectl kustomize k8s/providers/hetzner/infrastructure/controllers | wc -l→ 8717;.../docker/infrastructure/controllers→ 3060; against 126 for the cluster overlay.exactly the readers with the least tooling to notice — CI is unaffected because it runs
ksail workload validate.One addition to the acceptance criteria
A further wrinkle measured today:
vault-backupis included bybases/infrastructure/(whichhetzner pulls in) but is commented out in the docker provider, so that change is prod-only and
is invisible to the local overlay by construction. So "build the provider overlay" is not one command
— the guidance should tell the reader to build the provider overlay that actually includes the path
they edited, and to confirm coverage by grepping the render for their own change.
chore: agent-claim #3151 nonce=3504e13c64901d3b9ba31ee77b2ef1fb
docs(agents): make the no-KSail validation fallback build the provide…