Update Kamaji to edge-25.4.1 - #953
Conversation
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
WalkthroughThis update enhances Kamaji's Kubernetes CRDs with stricter OpenAPI validation rules, new descriptive fields, and additional deployment status tracking. Helm templates are revised to shift Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Helm
participant Kubernetes API
participant Kamaji Controller
User->>Helm: Install/upgrade Kamaji chart
Helm->>Kubernetes API: Apply CRDs (with new validations)
Helm->>Kubernetes API: Deploy ServiceAccount (with imagePullSecrets if set)
Helm->>Kubernetes API: Deploy Controller (no imagePullSecrets in pod spec)
Kubernetes API->>Kamaji Controller: Enforce new CRD schema and status fields
Poem
Note ⚡️ AI Code Reviews for VS Code, Cursor, WindsurfCodeRabbit now has a plugin for VS Code, Cursor and Windsurf. This brings AI code reviews directly in the code editor. Each commit is reviewed immediately, finding bugs before the PR is raised. Seamless context handoff to your AI code agent ensures that you can easily incorporate review feedback. Note ⚡️ Faster reviews with cachingCodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (2)
packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml (2)
1821-1821: Duplicate: Add validation pattern for C_IDENTIFIER onprefix
Same suggestion as above to enforce the C_IDENTIFIER constraint via a regex.
2070-2075: Duplicate: Enforce feature gate forstopSignal
Apply the same feature-gate annotation in this section to avoid schema errors on clusters without the alpha flag.
🧹 Nitpick comments (6)
packages/system/kamaji/values.yaml (1)
6-6: Use explicit versioned tag instead oflatestfor reproducibility
Using thelatesttag can lead to non-deterministic deployments. Consider pinning to a specific version—e.g.edge-25.4.1@sha256:…—to ensure consistent image pulls across environments.packages/system/kamaji/images/kamaji/Dockerfile (1)
2-2: Go base image bump to 1.24
Upgrading togolang:1.24aligns the build with the latest Go toolchain. For immutability and security, consider pinning to an image digest or explicit variant (e.g.,golang:1.24@sha256:…).packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml (1)
269-283: Add CEL validations for driver-specific TLS and auth
The newx-kubernetes-validationsblock enforces:
- For
etcd: mandatory TLS fields (CA, client cert, private key).- For non-
etcd: require at least one oftlsConfigorbasicAuthwith valid content.
These rules harden the schema against misconfigurations. Optionally, you could add a rule to explicitly forbidbasicAuthwhendriver == "etcd"for clarity.packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml (3)
450-450: Add validation pattern for C_IDENTIFIER onprefix
To enforce the C_IDENTIFIER constraint, add a regex pattern so invalid prefixes are rejected at validation time.prefix: description: Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER. + pattern: '^[A-Za-z_][A-Za-z0-9_]*$' type: string
4102-4102: Clarify K8ssubPathterminology
The term “sub path” should match the field namesubPathfor consistency with API docs.- Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33. + 'subPath' mounts for containers are not supported (spec.containers[*].volumeMounts.subPath) before 1.33.
7392-7392: Consider ordering enum values alphabetically or by lifecycle
Reordering the status values (e.g., Ready, NotReady, Migrating, Sleeping) can improve readability and maintenance.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (6)
packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml(2 hunks)packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml(11 hunks)packages/system/kamaji/charts/kamaji/templates/controller.yaml(0 hunks)packages/system/kamaji/charts/kamaji/templates/rbac.yaml(1 hunks)packages/system/kamaji/images/kamaji/Dockerfile(1 hunks)packages/system/kamaji/values.yaml(1 hunks)
💤 Files with no reviewable changes (1)
- packages/system/kamaji/charts/kamaji/templates/controller.yaml
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Build and Test
🔇 Additional comments (7)
packages/system/kamaji/charts/kamaji/templates/rbac.yaml (1)
12-15: Conditional imagePullSecrets for ServiceAccount
The new block correctly renders.Values.imagePullSecretsonly when defined, shiftingimagePullSecretsconfiguration from the controller pod spec to the ServiceAccount. Indentation and placement align with the Kubernetes ServiceAccount schema.packages/system/kamaji/images/kamaji/Dockerfile (1)
4-4: Update build ARGVERSIONtoedge-25.4.1
Pointing the build toedge-25.4.1ensures the correct GitHub tag is fetched and built, matching the Helm chart and values updates.packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_datastores.yaml (1)
123-125: Enforce driver field immutability
The added CEL validationself == oldSelfprevents changes to thedriverafter creation. Verify that target clusters run Kubernetes ≥1.25 so thatx-kubernetes-validationsCEL rules are supported.packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml (4)
430-430: Approve addition ofEnvFromSourcedescription
Adding a concise description forEnvFromSourceimproves discoverability and aligns with other CRD schemas.
1801-1801: Approve addition ofEnvFromSourcedescription (infra context)
Consistent with the upper section, this description clarifies the source of ConfigMaps and Secrets.
7076-7076: Approve enhanced description foravailableReplicas
This clarifies the metric being reported and matches Kubernetes terminology.
7160-7160: Approve enhanced description forupdatedReplicas
The new wording clearly describes the meaning ofupdatedReplicas.
| stopSignal: | ||
| description: |- | ||
| StopSignal defines which signal will be sent to a container when it is being stopped. | ||
| If not specified, the default is defined by the container runtime in use. | ||
| StopSignal can only be set for Pods with a non-empty .spec.os.name | ||
| type: string |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Enforce feature gate for stopSignal
Since stopSignal is an alpha feature, include the Kubernetes feature gate annotation to prevent schema validation failures on clusters without it.
stopSignal:
description: |-
StopSignal defines which signal will be sent to a container when it is being stopped.
type: string
+ x-kubernetes-feature-gate: PodStopSignal📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| stopSignal: | |
| description: |- | |
| StopSignal defines which signal will be sent to a container when it is being stopped. | |
| If not specified, the default is defined by the container runtime in use. | |
| StopSignal can only be set for Pods with a non-empty .spec.os.name | |
| type: string | |
| stopSignal: | |
| description: |- | |
| StopSignal defines which signal will be sent to a container when it is being stopped. | |
| If not specified, the default is defined by the container runtime in use. | |
| StopSignal can only be set for Pods with a non-empty .spec.os.name | |
| type: string | |
| x-kubernetes-feature-gate: PodStopSignal |
🤖 Prompt for AI Agents
In
packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
around lines 699 to 704, the stopSignal field is an alpha feature and requires a
Kubernetes feature gate annotation to avoid schema validation errors on clusters
where the feature is disabled. Add the appropriate feature gate annotation
(e.g., kubernetes.io/feature-gates: "StopSignal=true") to the stopSignal field
definition to enforce this requirement.
| terminatingReplicas: | ||
| description: |- | ||
| Total number of terminating pods targeted by this deployment. Terminating pods have a non-null | ||
| .metadata.deletionTimestamp and have not yet reached the Failed or Succeeded .status.phase. | ||
|
|
||
| This is an alpha field. Enable DeploymentReplicaSetTerminatingReplicas to be able to use this field. | ||
| format: int32 | ||
| type: integer |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add feature gate for terminatingReplicas
This field is alpha and requires the cluster feature gate; annotate it accordingly to avoid validation issues.
terminatingReplicas:
description: |-
Total number of terminating pods targeted by this deployment. Terminating pods have a non-null
.metadata.deletionTimestamp and have not yet reached the Failed or Succeeded .status.phase.
This is an alpha field. Enable DeploymentReplicaSetTerminatingReplicas to be able to use this field.
format: int32
type: integer
+ x-kubernetes-feature-gate: DeploymentReplicaSetTerminatingReplicas📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| terminatingReplicas: | |
| description: |- | |
| Total number of terminating pods targeted by this deployment. Terminating pods have a non-null | |
| .metadata.deletionTimestamp and have not yet reached the Failed or Succeeded .status.phase. | |
| This is an alpha field. Enable DeploymentReplicaSetTerminatingReplicas to be able to use this field. | |
| format: int32 | |
| type: integer | |
| terminatingReplicas: | |
| description: |- | |
| Total number of terminating pods targeted by this deployment. Terminating pods have a non-null | |
| .metadata.deletionTimestamp and have not yet reached the Failed or Succeeded .status.phase. | |
| This is an alpha field. Enable DeploymentReplicaSetTerminatingReplicas to be able to use this field. | |
| format: int32 | |
| type: integer | |
| x-kubernetes-feature-gate: DeploymentReplicaSetTerminatingReplicas |
🤖 Prompt for AI Agents
In
packages/system/kamaji/charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
around lines 7144 to 7151, the terminatingReplicas field is alpha and requires
the DeploymentReplicaSetTerminatingReplicas feature gate. Add the appropriate
feature gate annotation to this field's schema to indicate it is gated, ensuring
validation tools recognize the requirement and avoid errors.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added new validation rules to enforce stricter configuration requirements for datastore drivers and authentication fields. - Introduced a new field to specify stop signals for containers and a new status field to track terminating pods. - Added a new "Sleeping" status for version reporting. - **Improvements** - Updated and clarified field descriptions for environment variable sources, volume types, and deployment status. - Removed outdated beta feature gate notes from documentation. - **Bug Fixes** - Improved handling and validation of sensitive configuration fields based on driver type. - **Chores** - Updated Go base image and Kamaji version in the Dockerfile. - Changed Kamaji image tag to use the latest version. - **Refactor** - Moved imagePullSecrets configuration from the deployment to the ServiceAccount manifest for better management. <!-- end of auto-generated comment: release notes by coderabbit.ai --> (cherry picked from commit 5273722) Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
Signed-off-by: Andrei Kvapil kvapss@gmail.com
Summary by CodeRabbit
New Features
Improvements
Bug Fixes
Chores
Refactor