fix(opensearch-operator): replace deprecated kube-rbac-proxy image by myasnikovdaniil · Pull Request #2689 · cozystack/cozystack

myasnikovdaniil · 2026-05-20T05:15:22Z

What this PR does

Replaces the broken gcr.io/kubebuilder/kube-rbac-proxy:v0.15.0 image
in the opensearch-operator chart with quay.io/brancz/kube-rbac-proxy:v0.15.0
(the same image already used elsewhere in cozystack, e.g. etcd-operator).
The kubebuilder GCR registry was sunset and the image no longer pulls.

The fix is a local patch in patches/fix-kube-rbac-proxy-image.patch,
wired into the update target so it survives future chart re-pulls.

Upstream chart 2.8.1+ removes kubeRbacProxy entirely, but it also bumps
CRDs to controller-gen v0.19.0 with significant schema changes — too much
surface area for a focused image fix.

Follows the precedent set in #2181 for etcd-operator.

Release note

fix(opensearch-operator): replace deprecated `gcr.io/kubebuilder/kube-rbac-proxy` image with `quay.io/brancz/kube-rbac-proxy`

Summary by CodeRabbit

Chores
- Updated the container image repository used by the OpenSearch operator's kube-rbac-proxy component to the current upstream source. This ensures continued availability of security proxy updates and avoids service disruption from deprecated image locations.

gemini-code-assist · 2026-05-20T05:15:33Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves a critical issue where the opensearch-operator chart fails to deploy due to the removal of the kube-rbac-proxy image from the Google Container Registry. By switching to a stable mirror and automating the patch process within the build pipeline, the operator remains functional without the need for a disruptive upstream chart upgrade.

Highlights

Image replacement: Replaced the deprecated gcr.io/kubebuilder/kube-rbac-proxy image with quay.io/brancz/kube-rbac-proxy to resolve pull failures caused by the GCR sunset.
Persistence of fix: Integrated a patch application step into the Makefile to ensure the image replacement persists even after future chart re-pulls.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

Ignored by pattern: **/*.patch (1)
- packages/system/opensearch-operator/patches/fix-kube-rbac-proxy-image.patch
Ignored by pattern: **/charts/** (1)
- packages/system/opensearch-operator/charts/opensearch-operator/values.yaml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-05-20T05:15:38Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8219dadc-eaed-472c-a180-1cedbf20158f

📥 Commits

Reviewing files that changed from the base of the PR and between e50bba1 and e543724.

📒 Files selected for processing (1)

packages/system/opensearch-operator/values.yaml

✅ Files skipped from review due to trivial changes (1)

packages/system/opensearch-operator/values.yaml

📝 Walkthrough

Walkthrough

The opensearch-operator Helm values update replaces the kube-rbac-proxy image repository with the upstream quay.io/brancz/kube-rbac-proxy, and adjusts the related comment about the deprecated GCR image.

Changes

kube-rbac-proxy image registry update

Layer / File(s)	Summary
Update kube-rbac-proxy image registry in Helm values `packages/system/opensearch-operator/values.yaml`	Change the kube-rbac-proxy image repository from `gcr.io/kubebuilder/kube-rbac-proxy` to `quay.io/brancz/kube-rbac-proxy` in the opensearch-operator Helm values, with an updated comment referencing the deprecated GCR image.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested labels

area/platform

Suggested reviewers

lexfrei
androndo
sircthulhu
kvaps
lllamnyp

Poem

🐰 A tiny change, a tidy swap,
Notes updated, old links stop,
Quay now holds the proxy's name,
Values point without a blame.
Hop, commit, and off I hop!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title directly describes the main change: replacing a deprecated kube-rbac-proxy image in the opensearch-operator chart, which matches the primary objective of the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/opensearch-operator-rbac-proxy-image

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request modifies the opensearch-operator Makefile to apply a patch for the kube-rbac-proxy image during the update process. Feedback was provided noting that configuration-level changes, such as image overrides, should be implemented via the package's values.yaml file rather than through a patch in the Makefile, as per the repository style guide.

gemini-code-assist · 2026-05-20T05:16:31Z

 	helm repo add opensearch-operator https://opensearch-project.github.io/opensearch-k8s-operator/
 	helm repo update opensearch-operator
 	helm pull opensearch-operator/opensearch-operator --version 2.8.0 --untar --untardir charts
+	patch --no-backup-if-mismatch -p4 < patches/fix-kube-rbac-proxy-image.patch


According to the repository style guide (line 20), configuration-level changes should be implemented as overrides in the package root values.yaml rather than using patches. Since the kube-rbac-proxy image repository is a standard configurable value in the upstream chart, please move this override to packages/system/opensearch-operator/values.yaml and remove the patch logic from the Makefile.

Example for values.yaml:

opensearch-operator: kubeRbacProxy: image: repository: "quay.io/brancz/kube-rbac-proxy"

References

For configuration-level changes: suggest overrides in the package root values.yaml. ^(link)

Agreed — moved the override to packages/system/opensearch-operator/values.yaml under kubeRbacProxy.image.repository and reverted the patch plus the Makefile change, matching the convention in docs/agents/overview.md ("Override configuration in root values.yaml") and the pattern used by sibling packages like kamaji. Fixed in e50bba10.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/system/opensearch-operator/values.yaml`:
- Around line 5-8: The kubeRbacProxy image is not pinned and defaults to latest;
update the kubeRbacProxy -> image block by adding an explicit tag field (e.g.,
tag: "v0.15.0") alongside the existing repository to ensure a stable,
reproducible image; modify the image specification for kubeRbacProxy (look for
the kubeRbacProxy.image.repository entry) to include the tag attribute.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c0294545-d381-4863-a097-8c9cca3bf0e6

📥 Commits

Reviewing files that changed from the base of the PR and between aa8d2d3 and e50bba1.

📒 Files selected for processing (1)

packages/system/opensearch-operator/values.yaml

coderabbitai · 2026-05-20T05:28:06Z

+  kubeRbacProxy:
+    image:
+      # gcr.io/kubebuilder/kube-rbac-proxy was sunset; use the original upstream
+      repository: "quay.io/brancz/kube-rbac-proxy"


⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Description: Verify kubeRbacProxy image configuration and accessibility # Check if tag is specified in values.yaml echo "=== Checking kubeRbacProxy configuration in values.yaml ===" rg -A 5 'kubeRbacProxy:' packages/system/opensearch-operator/values.yaml # Check for consistency with other operators (e.g., etcd-operator mentioned in PR) echo -e "\n=== Checking kube-rbac-proxy usage in other operators ===" rg -n 'kube-rbac-proxy' packages/system/*/values.yaml # Verify the image exists and is accessible on quay.io echo -e "\n=== Verifying image exists on quay.io ===" curl -fsSL "https://quay.io/api/v1/repository/brancz/kube-rbac-proxy/tag/?specificTag=v0.15.0" | jq -r '.tags[]? | select(.name=="v0.15.0") | "✓ Tag v0.15.0 exists"'

Repository: cozystack/cozystack

Length of output: 638

Pin the kube-rbac-proxy image tag explicitly for production stability.

The current configuration uses the image repository without specifying a tag, which defaults to latest. Add tag: "v0.15.0" to the image specification:

Expected configuration

kubeRbacProxy: image: # gcr.io/kubebuilder/kube-rbac-proxy was sunset; use the original upstream repository: "quay.io/brancz/kube-rbac-proxy" tag: "v0.15.0"

The v0.15.0 tag is accessible on quay.io and aligns with the version referenced in the PR description.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/system/opensearch-operator/values.yaml` around lines 5 - 8, The kubeRbacProxy image is not pinned and defaults to latest; update the kubeRbacProxy -> image block by adding an explicit tag field (e.g., tag: "v0.15.0") alongside the existing repository to ensure a stable, reproducible image; modify the image specification for kubeRbacProxy (look for the kubeRbacProxy.image.repository entry) to include the tag attribute.

The gcr.io/kubebuilder/kube-rbac-proxy image is no longer available since GCR was deprecated. Replace it with quay.io/brancz/kube-rbac-proxy from the original upstream author. Applied as a local patch in patches/ because upstream chart 2.8.1+ drops kubeRbacProxy entirely but also bumps CRDs to controller-gen v0.19.0 with significant schema changes — out of scope for this fix. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

Move the kube-rbac-proxy image override from a patch + vendored-chart edit to a values.yaml override under kubeRbacProxy.image.repository. This matches the project convention documented in docs/agents/overview.md ("Override configuration in root values.yaml") and the pattern used by sibling packages such as kamaji. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

github-actions · 2026-05-20T14:01:51Z

Successfully created backport PR for release-1.4:

[Backport release-1.4] fix(opensearch-operator): replace deprecated kube-rbac-proxy image #2695

github-actions · 2026-05-20T14:01:57Z

Successfully created backport PR for release-1.3:

[Backport release-1.3] fix(opensearch-operator): replace deprecated kube-rbac-proxy image #2696

…ube-rbac-proxy image (#2696) # Description Backport of #2689 to `release-1.3`.

…ube-rbac-proxy image (#2695) # Description Backport of #2689 to `release-1.4`.

myasnikovdaniil requested review from IvanHunters, Andrey Kolkov (androndo), Andrei Kvapil (kvaps), Aleksei Sviridkin (lexfrei), Timofei Larkin (lllamnyp) and Kirill Ilin (sircthulhu) as code owners May 20, 2026 05:15

github-actions Bot added size/S This PR changes 10-29 lines, ignoring generated files area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review kind/bug Categorizes issue or PR as related to a bug labels May 20, 2026

gemini-code-assist Bot reviewed May 20, 2026

View reviewed changes

github-actions Bot added size/XS This PR changes 0-9 lines, ignoring generated files and removed size/S This PR changes 10-29 lines, ignoring generated files labels May 20, 2026

coderabbitai Bot reviewed May 20, 2026

View reviewed changes

IvanHunters approved these changes May 20, 2026

View reviewed changes

myasnikovdaniil added 2 commits May 20, 2026 15:45

myasnikovdaniil force-pushed the fix/opensearch-operator-rbac-proxy-image branch from e50bba1 to e543724 Compare May 20, 2026 10:45

myasnikovdaniil added backport Should change be backported on previous release backport-previous Backport target — previous release line labels May 20, 2026

myasnikovdaniil merged commit e03b9f6 into main May 20, 2026
17 of 18 checks passed

myasnikovdaniil deleted the fix/opensearch-operator-rbac-proxy-image branch May 20, 2026 14:00

github-actions Bot mentioned this pull request May 20, 2026

[Backport release-1.4] fix(opensearch-operator): replace deprecated kube-rbac-proxy image #2695

Merged

github-actions Bot mentioned this pull request May 20, 2026

[Backport release-1.3] fix(opensearch-operator): replace deprecated kube-rbac-proxy image #2696

Merged

myasnikovdaniil added a commit that referenced this pull request May 20, 2026

[Backport release-1.3] fix(opensearch-operator): replace deprecated k…

9093e29

…ube-rbac-proxy image (#2696) # Description Backport of #2689 to `release-1.3`.

myasnikovdaniil added a commit that referenced this pull request May 20, 2026

[Backport release-1.4] fix(opensearch-operator): replace deprecated k…

aa06369

…ube-rbac-proxy image (#2695) # Description Backport of #2689 to `release-1.4`.

myasnikovdaniil mentioned this pull request May 25, 2026

ci: consolidate CI fixes (#2602 flux 2.8 + #2601 seaweedfs-db + #2612 kubevirt TPM + #2615 e2e trace) #2619

Closed

coderabbitai Bot mentioned this pull request Jun 22, 2026

chore(images): refresh stale utility image references #2969

Merged

Navigation Menu

Uh oh!

fix(opensearch-operator): replace deprecated kube-rbac-proxy image - #2689

fix(opensearch-operator): replace deprecated kube-rbac-proxy image#2689
myasnikovdaniil merged 2 commits into
mainfrom
fix/opensearch-operator-rbac-proxy-image

myasnikovdaniil commented May 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented May 20, 2026

Uh oh!

coderabbitai Bot commented May 20, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Suggested labels

Suggested reviewers

Poem

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 20, 2026

Uh oh!

myasnikovdaniil May 20, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot May 20, 2026

Uh oh!

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

myasnikovdaniil commented May 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented May 20, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested labels

Suggested reviewers

Poem

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 20, 2026

Choose a reason for hiding this comment

Uh oh!

myasnikovdaniil May 20, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

myasnikovdaniil commented May 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 20, 2026 •

edited

Loading