chore(deps): take the drift on the five charts kx owns alone - #30
Merged
Conversation
The customManagers made 32 pins visible; ten are behind. These are the
five that can move here without anything else moving first.
argo-cd 9.5.14 -> 10.3.0 app v3.4.2 -> v3.5.0
kube-prometheus-stack 85.1.2 -> 88.2.0 prometheus-operator v0.93.0
cloudnative-pg 0.28.2 -> 0.29.0 operator 1.29.1 -> 1.30.0
trust-manager v0.22.1 -> v0.24.0
nats 2.14.0 -> 2.14.4
The split is not arbitrary. mirror-check holds kx's charts equal to a
pinned eks-gitops commit, so bumping a mirrored chart here alone breaks
that comparison. These five are declared kx-only in stack/upstream.json,
which is exactly why nothing was watching them and exactly why they can
move independently. The other five behind — cilium, opencost,
opentelemetry-collector, reloader, trivy-operator — are mirrored and have
to move on both sides together.
argo-cd crosses a chart major. Chart 10.0.0's single breaking change is
`global.networkPolicy.create` false -> true, which is live here because
cilium runs policyEnforcementMode default. Every rendered policy was
checked against kx's own values: argocd-server is `ingress: - {}`, dex and
commit-server are gated off, all policies are Ingress-only, and
defaultDenyIngress stays false. 10.3.0 carries the same appVersion as
10.2.3, so it is chart-only changes on top of the release that analysis
covered.
Every slice renders: scripts/render-check.sh templates all 33 with the
real pinned versions and values, and passes. yamllint, shellcheck and the
new coverage gate are clean.
Found while rendering, and not fixed here: `grafana/tempo` 1.24.4 is
`deprecated: true` upstream. eks-gitops pins the same chart at the same
version, so it is an org-wide question, and the successor
(`tempo-distributed`) is a different topology rather than a drop-in.
Renovate will go on offering 1.24.x patches and will never say the line is
dead — a currency instrument reporting "current" on a deprecated chart.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The customManagers from #29 made 32 pins visible. Ten are behind. These are the five that can move here without anything else moving first.
Why these five and not the other five
mirror-checkholds kx's charts equal to a pinned eks-gitops commit, so bumping a mirrored chart here alone breaks that comparison. These five are declared kx-only instack/upstream.json— which is exactly why nothing was watching them, and exactly why they can move independently.The other five behind (
cilium,opencost,opentelemetry-collector,reloader,trivy-operator) are mirrored and have to move on both sides together.ciliumin particular is 1.19.6 → 1.20.0, which is the release the IPv6 decision was parked on — that wants its own change and your call, not a drive-by bump.The one that crosses a major
Chart 10.0.0's single breaking change is
global.networkPolicy.createfalse → true. That is live here, because cilium runspolicyEnforcementMode: default. Every rendered policy was checked against kx's own values and none bites:argocd-serverisingress: - {}, dex and commit-server are gated off, all policies areIngress-only, anddefaultDenyIngressstays false.10.3.0 carries the same appVersion as 10.2.3 (v3.5.0), so it is chart-only changes on top of the release that analysis already covered.
Verification
scripts/render-check.shtemplates all 33 slices with the real pinned versions and values — passes.yamllint,shellcheckand the new coverage gate all clean.Found while rendering, not fixed here
grafana/tempo1.24.4 isdeprecated: trueupstream.eks-gitopspins the same chart at the same version, so this is an org-wide question, and the successortempo-distributedis a different topology rather than a drop-in.Worth naming as its own defect shape: Renovate will go on offering 1.24.x patches forever and will never say the chart line is dead. A currency instrument reporting "current" on a deprecated chart is the same class as everything else this campaign has been closing.