Repository navigation
fix(email): explain the health and probe mismatch - #5426
Conversation
Part of #5421. Compare fixed health requests, require complete query/get address inventories, keep administrative inputs on private stdin, and retain stable runtime/input bindings.
This extends the merged observer as a separate opt-in workflow. It retains the exact serving-image binding, first-attempt main dispatch, protected production serialization, finite waits, one fixed exec and stable before/after runtime and input identities. The two named credential inputs remain inside the workflow process and stdin; public output is a closed set of classifications. No application rule, probe, configuration, retained store or network permission is changed. The missing-workflow regression was RED before implementation. A runtime environment-injection control also reproduced unsafe admission before its guard was added. The full observer suite now passes, including race detection and actual HTTP execution of the embedded shell. Vet, ShellCheck, workflow security analysis and whitespace checks pass. A checksum-verified native Stalwart 0.16.27 synthetic store exercised the shipped request and a deliberately blocked documentation address. Query totals and exact query/get ID agreement prevent the native get-all limit from masquerading as a complete inventory; malformed, missing, oversized, expired and overridden cases are covered. Correctness, simplification and credential/egress self-review found no remaining actionable issue. The current probe source is a local control, not a reproduction of the kubelet network path, and stored rules do not attest the in-memory security cache. Hosted validation, protected merge and a bound production observation remain required. #5421 and #5412 stay open for those outcomes; no recovery is claimed. |
@coderabbitai review |
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 31 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
cr:no-gate@10de2f0. CodeRabbit declined the current-head request as rate limited. The fresh complete review-no-gate guard returned ADMIT; no CodeRabbit review is claimed. Advancing to the next provider in order. |
@codex review |
devantler
left a comment
devantler
left a comment
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer
Additional correctness review at 10de2f0. The health-path and access-state classifications have a useful bounded scope. The inline finding needs correction before claiming Kubernetes probe headers are reproduced; this is not a green-review record.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 10de2f04e5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Part of #5421. Use the actual kubelet minor in the User-Agent, verify target node identity and version, and accept only the existing two-key administrator Secret while extracting its password.
cr:no-gate@f87343f. The refreshed provider-health evidence places CodeRabbit's included review capacity under a current limit until 2026-10-27T06:15:25Z. No additional request is sent inside that window. The fresh complete guard returned ADMIT for this head. Current-head hosted CI has settled with 26 successes and 20 intended skips; the ordered review loop advances to Codex. |
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Ready at Current-head CI reports 26 successes and 20 intended skips. Complete Go regressions, repository guards, workflow security checks and publication validation passed. The actual path-classification job reports Current-head Codex summary6434788806 and clean receipt6435119848 report no findings. Complete conversation, review-object and thread reads are clear: The new observation remains opt-in and requires its confirmed first-attempt main workflow after merge. It changes no workload, access rule, data, probe or deployment filter. A bound production result is still required for #5421, and #5412 stays open for sustained recovery and authenticated administration. This readiness record claims no production recovery or security clearance. |
Why
Email answers a local health check while Kubernetes continues restarting it. That mismatch prevents a verified recovery and holds production delivery.
What
Add an opt-in observation that compares health requests and reports whether stored access rules match the host candidate, while keeping credentials and addresses private. This supplies evidence for the repair; sustained recovery remains tracked separately.
Part of #5421