Repository navigation
fix: restore security storage readiness before maintenance - #4778
Conversation
Evaluation of Read-only production evidence shows the storage Deployment unready after volume attachment fails because its scheduled worker has no Longhorn CSI driver. The existing claim remains bound, and eligible storage workers are ready and schedulable. All database clusters remain ready and archiving. The protected maintenance's readiness check is intentionally retained. The real pinned Kubescape chart reproduces unsafe placement before this fix and passes afterward for install and upgrade with the audited controller SDK. Negative controls reject compute-only workers, missing eligibility and a wrong operating-system boundary. The rendered claim and single-writer strategy are unchanged, and no other component's placement changes. The real production post-renderer check passes using Kubernetes 1.36.4; all 106 guard assertions pass on the committed tree. Shellcheck, actionlint, diff checks and the race-enabled authorization package pass. The authorization render changes exactly one existing ledger entry: Kubescape's HelmRelease, solely by adding the storage Deployment placement patch. Membership and every other entry, including grant-bearing resources, remain unchanged; no permission or identity is added. The validator's approved-renderer diagnostic supplies the new digest and its complete contract passes after recording that reviewed delta. KSail's production validation exits successfully with 127 kustomizations validated. Its existing OCI-chart credential-helper and offline namespace-policy warnings remain limits on unrelated full-chart/policy coverage; they are not counted as proven clean. Kubescape's actual chart has separate positive behavioral proof above. Self-review covered correctness, the narrow scheduling scope, workflow input handling, authorization boundaries and simplification. No unresolved finding remains in that pass; it is not the independent review gate. Codex's substantive green names this exact commit and follows the authenticated request. The ordered review loop used the serving Codex lane after CodeRabbit reported its included repository allowance consumed. Native current-head CI 38185689185 has passed, including the required aggregate; no unresolved thread remains. #4775 has merged as This head is ready for the normal protected queue. After deployment, verify the same claim identity and storage readiness before retrying #4744. Remove the temporary placement only through #4777 after the permanent client rollout and separated live samples. |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Why
The security scanner's persistent storage is stranded on a worker that cannot attach its volume. Its loss of readiness also blocks the protected storage maintenance needed to deliver the init-log repair.
What
Keep this single storage component on workers that currently support its existing volume, without changing its data or weakening health checks. The security agents and local development placement stay unchanged.
Deferred: #4777 — remove the temporary placement after the volume-client rollout is verified.
Fixes #4776