Repository navigation
refactor(infrastructure): centralize HelmRelease Flux remediation defaults - #1928
Merged
Merged
Conversation
…aults
The install/upgrade remediation block (retries: -1 + remediateLastFailure: true)
required by the enforce-flux-best-practices Kyverno policy was copy-pasted,
byte-identical, into all 37 HelmReleases. Move it into a Kustomize Component
(bases/components/helmrelease-flux-defaults) that merges it into every
HelmRelease — the same mechanism already used for helmrelease-drift-detection —
and delete the inline blocks.
A strategic-merge patch (not JSON6902) is used so the defaults MERGE: they create
spec.install/upgrade where absent and leave sibling fields (install.crds,
upgrade.crds, velero's upgrade.force) and per-chart values untouched.
The Component is wired into the same five overlay layers as drift detection
(providers/{docker,hetzner}/infrastructure[/controllers], hetzner/apps).
Behavior-preserving: `kubectl kustomize` output for all five HR-rendering
provider paths is byte-identical to before. `ksail workload validate` is
unchanged (local 0 failures; prod's only failure is the pre-existing coroot
catalog-schema one) — the single delta is one additional kustomization validated
(the new Component). Standalone base HRs no longer carry remediation, which is
schema-valid (the field is optional in the CRD); the live cluster still sees it
because Flux always renders HRs through an overlay that includes the Component,
so the Kyverno gate is satisfied.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
devantler
marked this pull request as ready for review
June 9, 2026 17:42
This was referenced Jun 9, 2026
Contributor
|
🎉 This PR is included in version 1.44.9 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The
install/upgraderemediation block required by theenforce-flux-best-practicesKyverno policy:was copy-pasted byte-identical into all 37 HelmReleases (~190 lines). Centralize it into a Kustomize Component — the same mechanism already used for
helmrelease-drift-detection— and delete the inline copies.How
k8s/bases/components/helmrelease-flux-defaults/merges the remediation block into everyHelmRelease.spec.install/spec.upgradewhen absent and leaves sibling fields untouched —install.crds,upgrade.crds, and velero'supgrade.forceare all preserved.providers/{docker,hetzner}/infrastructure,.../infrastructure/controllers, andhetzner/apps.Net: −185 lines across 37 HelmReleases; new HelmReleases no longer need to restate the block.
Validation (behavior-preserving)
kubectl kustomizefor all five HR-rendering provider paths is byte-identical to before (59 rendered HR instances total).ksail workload validate: local 0 failures; prod unchanged (its only failure is the pre-existing coroot catalog-schema issue). The sole delta is88 → 89 kustomizations validated— the new Component itself.remediation, which is schema-valid (optional in the CRD). On the live cluster Flux always renders HRs through an overlay that includes the Component, so the Kyvernoenforce-flux-best-practicesgate still sees the field.Note
This intentionally leaves
interval/timeoutinline (they have a few deliberate per-chart values, unlike the 100%-uniform remediation block). The one pre-existing label inconsistency (origin-ca-issuermissinghelm.toolkit.fluxcd.io/remediation: enabled) is left for a separate change to keep this PR a pure behavior-preserving refactor.🤖 Generated with Claude Code