Repository navigation
chore(kamaji): bump kamaji to 26.6.4-edge - #3013
Aleksei Sviridkin (lexfrei) wants to merge 1 commit into
Conversation
github-actions
Bot
added
area/uncategorized
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (7)
✅ Files skipped from review due to trivial changes (4)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughBumps the Kamaji system package: updates the image build version to ChangesKamaji Version Bump and CRD Schema Update
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
size/XS
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request upgrades the Kamaji control-plane manager to version 26.6.4-edge. The changes include updating the Dockerfile build argument, re-pinning container image digests in the values configuration, and re-vendoring the associated Helm charts to incorporate upstream networking and security enhancements while maintaining backward compatibility. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Kamaji builder image version in the Dockerfile to 26.6.4-edge, and updates the Kamaji image and migration image digests in values.yaml to sha256:30f19facd2820e3861d0ae29e2d3462db29b1464c6ba6524056e982a19657ec5. I have no feedback to provide as there are no review comments.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
myasnikovdaniil
left a comment
myasnikovdaniil
left a comment
There was a problem hiding this comment.
LGTM — approving. Reviewed in an isolated worktree + validated on a dev cluster against a live TenantControlPlane.
Version / build
DockerfileVERSION26.3.5-edge → 26.6.4-edge;-edgetracking is the package norm (Makefileupdatefilters for*-edge), so this is intentional, not an accidental pre-release pin.- Repinned digest
sha256:30f19fa…confirmed a real multi-arch manifest list (amd64 + arm64), distroless static nonroot, CGO off. CVE rationale checks out: #2885's list is 16 OS-package (Debian) advisories not present in distroless + 1 Gostdlibcleared by the golang:1.26 rebuild. fix-kubelet-config-compat.diffapplies cleanly against fetched 26.6.4-edge source (git apply --check✓); requiredfmt/blang/semverimports already exist upstream.
CRD additivity (the central risk) — verified backward-compatible
podCidr/serviceCidrretained (description gains a "Deprecated" note; field-levelisCIDRCEL unchanged).podCidrs/serviceCidrs/advertiseAddressare new and optional. The newcontainerSecurityContexts/konnectivitysecurityContextblocks account for most of the +1010; every addedrequired:is nested inside those new optional sub-objects, not at spec level. The one removed object-level CEL rule (dnsServiceIPs ⊆ serviceCidr) is a relaxation.- On a dev cluster: applied the new CRD
--server-side --dry-run=server→ accepted. Offline-validated an existingTenantControlPlaneCR (which uses the singularpodCidr/serviceCidr) against the new schema — strict superset, no field pruned,spec.requiredunchanged, no required tightening. Re-applied the live CR--dry-run=server→ clean. Existing tenant control planes stay valid.
I did not roll the operator against the live tenant (a concurrent coredns roll was in flight); the server-dry-run CRD validation + offline schema proof + verified image manifest are sufficient.
Nits (non-blocking): chart values.yaml adds a kamaji-etcd.certManager block but kamaji-etcd.deploy: false, so it's inert. Branch is ~2 commits behind main (kubevirt-instancetypes only, no kamaji overlap, merges clean) — a rebase is optional, not required.
Refreshes the kamaji control-plane manager onto current upstream. - images/kamaji/Dockerfile: ARG VERSION 26.3.5-edge -> 26.6.4-edge. The rebuild on golang:1.26 + distroless/static clears the Go stdlib advisory; the OS-package advisories from the scan apply to a debian-based image, not the distroless manager cozystack actually ships. - charts/: re-vendored from 26.6.4-edge. The TenantControlPlane CRD picks up the upstream dual-stack networking update -- new podCidrs / serviceCidrs array fields alongside the retained singular podCidr / serviceCidr, and the object-level CEL rule tying dnsServiceIPs to the singular serviceCidr replaced by per-field isCIDR validation -- plus an additive securityContext on the konnectivity-server container. These are backward-compatible: existing TenantControlPlanes keep validating (the singular fields stay accepted and the dropped rule only relaxes validation). The new certManager / selfSignedCertificates value blocks default to the chart's existing cert-manager + self-signed-issuer behaviour, so the webhook cert flow is unchanged. kamaji-etcd stays disabled. - values.yaml: re-pinned the image and the --migrate-image arg to the rebuilt multi-arch digest. The fix-kubelet-config-compat patch (k8s 1.35+ kubelet defaults) still applies cleanly on the new source. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
e124487 to
46b1967
Compare
There was a problem hiding this comment.
Code Review
This pull request updates the Kamaji package by bumping the builder version in the Dockerfile to 26.6.4-edge and updating the image tag and migration image digests in values.yaml. There are no review comments to evaluate, and I have no additional feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
Closing. This kamaji bump is both unnecessary for #2885 and harmful. Unnecessary: the #2885 CVE list was scanned against a Debian/Alpine image, but the kamaji image shipped here is distroless/static (trivy reports 0 OS-package vulnerabilities on the pinned digest), so 16 of the 17 CVEs are not present. The one real CVE is in the Go stdlib (go1.26.3 -> 1.26.4), which a plain rebuild on the current golang:1.26 closes with no version jump. Harmful: 26.6.4-edge vendors a k8s v1.36 kubeadm that dropped the kubeadm:cluster-admins Organization from the apiserver-kubelet-client certificate and moved that grant into a kubeadm:apiserver-kubelet-client -> system:kubelet-api-admin ClusterRoleBinding which kamaji never creates, so tenant control planes lose apiserver-to-kubelet authorization (kubectl logs/exec return Forbidden). Tracked upstream in clastix/kamaji#1171, fix in clastix/kamaji#1172. #2885 will instead be closed by rebuilding the current 26.3.5-edge. No version bump is needed. |
Aleksei Sviridkin (lexfrei)
added
area/kamaji
2 participants
What this PR does
Refreshes the kamaji control-plane manager onto current upstream (
26.3.5-edge→26.6.4-edge).ARG VERSION26.3.5-edge→26.6.4-edge. The rebuild ongolang:1.26+gcr.io/distroless/static:nonrootclears the Go stdlib advisory. The OS-package advisories from the scan (libpython3.13,libexpat,libgnutls30, krb5, sqlite, curl, libgcrypt, libcap2, nghttp2) apply to a Debian-based image, not the distroless manager cozystack actually ships.26.6.4-edge. TheTenantControlPlaneCRD picks up the upstream dual-stack networking update — newpodCidrs/serviceCidrsarray fields alongside the retained singularpodCidr/serviceCidr, and the object-level CEL rule tyingdnsServiceIPsto the singularserviceCidrreplaced by per-fieldisCIDRvalidation — plus an additivesecurityContexton the konnectivity-server container. These are backward-compatible: existingTenantControlPlanes keep validating (the singular fields stay accepted and the dropped rule only relaxes validation). The newcertManager/selfSignedCertificatesvalue blocks default to the chart's existing cert-manager + self-signed-issuer behaviour, so the webhook cert flow is unchanged.kamaji-etcdstays disabled.--migrate-imagearg to the rebuilt multi-arch digest (linux/amd64+linux/arm64).The
fix-kubelet-config-compatpatch (k8s 1.35+ kubelet defaults) still applies cleanly on the new source.Closes #2885
Release note
Summary by CodeRabbit
Release Notes
TenantControlPlanesecurity configuration with pod-level and per-component (API server, controller manager, scheduler) container security context options, plus Konnectivity add-on server security context support.podCidrs/serviceCidrs) while keeping deprecated single-CIDR fields for compatibility.networkProfile.advertiseAddress(including certificate SAN-related documentation).