Skip to content

fix: etcd auto-compaction + proxy nil-guard + operator anti-affinity - #13

Open
kamir wants to merge 61 commits into
mainfrom
fix/etcd-auto-compaction
Open

fix: etcd auto-compaction + proxy nil-guard + operator anti-affinity#13
kamir wants to merge 61 commits into
mainfrom
fix/etcd-auto-compaction

Conversation

@kamir

@kamir kamir commented May 23, 2026

Copy link
Copy Markdown
Owner

Summary

  • BUG-0014 (5698edf): metadata.cloneTopics nil-Topic guard. The proxy crash-looped at startup when an etcd metadata snapshot contained a nil-Topic entry. New code skips nil entries.
  • BUG-0012 (3ccb713, 75d255f): operator-managed broker + etcd StatefulSets carry a soft hostname anti-affinity by default. Unit tests assert exactly one preferred term + zero required terms (so single-node KIND stays schedulable).
  • etcd auto-compaction (the original branch purpose, unchanged).

Live proof (2026-05-22)

  • Proxy rc3 built from this branch: 1/1 Running, 0 restarts, no cloneTopics panic.
  • Operator rc4 built from this branch: broker + etcd STS both carry the soft anti-affinity, verified via kubectl get sts ... -o jsonpath='{.spec.template.spec.affinity}'.
  • bp-001 foundation smoke + ADR-0002 gate green against rc3 + rc4.
  • Full operator unit-test suite green.

Cross-refs

  • SAO commit efc63f2 repoints bp-001 to proxy rc3.
  • bp-001 chart pins operator rc4.
  • BUG resolutions with kubectl-quoted evidence: scalytics-all-in-one-meta/BUGS/BUG-0014-*.md, BUG-0012-*.md.

Risk

Proxy: pure defensive nil-skip. Operator: only adds a soft term; existing single-node KIND keeps every replica schedulable. etcd: pre-existing.

kamir and others added 30 commits January 31, 2026 16:43
@kamir
Improve demo test support
0270095
@kamir
Add IPv6 MetalLB e2e coverage
e9fd657
@kamir
Fix IPv6 MetalLB e2e execution path
35d3459
@novatechflow
Fix demo bootstrap + add long-running demo target (KafScale#86)
37fb73c 
<!--
Copyright 2025 Alexander Alten (novatechflow), NovaTechflow
(novatechflow.com).
This project is supported and financed by Scalytics, Inc.
(www.scalytics.io).

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->

## Summary
- Handle IPv6 kind networks when deriving MetalLB address pools.
- Add a long-running demo test target that disables go test timeout.
- Add IPv6 MetalLB e2e coverage for demo bootstrap.

## Changes
- scripts/demo-platform.sh: use IPv6 CIDR as the MetalLB pool when the
kind subnet is IPv6.
- Makefile: add demo-long target (go test -timeout 0).
- test/e2e/metallb_ipv6_kind_test.go: new opt-in IPv6 kind e2e test.

## Validation
- KAFSCALE_E2E=1 KAFSCALE_E2E_KIND=1 KAFSCALE_E2E_KIND_IPV6=1 go test
-tags=e2e ./test/e2e -run TestDemoPlatformMetallbIPv6 -v
@dependabot
chore(deps): bump docker/login-action from 3.6.0 to 3.7.0
189f3c8 
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@5e57cd1...c94ce9f)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.0 to 0.23.1
611966f 
Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.23.0 to 0.23.1.
- [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases)
- [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md)
- [Commits](kubernetes-sigs/controller-runtime@v0.23.0...v0.23.1)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/controller-runtime
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@novatechflow
chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.0 to 0.23.1 (
9d97825 
KafScale#90)

Bumps
[sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime)
from 0.23.0 to 0.23.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kubernetes-sigs/controller-runtime/releases">sigs.k8s.io/controller-runtime's
releases</a>.</em></p>
<blockquote>
<h2>v0.23.1</h2>
<h2>What's Changed</h2>
<ul>
<li>[release-0.23] 🐛 Cache reader: Wait for cache sync when
ReaderFailOnMissingInformer is true by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@​k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3433">kubernetes-sigs/controller-runtime#3433</a></li>
<li>[release-0.23] 🐛 Fix panic when using CRs with embedded pointer
structs by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@​k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3436">kubernetes-sigs/controller-runtime#3436</a></li>
<li>[release-0.23] 🌱 Test cache reader waits for cache sync by
<a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@​k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3438">kubernetes-sigs/controller-runtime#3438</a></li>
<li>[release-0.23] 🐛 Fakeclient: Fix status apply if existing object
has managedFields set by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@​k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3437">kubernetes-sigs/controller-runtime#3437</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.0...v0.23.1">https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.0...v0.23.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/f52bbb8bb1a2275cbe90dec8d6c12d5cacb1a7de"><code>f52bbb8</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3437">#3437</a>
from k8s-infra-cherrypick-robot/cherry-pick-3430-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/4f41337fdd898537c6633a174cd539cb2e0c4d15"><code>4f41337</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3438">#3438</a>
from k8s-infra-cherrypick-robot/cherry-pick-3434-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/e29a1b93fae5c5f22c992c57b11dcf90ccc35c53"><code>e29a1b9</code></a>
seedling: Test cache reader waits for cache sync</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/83c8dc31c46c621c336c8a7749ee41658b6d17e1"><code>83c8dc3</code></a>
bug: Fakeclient: Fix status apply if existing object has managedFields
set</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/bf6bcd55b4d5eba00273426d61db313dcd2a6c7f"><code>bf6bcd5</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3436">#3436</a>
from k8s-infra-cherrypick-robot/cherry-pick-3431-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/b6a3a46120e0232ff3e2899120b230eda240f2fd"><code>b6a3a46</code></a>
bug: Fix panic when using CRs with embedded pointer structs</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/7866fb0c7b32e8a63fe0b02a159f3eb52ebf84ad"><code>7866fb0</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3433">#3433</a>
from k8s-infra-cherrypick-robot/cherry-pick-3425-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/90b26f7be96f5845440a90d524e3ae08179fa879"><code>90b26f7</code></a>
check to see if informer is synced and started before returning
cache</li>
<li>See full diff in <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.0...v0.23.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sigs.k8s.io/controller-runtime&package-manager=go_modules&previous-version=0.23.0&new-version=0.23.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@novatechflow
Merge branch 'main' into dependabot/github_actions/docker/login-actio…
8574596 
…n-3.7.0
@novatechflow
chore(deps): bump docker/login-action from 3.6.0 to 3.7.0 (KafScale#89)
930d3c2 
Bumps [docker/login-action](https://github.com/docker/login-action) from
3.6.0 to 3.7.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/login-action/releases">docker/login-action's
releases</a>.</em></p>
<blockquote>
<h2>v3.7.0</h2>
<ul>
<li>Add <code>scope</code> input to set scopes for the authentication
token by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/912">docker/login-action#912</a></li>
<li>Add support for AWS European Sovereign Cloud ECR by <a
href="https://github.com/dphi"><code>@​dphi</code></a> in <a
href="https://redirect.github.com/docker/login-action/pull/914">docker/login-action#914</a></li>
<li>Ensure passwords are redacted with <code>registry-auth</code> input
by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a>
in <a
href="https://redirect.github.com/docker/login-action/pull/911">docker/login-action#911</a></li>
<li>build(deps): bump lodash from 4.17.21 to 4.17.23 in <a
href="https://redirect.github.com/docker/login-action/pull/915">docker/login-action#915</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/login-action/compare/v3.6.0...v3.7.0">https://github.com/docker/login-action/compare/v3.6.0...v3.7.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/login-action/commit/c94ce9fb468520275223c153574b00df6fe4bcc9"><code>c94ce9f</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/915">#915</a>
from docker/dependabot/npm_and_yarn/lodash-4.17.23</li>
<li><a
href="https://github.com/docker/login-action/commit/8339c958ce8511f38d0c474c1886a87c802bf1ef"><code>8339c95</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/912">#912</a>
from docker/scope</li>
<li><a
href="https://github.com/docker/login-action/commit/c83e9320c8beb50b77dd007c46d5c8161f0cac4a"><code>c83e932</code></a>
build(deps): bump lodash from 4.17.21 to 4.17.23</li>
<li><a
href="https://github.com/docker/login-action/commit/b268aa57e39ff0a5386d2fd1eded4e2e1d60d705"><code>b268aa5</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/login-action/commit/a60322927812ddc99316dd6252b4fba6d8f09ac1"><code>a603229</code></a>
documentation for scope input</li>
<li><a
href="https://github.com/docker/login-action/commit/7567f92a74b2639be1bd8bc932a112a0d81283da"><code>7567f92</code></a>
Add scope input to set scopes for the authentication token</li>
<li><a
href="https://github.com/docker/login-action/commit/0567fa5ae8c9a197cb207537dc5cbb43ca3d803f"><code>0567fa5</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/914">#914</a>
from dphi/add-support-for-amazonaws.eu</li>
<li><a
href="https://github.com/docker/login-action/commit/f6ef57754547a85003a0e18f789be661346d4a6e"><code>f6ef577</code></a>
feat: add support for AWS European Sovereign Cloud ECR registries</li>
<li><a
href="https://github.com/docker/login-action/commit/916386b00027d425839f8da46d302dab33f5875b"><code>916386b</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/login-action/issues/911">#911</a>
from crazy-max/ensure-redact</li>
<li><a
href="https://github.com/docker/login-action/commit/5b3f94a294ea5478af3af437baa6ad0d3dcd04fd"><code>5b3f94a</code></a>
chore: update generated content</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/login-action/compare/5e57cd118135c172c3672efd75eb46360885c0ef...c94ce9fb468520275223c153574b00df6fe4bcc9">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=3.6.0&new-version=3.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@dependabot
chore(deps): bump github/codeql-action from 4.31.11 to 4.32.0 (KafSca…
2398ab4 
…le#88)

Auto-merge Dependabot GitHub Actions bump; checks green.
@dependabot
chore(deps): bump github/codeql-action from 4.32.1 to 4.32.2 (KafScal…
6a175f6 
…e#92)

Auto-merge Dependabot update; checks are green.
@dependabot
chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.95.1…
19b3477 
… to 1.96.0 (KafScale#93)

Dependabot update merged after green checks.
@dependabot
chore(deps): bump go.etcd.io/etcd/server/v3 from 3.6.6 to 3.6.8 (KafS…
79e49f5 
…cale#103)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump docker/build-push-action from 5.4.0 to 6.19.2
1ddd045 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.4.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@ca052bb...10e90e3)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.19.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
chore(deps): bump etcd-development/etcd in /deploy/docker
203d193 
Bumps etcd-development/etcd from v3.6.7 to v3.6.8.

---
updated-dependencies:
- dependency-name: etcd-development/etcd
  dependency-version: v3.6.8
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3
5360c86 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.2 to 4.32.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@45cbd0c...9e907b5)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
chore(deps): bump github.com/modelcontextprotocol/go-sdk from 1.2.0 t…
a7fe18b 
…o 1.3.0 (KafScale#102)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump k8s.io/client-go from 0.35.0 to 0.35.1 (KafScale#101)
573b7ea 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.1 (KafSc…
2b17bd2 
…ale#100)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@novatechflow
Merge branch 'main' into dependabot/docker/deploy/docker/etcd-develop…
f22a456 
…ment/etcd-v3.6.8
@novatechflow
chore(deps): bump etcd-development/etcd from v3.6.7 to v3.6.8 in /dep…
7bf9814 
…loy/docker (KafScale#94)

Bumps etcd-development/etcd from v3.6.7 to v3.6.8.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=etcd-development/etcd&package-manager=docker&previous-version=v3.6.7&new-version=v3.6.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@novatechflow
Merge branch 'main' into dependabot/github_actions/docker/build-push-…
a07f444 
…action-6.19.2
@novatechflow
Merge branch 'main' into dependabot/github_actions/github/codeql-acti…
a5ce6a8 
…on-4.32.3
@novatechflow
chore(deps): bump docker/build-push-action from 5.4.0 to 6.19.2 (KafS…
6fcb623 
…cale#95)

Bumps
[docker/build-push-action](https://github.com/docker/build-push-action)
from 5.4.0 to 6.19.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/build-push-action/releases">docker/build-push-action's
releases</a>.</em></p>
<blockquote>
<h2>v6.19.2</h2>
<ul>
<li>Preserve port in <code>GIT_AUTH_TOKEN</code> host by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/1458">docker/build-push-action#1458</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.19.1...v6.19.2">https://github.com/docker/build-push-action/compare/v6.19.1...v6.19.2</a></p>
<h2>v6.19.1</h2>
<ul>
<li>Derive <code>GIT_AUTH_TOKEN</code> host from GitHub server URL by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/1456">docker/build-push-action#1456</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.19.0...v6.19.1">https://github.com/docker/build-push-action/compare/v6.19.0...v6.19.1</a></p>
<h2>v6.19.0</h2>
<ul>
<li>Scope default git auth token to <code>github.com</code> by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/1451">docker/build-push-action#1451</a></li>
<li>Bump brace-expansion from 1.1.11 to 1.1.12 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1396">docker/build-push-action#1396</a></li>
<li>Bump form-data from 2.5.1 to 2.5.5 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1391">docker/build-push-action#1391</a></li>
<li>Bump js-yaml from 3.14.1 to 3.14.2 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1429">docker/build-push-action#1429</a></li>
<li>Bump lodash from 4.17.21 to 4.17.23 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1446">docker/build-push-action#1446</a></li>
<li>Bump tmp from 0.2.3 to 0.2.4 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1398">docker/build-push-action#1398</a></li>
<li>Bump undici from 5.28.4 to 5.29.0 in <a
href="https://redirect.github.com/docker/build-push-action/pull/1397">docker/build-push-action#1397</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.18.0...v6.19.0">https://github.com/docker/build-push-action/compare/v6.18.0...v6.19.0</a></p>
<h2>v6.18.0</h2>
<ul>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.61.0 to 0.62.1 in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1381">docker/build-push-action#1381</a></li>
</ul>
<blockquote>
<p>[!NOTE]
<a
href="https://docs.docker.com/build/ci/github-actions/build-summary/">Build
summary</a> is now supported with <a
href="https://docs.docker.com/build-cloud/">Docker Build Cloud</a>.</p>
</blockquote>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.17.0...v6.18.0">https://github.com/docker/build-push-action/compare/v6.17.0...v6.18.0</a></p>
<h2>v6.17.0</h2>
<ul>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.59.0 to 0.61.0 by
<a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1364">docker/build-push-action#1364</a></li>
</ul>
<blockquote>
<p>[!NOTE]
Build record is now exported using the <a
href="https://docs.docker.com/reference/cli/docker/buildx/history/export/"><code>buildx
history export</code></a> command instead of the legacy export-build
tool.</p>
</blockquote>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.16.0...v6.17.0">https://github.com/docker/build-push-action/compare/v6.16.0...v6.17.0</a></p>
<h2>v6.16.0</h2>
<ul>
<li>Handle no default attestations env var by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/1343">docker/build-push-action#1343</a></li>
<li>Only print secret keys in build summary output by <a
href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a
href="https://redirect.github.com/docker/build-push-action/pull/1353">docker/build-push-action#1353</a></li>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.56.0 to 0.59.0 in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1352">docker/build-push-action#1352</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.15.0...v6.16.0">https://github.com/docker/build-push-action/compare/v6.15.0...v6.16.0</a></p>
<h2>v6.15.0</h2>
<ul>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.55.0 to 0.56.0 in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1330">docker/build-push-action#1330</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.14.0...v6.15.0">https://github.com/docker/build-push-action/compare/v6.14.0...v6.15.0</a></p>
<h2>v6.14.0</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/build-push-action/commit/10e90e3645eae34f1e60eeb005ba3a3d33f178e8"><code>10e90e3</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1458">#1458</a>
from crazy-max/git-auth-port</li>
<li><a
href="https://github.com/docker/build-push-action/commit/5262538458b1dbba30c9bd737bd974c879110196"><code>5262538</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/cd130e45cb5599aef419bf8afd66b57ed9e6ef72"><code>cd130e4</code></a>
preserve port in GIT_AUTH_TOKEN host</li>
<li><a
href="https://github.com/docker/build-push-action/commit/806c75105a1251cac8905df5dd4723b33174552c"><code>806c751</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1452">#1452</a>
from crazy-max/update-yarn</li>
<li><a
href="https://github.com/docker/build-push-action/commit/601a80b39c9405e50806ae38af30926f9d957c47"><code>601a80b</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1456">#1456</a>
from crazy-max/auth-token-dyn-host</li>
<li><a
href="https://github.com/docker/build-push-action/commit/8f7fd7c8c7c3eb0de00d0ddff2fc40be6ec64bf1"><code>8f7fd7c</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/710e33547432c0d28271c6786a7c5d06b2d47adc"><code>710e335</code></a>
derive GIT_AUTH_TOKEN host from GitHub server URL</li>
<li><a
href="https://github.com/docker/build-push-action/commit/c4ca8486a6a47db97a23379a9c7a9c0e86a954c1"><code>c4ca848</code></a>
update yarn to 4.9.2</li>
<li><a
href="https://github.com/docker/build-push-action/commit/ee4ca427a2f43b6a16632044ca514c076267da23"><code>ee4ca42</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1398">#1398</a>
from docker/dependabot/npm_and_yarn/tmp-0.2.4</li>
<li><a
href="https://github.com/docker/build-push-action/commit/f1b3bb51af7f5b69b537668d0e140572a5e992d0"><code>f1b3bb5</code></a>
chore: update generated content</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/build-push-action/compare/ca052bb54ab0790a636c9b5f226502c73d547a25...10e90e3645eae34f1e60eeb005ba3a3d33f178e8">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/build-push-action&package-manager=github_actions&previous-version=5.4.0&new-version=6.19.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@novatechflow
Merge branch 'main' into dependabot/github_actions/github/codeql-acti…
a8f11bd 
…on-4.32.3
@novatechflow
chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3 (KafScal…
2cd3b8c 
…e#96)

Bumps [github/codeql-action](https://github.com/github/codeql-action)
from 4.32.2 to 4.32.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.32.3</h2>
<ul>
<li>Added experimental support for testing connections to <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private
package registries</a>. This feature is not currently enabled for any
analysis. In the future, it may be enabled by default for Default Setup.
<a
href="https://redirect.github.com/github/codeql-action/pull/3466">#3466</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.32.3 - 13 Feb 2026</h2>
<ul>
<li>Added experimental support for testing connections to <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private
package registries</a>. This feature is not currently enabled for any
analysis. In the future, it may be enabled by default for Default Setup.
<a
href="https://redirect.github.com/github/codeql-action/pull/3466">#3466</a></li>
</ul>
<h2>4.32.2 - 05 Feb 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.1">2.24.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3460">#3460</a></li>
</ul>
<h2>4.32.1 - 02 Feb 2026</h2>
<ul>
<li>A warning is now shown in Default Setup workflow logs if a <a
href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">private
package registry is configured</a> using a GitHub Personal Access Token
(PAT), but no username is configured. <a
href="https://redirect.github.com/github/codeql-action/pull/3422">#3422</a></li>
<li>Fixed a bug which caused the CodeQL Action to fail when repository
properties cannot successfully be retrieved. <a
href="https://redirect.github.com/github/codeql-action/pull/3421">#3421</a></li>
</ul>
<h2>4.32.0 - 26 Jan 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.24.0">2.24.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/3425">#3425</a></li>
</ul>
<h2>4.31.11 - 23 Jan 2026</h2>
<ul>
<li>When running a Default Setup workflow with <a
href="https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging">Actions
debugging enabled</a>, the CodeQL Action will now use more unique names
when uploading logs from the Dependabot authentication proxy as workflow
artifacts. This ensures that the artifact names do not clash between
multiple jobs in a build matrix. <a
href="https://redirect.github.com/github/codeql-action/pull/3409">#3409</a></li>
<li>Improved error handling throughout the CodeQL Action. <a
href="https://redirect.github.com/github/codeql-action/pull/3415">#3415</a></li>
<li>Added experimental support for automatically excluding <a
href="https://docs.github.com/en/repositories/working-with-files/managing-files/customizing-how-changed-files-appear-on-github">generated
files</a> from the analysis. This feature is not currently enabled for
any analysis. In the future, it may be enabled by default for some
GitHub-managed analyses. <a
href="https://redirect.github.com/github/codeql-action/pull/3318">#3318</a></li>
<li>The changelog extracts that are included with releases of the CodeQL
Action are now shorter to avoid duplicated information from appearing in
Dependabot PRs. <a
href="https://redirect.github.com/github/codeql-action/pull/3403">#3403</a></li>
</ul>
<h2>4.31.10 - 12 Jan 2026</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.9. <a
href="https://redirect.github.com/github/codeql-action/pull/3393">#3393</a></li>
</ul>
<h2>4.31.9 - 16 Dec 2025</h2>
<p>No user facing changes.</p>
<h2>4.31.8 - 11 Dec 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.8. <a
href="https://redirect.github.com/github/codeql-action/pull/3354">#3354</a></li>
</ul>
<h2>4.31.7 - 05 Dec 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.7. <a
href="https://redirect.github.com/github/codeql-action/pull/3343">#3343</a></li>
</ul>
<h2>4.31.6 - 01 Dec 2025</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/9e907b5e64f6b83e7804b09294d44122997950d6"><code>9e907b5</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3479">#3479</a>
from github/update-v4.32.3-4bf6fa4e2</li>
<li><a
href="https://github.com/github/codeql-action/commit/1814c9fbfdacff163f64a33db0c8f4310a2075dd"><code>1814c9f</code></a>
Update changelog for v4.32.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/4bf6fa4e2d56c1f3b43ad70ef81b160be508aafa"><code>4bf6fa4</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3478">#3478</a>
from github/mbg/changelog/add-connection-test-entry</li>
<li><a
href="https://github.com/github/codeql-action/commit/9658e23e5b27239b07c69f317b820c9a6fa90080"><code>9658e23</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3476">#3476</a>
from github/henrymercer/retry-auth-errors</li>
<li><a
href="https://github.com/github/codeql-action/commit/be75dd92eac202c8797dba88d21de3d63f68ce88"><code>be75dd9</code></a>
Add changelog entry for <a
href="https://redirect.github.com/github/codeql-action/issues/3466">#3466</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/05bca54402fd346d5bb6baa7078a0b6e12cbb926"><code>05bca54</code></a>
Apply suggestion from <a
href="https://github.com/Copilot"><code>@​Copilot</code></a></li>
<li><a
href="https://github.com/github/codeql-action/commit/2d6b98c7cf7260afd6954ee7de478b21127b40f4"><code>2d6b98c</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3475">#3475</a>
from github/henrymercer/retry-auth-errors</li>
<li><a
href="https://github.com/github/codeql-action/commit/876cecb3837313f6013c27801cf22b7f3ed7ac8d"><code>876cecb</code></a>
Avoid requesting features in CCR</li>
<li><a
href="https://github.com/github/codeql-action/commit/43b46a19bec8253deaf46057ecff156567edc8bc"><code>43b46a1</code></a>
Retry API authentication errors since these can be transient</li>
<li><a
href="https://github.com/github/codeql-action/commit/8ad4b6ec58178e8dbb44a62677274b3a5916baa9"><code>8ad4b6e</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3472">#3472</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2...9e907b5e64f6b83e7804b09294d44122997950d6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4.32.2&new-version=4.32.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@dependabot
chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.7 to …
a411372 
…1.32.9 (KafScale#108)

Dependabot update merged after green checks.
@dependabot
chore(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.…
98d9a65 
…7 to 1.19.9 (KafScale#107)

Dependabot update merged after green checks.
@dependabot
chore(deps): bump github/codeql-action from 4.32.3 to 4.32.4 (KafScal…
91a8d6e 
…e#106)

Dependabot update merged after green checks.
@dependabot
chore(deps): bump github.com/twmb/franz-go from 1.20.6 to 1.20.7 (Kaf…
34e5549 
…Scale#105)

Dependabot update merged after green checks.
klaudworks and others added 27 commits February 25, 2026 08:28
@klaudworks
fix: use atomic counter in test to avoid data race with parallel uploads
4ae09e5
@novatechflow
perf: parallelize S3 segment and index uploads (KafScale#110)
1bf442e 
See KafScale#109

## Summary

- Upload `.kfs` and `.index` files concurrently in `flushLocked()` using
`errgroup`, eliminating one sequential S3 round-trip from the produce
path.

## Details

The two S3 uploads are independent — neither depends on the other's
result. `errgroup.WithContext` is used so that if one upload fails, the
other's context is cancelled promptly. The `onS3Op` callback still
reports individual per-upload timings.
@klaudworks
perf: S3 concurrency semaphore and lock-free flush uploads (KafScale#111
b1fc0da 
)
@klaudworks
fix: handle orphaned S3 segments gracefully in RestoreFromS3 and Read (…
16f6140 
…KafScale#114)
@klaudworks
fix: arm64 images contain amd64 binaries due to hardcoded TARGETARCH …
9a5cfcb 
…default (KafScale#117)
@klaudworks
cleanup: remove minio defaults from broker, pass through operator env…
446b765 
… vars (KafScale#119)
@klaudworks @novatechflow
fix: don't block all partitions while one is initializing (KafScale#118)
93c4d83 
Co-authored-by: Alexander Alten <alo.alt@me.com>
@klaudworks
fix: prevent duplicate offset assignment with etcd lease-based partit…
578b149 
…ion ownership (KafScale#123)
@klaudworks
fix: route group coordination requests to a single broker to prevent …
8f7b489 
…split brain (KafScale#125)
@novatechflow @klaudworks
ci: add explicit CodeQL workflow for PR and push (KafScale#116)
471900e 
Co-authored-by: Nico Duldhardt <36307788+klaudworks@users.noreply.github.com>
@klaudworks
feat: fetch partition routing and on-demand metadata refresh (KafScal…
5162304 
…e#126)
@klaudworks
fix: move produce tagged fields inside partition loop (KafScale#127)
3e1fb5a
@kamir @claude
feat: add KafScale onboarding examples (E10-E50) and developer guide (K…
a5b684a 
…afScale#130)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@klaudworks
cleanup / bugfix: replace hand-rolled Kafka wire protocol with franz-…
dfa5c85 
…go's kmsg (KafScale#132)
@kamir @claude
fix: broker sends error response instead of dropping connection (KafS…
3f575ae 
…cale#133)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@kamir @claude
feat: add Large File Support (LFS) subsystem (KafScale#134)
8f60792 
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@novatechflow
Security (KafScale#135)
8018c8d
@novatechflow
Novatechflow/dependabot vuln remediation (KafScale#136)
06d33bd
@novatechflow
fix(security): bump pgproto3 to patched pseudo-version (KafScale#137)
1b5dbd8
@kamir @claude
operator(etcd): enable auto-compaction + bump quota
5a78f75 
KafScale writes one etcd revision per offset update (one per produce).
Without compaction the etcd DB fills to the 2 GiB default quota in
minutes under SAO load — bp-002 BDR + bp-004 detectors + bp-001
component traffic in parallel — and the broker starts rejecting
produce with `mvcc: database space exceeded`. Recovery requires
manual `etcdctl compact + defrag + alarm disarm` per the cluster
runbook.

Add two args to every etcd container the operator manages:

  --auto-compaction-mode=periodic    # built-in periodic GC
  --auto-compaction-retention=5m     # 5 minutes of revisions kept
  --quota-backend-bytes=4294967296   # 4 GiB soft cap (default: 2 GiB)

5m of retention is plenty for crash-recovery (kafSCALE flushes
offsets at most every ~10s); 4 GiB of quota gives a comfortable
buffer between scheduled compactions on a heavy host. Both values
are static here — exposing them on the KafscaleCluster CR is a
follow-up if production needs different ratios.

Verified live: after rolling the etcd StatefulSet with the new
args, `make release-verify RC=2026.05-rc2 BPS="bp-001 bp-002 bp-004"`
flipped bp-002 fully green for the first time:

  TestSCEN_bp002_06_Replication     PASS  14.15s   (previously: hung 37s)
  TestSCEN_bp002_07_MedallionFlow   PASS  22.23s   (previously: 140s timeout)

Bonus: bp-004 InjectionScoring also passes (52s) with the healthier
broker — BUG-0003 was indirectly etcd-related on this host.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@kamir @claude
Iter-7 E-10: kafscale chart 0.4.1 — PSA-restricted securityContext
8cd0508 
PLAN-06 iter-7 E-10 / BUG-0009. The operator, console, and proxy
container images already run as USER 10001 (Dockerfile-baked, every
*.Dockerfile under deploy/docker/) but the chart templates did not
declare the four PSA-restricted requirements, so deployments warned
under `pod-security.kubernetes.io/audit: restricted`.

Templates extended:
  * operator-deployment.yaml: pod-level + container-level
    securityContext blocks wired to .Values.operator.podSecurityContext
    and .Values.operator.containerSecurityContext.
  * console-deployment.yaml: same shape under .Values.console.*.
  * proxy-deployment.yaml: same shape under .Values.proxy.*.

values.yaml defaults (all three components):
  * podSecurityContext: runAsNonRoot=true, runAsUser=10001,
    runAsGroup=10001, fsGroup=10001, seccompProfile=RuntimeDefault.
  * containerSecurityContext: allowPrivilegeEscalation=false,
    readOnlyRootFilesystem=true, capabilities.drop=[ALL].

Result, verified against the bp-001 umbrella with helm template:
admission emits the operator + console + proxy pod specs cleanly
under PSA `restricted` (zero warnings). The brokers themselves are
operator-reconciled, not chart-templated; broker hardening is a
follow-up that touches the operator binary, not this chart.

Chart bump 0.4.0 -> 0.4.1.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@kamir @claude
Iter-7 E-14: proxy default anti-affinity + topologySpreadConstraints …
529551d 
…hook

PLAN-06 iter-7 E-14 / G-007. The chart-templated proxy is the only
multi-replica workload bp-001 controls through this chart (operator-
managed brokers + etcd are tracked in BUG-0012). Defaults match the
soft-anti-affinity shape we want everywhere:

  * podAntiAffinity / preferredDuringSchedulingIgnoredDuringExecution,
    weight 100, topologyKey kubernetes.io/hostname. Soft so single-
    node KIND clusters still schedule both proxy replicas; flip to
    requiredDuring in a multi-node production overlay.
  * topologySpreadConstraints: [] by default; populate per-cluster
    when multi-zone topology is available.

Templates extended:
  * proxy-deployment.yaml: added topologySpreadConstraints hook
    next to the existing affinity hook (both gated by `with`).

Chart bump 0.4.1 -> 0.4.2.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@kamir @claude
Iter-7 E-15: wire LFS HTTP listener in kafscale chart (closes BUG-000…
d233ed2 
…8 chart-layer)

PLAN-06 iter-7 E-15 / BUG-0008. The proxy binary already supports
KAFSCALE_LFS_PROXY_HTTP_ADDR; main.go starts the LFS HTTP server
on that addr when set. The chart never wired the env var, which is
why bp-001 has been shipping the `kafscaleProxyStub` nginx as a
workaround for kafclaw's group/join `/lfs/produce` requirement.

This commit adds (gated by `.Values.proxy.lfs.http.enabled`, default
false to preserve existing-install behaviour):

  * KAFSCALE_LFS_PROXY_HTTP_ADDR env on the proxy container, set
    to `:<.Values.proxy.lfs.http.port>` (default 8081).
  * `lfs-http` named containerPort on the proxy Deployment.
  * `lfs-http` named port on the proxy Service.

bp-001 stub deletion + kafclaw URL flip is the paired iter-8 work
(sequenced as iter-8 E-18 alongside the other stub replacements).

Chart bump 0.4.2 -> 0.4.3.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@kamir @claude
fix(proxy): guard nil topic name in cloneTopics — BUG-0014
5698edf 
The proxy crashed at startup with a nil-pointer panic in
metadata.cloneTopics (store.go:199, `*topic.Topic`) on the
refreshSnapshot -> Update -> cloneMetadata path. A metadata entry with
a nil Topic pointer (e.g. from a partial etcd CreateTopics write
interrupted by an etcd NOSPACE window — BUG-0015) crashed every proxy
replica, which is why bp-001 had to pin the proxy to the older
single-arch `dev` image instead of the multi-arch scalytics build.

Fix: skip malformed nil-Topic entries when cloning the metadata
snapshot instead of dereferencing them. A nameless topic is unusable
and is dropped from the snapshot rather than taking down the proxy.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@kamir @claude
feat(operator): soft pod anti-affinity on broker + etcd StatefulSets …
3ccb713 
…— BUG-0012

Operator-managed broker and etcd StatefulSets shipped with no anti-affinity,
so all replicas could schedule onto one node and a single node loss took out
the whole quorum. Add a preferred (soft) podAntiAffinity over each
StatefulSet's own pod labels keyed on kubernetes.io/hostname. Soft so the
single-node KIND demo still schedules every replica; on a multi-node cluster
the scheduler spreads them.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@kamir @claude
test(operator): assert soft anti-affinity on broker + etcd STS — BUG-…
75d255f 
…0012

Locks in the BUG-0012 fix: both operator-built StatefulSets must carry the
preferred (soft) hostname anti-affinity, and must NOT carry a required term
(which would strand replicas on single-node KIND).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@kamir
fix(proxy): close PLAN-03 unknown-topic + readiness gap
65347c2 
Two coupled fixes that together let AdminClient.CreateTopics + producer
auto-create-on-metadata work through the proxy:

1. setReady(true) now also fires from refreshMetadataCache() when etcd
   returns >=1 broker. The legacy gate at main.go:163 only set ready
   when KAFSCALE_PROXY_BACKENDS env was non-empty, so operator-managed
   deployments (which leave that env unset) stayed not-ready forever and
   served the not-ready stub (ControllerID=-1, REQUEST_TIMED_OUT per
   topic) on every metadata request.

2. handleMetadata now calls store.CreateTopic for any unknown topic in
   the request (gated on KAFSCALE_AUTO_CREATE_TOPICS, default true).
   Previously the proxy served metadata from its own etcd-backed cache
   and never forwarded to the broker, so the broker's
   auto-create-on-metadata path (cmd/broker/main.go:130-150) was never
   reached. Store is etcd-backed, so CreateTopic via the proxy is
   visible to every broker immediately.

Live proof (2026-05-23, dev cluster):
  $ kubectl run seed-topics --image=...:rc2 -- --topics=a,b,c
    seed-topics: a, created   b, created   c, created
  $ kafka-topics --bootstrap-server ops-foundation-proxy:9092 --list
    a, b, c, qip.bronze.questions.raw, qip.silver.questions.enriched, ...
  $ kubectl logs ops-foundation-proxy
    msg="auto-created topic via metadata request" topic=qip.bronze.questions.raw partitions=1
    (6 such lines, one per bp-002 medallion topic)

Required chart-side companion (SAO commit follows): set
`kafscale.proxy.backends: [<broker-fqdn>:9092]` in bp-001 values so the
proxy ALSO marks itself ready at startup via the legacy env path,
without waiting for the 30-second etcd refresh.

Closes the Track B blocker from REVIEWS/2026-05-23-charly-v2-confirmation-to-ceo.md.
Local-only commit per user request; PR after end-to-end verification.
@kamir

kamir commented May 23, 2026

Copy link
Copy Markdown
Owner Author

Added commit 65347c2 (PLAN-03 close).

Two more proxy changes in cmd/proxy/main.go:

  1. refreshMetadataCache now marks setReady(true) when etcd has at least one broker. The legacy gate only fired when KAFSCALE_PROXY_BACKENDS env was non-empty; operator-managed deployments (which leave that env unset) stayed not-ready forever and returned ControllerID=-1 + REQUEST_TIMED_OUT on every metadata request.
  2. handleMetadata calls store.CreateTopic for any unknown topic in the request (gated on KAFSCALE_AUTO_CREATE_TOPICS, default true). The broker's metadata handler already auto-creates, but the proxy was serving from its own etcd-backed store and never forwarding to a broker. Etcd is shared, so CreateTopic via the proxy is visible to every broker.

Live proof: kadm.CreateTopics through the proxy now succeeds; kafka-topics --list returns the catalog; make demo-gate-1 is 12/12 packages green on a fresh KIND cluster.

PLAN-03 spec: scalytics-all-in-one-meta/PLAN/03-platform-createtopics-fix.md.

The earlier commits (BUG-0014 nil-guard, BUG-0012 anti-affinity + tests, etcd auto-compaction) remain unchanged.

kamir and others added 2 commits June 1, 2026 20:39
@kamir @claude
kafscale 0.4.4: proxy-service honours service.nodePort (ADR-0002)
92d6729 
proxy-service.yaml rendered no nodePort, so the proxy got a random NodePort and
the Kind host:9092->30092 mapping never reached it. Render spec.ports[0].nodePort
when service.type=NodePort and nodePort is set, so the proxy can be pinned to
30092. ADR-0002: proxy is the only Kafka entrypoint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@kamir @claude
ci(docker): drop the stale lfs-proxy image build
9c68973 
LFS moved into the broker/console (internal/console/lfs_*.go) and
deploy/docker/lfs-proxy.Dockerfile was deleted, but the docker.yml matrix
still built kafscale-lfs-proxy from that missing file (a dead, conflicting
build to GHCR). Remove the matrix entry; a dedicated LFS image conflicts
with the in-broker LFS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kamir @novatechflow @klaudworks