Repository navigation
Documented no-KSail fallback validation renders no base manifests #3165
Description
🤖 Generated by the Agentic Engineer
Evidence
AGENTS.md prescribes, for contributors without KSail installed:
Without KSail, both overlays MUST build:
kubectl kustomize k8s/clusters/local/andkubectl kustomize k8s/clusters/prod/
Measured on main (2026-08-16), that build is 126 lines and contains 4 Kustomization CRs and zero other resources:
$ kubectl kustomize k8s/clusters/prod/ | grep -c HTTPRoute
0
$ kubectl kustomize k8s/clusters/prod/ | grep "^kind:" | sort | uniq -c
4 kind: Kustomization
The cluster overlays contain only the Flux Kustomization CRs that point at providers/<p>/... paths. Nothing under k8s/bases/** is rendered, so the prescribed command cannot fail on a broken base manifest.
Impact
A contributor without KSail follows the documented procedure, both commands exit 0, and they reasonably conclude the change is validated — while the file they edited was never rendered. The failure is silent and in the false-negative direction.
This is the documented fallback, so it affects exactly the people with the least tooling to notice. CI is unaffected (it runs ksail workload validate, which renders 564 files).
Expected
The no-KSail fallback should render the manifests actually being changed. The provider overlays do:
$ kubectl kustomize k8s/providers/hetzner/infrastructure/controllers | wc -l
8717
$ kubectl kustomize k8s/providers/docker/infrastructure/controllers | wc -l
3060
Acceptance criteria
- The
ValidationandMaintenancesections name commands that renderk8s/bases/**. - A reader can tell which command covers which paths.
- Optionally: a note that editing a base manifest and running only the cluster-overlay build proves nothing.
Rough size: docs-only, small.
Activity
coderabbitai commentedon Aug 16, 2026
🔗 Related PRs
#2712 - fix(coroot): use dedicated postgres scrape credentials [merged]
#2721 - fix(kyverno): scope Flagger primary mutation RBAC [merged]
#2742 - fix(apps): gate Actual Budget behind oauth2-proxy [merged]
#3037 - fix(cilium): refuse a zero-count gate release and correct the runbook order [merged]
#3109 - fix(deploy): avoid redundant GHCR node reboots [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
devantler commentedon Aug 19, 2026
Closing as a duplicate of #3151, which filed the same finding a day earlier (2026-08-15 vs
2026-08-16) and carries the fuller acceptance criteria.
Nothing here is lost: I have folded this issue's two unique contributions into #3151 — the
provider-overlay line counts (
hetzner/infrastructure/controllers8717,docker/...3060,against 126 for the cluster overlay) and the framing that the failure is silent and in the
false-negative direction, hitting exactly the readers with the least tooling to notice.
Independently re-encountered today while working a
vault-backupchange, which is recorded on#3151 as evidence the guidance is still actively misleading. Please follow #3151.