Repository navigation
fix(etcd): remove destructive post-upgrade cert-regeneration hook - #2462
Conversation
The etcd chart shipped a `post-upgrade` Helm hook that `kubectl delete`d the
etcd TLS chain (`etcd-{ca,peer-ca,client,peer,server}-tls`) and then deleted
etcd pods on every chart upgrade, gated by a semver compare of an
`etcd-deployed-version` ConfigMap against `2.6.1`.
The hook was added as a one-shot migration for the chart `2.6.0 -> 2.6.1`
transition. Since commit f871fbd ("Remove versions_map logic") all chart
versions are stamped as `0.0.0+<git-hash>`, which per semver is always
`< 2.6.1`. The gate therefore always resolves to "update certs", firing the
destructive hook on every etcd upgrade. On clusters running Kamaji-managed
tenant control planes this wipes the etcd CA, cert-manager re-issues it, and
tenant kube-apiservers hit `x509: certificate signed by unknown authority`
against `etcd.<ns>.svc:2379` until each tenant DataStore is manually
re-reconciled.
Commit 47d81f7 ("Disabled private key rotation in CA certs") already fixed
the underlying `rotationPolicy: Always` issue the migration was papering
over, so the hook has no remaining use. Remove the hook Job, its RBAC, the
version ConfigMap it read, and add a helm-unittest suite under
`packages/extra/etcd/tests/` that guards against re-introducing the hook
or the version ConfigMap.
Assisted-By: Claude <[email protected]>
Signed-off-by: Myasnikov Daniil <[email protected]>
dosubot
Bot
added
the
size/XS
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request removes a legacy post-upgrade Helm hook from the etcd chart that was intended for a one-time migration but had become a recurring source of instability. Due to changes in how chart versions are stamped, the hook was triggering on every upgrade, causing unnecessary certificate regeneration and service disruption in environments like Kamaji. The change cleans up the associated infrastructure and adds a test to prevent future regressions. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
📝 WalkthroughWalkthroughThis PR removes the post-upgrade hook infrastructure (Job, RBAC resources, ServiceAccount) and the version-tracking ConfigMap from the etcd Helm chart. A new Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request removes the post-upgrade certificate regeneration hook and the version tracking ConfigMap from the etcd package, along with their associated RBAC and ServiceAccount resources. A new test suite is introduced to ensure these components are no longer rendered. A critical issue was identified in the new test file: it references the deleted template files, which will cause helm unittest to fail. It is recommended to remove the explicit template list to fix the tests and improve regression coverage.
| templates: | ||
| - templates/check-release-name.yaml | ||
| - templates/dashboard-resourcemap.yaml | ||
| - templates/datastore.yaml | ||
| - templates/etcd-defrag.yaml | ||
| - templates/hook/job.yaml | ||
| - templates/podscrape.yaml | ||
| - templates/prometheus-rules.yaml | ||
| - templates/version.yaml | ||
|
|
||
| tests: |
There was a problem hiding this comment.
The templates list includes templates/hook/job.yaml and templates/version.yaml, which are being deleted in this pull request. Including non-existent files in the templates list will cause helm unittest to fail with a 'template not found' error, preventing the tests from running.
To properly implement a regression guard that ensures these resources are not present anywhere in the chart, it is better to remove the templates block entirely. When omitted, helm-unittest renders all templates in the chart, allowing the assertions to catch these resources if they are ever re-added to any file in the future.
tests:There was a problem hiding this comment.
Thanks for the flag, but this is tolerated by helm-unittest in practice — paths listed under a suite-level templates: that don't exist at render time don't error (verified on the installed v1.0.3); make unit-tests passes locally and the Build check is green on this PR.
I also tried the "omit templates:" alternative: with documentSelector.skipEmptyTemplates: true, omitting the list makes the suite pass even when templates/hook/job.yaml is reintroduced, which silently defeats the regression guard. Listing the deleted paths explicitly is the only variant I've found where re-adding the hook actually fails hasDocuments: count: 0.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
packages/extra/etcd/Makefile (1)
8-10: Declaretestas.PHONY.
testis not a file target; without.PHONY, a straytestfile/dir in the package would silently skip execution. Matches the static-analysis hint.♻️ Proposed fix
+.PHONY: test test: helm unittest .🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/extra/etcd/Makefile` around lines 8 - 10, The Makefile declares a non-file target named "test" which should be marked phony to avoid being skipped if a file/dir named test exists; update the Makefile to add a .PHONY declaration (e.g., add a line declaring ".PHONY: test") so the test target that runs "helm unittest ." is always executed even if a file named test exists.packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml (1)
17-34: Consider asserting bykindas well, to avoid false negatives on rename.
documentSelectormatches only onmetadata.name. If a future reintroduction of the hook uses a different name (e.g.etcd-cert-regen) the guard won't trigger. Since the PR's intent is "no destructive post-upgrade hook ever again," consider also asserting there are no documents withmetadata.annotations["helm.sh/hook"]containingpost-upgradethat also delete secrets/pods — or at minimum, assert no Job carries ahelm.sh/hook: post-upgradeannotation in this chart.- it: renders no post-upgrade hook Job asserts: - notContainsDocument: kind: Job apiVersion: batch/v1 any: true # plus a documentSelector on metadata.annotations["helm.sh/hook"]Optional hardening; not blocking.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml` around lines 17 - 34, The current tests only check metadata.name (tests "renders no Job named etcd-hook" and "renders no ConfigMap named etcd-deployed-version") which can miss renamed hooks; update the test cases to also assert on kind and helm hook annotations by replacing or adding selectors that include kind: Job and a metadata.annotations["helm.sh/hook"] matching post-upgrade (or use notContainsDocument with kind: Job and an annotation filter for helm.sh/hook: post-upgrade) so the suite rejects any Job with a post-upgrade hook regardless of its name.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml`:
- Around line 7-15: The test's templates list still references deleted files
(templates/hook/job.yaml and templates/version.yaml) causing helm-unittest
"template file not found" errors; open
packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml and either remove the
entire templates: block so the chart is rendered and documentSelector/assertions
drive the test, or delete only the two entries (templates/hook/job.yaml and
templates/version.yaml) from the templates: list so it lists only existing
templates; ensure the file no longer references the deleted templates so the
suite can load.
---
Nitpick comments:
In `@packages/extra/etcd/Makefile`:
- Around line 8-10: The Makefile declares a non-file target named "test" which
should be marked phony to avoid being skipped if a file/dir named test exists;
update the Makefile to add a .PHONY declaration (e.g., add a line declaring
".PHONY: test") so the test target that runs "helm unittest ." is always
executed even if a file named test exists.
In `@packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml`:
- Around line 17-34: The current tests only check metadata.name (tests "renders
no Job named etcd-hook" and "renders no ConfigMap named etcd-deployed-version")
which can miss renamed hooks; update the test cases to also assert on kind and
helm hook annotations by replacing or adding selectors that include kind: Job
and a metadata.annotations["helm.sh/hook"] matching post-upgrade (or use
notContainsDocument with kind: Job and an annotation filter for helm.sh/hook:
post-upgrade) so the suite rejects any Job with a post-upgrade hook regardless
of its name.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: e0066424-7de5-4bed-9db8-7274cbb5d5ec
📒 Files selected for processing (7)
packages/extra/etcd/Makefilepackages/extra/etcd/templates/hook/job.yamlpackages/extra/etcd/templates/hook/role.yamlpackages/extra/etcd/templates/hook/rolebinding.yamlpackages/extra/etcd/templates/hook/serviceaccount.yamlpackages/extra/etcd/templates/version.yamlpackages/extra/etcd/tests/no-post-upgrade-hook_test.yaml
💤 Files with no reviewable changes (5)
- packages/extra/etcd/templates/version.yaml
- packages/extra/etcd/templates/hook/serviceaccount.yaml
- packages/extra/etcd/templates/hook/rolebinding.yaml
- packages/extra/etcd/templates/hook/role.yaml
- packages/extra/etcd/templates/hook/job.yaml
| templates: | ||
| - templates/check-release-name.yaml | ||
| - templates/dashboard-resourcemap.yaml | ||
| - templates/datastore.yaml | ||
| - templates/etcd-defrag.yaml | ||
| - templates/hook/job.yaml | ||
| - templates/podscrape.yaml | ||
| - templates/prometheus-rules.yaml | ||
| - templates/version.yaml |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Confirm the referenced template files no longer exist after this PR.
fd -t f . packages/extra/etcd/templates | sort
echo '---'
for f in templates/hook/job.yaml templates/version.yaml templates/hook/role.yaml templates/hook/rolebinding.yaml templates/hook/serviceaccount.yaml; do
test -e "packages/extra/etcd/$f" && echo "EXISTS: $f" || echo "MISSING: $f"
doneRepository: cozystack/cozystack
Length of output: 637
🌐 Web query:
helm-unittest behavior when a path listed under templates: does not exist in the chart — does it error or silently skip?
💡 Result:
helm-unittest errors when a path listed under templates: does not exist in the chart. It fails to find the specified template file and reports an error like "template 'path/to/nonexistent.yaml' not exists or not selected in test suite". This behavior is consistent across multiple GitHub issues where tests fail if listed templates cannot be located or resolved during rendering (e.g., due to path translation bugs or missing includes). Globs like templates/*.yaml match existing files only, but explicit non-existent paths cause immediate failure before rendering. Official docs describe templates as the scope of files to render, implying listed paths must resolve to actual files; no mention of silent skipping for non-existent paths.
Citations:
- 1: https://github.com/helm-unittest/helm-unittest/blob/main/DOCUMENT.md
- 2: https://github.com/helm-unittest/helm-unittest/blob/main/README.md
- 3: Failure with v0.3.5 that it cannot find template file helm-unittest/helm-unittest#219
- 4: $.Template.BasePath can't be handled properly helm-unittest/helm-unittest#293
- 5: Template path is translated differently helm-unittest/helm-unittest#300
- 6: print $.Template.BasePath "/configmap.yaml" fails in unittests helm-unittest/helm-unittest#162
- 7: Cannot find subchart template files if filename includes chart name helm-unittest/helm-unittest#238
- 8: question on test for "all" template files helm-unittest/helm-unittest#320
- 9: https://github.com/helm-unittest/helm-unittest/tree/main/pkg/unittest
- 10: Empty documents are considered failed templates helm-unittest/helm-unittest#191
🏁 Script executed:
cat -n packages/extra/etcd/tests/no-post-upgrade-hook_test.yamlRepository: cozystack/cozystack
Length of output: 1130
The templates: list references deleted files — the test suite fails to load.
This PR deletes templates/hook/job.yaml and templates/version.yaml. The test explicitly lists both files under templates:, and helm-unittest errors with "template file not found" when trying to resolve missing paths. The suite cannot run while these references remain.
The inverted regression guard means: the test only executes if someone reintroduces the deleted templates, at which point the hasDocuments: count: 0 assertions will trigger — which is the right alarm but signals the opposite of what the test is meant to guard against.
To fix, either:
- Omit
templates:entirely — render the whole chart and rely ondocumentSelectorassertions. Simplest and most future-proof. - List only currently-existing templates — remove lines 12 and 15.
♻️ Suggested simplification
-templates:
- - templates/check-release-name.yaml
- - templates/dashboard-resourcemap.yaml
- - templates/datastore.yaml
- - templates/etcd-defrag.yaml
- - templates/hook/job.yaml
- - templates/podscrape.yaml
- - templates/prometheus-rules.yaml
- - templates/version.yaml
-
tests:
- it: renders no Job named etcd-hook📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| templates: | |
| - templates/check-release-name.yaml | |
| - templates/dashboard-resourcemap.yaml | |
| - templates/datastore.yaml | |
| - templates/etcd-defrag.yaml | |
| - templates/hook/job.yaml | |
| - templates/podscrape.yaml | |
| - templates/prometheus-rules.yaml | |
| - templates/version.yaml | |
| tests: | |
| - it: renders no Job named etcd-hook |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml` around lines 7 -
15, The test's templates list still references deleted files
(templates/hook/job.yaml and templates/version.yaml) causing helm-unittest
"template file not found" errors; open
packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml and either remove the
entire templates: block so the chart is rendered and documentSelector/assertions
drive the test, or delete only the two entries (templates/hook/job.yaml and
templates/version.yaml) from the templates: list so it lists only existing
templates; ensure the file no longer references the deleted templates so the
suite can load.
There was a problem hiding this comment.
Verified empirically — helm unittest . on this branch passes 2/2 locally and Build is green in CI, so the "template not found" error doesn't trigger for these entries (helm-unittest only errors when a specific test's template: can't be resolved, not when a suite-level templates: entry is absent).
I tested the "omit templates:" variant you suggested: with documentSelector.skipEmptyTemplates: true, omitting the list makes the suite pass even after re-adding templates/hook/job.yaml, which breaks the regression guard. Listing the deleted paths explicitly is what makes the hasDocuments: count: 0 assertion actually fail on reintroduction, which I confirmed by temporarily restoring the file during development.
There was a problem hiding this comment.
@myasnikovdaniil, thanks for the detailed empirical verification — you're right and my analysis was wrong. The distinction between suite-level templates: (silently skipped when absent) and test-level template: (errors when absent) is exactly what makes this pattern work. The intentional design — listing the deleted paths so that reintroducing them causes the hasDocuments: count: 0 assertion to fire — is a clever regression guard. I'll retract my concern.
✏️ Learnings added
Learnt from: myasnikovdaniil
Repo: cozystack/cozystack PR: 2462
File: packages/extra/etcd/tests/no-post-upgrade-hook_test.yaml:7-15
Timestamp: 2026-04-23T09:30:33.502Z
Learning: In the cozystack/cozystack repository (and in helm-unittest generally), suite-level `templates:` entries that reference non-existent files are silently skipped — helm-unittest does NOT error at the suite level for missing paths. It only errors when a specific *test-level* `template:` field cannot be resolved. This means deliberately listing deleted template paths (e.g., `templates/hook/job.yaml`) in the suite `templates:` block is a valid regression-guard technique: the test passes while those files are absent, but if they are reintroduced, they are rendered and `hasDocuments: count: 0` assertions will fail. Omitting the `templates:` block entirely breaks this guard when `documentSelector.skipEmptyTemplates: true` is in effect.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
🧠 Learnings used
Learnt from: lllamnyp
Repo: cozystack/cozystack PR: 2330
File: packages/system/cozystack-scheduler/tests/configmap_test.yaml:3-4
Timestamp: 2026-04-06T11:48:16.142Z
Learning: In the cozystack/cozystack Helm unittest suite, `templates:` paths that reference subcharts must use the subchart alias from the parent chart’s `Chart.yaml` (`dependencies[].alias`), not the subchart’s actual directory name under `charts/`. Therefore, when writing or reviewing unittest `templates:` references, resolve subchart paths like `charts/<alias>/templates/...` and do not flag them as incorrect even if the directory is named differently (e.g., `charts/cozystack-scheduler/` aliased as `cozy-cozystack-scheduler` should be referenced as `charts/cozy-cozystack-scheduler/templates/...`).
Learnt from: lexfrei
Repo: cozystack/cozystack PR: 2010
File: packages/core/installer/values.yaml:10-26
Timestamp: 2026-02-10T10:44:34.963Z
Learning: In the cozystack/cozystack repository, the Makefile uses `helm template -s` to selectively render templates for different modes (talos, generic, hosted). Because Helm evaluates all templates regardless of `-s` filtering, using `required` checks in mode-specific templates (e.g., generic-mode templates) would break the build for other modes. Therefore, avoid suggesting `required` validation for mode-specific values in Helm templates in this repository.
Learnt from: mattia-eleuteri
Repo: cozystack/cozystack PR: 2095
File: packages/apps/kubernetes/templates/helmreleases/csi.yaml:30-42
Timestamp: 2026-02-24T18:01:11.514Z
Learning: In the cozystack/cozystack repository, Helm templates under `packages/apps/kubernetes/templates/` are only rendered by FluxCD against live clusters (not via `helm template`). The established convention is to directly access `(lookup "..." "" "" "").items` without nil guards. This pattern is used consistently across multiple templates (e.g., linstor-scheduler/_helpers.tpl, cluster.yaml, driver-config.yaml, helmreleases/csi.yaml), so adding defensive checks would be inconsistent with the codebase style.
<!-- [/add_learning]
Learnt from: mattia-eleuteri
Repo: cozystack/cozystack PR: 2095
File: packages/apps/kubernetes/templates/csi/driver-config.yaml:6-17
Timestamp: 2026-02-24T18:01:15.015Z
Learning: In the cozystack/cozystack repository, Helm templates are rendered exclusively by FluxCD's helm-controller against a live cluster, never via standalone `helm template`. Therefore, the `(lookup ...).items` pattern is safe and used consistently throughout the codebase (e.g., in packages/apps/kubernetes/templates/cluster.yaml and packages/system/linstor-scheduler/). Adding `default dict` guards to protect against nil lookup results is unnecessary and would be inconsistent with project conventions.
Learnt from: sircthulhu
Repo: cozystack/cozystack PR: 2247
File: packages/apps/postgres/templates/init-script.yaml:70-82
Timestamp: 2026-03-25T07:20:03.991Z
Learning: In the cozystack/cozystack repository, database and role name identifiers in `packages/apps/postgres/templates/init-script.yaml` are sourced from Helm values map keys. Helm values keys cannot contain spaces or special characters, so shell word-splitting on these identifiers (e.g. iterating `for db in $MANAGED_DBS`) is safe in practice. The existing user deletion code in the same file uses the identical pattern. Do not flag this as a critical bug; at most note it as a low-priority hardening opportunity for a follow-up.
Learnt from: mattia-eleuteri
Repo: cozystack/cozystack PR: 2199
File: packages/apps/tenant/templates/networkpolicy.yaml:222-225
Timestamp: 2026-03-10T16:00:27.642Z
Learning: In this repository, Cilium hostFirewall is enabled, so pods using hostNetwork (e.g., virt-handler) retain their Cilium endpoint identity and are matchable by label-based toEndpoints/matchLabels in CiliumNetworkPolicy. When reviewing YAML network policy manifests (e.g., packages/apps/**/templates/networkpolicy.yaml and similar), do not flag toEndpoints rules that target hostNetwork: true pods as ineffective. Ensure that policy selectors use labels that correctly target these hostNetwork pods and validate that policies reflect intended access while leveraging the retained identity for precise matching.
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
Root cause analysis is solid and well-documented. The version gate has been trivially satisfied on every upgrade since f871fbd (chart versions became 0.0.0+, always < 2.6.1 per semver), while the underlying rotationPolicy: Always issue was already fixed independently in 47d81f7. Removing the hook is the correct call — it was a one-shot migration that became a permanent footgun.
One nit left open from bot review: the test Makefile target is missing a .PHONY declaration.
| cozyvalues-gen -v values.yaml -s values.schema.json -r README.md | ||
| ../../../hack/update-crd.sh | ||
|
|
||
| test: |
There was a problem hiding this comment.
Suggestion (non-blocking): test should be declared .PHONY. The CI runner (hack/helm-unit-tests.sh) detects the target with make -n test before invoking it. Without .PHONY, a file or directory named test anywhere in this package would make both calls exit 0 silently and helm unittest . would never run. Matches the pattern in packages/apps/mongodb/Makefile.
+.PHONY: test
test:
helm unittest .
myasnikovdaniil
added
kind/backport
|
Successfully created backport PR for |
|
Successfully created backport PR for |
The auto-generated changelog only listed #2459/#2467 (velero-configmap Role move). Five additional PRs were backported and merged into release-1.3 between then and the v1.3.1 tag (2026-04-28): - #2471/#2524 - fix(api): IDOR in TenantNamespace Get/Watch - #2496/#2505 - feat(linstor): linstor-csi v1.10.6 (Protocol-C dual-attach) - #2462/#2511 - fix(etcd): remove destructive post-upgrade hook - #2421/#2491 - fix(kamaji): memory limits + startup probe - #2498/#2518 - build(linstor): wire linstor-gui into root build target Update the release date to match the actual tag (2026-04-28), rewrite the intro paragraph, and add @kvaps to contributors. Signed-off-by: Myasnikov Daniil <[email protected]>
2 participants
What this PR does
Removes the
post-upgradeHelm hook inpackages/extra/etcdthat waskubectl deleteing the etcd TLS chain (etcd-ca-tls,etcd-peer-ca-tls,etcd-client-tls,etcd-peer-tls,etcd-server-tls) and then deletingetcd pods on every chart upgrade.
The hook was gated by a semver compare of a stored
etcd-deployed-versionConfigMap against
2.6.1. That gate was written when chart versions lookedlike
2.6.0,2.6.1, etc. Since commitf871fbdb("Remove versions_maplogic") all chart versions are stamped as
0.0.0+<git-hash>, which persemver is always
< 2.6.1, so the gate always evaluates to "regeneratecerts" and the destructive hook fires on every upgrade.
On clusters running Kamaji-managed tenant control planes the consequence is
severe: wiping the etcd CA triggers cert-manager to re-issue it with a
brand-new CA, but Kamaji's
datastore-certificateSecrets still carry theold CA bundle mounted into tenant
kube-apiserverpods. Those apiservershit
x509: certificate signed by unknown authorityagainstetcd.<ns>.svc:2379and go into CrashLoopBackOff until each tenantDataStoreis individually force-reconciled and the Deployments rolled.Commit
47d81f70("Disabled private key rotation in CA certs") alreadyfixed the underlying
rotationPolicy: Alwaysissue the hook was written topaper over in March 2025, so the migration has no remaining use.
Changes:
templates/hook/{job,role,rolebinding,serviceaccount}.yamltemplates/version.yaml(only the hook readetcd-deployed-version)tests/no-post-upgrade-hook_test.yamlas a regression guard — iftemplates/hook/job.yamlortemplates/version.yamlis ever brought back,make unit-testsfailsRelease note
Summary by CodeRabbit
Tests
Chores
testtarget to Makefile for running Helm chart unit tests.