Skip to content

Release v0.28.1 - #714

Closed
Timofei Larkin (lllamnyp) wants to merge 3 commits into
mainfrom
release-v0.28.1
Closed

Release v0.28.1#714
Timofei Larkin (lllamnyp) wants to merge 3 commits into
mainfrom
release-v0.28.1

Conversation

@lllamnyp

@lllamnyp Timofei Larkin (lllamnyp) commented Mar 26, 2025 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • Chores
    • Updated container images and configuration values across multiple components (e.g., cozystack, cluster-autoscaler, kubevirt, kamaji, kubeovn, and ingress-nginx) to newer versions.
    • Refined Helm chart settings to streamline deployments and improve service configurations.
  • Documentation
    • Revised ingress-nginx documentation to include a new Pod Security Admission section and updated version badges.
  • Tests
    • Expanded and enhanced test suites to validate ingress controller, default backend, and related service configurations.

@NickVolynkin @lllamnyp
Fix typo in VirtualPodAutoscaler Makefile
934874a 
Makefile was copied from VictoriaMetrics Operator, some lines were not
changed.

Follow-up to #676
Resolves #705

Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>
(cherry picked from commit 92e2173)
@lllamnyp
Merge pull request #710 from cozystack/709-update-ingress-nginx
82cf60a 
Update ingress-nginx to mitigate CVE-2025-1974

(cherry picked from commit c66eb9f)
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
@lllamnyp
Prepare release v0.28.1
dcacb2b 
Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
@coderabbitai

coderabbitai Bot commented Mar 26, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Walkthrough

This pull request consolidates multiple image version updates and configuration changes across various components. Container images for cozystack, testing, dashboards, and Kubernetes components are upgraded from v0.28.0 to v0.28.1 with corresponding SHA256 digest updates. Numerous Helm chart and template modifications occur in the ingress‑nginx package—including version bumps, removal of deprecated functions, and additions of new configuration options (e.g. for webhooks, metrics, and extra modules). Additional test cases have been added while obsolete configuration files have been removed, and naming conventions are updated for uniformity.

Changes

File(s) Change Summary
manifests/cozystack-installer.yaml, packages/core/installer/values.yaml, packages/core/testing/values.yaml, packages/extra/bootbox/images/matchbox.tag, packages/system/cozystack-api/values.yaml, packages/system/cozystack-controller/values.yaml Updated container image versions from v0.28.0 to v0.28.1 with corresponding SHA256 digest adjustments.
packages/apps/kubernetes/images/cluster-autoscaler.tag, packages/apps/kubernetes/images/kubevirt-cloud-provider.tag, packages/apps/kubernetes/images/kubevirt-csi-driver.tag, packages/system/bucket/images/s3manager.tag Updated image digests for Kubernetes autoscaler, Kubevirt components, and S3 manager reflecting revised underlying images.
packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml, packages/system/dashboard/values.yaml Incremented app and image versions from v0.28.0 to v0.28.1 with updated digests in dashboard configurations.
packages/system/ingress-nginx/charts/ingress-nginx/{Chart.yaml, OWNERS, README.md, README.md.gotmpl}, and files under packages/system/ingress-nginx/charts/ingress-nginx/ci/ and templates/ Upgraded ingress‑nginx chart versions (e.g. from v1.11.1/4.11.1 to v1.11.5/4.11.5), removed obsolete functions (e.g. version validation), and introduced new settings (e.g. metrics, webhooks, extra modules).
packages/system/ingress-nginx/charts/ingress-nginx/tests/* Added comprehensive test suites covering admission webhooks, service accounts, pod disruption budgets, and image configuration validations.
packages/system/ingress-nginx/values.yaml (both chart and central config) Updated controller and protobuf-exporter image sources, tags, and digests to new versions (e.g. from v1.11.2 to v1.11.5).
packages/system/kamaji/values.yaml, packages/system/kubeovn-webhook/values.yaml, packages/system/kubeovn/values.yaml, packages/system/vertical-pod-autoscaler/Makefile Revised image tags/digests and standardized naming conventions (e.g. switching NAME to vertical-pod-autoscaler) to reflect version upgrades.

Possibly related PRs

Suggested reviewers

  • kvaps

Poem

Hop along the code trail, I cheer,
Image tags updated, oh so clear!
Config and charts get a little tweak,
New tests and cleanups make the system sleek.
With a twirl and a nibble on each new line,
I, a happy bunny, sing: “All is fine!”
🐇✨

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai plan to trigger planning for file edits and PR creation.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

coderabbitai[bot]
coderabbitai Bot reviewed Mar 26, 2025
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (15)
packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml (1)

1-6: New Controller Image Configuration for AddHeaders

This new configuration specifies the controller’s image details with the repository, a dev tag, and an unset digest (null). Ensure that leaving the digest as null is intentional—for example, if it is expected to be dynamically populated or if version pinning isn’t required here.

packages/system/ingress-nginx/charts/ingress-nginx/templates/controller-service-webhook.yaml (1)

31-33: Dynamic Port Configuration for Webhook Service

Replacing the hardcoded port with {{ .Values.controller.admissionWebhooks.service.servicePort }} enhances configurability. Please ensure that a default value is set in the associated values.yaml so that deployments without an explicit configuration do not fail.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml (2)

1-6: New ProxyHeaders Configuration Added

The configuration setup under the controller field, including the image details and service type (ClusterIP), is consistent with other similar configuration files. As with the addHeaders file, ensure that leaving the digest as null is intentional.

10-11: Proxy Header Settings for Enhanced Security

The proxySetHeaders configuration with X-Forwarded-Proto: https is a useful addition to ensure that clients and backends correctly interpret the protocol. Consider adding documentation for these custom settings if not already present.

packages/system/vertical-pod-autoscaler/Makefile (1)

8-8: Operator Comment Update
The inline comment has been updated to "# VirtualPodAutoscaler operator" to match the new operator name. This improves clarity but double-check that the naming is consistent across documentation and other scripts.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-ingressclass-values.yaml (1)

1-5: Controller Image Configuration Defined.
The image configuration (repository, tag, and digest) is clearly specified. Consider using parameterized values for the tag and digest if you anticipate environment-specific adjustments in the future.

packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml (1)

43-43: Addition of Webhook Service Port.
Introducing the port field in the clientConfig section ensures that the admission webhook correctly references the service port. This is crucial for proper webhook functionality.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-configmap-values.yaml (1)

10-11: Streamlined Controller Config.
The config block now solely includes the use-proxy-protocol setting. The removal of previous settings (e.g., admissionWebhooks and allowSnippetAnnotations) simplifies the configuration. Ensure that these removals are aligned with your overall configuration strategy.

packages/system/ingress-nginx/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml (1)

2-6: Centralize Replica Count Logic for PodDisruptionBudget

Using the temporary variable $replicas (lines 2–6) to determine the effective replica count—taking autoscaling settings into account—is a clean and maintainable approach. Please ensure that when autoscaling is enabled, the minReplicas value is always defined.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml (1)

10-13: DaemonSet Kind and Metrics Configuration Update.
The configuration now specifies kind: DaemonSet and adds a new metrics section with enabled: true. This update should help integrate metrics into the observability stack; please ensure that the monitoring components are adjusted accordingly.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-hpa-values.yaml (1)

1-6: Controller Image Configuration
The image configuration is clearly defined with repository and tag details. Note that the digest is set to null; if this is intentional (e.g., to enable dynamic resolution), it is acceptable. Otherwise, consider specifying an explicit digest for build reproducibility.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-service-values.yaml (1)

16-17: Addition of portNamePrefix Property
The new property portNamePrefix: port is added at the root level following the controller block. Please verify that this top-level placement aligns with how templates reference this property. If it is intentional, a brief inline comment or documentation note might aid future maintainers.

packages/system/ingress-nginx/charts/ingress-nginx/README.md (1)

232-248: Addition of Pod Security Admission Section.
A new section for Pod Security Admission has been added, complete with example YAML. This provides valuable guidance on securing the namespace using Pod Security Admission. Consider linking to the official Kubernetes documentation for deeper reference.

packages/system/ingress-nginx/charts/ingress-nginx/values.yaml (2)

1070-1071: Note: Review commented topology spread constraints update.
The commented-out lines adding a matchLabelKeys setting with the value pod-template-hash are now present. Please verify if these should remain as comments or be activated, depending on your topology spread configuration requirements.

1080-1081: Note: Additional commented topology spread constraints configuration.
A similar commented update for matchLabelKeys appears later in the default backend section. Confirm whether these commented hints should be enabled or removed for a cleaner configuration.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c66eb9f and dcacb2b.

📒 Files selected for processing (87)
  • manifests/cozystack-installer.yaml (2 hunks)
  • packages/apps/kubernetes/images/cluster-autoscaler.tag (1 hunks)
  • packages/apps/kubernetes/images/kubevirt-cloud-provider.tag (1 hunks)
  • packages/apps/kubernetes/images/kubevirt-csi-driver.tag (1 hunks)
  • packages/core/installer/values.yaml (1 hunks)
  • packages/core/testing/values.yaml (1 hunks)
  • packages/extra/bootbox/images/matchbox.tag (1 hunks)
  • packages/system/bucket/images/s3manager.tag (1 hunks)
  • packages/system/cozystack-api/values.yaml (1 hunks)
  • packages/system/cozystack-controller/values.yaml (1 hunks)
  • packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml (1 hunks)
  • packages/system/dashboard/values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/Chart.yaml (2 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/OWNERS (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/README.md (8 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/README.md.gotmpl (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-admission-tls-cert-manager-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-configmap-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-custom-ingressclass-flags.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-extra-modules-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-metrics-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-opentelemetry-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-extra-modules-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-opentelemetry-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-hpa-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-ingressclass-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-service-internal-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-service-values.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-customconfig-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-customnodeport-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-extra-modules.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-headers-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-nodeport-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-tcp-udp-configMapNamespace-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-tcp-udp-portNamePrefix-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-tcp-udp-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-tcp-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deamonset-metrics-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-autoscaling-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-extra-modules-default-container-sec-context.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-extra-modules-specific-container-sec-context.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-extra-modules.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-headers-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-internal-lb-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-nodeport-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-tcp-udp-configMapNamespace-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-tcp-udp-portNamePrefix-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-tcp-udp-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-tcp-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-webhook-extraEnvs-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-webhook-resources-values.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/_helpers.tpl (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/controller-daemonset.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/controller-deployment.yaml (0 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/controller-service-webhook.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/controller-servicemonitor.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/default-backend-deployment.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml (2 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-configmap_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-daemonset_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-deployment_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-service-webhook_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/default-backend-deployment_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml (1 hunks)
  • packages/system/ingress-nginx/charts/ingress-nginx/values.yaml (10 hunks)
  • packages/system/ingress-nginx/values.yaml (2 hunks)
  • packages/system/kamaji/values.yaml (1 hunks)
  • packages/system/kubeovn-webhook/values.yaml (1 hunks)
  • packages/system/kubeovn/values.yaml (1 hunks)
  • packages/system/vertical-pod-autoscaler/Makefile (1 hunks)
💤 Files with no reviewable changes (28)
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-tcp-udp-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-internal-lb-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/controller-deployment.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-nodeport-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-headers-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-tcp-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-nodeport-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deamonset-metrics-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-customnodeport-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-tcp-udp-portNamePrefix-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-customconfig-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-webhook-resources-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-extra-modules-specific-container-sec-context.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/templates/controller-daemonset.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-tcp-udp-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-admission-tls-cert-manager-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-autoscaling-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-extra-modules.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-extra-modules-default-container-sec-context.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-tcp-udp-configMapNamespace-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/OWNERS
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-extra-modules.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-custom-ingressclass-flags.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-headers-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/daemonset-tcp-udp-configMapNamespace-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-tcp-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-webhook-extraEnvs-values.yaml
  • packages/system/ingress-nginx/charts/ingress-nginx/ci/deployment-tcp-udp-portNamePrefix-values.yaml
🧰 Additional context used
🪛 YAMLlint (1.35.1)
packages/system/ingress-nginx/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

🪛 markdownlint-cli2 (0.17.2)
packages/system/ingress-nginx/charts/ingress-nginx/README.md

387-387: Bare URL used
null

(MD034, no-bare-urls)

🔇 Additional comments (120)
packages/system/cozystack-api/values.yaml (1)

1-3: Image Version Bump for cozystack-api.
The image version has been updated from v0.28.0 to v0.28.1 with the SHA256 digest unchanged. Please verify that the digest accurately reflects the new image build for release v0.28.1.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-values.yaml (1)

1-11: New Deployment Configuration for Ingress-nginx Controller.
This new file specifies the controller deployment settings using a Deployment. The image repository, tag (1.0.0-dev), and digest (null) are explicitly defined. Confirm that the chosen tag is intentional for the development or testing environment and that a null digest is acceptable in your deployment pipeline.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-values.yaml (1)

1-11: Introduction of DaemonSet for Ingress-nginx Controller.
This configuration now differentiates between Deployment and DaemonSet by setting kind: DaemonSet, which is important if your environment requires a distributed controller across nodes. Please ensure that this aligns with your operational requirements and that other relevant configurations (e.g., metrics or opentelemetry settings) remain consistent.

packages/system/dashboard/charts/kubeapps/templates/dashboard/configmap.yaml (1)

73-79: Updated AppVersion in Dashboard ConfigMap.
The "appVersion" in the config.json section has been updated to "v0.28.1", matching the coordinated release changes. Ensure that downstream components correctly use this new version value and that this update does not disrupt any existing version-based logic.

packages/core/testing/values.yaml (1)

1-3: E2E Sandbox Image Version Update.
The image for the e2e service has been updated to v0.28.1 with the corresponding SHA256 digest. Verify that this version update is properly integrated with the end-to-end testing framework and that the digest is valid for the new image.

packages/extra/bootbox/images/matchbox.tag (1)

1-2: Update Image Reference to v0.28.1 Confirmed

The matchbox image reference has been updated to version v0.28.1 with the new SHA256 digest. Please verify that the digest matches the built image for consistency across deployments.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-configmap-addheaders-values.yaml (2)

7-9: Service Type Configuration Looks Good

The service type is set to ClusterIP, which is appropriate for internal cluster access. No issues found.

10-11: Security Header Addition is Well Defined

The addition of the X-Frame-Options: deny header improves security by mitigating clickjacking. Ensure that this header does not conflict with any downstream proxy configurations.

packages/system/bucket/images/s3manager.tag (1)

1-2: S3 Manager Image Digest Updated

The image reference for s3manager has been updated with the new digest for version v0.5.0. Confirm that this digest correctly corresponds to the updated image build.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-configmap-proxyheaders-values.yaml (1)

7-9: Service Type Specification is Appropriate

The service type specified here is ClusterIP, which maintains internal accessibility as expected.

packages/system/ingress-nginx/charts/ingress-nginx/README.md.gotmpl (1)

229-245: Good addition of Pod Security Admission documentation!

The new section provides clear guidance on how to secure the ingress-nginx namespace using Kubernetes Pod Security Admission. The example YAML demonstrates the proper labeling pattern with the 'restricted' enforcement level, which helps users implement security best practices.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-opentelemetry-values.yaml (1)

10-10: Explicit DaemonSet configuration looks good

The addition of kind: DaemonSet clarifies the controller's deployment type, ensuring one controller instance runs on each node in the cluster when OpenTelemetry is enabled.

packages/apps/kubernetes/images/kubevirt-cloud-provider.tag (1)

1-1: Updated image digest for kubevirt-cloud-provider

The SHA256 digest has been updated while maintaining the same version label (0.15.2). This indicates a rebuild or patch of the image content without a version change.

packages/system/kamaji/values.yaml (1)

6-6: Version bump from v0.28.0 to v0.28.1

The kamaji image has been updated to version v0.28.1 with the corresponding new SHA256 digest. This aligns with the release version mentioned in the PR title.

packages/system/ingress-nginx/charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml (1)

23-23: Dynamic ServiceAccount Naming Assertion Update
The expected value for the ServiceAccount's metadata name has been updated to use dynamic naming ("RELEASE-NAME-ingress-nginx-admission"). Please verify that this change correctly reflects the template behavior that substitutes the release name at runtime.

packages/core/installer/values.yaml (1)

2-2: Cozystick Installer Image Version & Digest Updated
The installer image is updated to v0.28.1 with a new SHA256 digest. Ensure that this image change is intentional and that all deployments using this component are prepared for the update.

packages/apps/kubernetes/images/kubevirt-csi-driver.tag (1)

1-1: Kubevirt CSI Driver Digest Update
The image digest for the kubevirt-csi-driver has been updated while retaining the version tag (0.15.2). Confirm that this new digest represents the intended image update and that downstream components have been tested against it.

packages/system/vertical-pod-autoscaler/Makefile (1)

1-1: Operator Name Variable Updated
The export NAME variable has been changed to "vertical-pod-autoscaler" to reflect the new operator identity. Ensure that all dependent scripts and references have been updated accordingly.

packages/system/kubeovn-webhook/values.yaml (1)

3-3: Kubeovn-webhook Image Version & Digest Updated
The image for kubeovn-webhook is updated to v0.28.1 with a new digest. Please verify that the provided digest is correct and that all configurations expecting the previous version are updated.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-ingressclass-values.yaml (3)

7-8: Service Configuration is Correct.
The service is appropriately set to use ClusterIP, which is typical for internal services.

10-13: IngressClassResource Specification is Clear.
Defining the ingress class with a custom name, default flag, and controller value ensures clarity in resource usage.

15-15: Watching Ingress Without Class Enabled.
Enabling watchIngressWithoutClass allows for broader resource coverage. Please verify that this behavior aligns with your deployment strategy.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-configmap-values.yaml (1)

1-8: Controller Image and Service Settings Remain Intact.
The image and service configuration is maintained here. Note that the tag "1.0.0-dev" is used—please confirm that this version is intentional, especially amid broader version updates in the release.

packages/apps/kubernetes/images/cluster-autoscaler.tag (1)

1-1: Updated Cluster Autoscaler Image Digest.
The new digest reflects an update in the underlying image, which may include important fixes or improvements. Please verify that this new digest is in sync with your deployment and testing pipelines.

packages/system/kubeovn/values.yaml (1)

24-25: Kubeovn Image Tag Updated.
The image tag for kubeovn has been updated to include a new digest, ensuring consistency with updated components. Confirm that this update aligns with other version and digest changes across the release.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-metrics-values.yaml (2)

10-11: Validate Deployment Kind Usage

The addition of kind: Deployment (lines 10–11) clearly identifies the intended Kubernetes resource type. Please verify that this change aligns with your overall deployment strategy and matches related configurations.

12-13: Enable Metrics for Monitoring

The new metrics section with enabled: true (lines 12–13) enhances observability for the controller. Ensure that these metrics settings are compatible with other monitoring configurations (e.g., in the ServiceMonitor resource).

packages/system/ingress-nginx/charts/ingress-nginx/ci/admission-webhooks-cert-manager-values.yaml (1)

10-12: Update Admission Webhooks for Cert Manager

Replacing the previous admission webhook configuration with the new admissionWebhooks.certManager.enabled: true (lines 10–12) streamlines the controller’s certificate management. Verify that the removal of the old configuration is intentional and that any dependent documentation or tests are updated.

packages/system/ingress-nginx/charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml (1)

6-7: Conditional PDB Creation Check

The condition {{- if gt ($replicas | int) 1 }} (lines 6–7) correctly prevents the creation of a PodDisruptionBudget for single-replica deployments. This logic appears sound, but please confirm that this meets your intended availability guarantees.

packages/system/ingress-nginx/charts/ingress-nginx/templates/controller-servicemonitor.yaml (7)

6-10: Conditional Namespace Configuration

The if/else logic for setting the namespace (lines 6–10) is effective. Be sure that the fallback using {{ include "ingress-nginx.namespace" . }} stays consistent with your standard naming conventions across resources.

14-16: Optional Additional Labels Integration

Adding additionalLabels within the labels block (lines 14–16) provides useful flexibility. Verify that the YAML indentation produced by nindent meets your formatting requirements.

17-19: Annotation Configuration Consistency

The conditional inclusion of annotations (lines 17–19) supports customizable metadata. Ensure that this section is tested to correctly include annotations when provided.

21-27: Namespace Selector Handling

The conditional configuration of namespaceSelector (lines 21–27) shows a robust fallback mechanism by using the ingress namespace when no custom selector is provided. Confirm that converting the configuration with toYaml preserves the intended structure.

28-31: Selector Labels Consistency

The matchLabels setup (lines 28–31) is consistent with standard practices for identifying controller components. This configuration is straightforward and should work well with your label selectors.

33-43: Endpoints and Metric Relabelings

The endpoints configuration (lines 33–43), including the interval and optional relabelings, is well-organized. Please ensure that the use of nindent for formatting the YAML output maintains valid syntax.

44-49: Job Label and Target Labels Configuration

Including the optional jobLabel (with quoting) and targetLabels (lines 44–49) adds helpful customization for monitoring jobs. Verify that these settings are reflected accurately in the resulting ServiceMonitor resource.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-service-internal-values.yaml (1)

6-9: Streamlined Controller Service Configuration

The cleanup in this configuration—evidenced by the removal of deprecated fields (e.g., kind: DaemonSet and admissionWebhooks)—simplifies the controller’s service setup. Retaining the internal service configuration with enabled: true and proper annotations (lines 10–14) is appropriate.

packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-poddisruptionbudget_test.yaml (1)

74-90: Validate PodDisruptionBudget configuration for minAvailable/maxUnavailable
This new test accurately verifies that when both controller.minAvailable and controller.maxUnavailable are specified, the rendered PodDisruptionBudget omits the spec.minAvailable field and correctly sets spec.maxUnavailable to 1. Ensure that this behavior is fully consistent with the intended Helm chart logic.

packages/system/ingress-nginx/charts/ingress-nginx/tests/default-backend-deployment_test.yaml (3)

139-149: Custom Registry Image Test Validation
The test case for a custom registry confirms that when defaultBackend.image.registry is provided (without an overriding repository), the constructed image uses the custom registry concatenated with the default image name (assumed to be defaultbackend-amd64) along with the specified tag and digest. Please verify that your chart’s default for .Values.defaultBackend.image.image is indeed defaultbackend-amd64 so that this expected output remains correct.

150-160: Custom Image Override Test Validation
This test effectively asserts that when defaultBackend.image.image is set, the final image string is built using the provided custom image value and the standard registry fallback (here registry.k8s.io). The output format is as expected.

161-170: Custom Tag Application Test Validation
The test case for a custom tag ensures that specifying defaultBackend.image.tag updates the image tag in the final constructed image correctly. The expected image string uses the default image name and registry when not overridden. The test appears well crafted and in line with the desired behavior.

packages/system/ingress-nginx/charts/ingress-nginx/templates/default-backend-deployment.yaml (1)

105-106: Consistent ServiceAccountName Rendering
The modification from using a template function to the include function for rendering serviceAccountName enhances consistency with other chart templates and improves readability. Verify that this change integrates seamlessly with your overall chart conventions.

packages/system/ingress-nginx/charts/ingress-nginx/Chart.yaml (1)

3-3: Version and Metadata Update Confirmation
The updates in this file reflect the release bump with the following changes:

  • The annotation now documents the update to controller-v1.11.5 (line 3).
  • appVersion has been updated to 1.11.5 (line 6).
  • version has been bumped to 4.11.5 (line 23).

These modifications are in line with the desired release version and metadata changes. Ensure that accompanying documentation and dependent charts are updated accordingly.

Also applies to: 6-6, 23-23

packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-prometheusrule_test.yaml (1)

1-17: New PrometheusRule Test Suite Addition
This newly added test suite validates that when controller.metrics.prometheusRule.enabled (in conjunction with controller.metrics.enabled) is true, a PrometheusRule resource is generated with the correct metadata. The assertions check for a single document, the proper kind (PrometheusRule), and an expected metadata name. The test is clear and aligns well with the updated metrics configuration.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-opentelemetry-values.yaml (1)

10-13: New Deployment Kind and OpenTelemetry Configuration.
The addition of kind: Deployment along with the new opentelemetry section (with enabled: true) clearly signals the controller’s configuration shift toward enhanced observability. Please verify that downstream chart templates and associated documentation are updated accordingly.

packages/system/ingress-nginx/charts/ingress-nginx/templates/default-backend-serviceaccount.yaml (2)

1-1: Updated ServiceAccount Conditional & Templating Syntax.
The modified conditional using {{- if and .Values.defaultBackend.enabled .Values.defaultBackend.serviceAccount.create -}} improves clarity and consistency. Note that YAML linters may flag these Helm templating markers as syntax errors, which is expected behavior.

🧰 Tools
🪛 YAMLlint (1.35.1)

[error] 1-1: syntax error: expected the node content, but found '-'

(syntax)

11-11: Enhanced ServiceAccount Name Rendering.
Switching to {{ include "ingress-nginx.defaultBackend.serviceAccountName" . }} for rendering the ServiceAccount name improves consistency across the chart. Ensure that any related templates relying on service account naming conventions are aligned with this change.

manifests/cozystack-installer.yaml (2)

72-72: Updated Cozystack Container Image Version.
The container image for the "cozystack" container is now set to v0.28.1. Please confirm that this version is compatible with all dependent system components and environments.

91-91: Updated Assets Container Image Version.
The update to "ghcr.io/cozystack/cozystack/installer:v0.28.1" for the "assets" container ensures consistency with the cozystack service upgrade. Validate that any image-specific configurations continue to work as expected.

packages/system/cozystack-controller/values.yaml (2)

2-2: CozyStack-Controller Image Upgrade.
The image has been updated to ghcr.io/cozystack/cozystack/cozystack-controller:v0.28.1 with the new SHA256 digest. Verify that this image version is fully vetted and compatible with your current deployment setup.

5-5: Updated CozyStack Version Identifier.
Setting cozystackVersion to "v0.28.1" aligns the version information with the rest of the system’s coordinated upgrade. Please confirm that any version-dependent logic or configurations are correspondingly updated.

packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-serviceaccount_test.yaml (5)

1-4: File Structure & Suite Definition
The YAML structure clearly defines the test suite and specifies the template, making it easy to understand which resources are under test.

5-12: Test: No ServiceAccount Created When Disabled
This test correctly validates that no ServiceAccount is created when serviceAccount.create is set to false. The assertion on document count meets the expected behavior.

13-24: Test: ServiceAccount Creation When Enabled
The test ensures that enabling serviceAccount.create produces one ServiceAccount document with the expected kind and name format (RELEASE-NAME-ingress-nginx). Please verify that the naming convention aligns with your release process.

25-36: Test: ServiceAccount with Custom Name
The test configures and checks a custom ServiceAccount name (ingress-nginx-admission-test-sa), and the assertions clearly validate its creation and naming.

37-48: Test: Token Auto-Mounting Disabled
This test confirms that setting serviceAccount.automountServiceAccountToken to false results in a ServiceAccount with token auto-mounting disabled. The assertions are explicit and thorough.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-hpa-values.yaml (2)

7-9: Service Type Configuration
Setting the service type to ClusterIP is straightforward and appropriate for the controller’s operation.

10-19: Autoscaling Settings
The autoscaling configuration—with a stabilization window and clear policies—is well laid out. Verify that the policy values (e.g., periodSeconds and value) match your performance targets.

packages/system/dashboard/values.yaml (2)

17-22: Dashboard Image Update
The dashboard image configuration updates the tag to v0.28.1, aligning with the overall release version. The digest remains unchanged, which is acceptable if it represents the intended image.

23-28: Kubeapps APIs Image Update
The kubeappsapis image now has an updated tag (v0.28.1) and a new digest. This update ensures version consistency across the system.

packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-daemonset_test.yaml (10)

1-17: Test: Basic DaemonSet Creation
This initial test validates that setting controller.kind to "DaemonSet" produces the expected DaemonSet with the correct name (RELEASE-NAME-ingress-nginx-controller). The assertions for document count and kind are clear and effective.

18-26: Test: Metrics Disabled Argument Injection
The test verifies that when controller.metrics.enabled is false, the container arguments include --enable-metrics=false. This helps ensure that metrics are correctly toggled off when required.

27-35: Test: Omission of Metrics Argument When Enabled
By asserting the absence of --enable-metrics=false when metrics are enabled, the test confirms that unnecessary flags are not added.

36-44: Test: Custom Controller Class Argument
The test checks that providing controller.ingressClassResource.controllerValue (with the value k8s.io/ingress-nginx-internal) correctly adds the corresponding argument in the container.

45-57: Test: Resource Limits Configuration
The assertions confirm that the specified CPU and memory limits (500m and 512Mi respectively) are applied to the container, ensuring proper resource allocation.

58-98: Test: Topology Spread Constraints
This test ensures that custom topology spread constraints are effectively applied to the Pod specification. The transformation of label selectors to fixed values (ingress-nginx and RELEASE-NAME) appears intentional; please verify that this mapping fulfills your deployment expectations.

99-141: Test: Affinity Settings
The affinity configuration is extensively checked to ensure proper pod anti-affinity rules. The assertions confirm that the expected label selectors and topology keys are set correctly.

142-152: Test: Custom Registry Image
This test confirms that setting a custom controller.image.registry along with custom tag and digest results in the expected fully qualified image string. The resulting image is constructed correctly.

153-163: Test: Custom Image Field Usage
When using the alternative image configuration via controller.image.image, the test validates that the image URL is prefixed with registry.k8s.io/ and formatted with the provided tag and digest.

164-173: Test: Custom Tag Override
This test verifies that overriding the image tag (to custom-tag) updates the final image string correctly while retaining the digest and registry values.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-extra-modules-values.yaml (4)

1-6: Controller Image Configuration for Deployment
The image configuration for the controller is consistent with other deployment settings. Note that the digest remains null; ensure that this behavior is intentional (for example, to allow digest injection later in the pipeline).

7-9: Service Configuration
Setting the service type to ClusterIP is clear and adheres to standard deployment practices for this component.

10-10: Deployment Kind Specification
Explicitly designating the kind as Deployment helps differentiate this configuration from DaemonSet-based deployments.

12-31: Extra Modules: Opentelemetry Configuration
The new extraModules section for opentelemetry is well detailed. The image configuration, including registry, image name, tag, and digest, is precise. The additional security context enforces best practices by running as a non-root user, disabling privilege escalation, and applying a strict seccomp profile along with capability drops and a read-only filesystem. This configuration strengthens container security and aligns well with modern container deployment standards.

packages/system/ingress-nginx/charts/ingress-nginx/templates/_helpers.tpl (1)

205-207: Improved comment documentation

The comment has been updated to more clearly describe the purpose of the function that follows. This change improves the documentation by simply stating that this is the "default backend service account to use" rather than the previous comment which may have been confusing or limiting.

packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-deployment_test.yaml (3)

164-173: Enhanced test coverage for custom registry configuration

This test case ensures that when a custom registry is specified via controller.image.registry, the Deployment correctly uses that registry in the image path. This is a valuable addition that verifies the configurability of the Helm chart.

174-183: Enhanced test coverage for custom image configuration

Good addition of a test case that verifies the Deployment correctly uses a custom image when controller.image.image is specified. This test ensures that users can override the default image while maintaining the expected format.

184-191: Enhanced test coverage for custom tag configuration

This test case confirms that when a custom tag is specified via controller.image.tag, the Deployment correctly incorporates that tag in the image path. This completes the set of tests for image customization options.

packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-configmap_test.yaml (2)

19-21: Updated test configuration parameters

The test configuration has been updated to use more generic parameter types (template, integer, boolean) instead of specific configuration keys. This change makes the test more focused on verifying the templating functionality rather than specific config parameters.

24-31: Updated assertions to match new parameters

The assertion paths and expected values have been correctly updated to match the new configuration parameters. The test now properly verifies:

  1. Template interpolation with the release namespace
  2. Integer-to-string conversion
  3. Boolean-to-string conversion

These changes ensure that all value types are properly handled in the ConfigMap.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-extra-modules-values.yaml (2)

1-11: Added DaemonSet configuration for testing

This new file adds configuration for testing the ingress-nginx controller as a DaemonSet. The configuration specifies the controller image details and sets the service type to ClusterIP. This is a good addition that ensures the chart works properly with DaemonSet deployments.

12-30: Well-configured extra module with strong security settings

The OpenTelemetry module configuration is well-structured with:

  1. Detailed image specification including registry, tag, and digest
  2. Robust security context settings following container security best practices:
    • Running as non-root with specific UIDs
    • Disabling privilege escalation
    • Using a RuntimeDefault seccomp profile
    • Dropping ALL capabilities
    • Enforcing a read-only root filesystem

This configuration helps ensure secure deployment of additional modules.

packages/system/ingress-nginx/charts/ingress-nginx/tests/admission-webhooks/validating-webhook_test.yaml (4)

1-4: Test Suite Definition and Template Inclusion
The suite is clearly identified as "Admission Webhooks > ValidatingWebhookConfiguration" and correctly references the supporting template. This setup looks good and aligns with the intended configuration testing.

5-12: Test Case for Disabled Admission Webhook
The first test case properly sets controller.admissionWebhooks.enabled to false and asserts that no ValidatingWebhookConfiguration documents are created (count: 0). This straightforward negative test helps ensure webhooks are not erroneously created.

13-24: Test Case for Enabled Admission Webhook
This test correctly enables admission webhooks and asserts that exactly one document is created, verifies its kind, and checks that the metadata name is templated as expected.

25-32: Test Case for Custom Service Port Configuration
The test sets a custom service port (9443) and asserts that the client configuration in the webhook reflects this change. The use of the JSON path webhooks[0].clientConfig.service.port is appropriate for verifying that dynamic configuration.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-service-values.yaml (3)

1-5: Base Controller Configuration
The image block and basic controller configuration remain unchanged and continue to look correct.

7-15: Service and NodePort Configuration
The service is now set to NodePort with clearly defined node ports for TCP and UDP. These values remain consistent with expectations.

18-23: TCP and UDP Endpoint Configuration Changes
Removing the quotation marks around the values (e.g. changing from "default/test:8080" to default/test:8080) is acceptable if these values are meant to be interpreted as strings and the YAML parser accepts this syntax. Given that colon characters in unquoted scalars can sometimes introduce ambiguity, please double-check that the YAML interpreter in your deployment context handles these correctly.

packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-servicemonitor_test.yaml (3)

1-4: ServiceMonitor Test Suite Definition
The test suite for "Controller > ServiceMonitor" is clearly defined, and the template reference to controller-servicemonitor.yaml appears correct.

5-18: Test Case for ServiceMonitor Creation
This test case enables metrics and the ServiceMonitor, then asserts that one ServiceMonitor document is generated with the correct kind and expected metadata name. The assertions are comprehensive and validate the basic resource creation properly.

19-30: Test Case for ServiceMonitor with Annotations
The second test case successfully verifies that when custom annotations are provided under controller.metrics.serviceMonitor.annotations, they are accurately reflected in the metadata annotations of the created resource. The nested key/value assertion is clear and effective.

packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-deployment-podannotations-values.yaml (4)

1-5: Controller Deployment Base Settings
The image repository, tag, and digest settings remain unchanged. These foundational settings are correct.

7-9: Service Type Configuration
The service is now configured with type ClusterIP, which is common for internal communication within the cluster. This update appears intentional within your deployment strategy.

10-11: Addition of kind: Deployment
The introduction of kind: Deployment explicitly defines the workload type, ensuring correct interpretation by Kubernetes. This change enhances clarity and consistency across configurations.

12-17: Revised Pod Annotations for Prometheus Integration
The pod annotations now specify:

  • prometheus.io/scrape: "true" to indicate scraping is enabled,
  • prometheus.io/port: "10254" to define the metrics port,
  • prometheus.io/scheme: http and
  • prometheus.io/path: /metrics to direct the metrics endpoint.
    This reordering and explicit configuration are aligned with best practices for Prometheus monitoring.
packages/system/ingress-nginx/charts/ingress-nginx/ci/controller-daemonset-podannotations-values.yaml (4)

1-5: DaemonSet Controller Base Configuration
The controller image settings remain consistent and are correctly defined.

7-9: Service Type Verification
Here the service is maintained with ClusterIP, which is typical for DaemonSet-backed configurations as well. This continues to align with your service design.

10-11: Explicit DaemonSet Kind Declaration
The new line kind: DaemonSet properly indicates the desired workload type for this configuration. This explicit declaration is important for differentiation from deployment-type strategies.

12-17: Updated Pod Annotations for Metrics
The pod annotations now configure Prometheus scraping by setting:

  • prometheus.io/scrape: "true",
  • prometheus.io/port: "10254",
  • prometheus.io/scheme: http, and
  • prometheus.io/path: /metrics.

These adjustments closely mirror analogous changes in the deployment values file, ensuring uniform observability settings across resource types.

packages/system/ingress-nginx/values.yaml (2)

7-9: Update Controller Image Configuration to New Version.
The controller’s image is now set to cozystack/ingress-nginx-with-protobuf-exporter/controller with tag v1.11.5 and an updated digest, which aligns with the release objectives. Please confirm that the registry change and digest update are properly tested in your deployment pipelines.

19-19: Update Protobuf Exporter Image Configuration.
The protobuf-exporter image reference has been updated to use the new repository and version (v1.11.5 with the new digest). This change appears to reflect the latest release requirements.

packages/system/ingress-nginx/charts/ingress-nginx/tests/controller-service-webhook_test.yaml (3)

6-12: Test for Webhook Service Absence when Disabled.
This test correctly validates that no webhook Service is created when controller.admissionWebhooks.enabled is set to false.

13-24: Test for Webhook Service Creation with Default Port.
The test properly verifies that enabling admission webhooks results in a Service with the expected kind and name. Ensure that the default behavior is consistent with the template expectations.

25-33: Test for Webhook Service Creation with Custom Port.
This test confirms that setting controller.admissionWebhooks.service.servicePort to a custom value (9443) is correctly rendered in the service configuration.

packages/system/ingress-nginx/charts/ingress-nginx/tests/default-backend-serviceaccount_test.yaml (4)

6-13: Test for Absence of ServiceAccount.
The test validates that when defaultBackend.serviceAccount.create is false, no ServiceAccount is created, which is the intended behavior.

14-26: Test for Default ServiceAccount Creation.
This test ensures that enabling defaultBackend.serviceAccount.create results in a single ServiceAccount with the expected kind and default name.

27-39: Test for ServiceAccount Creation with Custom Name.
The configuration correctly overrides the default name when defaultBackend.serviceAccount.name is set. The assertions confirm that the custom name is applied.

40-52: Test for ServiceAccount with Token Auto-Mounting Disabled.
This test confirms that setting defaultBackend.serviceAccount.automountServiceAccountToken to false correctly reflects in the ServiceAccount specification.

packages/system/ingress-nginx/charts/ingress-nginx/tests/default-backend-poddisruptionbudget_test.yaml (4)

6-18: Test for PodDisruptionBudget Creation with Sufficient Replica Count.
This test verifies that when defaultBackend.replicaCount is greater than 1, a PodDisruptionBudget is created with the expected kind and metadata name.

19-26: Test for Absence of PodDisruptionBudget with Low Replica Count.
This test confirms that no PodDisruptionBudget is created when the replica count is set to 1, which is the expected behavior.

27-40: Test for PodDisruptionBudget Creation Under Autoscaling Conditions.
The autoscaling configuration is properly validated here—the test checks that when autoscaling is enabled and minReplicas is greater than 1, a PodDisruptionBudget is created.

41-49: Test for Absence of PodDisruptionBudget with Minimal Autoscaling Replicas.
This test ensures that when autoscaling is enabled but minReplicas is 1, no PodDisruptionBudget is rendered.

packages/system/ingress-nginx/charts/ingress-nginx/README.md (1)

5-5: Update Version and AppVersion Badges.
The version badges have been updated to 4.11.5 and 1.11.5, maintaining consistency with the updated image configurations and overall release version.

packages/system/ingress-nginx/charts/ingress-nginx/values.yaml (6)

29-31: Update: Controller image tag and digest updates.
The controller image has been updated to use tag "v1.11.5" with new digest values for both digest and digestChroot. Verify that these values correctly correspond to the new image version.

197-197: Update: Corrected Maxmind documentation URL.
The documentation comment now reflects the URL with the date modified from 2019/12/18 to 2019/12, which aligns with the intended correction.

713-713: Update: Opentelemetry image name revised.
The opentelemetry image identifier is now specified as "ingress-nginx/opentelemetry-1.25.3", reflecting the updated version name.

717-718: Update: Opentelemetry image tag and digest updated.
The new tag "v20240813-b933310d" along with its SHA256 digest has been set. Please confirm that these values match the intended release and that the image is available as expected.

811-812: Update: Webhook patch image tag and digest updated.
The patch image now uses tag "v1.5.2" with the corresponding updated SHA256 digest. This update ensures that the webhook patch component is aligned with the latest release.

1102-1102: Info: PodDisruptionBudget reminder comment added.
The newly added comment regarding the "Minimum available pods" for the PodDisruptionBudget serves as a reminder. Ensure that the configured minAvailable aligns with your availability targets.

@kvaps

Andrei Kvapil (kvaps) commented Apr 2, 2025

Copy link
Copy Markdown
Member

Added into release-0.28 branch (see dcacb2b)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments
@kvaps Andrei Kvapil (kvaps) Awaiting requested review from kvaps kvaps is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@lllamnyp @kvaps @NickVolynkin