Repository navigation
fix(kyverno): preserve severity in admission logs - #4889
Conversation
The regression first failed on the real chart because the admission controller still emitted colored text. With the change, native Helm 4.2.0 and the audited controller SDK render exactly one admission argument change: text to JSON. Verbosity remains 2 and the other three controllers' argument lists are unchanged. The pinned Coroot parser's real CRI decoder/callback reproduces the false error on the colored trace sample. Structured trace/debug remain debug, info remains info, and warning/error remain warning/error even when the message contains misleading severity words. The original flag field is retained. These are consumer fixtures and chart-output checks; live structured logs remain a post-deployment check, not a result inferred from this test. Local race tests, vet, lint, workflow validation, both static cluster validations, and the native disruption-budget selector guard pass. The changed HelmRelease appears in validation output. Static validation still reports unrelated OCI render skips caused by this host's missing credential helper; the new native Kyverno render is complete. The post-renderer guard checked no changed post-rendered release because Kyverno has none; it is not claimed as changed-chart coverage. Authorization conservation: the approved kubectl v1.36.2 / Kustomize v5.8.1 renderer reports only the existing kyverno/kyverno HelmRelease ledger entry moving from 3a6ac464cd62f30e69068309e14d7d7409cd0ff395c4fbac735d514e0b8616a8 to 3e38058965f5a8c7b455389f097bb4fe1c55a05383889e57651e5cd6616a34b8. No entry is added or removed. Its sole authored manifest change is the admission logging override; grants, identities, policy enforcement, resources, replicas and rollout controls are untouched. The complete authorization race suite and executable validator now pass. No threshold, suppression, deletion or production maintenance has been performed. Reviewed source: fbd91f0. Hosted CI, an independent exact-head review, merge and deployed readback remain required. |
@coderabbitai full review |
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 15 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
cr:no-gate@fbd91f0. CodeRabbit refused this request under the included OSS review limit at 2026-10-14T16:13:11Z, with its next included review stated as 15 minutes later: #4889 (comment). The fresh direct artifact read and no-gate guard found no current-head substantive review or finding. This is provider availability, not a green review; no paid overage or redundant request is used. Continue to Codex now. |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Codex completed a clean review of fbd91f0 at 2026-10-14T16:20:17Z: #4889 (comment). The returned reviewed-commit prefix matches the unchanged, verified signed head. A complete thread read reports zero threads; no provider finding was discarded. CodeRabbit's quota refusal remains a no-gate, not a second review, and no further provider request is needed at this head. The new source remains draft while hosted CI completes. Merge, normal deployment and live structured-log readback remain separate delivery stages; old log patterns will not be erased to claim a clean counter. |
Why
Kyverno reports a trace-level startup message as an error in Coroot because its colored text includes the word “error”. This creates misleading alerts and makes genuine failures harder to spot.
What
Use structured logging for the affected controller, keeping the same verbosity and preserving warning and error reporting. Add a regression that exercises the actual log consumer and chart.
Fixes #4888
📦 New dependency: Coroot’s log parser — test the deployed consumer instead of a substitute.