chore(kubernetes): refresh managed Kubernetes patch versions#3014
Conversation
Bumps every supported Kubernetes minor in the apps/kubernetes version map to its latest upstream patch, picking up the published Go-stdlib / x/net fixes in the control-plane component images: - v1.35: v1.35.1 -> v1.35.6 - v1.34: v1.34.4 -> v1.34.9 - v1.33: v1.33.8 -> v1.33.13 - v1.32: v1.32.12 -> v1.32.13 v1.31 and v1.30 already track their latest patch (.14). The major/minor enum is unchanged, so the generated values schema, CRD and README are untouched (make generate is a no-op). The version range is intentionally held at v1.30-v1.35 and does NOT advance to v1.36: KubeVirt 1.8.2 rejects the kubelet checksum on Kubernetes 1.36 (int32 CRD validation), leaving tenant VMIs stuck Scheduled. The kamaji bump to 26.6.4-edge raises KubeadmVersion to v1.36.0, so hack/update-versions.sh would otherwise add v1.36 here -- that expansion is deferred until the KubeVirt regression is fixed. The script also caps the top minor at the exact KubeadmVersion (v1.35.0); v1.35 is set to the latest patch (v1.35.6) by hand instead, matching the existing practice of running a patch above the kubeadm tool version. The OS-package advisories in the scan live in the ubuntu-container-disk worker images; those clear when the release pipeline rebuilds them on the floating ubuntu noble/current base (no source change needed -- the base is not pinned). Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe ChangesKubernetes Patch Version Bumps
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request updates the managed Kubernetes patch versions within the project configuration to ensure the control-plane components benefit from the latest upstream security and stability improvements. The changes are limited to the version mapping file, ensuring that no breaking changes are introduced to the existing infrastructure schema or generated artifacts. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request updates the Kubernetes patch versions in packages/apps/kubernetes/files/versions.yaml for versions v1.32 through v1.35. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
myasnikovdaniil
left a comment
There was a problem hiding this comment.
APPROVE — clean, correctly-scoped patch refresh.
Verified statically (no tenant cluster stood up, per scope):
- Versions are real and latest-in-minor.
registry.k8s.io/kube-apiserverreturns 200 for v1.35.6 / v1.34.9 / v1.33.13 / v1.32.13, and the next patch in each minor (v1.35.7 / v1.34.10 / v1.33.14 / v1.32.14) is 404 — so these are the current latest patches. v1.31.14 / v1.30.14 are also confirmed latest and correctly left unchanged. The string resolves to the kamaji TenantControlPlaneversion:(templates/cluster.yaml:216) which maps to existing control-plane images. - 1.36 exclusion is genuine. No 1.36 key was added. #2769 is OPEN and matches the cited root cause; the repo ships KubeVirt v1.8.2 (
packages/system/kubevirt-operator/Makefile:10,templates/kubevirt-operator.yaml:8539-8546). Good call hand-editing the map rather than runninghack/update-versions.sh, which would cap the top minor at kamaji'sKubeadmVersion(downgrading v1.35) and otherwise pull 1.36. Note kamaji itself is unchanged by this PR (26.3.5-edgeon both main and head). - Purely additive, no strand risk. All six minor keys (v1.35–v1.30) are preserved; tenant CRs pin the minor (the
values.yamlenum is minor-only), so existing tenants simply get the new patch on next reconcile. - ubuntu-container-disk / OS-CVE claim is context, not in this diff — correct. Worker disk tag files are minor-keyed and rebuilt by the release pipeline from the floating
noble/currentbase; independently, workers fetch the exact patch kubelet/kubeadm at boot fromdl.k8s.io(templates/cluster.yaml:435-468), so the patch refresh takes effect at deploy time regardless of disk rebuild. - make generate is a no-op (patch-level map vs minor-level schema), consistent with the +4/-4 single-file diff. helm-unittest passes locally (129/129), matching the PR body.
No blocking findings.
What this PR does
Refreshes every supported Kubernetes minor in the
apps/kubernetesversion map (files/versions.yaml) to its latest upstream patch, picking up the published Go-stdlib /x/netfixes in the control-plane component images:v1.31.14andv1.30.14already track their latest patch. The major/minor enum is unchanged, somake generateis a no-op (the values schema, CRD and README are untouched). helm-unittest passes (129/129).Scope notes
Scheduled(tracked in KubeVirt 1.8.2 VMIs stuck in Scheduled on Kubernetes 1.36 hosts (checksum int32 CRD validation) #2769). The kamaji bump to26.6.4-edgeraisesKubeadmVersiontov1.36.0, sohack/update-versions.shwould otherwise pull v1.36 into this map — that expansion is deferred until the KubeVirt regression is fixed.hack/update-versions.shalso caps the top minor at the exactKubeadmVersion(v1.35.0), which would downgrade the currentv1.35.1.v1.35is set to the latest patch (v1.35.6) by hand instead, matching the existing practice of running a patch above the kubeadm tool version.libexpat,libpython3.13,git,python3,perl, …) live in theubuntu-container-diskworker images, built viaguestfishfrom the floatingubuntu noble/currentbase. Those clear when the release pipeline rebuilds them on the current cloud image — the base is not digest-pinned, so no source change is needed for them here.Refs #2876
Release note
Summary by CodeRabbit