You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(talos): enable the pod certificate and cluster trust bundle features - #5896
The kagent Agentic Engineer lane runs on kagent 1.0, whose sandbox runtime (Substrate) gives every workload its identity as a pod certificate. Kubernetes 1.36 ships pod certificates and cluster trust bundles switched off, so Substrate cannot install on the cluster today.
What
Switches on the beta pod certificate and cluster trust bundle features in the control plane and on every node. The deploy rolls the control-plane components one at a time; nothing else changes until Substrate is installed in a follow-up PR.
Substrate, the sandbox runtime under kagent 1.0's Claude Code harness,
issues workload identities as Pod Certificates and publishes its CAs as
ClusterTrustBundles. Kubernetes 1.36 ships both APIs as beta and off by
default, so serve certificates.k8s.io/v1beta1 and enable the
ClusterTrustBundle, ClusterTrustBundleProjection and PodCertificateRequest
gates on the API server, controller manager, scheduler and kubelet, as
Substrate's reference cluster does. The kubelet readback fixture now
declares the same gates.
Part of #5892
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
No actionable comments were generated in the recent review.
Walkthrough
Both Talos cluster configuration patches enable ClusterTrustBundle, ClusterTrustBundleProjection, and PodCertificateRequest for the API server, controller manager, scheduler, and kubelet. They also enable certificates.k8s.io/v1beta1 through API server runtime configuration. The healthy kubelet configuration fixture now includes all three feature gates set to true.
The certificate configuration is ready to merge after normal checks; no blocking issue was identified.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title describes the pod certificate and cluster trust bundle features enabled by the changes.
Description check
The description relates to the feature gates enabled in the Talos cluster configurations.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Reviewing files that changed from the base of the PR and between ee5911d and 2af897a.
Files selected for processing: 3
scripts/tests/test-kubelet-config-readback.sh
talos-local/cluster/enable-pod-certificates.yaml
talos/cluster/enable-pod-certificates.yaml
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Recent review details
Additional context used
Code guidelines: 1
AGENTS.md — auto-discovered
Path-based instructions: 1
Source excerpt: **Talos machine-config patches** (`talos/`, `talos-local/`) follow the same spirit: **one YAML document per file** and intent-describing `‹verb›-‹purpose›.yaml` names (e.g.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The kagent Agentic Engineer lane runs on kagent 1.0, whose sandbox runtime (Substrate) gives every workload its identity as a pod certificate. Kubernetes 1.36 ships pod certificates and cluster trust bundles switched off, so Substrate cannot install on the cluster today.
What
Switches on the beta pod certificate and cluster trust bundle features in the control plane and on every node. The deploy rolls the control-plane components one at a time; nothing else changes until Substrate is installed in a follow-up PR.
🤖 Generated with Claude Code
Part of #5892