chore(images): refresh stale utility image references by lexfrei · Pull Request #2969 · cozystack/cozystack

Aleksei Sviridkin (lexfrei) · 2026-06-22T10:22:34Z

What this PR does

Refreshes the stale utility image references the issue flags (2021-era builds carrying long-fixed golang.org/x/crypto / golang.org/x/net):

kube-rbac-proxy v0.11.0 → v0.22.0 (etcd metrics scrape proxy, monitoring-agents) on the quay.io/brancz registry that etcd-operator already standardized on. Only the two core flags --secure-listen-address / --upstream are used; both are stable across the version range.
matchbox base image v0.10.0 → v0.11.0 (core/talos PXE image). v0.11.0 only bumps butane and adds darwin arm64 artifacts; the COPY asset paths are unchanged.
alpine/k8s tools image 1.33.4 → 1.36.2, applied to every non-vendored reference so the repo runs a single current tools-image version: seaweedfs resize/kubectl hooks, the cozystack-api post-upgrade hook, the installer, the vm-disk and vm-instance resize hooks, the vertical-pod-autoscaler CRD-install override, and the e2e cilium leak healer. The two digest-pinned refs (installer, e2e healer) get the matching multi-arch digest sha256:44ef4942….

Note on the issue text: #2903 cites the seaweedfs alpine/k8s ref as 1.28.4, but that value only exists as the vendored subchart default (charts/seaweedfs/values.yaml), which is left untouched per the vendoring rules. The effective runtime value comes from the non-vendored values.yaml override, which was already at 1.33.4 and is bumped here to 1.36.2.

Verified: helm template renders the new tags (incl. the digest-pinned installer ref); helm unittest passes for seaweedfs (7) and cozystack-api (6); no fixture pins any of these tags.

Closes #2903

Release note

chore(images): refresh kube-rbac-proxy (v0.22.0), matchbox (v0.11.0), and alpine/k8s (1.36.2) utility images

Summary by CodeRabbit

Chores
- Updated container images across system components, operational hooks, and monitoring utilities to newer stable versions.
Security
- Hardened several lifecycle hook Jobs and related pod templates to run as non-root, use seccompProfile: RuntimeDefault, disallow privilege escalation, and drop all Linux capabilities.
Tests
- Added Helm unit test coverage to verify hook Jobs’ non-root security settings and related Job fields.
Documentation
- Added helm unittest-based test targets for relevant charts to support the new coverage.

coderabbitai · 2026-06-22T10:22:42Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 1e8cd3ea-f8c0-4738-aac5-0742162188f9

📥 Commits

Reviewing files that changed from the base of the PR and between 303ca96 and aed0162.

📒 Files selected for processing (16)

hack/e2e-cilium-leak-healer.yaml
packages/apps/vm-disk/Makefile
packages/apps/vm-disk/templates/pvc-resize-hook.yaml
packages/apps/vm-disk/tests/hook_securitycontext_test.yaml
packages/apps/vm-instance/Makefile
packages/apps/vm-instance/templates/vm-update-hook.yaml
packages/apps/vm-instance/tests/hook_securitycontext_test.yaml
packages/core/installer/templates/cozy-system-labels.yaml
packages/core/talos/images/matchbox/Dockerfile
packages/system/cozystack-api/templates/hook.yaml
packages/system/cozystack-api/tests/hook_securitycontext_test.yaml
packages/system/monitoring-agents/templates/etcd-proxy-scrape.yaml
packages/system/seaweedfs/templates/hook.yaml
packages/system/seaweedfs/tests/hook_securitycontext_test.yaml
packages/system/seaweedfs/values.yaml
packages/system/vertical-pod-autoscaler/values.yaml

✅ Files skipped from review due to trivial changes (5)

packages/apps/vm-instance/tests/hook_securitycontext_test.yaml
packages/system/seaweedfs/tests/hook_securitycontext_test.yaml
packages/system/vertical-pod-autoscaler/values.yaml
packages/system/cozystack-api/tests/hook_securitycontext_test.yaml
packages/system/seaweedfs/values.yaml

🚧 Files skipped from review as they are similar to previous changes (4)

packages/core/installer/templates/cozy-system-labels.yaml
hack/e2e-cilium-leak-healer.yaml
packages/system/monitoring-agents/templates/etcd-proxy-scrape.yaml
packages/system/seaweedfs/templates/hook.yaml

📝 Walkthrough

Walkthrough

Container image versions are bumped across ten files: docker.io/alpine/k8s is updated from 1.33.4 to 1.36.2 in six hook Job templates and two Helm values files, four hook Job templates receive added pod and container securityContext hardening (non-root execution as user 65534, RuntimeDefault seccomp profile, disabled privilege escalation, and dropped ALL capabilities), quay.io/brancz/kube-rbac-proxy is updated from v0.11.0 to v0.22.0, and quay.io/poseidon/matchbox is updated from v0.10.0 to v0.11.0. Two new Makefile test targets and four new Helm test suites validate the added security contexts.

Changes

Container Image Bumps and Hook Security Hardening

Layer / File(s)	Summary
vm-disk pvc-resize hook image bump and security hardening `packages/apps/vm-disk/Makefile`, `packages/apps/vm-disk/templates/pvc-resize-hook.yaml`, `packages/apps/vm-disk/tests/hook_securitycontext_test.yaml`	The pvc-resize hook Job updates `alpine/k8s` from `1.33.4` to `1.36.2` and adds pod/container `securityContext` with non-root user, RuntimeDefault seccomp, no privilege escalation, and dropped capabilities. A new `test` Makefile target and Helm test suite validate the security hardening and backoffLimit placement.
vm-instance update-hook image bump and security hardening `packages/apps/vm-instance/Makefile`, `packages/apps/vm-instance/templates/vm-update-hook.yaml`, `packages/apps/vm-instance/tests/hook_securitycontext_test.yaml`	The update-hook Job updates `alpine/k8s` from `1.33.4` to `1.36.2` and adds pod-level `securityContext` (non-root user 65534, RuntimeDefault seccomp) plus container-level restrictions (allowPrivilegeEscalation false, dropped ALL capabilities). A new `test` Makefile target and Helm test suite validate the hardened security settings.
cozystack-api hook image bump and security hardening `packages/system/cozystack-api/templates/hook.yaml`, `packages/system/cozystack-api/tests/hook_securitycontext_test.yaml`	The cozystack-api-hook Job updates the `kubectl` image from `alpine/k8s:1.33.4` to `alpine/k8s:1.36.2` and adds pod-level `securityContext` (non-root user 65534, RuntimeDefault seccomp) plus container-level restrictions. A new Helm test suite validates pod and container security settings.
seaweedfs update-hook image bump and security hardening `packages/system/seaweedfs/templates/hook.yaml`, `packages/system/seaweedfs/tests/hook_securitycontext_test.yaml`	The update-hook Job updates the `kubectl` image from `alpine/k8s:1.33.4` to `alpine/k8s:1.36.2` and adds pod/container `securityContext` hardening (non-root user 65534, RuntimeDefault seccomp, no privilege escalation, dropped ALL capabilities). A new Helm test suite validates the restrictive security context.
Simpler single-line image updates `hack/e2e-cilium-leak-healer.yaml`, `packages/core/installer/templates/cozy-system-labels.yaml`, `packages/system/monitoring-agents/templates/etcd-proxy-scrape.yaml`, `packages/system/seaweedfs/values.yaml`, `packages/system/vertical-pod-autoscaler/values.yaml`, `packages/core/talos/images/matchbox/Dockerfile`	Straightforward version/digest updates: `alpine/k8s` bumped in two additional templates and two values files, `kube-rbac-proxy` updated from `v0.11.0` to `v0.22.0` in the etcd-proxy DaemonSet, and matchbox Dockerfile base image bumped from `v0.10.0` to `v0.11.0`.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

cozystack/cozystack#2689: Both PRs update container image references in Helm templates and values files; this PR bumps kube-rbac-proxy for the etcd-proxy scrape DaemonSet as part of a broader utility image refresh.

Suggested labels

size/M, area/testing

Suggested reviewers

kvaps
lllamnyp
androndo
IvanHunters
sircthulhu

Poem

🐇 Hop hop, the images are fresh today,
Alpine/k8s leapt from 1.33 to 1.36 on the way,
Four hooks now run non-root with strictest of care,
With seccomp and no caps—security's fair!
Tests validate all, from vm-disk to seaweedfs delight,
This bunny approves each bump and hardening bright. ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The PR includes two out-of-scope changes: addition of test targets in Makefiles and creation of new security context test files unrelated to the core image refresh objective.	Separate the security context testing additions into a dedicated PR to keep the image refresh objective focused and distinct from test infrastructure changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore(images): refresh stale utility image references' accurately and concisely summarizes the main change of updating outdated utility images across the repository.
Linked Issues check	✅ Passed	All objectives from issue `#2903` are met: kube-rbac-proxy upgraded to v0.22.0, alpine/k8s updated to 1.36.2, and matchbox base image updated to v0.11.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/bump-utility-images-2903

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2026-06-22T10:22:51Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refreshes several stale utility image references that were previously using outdated versions. By standardizing these images, the repository improves security and ensures consistent tooling across various system components and hooks. The changes have been validated through helm testing to confirm that all deployments and hooks remain functional with the updated versions.

Highlights

Utility Image Updates: Updated multiple utility images across the repository to address stale references and security concerns, including kube-rbac-proxy (v0.11.0 to v0.22.0), matchbox (v0.10.0 to v0.11.0), and alpine/k8s (1.33.4 to 1.36.2).
Standardization: Unified the alpine/k8s tools image version across all non-vendored references to ensure consistency, including updates to seaweedfs, cozystack-api, and various system hooks.
Verification: Verified changes using helm template and helm unittest to ensure compatibility and correct rendering of tags and digest-pinned references.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request updates several container images across multiple packages, notably upgrading alpine/k8s from 1.33.4 to 1.36.2, matchbox to v0.11.0, and kube-rbac-proxy to v0.22.0. The review feedback highlights several containers that lack resource requests/limits and proper securityContext configurations, which are required by the repository's security and workload guidelines.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-06-22T10:24:15Z

      containers:
        - name: resize
-          image: docker.io/alpine/k8s:1.33.4
+          image: docker.io/alpine/k8s:1.36.2


To align with the repository guidelines and security best practices, please add resource requests/limits and a securityContext to the resize container. This ensures predictable resource allocation and adheres to the principle of least privilege.

image: docker.io/alpine/k8s:1.36.2 resources: requests: cpu: 10m memory: 32Mi limits: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: ["ALL"]

References

RBAC, ServiceAccounts, and SecurityContext: flag missing securityContext. ^(link)

Missing resource requests/limits on workloads. ^(link)

Added the securityContext in aed0162 — the resize hook now runs non-root (pod runAsNonRoot + runAsUser 65534 + seccompProfile RuntimeDefault; container allowPrivilegeEscalation: false + drop ["ALL"]), mirroring the dashboard adopt hook, and pinned in a new helm-unittest. I left resource requests/limits out: the cited dashboard precedent doesn't set them either, and a consistent resources pass across these short-lived hooks fits better as its own change.

gemini-code-assist · 2026-06-22T10:24:15Z

      containers:
        - name: kubectl
-          image: docker.io/alpine/k8s:1.33.4
+          image: docker.io/alpine/k8s:1.36.2


To align with the repository guidelines and security best practices, please add resource requests/limits and a securityContext to the kubectl container. This ensures predictable resource allocation and adheres to the principle of least privilege.

image: docker.io/alpine/k8s:1.36.2 resources: requests: cpu: 10m memory: 32Mi limits: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: ["ALL"]

References

RBAC, ServiceAccounts, and SecurityContext: flag missing securityContext. ^(link)

Missing resource requests/limits on workloads. ^(link)

Added the securityContext in aed0162 — the hook now runs non-root (runAsUser 65534, runAsNonRoot, seccompProfile RuntimeDefault, drop ["ALL"]), mirroring the dashboard adopt hook, pinned in a helm-unittest that mocks the gating DaemonSet. Resource requests/limits left out for the same reason as the other hooks (not in the precedent; separate pass).

gemini-code-assist · 2026-06-22T10:24:15Z

      containers:
        - name: kubectl
-          image: docker.io/alpine/k8s:1.33.4
+          image: docker.io/alpine/k8s:1.36.2


To align with the repository guidelines and security best practices, please add resource requests/limits and a securityContext to the kubectl container. This ensures predictable resource allocation and adheres to the principle of least privilege.

image: docker.io/alpine/k8s:1.36.2 resources: requests: cpu: 10m memory: 32Mi limits: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: ["ALL"]

References

RBAC, ServiceAccounts, and SecurityContext: flag missing securityContext. ^(link)

Missing resource requests/limits on workloads. ^(link)

Added the securityContext in aed0162 — the update hook now runs non-root (runAsUser 65534, runAsNonRoot, seccompProfile RuntimeDefault, drop ["ALL"]), pinned in a helm-unittest. Resource requests/limits left out (not in the dashboard precedent; separate pass).

gemini-code-assist · 2026-06-22T10:24:15Z

      containers:
        - name: update-resources
-          image: docker.io/alpine/k8s:1.33.4
+          image: docker.io/alpine/k8s:1.36.2


To align with the repository guidelines and security best practices, please add a securityContext to the update-resources container. This adheres to the principle of least privilege.

image: docker.io/alpine/k8s:1.36.2 securityContext: allowPrivilegeEscalation: false capabilities: drop: ["ALL"]

References

RBAC, ServiceAccounts, and SecurityContext: flag missing securityContext. ^(link)

Added the securityContext in aed0162 — the update-resources hook now runs non-root (runAsUser 65534, runAsNonRoot, seccompProfile RuntimeDefault, drop ["ALL"]), mirroring the dashboard adopt hook, pinned in a helm-unittest that mocks the gating Service.

gemini-code-assist · 2026-06-22T10:24:15Z

          # Reuse the in-tree, digest-pinned kubectl+jq image already shipped by
          # the installer (packages/core/installer/templates/cozy-system-labels.yaml).
-          image: docker.io/alpine/k8s:1.33.4@sha256:b0523f0a244ddc4c8e055aa335c040d3d78b3ead5528f4544395f7f9f69c7b68
+          image: docker.io/alpine/k8s:1.36.2@sha256:44ef4942e171939b9c665a4a84beb80e2dcdb9a24330d4651cfdfd2e9deecc47


To align with the repository guidelines and security best practices, please add a securityContext to the healer container. This adheres to the principle of least privilege.

image: docker.io/alpine/k8s:1.36.2@sha256:44ef4942e171939b9c665a4a84beb80e2dcdb9a24330d4651cfdfd2e9deecc47 securityContext: allowPrivilegeEscalation: false capabilities: drop: ["ALL"]

References

RBAC, ServiceAccounts, and SecurityContext: flag missing securityContext. ^(link)

Deferring this one. hack/e2e-cilium-leak-healer.yaml is an e2e test fixture (it runs with hostNetwork: true and execs /opt/healer/heal.sh), not a shipped chart, so its security posture is low-stakes here. A leak healer on the host network plausibly needs elevation, and whether it still works non-root can't be confirmed without running the e2e suite — so it's out of scope for this image-ref refresh.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/core/talos/images/matchbox/Dockerfile`:
- Line 1: The Dockerfile uses the base image quay.io/poseidon/matchbox:v0.11.0
which does not specify a non-root user, causing the container to run as root by
default. After the FROM instruction, add commands to create a non-root user
group and user (e.g., matchbox) using addgroup and adduser commands, then add a
USER instruction to switch to that non-root user before any subsequent commands
or at the end of the Dockerfile. This ensures the container runs with reduced
privileges adhering to security best practices.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b819b68e-a030-47e6-8b4a-d79c18b8ec6c

📥 Commits

Reviewing files that changed from the base of the PR and between 6329ffe and 303ca96.

📒 Files selected for processing (10)

hack/e2e-cilium-leak-healer.yaml
packages/apps/vm-disk/templates/pvc-resize-hook.yaml
packages/apps/vm-instance/templates/vm-update-hook.yaml
packages/core/installer/templates/cozy-system-labels.yaml
packages/core/talos/images/matchbox/Dockerfile
packages/system/cozystack-api/templates/hook.yaml
packages/system/monitoring-agents/templates/etcd-proxy-scrape.yaml
packages/system/seaweedfs/templates/hook.yaml
packages/system/seaweedfs/values.yaml
packages/system/vertical-pod-autoscaler/values.yaml

Refreshes the matchbox PXE image base from the 2021-era v0.10.0 to v0.11.0, clearing the long-fixed golang.org/x/crypto and x/net versions baked into the old build. v0.11.0 only bumps butane (v0.17->v0.18) and adds darwin arm64 artifacts; no behavior change for Talos PXE boot. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>

…roxy to v0.22.0 Bumps the etcd metrics scrape proxy from the 2021-era v0.11.0 to v0.22.0 on the same quay.io/brancz registry that etcd-operator already standardized on. The two flags used here (--secure-listen-address, --upstream) are core and stable across the version range. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>

Bumps the alpine/k8s tools image used by the seaweedfs resize hook and the kubectl hook job from 1.33.4 to 1.36.2 (current). This non-vendored override is the effective runtime value; the vendored chart's stale 1.28.4 default is unused and left untouched per the vendoring rules. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>

…36.2 Six further references to the alpine/k8s tools image were still pinned at 1.33.4 across the installer, the cozystack-api post-upgrade hook, the vm-disk and vm-instance resize hooks, the vertical-pod-autoscaler CRD-install override, and the e2e cilium leak healer. Move them all to 1.36.2 so the whole repo runs a single current tools-image version (the two digest-pinned refs get the matching multi-arch digest sha256:44ef4942...). Same stale-stdlib remediation as the seaweedfs bump in this PR. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>

The vm-disk pvc-resize, cozystack-api, seaweedfs and vm-instance update hooks (whose alpine/k8s image this PR refreshes) ran as root with no securityContext. Add a pod-level runAsNonRoot + runAsUser 65534 + seccompProfile RuntimeDefault and a container-level allowPrivilegeEscalation: false + capabilities drop ALL, mirroring the dashboard adopt hook. kubectl needs no root, so this is behavior-neutral. Each hook is lookup-gated; pin the securityContext in a per-chart helm-unittest that mocks the gating object (DaemonSet / PVC / Service) via kubernetesProvider so the guard renders without a cluster. vm-disk and vm-instance had no Makefile test target, so add 'test: helm unittest .' to both so CI runs the new suites. Scope note: other kubectl hooks on clastix/kubectl (mariadb, keycloak, kubernetes, tenant) are untouched here — they are not part of this alpine/k8s refresh and belong to a separate hardening pass. Also fix the vm-disk resize hook's backoffLimit: it was nested under the pod spec (silently ignored, leaving the Job at the default 6 retries) instead of Job.spec. Move it to Job.spec and pin it in the test. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>

myasnikovdaniil

LGTM. Verified every refreshed reference against the registries:

alpine/k8s:1.36.2 resolves to sha256:44ef4942e171939b9c665a4a84beb80e2dcdb9a24330d4651cfdfd2e9deecc47, which exactly matches both digest-pinned refs (installer + e2e healer), and keeps the same linux/amd64 + linux/arm64 coverage as the old b0523f0a… pin.
quay.io/brancz/kube-rbac-proxy:v0.22.0 exists; only --secure-listen-address / --upstream are used and both are stable across v0.11→v0.22 — no deprecated flags involved. Registry choice is consistent with etcd-operator and opensearch-operator.
quay.io/poseidon/matchbox:v0.11.0 exists with an identical entrypoint (/matchbox) and exposed port (8080/tcp) vs v0.10.0; the COPY asset paths are unchanged — drop-in.

Consistency: grep finds no stragglers on the old tags anywhere non-vendored. The remaining alpine/k8s:1.28.4 is the vendored seaweedfs subchart default, correctly overridden by the non-vendored resizeHook.image — the PR body's note on #2903 is accurate.

The bundled non-root hardening on the kubectl hooks is safe: smoke-tested alpine/k8s:1.36.2 under --user 65534 --read-only, and every hook body is pure kubectl patch/delete with no filesystem writes. Nice catch relocating vm-disk's backoffLimit from the (ignored) pod spec to the Job spec, with a test that guards the regression. make test passes for all four affected charts; git status is clean.

Optional nit: the release-note only mentions the image refresh — consider noting the hooks now run non-root, since that's a user-visible posture change.

Aleksei Sviridkin (lexfrei) marked this pull request as ready for review June 22, 2026 10:22

github-actions Bot added area/uncategorized PR auto-labeler could not map title scope to a known area/*; please review kind/cleanup Categorizes issue or PR as related to cleanup of code, process, or technical debt labels Jun 22, 2026

Aleksei Sviridkin (lexfrei) requested a review from Andrei Kvapil (kvaps) as a code owner June 22, 2026 10:22

github-actions Bot added the size/S This PR changes 10-29 lines, ignoring generated files label Jun 22, 2026

Aleksei Sviridkin (lexfrei) requested review from IvanHunters, Andrey Kolkov (androndo), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners June 22, 2026 10:22

gemini-code-assist Bot reviewed Jun 22, 2026

View reviewed changes

coderabbitai Bot reviewed Jun 22, 2026

View reviewed changes

Comment thread packages/core/talos/images/matchbox/Dockerfile

Aleksei Sviridkin (lexfrei) added 4 commits June 22, 2026 19:12

Aleksei Sviridkin (lexfrei) mentioned this pull request Jun 22, 2026

security(matchbox): run the matchbox container as non-root #2997

Open

Aleksei Sviridkin (lexfrei) force-pushed the chore/bump-utility-images-2903 branch from 303ca96 to aed0162 Compare June 22, 2026 18:40

github-actions Bot added size/L This PR changes 100-499 lines, ignoring generated files and removed size/S This PR changes 10-29 lines, ignoring generated files labels Jun 22, 2026

Aleksei Sviridkin (lexfrei) mentioned this pull request Jun 22, 2026

security: add securityContext to the remaining kubectl hook jobs #3012

Open

myasnikovdaniil approved these changes Jun 23, 2026

View reviewed changes

myasnikovdaniil mentioned this pull request Jun 23, 2026

chore(talos): bump core/talos to Talos v1.13.5 and matchbox v0.11.0 #3008

Merged

Aleksei Sviridkin (lexfrei) self-assigned this Jun 23, 2026

Aleksei Sviridkin (lexfrei) merged commit 0bb15b9 into main Jun 23, 2026
12 checks passed

Aleksei Sviridkin (lexfrei) deleted the chore/bump-utility-images-2903 branch June 23, 2026 10:12

Uh oh!

Conversation

Aleksei Sviridkin (lexfrei) commented Jun 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

gemini-code-assist Bot commented Jun 22, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Aleksei Sviridkin (lexfrei) Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Aleksei Sviridkin (lexfrei) Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Aleksei Sviridkin (lexfrei) Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Aleksei Sviridkin (lexfrei) Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Aleksei Sviridkin (lexfrei) Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

myasnikovdaniil left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Aleksei Sviridkin (lexfrei) commented Jun 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 22, 2026 •

edited

Loading