Repository navigation
fix(kyverno): make the 1.20 cap check account for sources it cannot read - #5858
Merged
Merged
Conversation
The cap check only reads this repository. Its removal message now asks for a check of every tenant source before the cap goes. Flux Kustomizations that a root renders are followed when they read the platform's own source, so a Kyverno release behind one is judged like a root's. Those that read another source, such as a tenant repository, are counted and reported as unexamined on every pass. Fixes #5017 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
@codex review 🤖 Generated with Claude Code |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Contributor
Author
|
Tried as a user, at
🤖 Generated with Claude Code |
Contributor
Author
Status: held as a draft. The Codex review at the current head is clean. This change can't merge yet for two reasons outside it:
Next steps: once #5853 merges, update this branch from 🤖 Generated with Claude Code |
Contributor
✅
|
Contributor
Author
Blocker: none Cleared 2026-11-04: platform#5853 merged 2026-11-04T08:01Z; the organization Go workflow passes on main again and pull requests can pass their required checks (platform#5852 status 2026-11-04) Previous record (historical): |
…nant-sources-5017 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
@codex review 🤖 Generated with Claude Code |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
devantler
commented
Nov 4, 2026
devantler
left a comment
devantler
left a comment
Contributor
Author
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer (interactive Claude Code session)
Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)
Reviewed commit: fbfc336
- CodeRabbit: rate-limited for this organisation since 2026-11-03 09:04Z (batch lane check); not requested.
- Codex: answered the 2026-11-04 request for this head with its code-review usage-limit message instead of a review.
- Cursor Bugbot: reached its usage limit at 2026-11-04 00:28Z; no review since.
Scope: the whole diff against main at this head, including the main merge. The nested walk only follows a Flux Kustomization that reads one of the sources the cluster roots read, applies the same spec.patches / spec.components refusal to it, de-duplicates roots so a cycle terminates, and counts the rest as unexamined on the PASS line instead of silently passing them. The removal message now asks for the tenant-source check before the cap goes. At this head shellcheck passes, the regression passes its 31 cases, and the check passes on the committed tree. Not blocking: the unexamined count is per rendered occurrence rather than per unique Kustomization; it is a report, not a gate.
Verdict: no P0/P1 findings
🤖 Generated with Claude Code
Contributor
Author
Tried as a user, at
🤖 Generated with Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Kyverno 1.20 cap check keeps Kyverno on the 1.19 line while any
kyverno.iopolicy remains, because 1.20 removes those APIs. It can only see this repository. A tenant that ships its ownkyverno.iopolicy, or a Kyverno release reached through a nested Flux Kustomization, was invisible to it. So at removal time the check could ask for the cap to be lifted while something still depended on it. Nothing bypasses the cap today; the risk is when it is removed.What
kyverno.ioresource remains here, the failure now says to check every tenant source the platform deploys before removing the cap.spec.patchesandspec.components. One that reads another source cannot be rendered here. Each run counts these and reports them on its PASS line. Today that is the 7 tenant Kustomizations plus 2 in the tenant templates. The tree as committed still passes.Validation
bash scripts/tests/test-kyverno-1-20-cap.shpasses 31 cases. New cases:spec.patchesis refused;main's version of the check, the updated test fails at its first new assertion.bash scripts/check-kyverno-1-20-cap.shon the committed tree:PASS: 27 kyverno.io resources remain in 958 files; Kyverno is held below 1.20 (chart 3.9.2 <3.10.0 in 2 HelmReleases across 10 Flux roots, CLI 1.19.2 <1.20.0); 9 Flux Kustomizations read other sources and were not examined.shellcheckpasses for both scripts.This is a CI guard with no runtime surface in the cluster. Running the check is the user path, shown above.
Fixes #5017
🤖 Generated with Claude Code