Skip to content

fix(deps): bump loft-sh/kubernetes from 77fe896 to dff9087 in /pkg/fsutil/configmanager/vcluster - #8060

Draft
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/docker/pkg/fsutil/configmanager/vcluster/loft-sh/kubernetes-dff9087
Draft

dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/docker/pkg/fsutil/configmanager/vcluster/loft-sh/kubernetes-dff9087

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

Why

The pinned vCluster Kubernetes image has a refreshed build, but its update is blocked by chart checks that use an unsupported Helm 4 option.

What

Adopt the refreshed image and keep the chart checks working with Helm 3 and Helm 4 while preserving release-health and ownership safeguards.

Part of #8073

Bumps loft-sh/kubernetes from `77fe896` to `dff9087`.

---
updated-dependencies:
- dependency-name: loft-sh/kubernetes
  dependency-version: v1.37.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@ksail-bot
ksail-bot Bot enabled auto-merge (squash) October 29, 2026 17:14
@github-actions

github-actions Bot commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

✅⚠️MegaLinter analysis: Success with warnings

⚠️ BASH / bash-exec - 1 error
Results of bash-exec linter (version 5.3.9)
See documentation on https://megalinter.io/10.1.0/descriptors/bash_bash_exec/
-----------------------------------------------

✅ [SUCCESS] .github/actions/cleanup-hetzner/cleanup-hetzner.sh
✅ [SUCCESS] .github/actions/cleanup-hetzner/cleanup-hetzner.test.sh
✅ [SUCCESS] .github/actions/free-disk-space/free-disk-space.sh
✅ [SUCCESS] .github/actions/ksail-cluster/hetzner-inventory-config.sh
✅ [SUCCESS] .github/actions/ksail-system-test/autoscaler-audit-trial.sh
✅ [SUCCESS] .github/actions/ksail-system-test/calico-migration.sh
✅ [SUCCESS] .github/actions/ksail-system-test/calico-migration.test.sh
✅ [SUCCESS] .github/actions/ksail-system-test/chart-values-drift.sh
✅ [SUCCESS] .github/actions/ksail-system-test/helm-values-precedence.sh
✅ [SUCCESS] .github/actions/ksail-system-test/offline-ecr-upstream.sh
✅ [SUCCESS] .github/actions/ksail-system-test/offline-ecr-upstream.test.sh
✅ [SUCCESS] .github/actions/ksail-system-test/talos-kubernetes-upgrade.sh
✅ [SUCCESS] .github/actions/ksail-system-test/verify-offline-ecr-pull.sh
✅ [SUCCESS] .github/actions/ksail-system-test/verify-offline-ecr-pull.test.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/install-with-recovery.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/install-with-recovery.test.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/reject-remote-kustomize-resources.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/remote-resource-guard.test.sh
✅ [SUCCESS] .github/actions/pull-registry-image/pull-registry-image.sh
✅ [SUCCESS] .github/actions/rate-limit-gate/wait-for-rate-limit.sh
✅ [SUCCESS] .github/actions/rate-limit-gate/wait-for-rate-limit.test.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/cache-validation.test.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/mirror-artifact.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/pull-helper-image.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/pull-helper-image.test.sh
✅ [SUCCESS] .github/scripts/assert-gitops-deployed.sh
✅ [SUCCESS] .github/scripts/assert-gitops-deployed.test.sh
✅ [SUCCESS] .github/scripts/assert-k3k-server-creator.sh
✅ [SUCCESS] .github/scripts/assert-k3k-server-creator.test.sh
✅ [SUCCESS] .github/scripts/build-calico-migration-baseline.sh
✅ [SUCCESS] .github/scripts/cask-pr-handoff-workflow.test.sh
✅ [SUCCESS] .github/scripts/cask-rendering.test.sh
✅ [SUCCESS] .github/scripts/check-eks-capacity.sh
✅ [SUCCESS] .github/scripts/check-eks-capacity.test.sh
✅ [SUCCESS] .github/scripts/codeql-autobuild-prepare.sh
✅ [SUCCESS] .github/scripts/codeql-autobuild-prepare.test.sh
✅ [SUCCESS] .github/scripts/codeql-source.sh
✅ [SUCCESS] .github/scripts/collect-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/collect-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/delete-eks-smoke-cluster.sh
✅ [SUCCESS] .github/scripts/delete-eks-smoke-cluster.test.sh
✅ [SUCCESS] .github/scripts/delete-old-workflow-runs.sh
✅ [SUCCESS] .github/scripts/delete-old-workflow-runs.test.sh
✅ [SUCCESS] .github/scripts/download-go-modules.sh
✅ [SUCCESS] .github/scripts/eks-report-test-lib.sh
✅ [SUCCESS] .github/scripts/find-merged-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/find-merged-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/finish-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/finish-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/install-release.test.sh
✅ [SUCCESS] .github/scripts/list-link-check-files.sh
✅ [SUCCESS] .github/scripts/profile-codeql-cohort.sh
✅ [SUCCESS] .github/scripts/profile-codeql-compare.sh
✅ [SUCCESS] .github/scripts/profile-codeql-compare.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-files.sh
✅ [SUCCESS] .github/scripts/profile-codeql-files.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-go.sh
✅ [SUCCESS] .github/scripts/profile-codeql-go.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-swap.sh
✅ [SUCCESS] .github/scripts/profile-codeql-swap.test.sh
✅ [SUCCESS] .github/scripts/publish-mcp-registry.sh
✅ [SUCCESS] .github/scripts/publish-mcp-registry.test.sh
✅ [SUCCESS] .github/scripts/publish-operator-chart.sh
✅ [SUCCESS] .github/scripts/redraft-evergreen-cask-prs.sh
✅ [SUCCESS] .github/scripts/redraft-evergreen-cask-prs.test.sh
✅ [SUCCESS] .github/scripts/report-eks-account-capacity.sh
✅ [SUCCESS] .github/scripts/report-eks-account-capacity.test.sh
✅ [SUCCESS] .github/scripts/report-eks-create-failure.sh
✅ [SUCCESS] .github/scripts/report-eks-create-failure.test.sh
✅ [SUCCESS] .github/scripts/resolve-cask-publication.sh
✅ [SUCCESS] .github/scripts/resolve-cask-publication.test.sh
✅ [SUCCESS] .github/scripts/resolve-release-publish-state.sh
✅ [SUCCESS] .github/scripts/resolve-release-publish-state.test.sh
❌ [ERROR] .github/scripts/resolve-release-replay.sh
    Error: File:[.github/scripts/resolve-release-replay.sh] is not executable

✅ [SUCCESS] .github/scripts/strict-link-transport.sh
✅ [SUCCESS] .github/scripts/strict-link-transport.test.sh
✅ [SUCCESS] .github/scripts/style-clean-cask-branch.sh
✅ [SUCCESS] .github/scripts/style-clean-cask-branch.test.sh
✅ [SUCCESS] .github/scripts/upload-release-assets.sh
✅ [SUCCESS] .github/scripts/upload-release-assets.test.sh
✅ [SUCCESS] .github/scripts/validate-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/validate-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/validate-release-ref.sh
✅ [SUCCESS] .github/scripts/validate-release-ref.test.sh
✅ [SUCCESS] .github/scripts/verify-desktop-codeql.sh
✅ [SUCCESS] .github/scripts/verify-desktop-codeql.test.sh
✅ [SUCCESS] .github/scripts/verify-go-archive-parity.sh
✅ [SUCCESS] .github/scripts/verify-go-archive-parity.test.sh
✅ [SUCCESS] .github/scripts/verify-otelzap-parity.sh
✅ [SUCCESS] .github/scripts/verify-otelzap-parity.test.sh
✅ [SUCCESS] .github/scripts/verify-vendored-comment-scan.sh
✅ [SUCCESS] .github/scripts/wait-for-github-api-budget.sh
✅ [SUCCESS] .github/scripts/wait-for-github-api-budget.test.sh
✅ [SUCCESS] desktop/scripts/make-icns.sh
✅ [SUCCESS] desktop/scripts/make-info-plist.sh
✅ [SUCCESS] desktop/scripts/make-macos-app.sh
✅ [SUCCESS] docs/demos/render.sh
✅ [SUCCESS] images/ksail-analysis-runner/smoke.sh
✅ [SUCCESS] install.sh
✅ [SUCCESS] internal/ciharness/testdata/schematic_fake_ksail.sh
✅ [SUCCESS] pkg/svc/provisioner/cluster/vcluster/containerd_registry_hosts.sh
✅ [SUCCESS] scripts/stage-webui.sh

✅ Linters with no issues

actionlint, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

Preserve all-status release inspection and rollback on Helm 3 and 4. Exercise the Helm 4 command boundary and reject pending, ambiguous, and unsupported-version evidence. Part of #8073.
@devantler
devantler marked this pull request as draft October 29, 2026 19:57
auto-merge was automatically disabled October 29, 2026 19:57

Pull request was converted to draft

@devantler

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

Adaptation prepared at e91bdd8c35651e0a2e77c33c0553c8aa3ede7599, including current main da546b96d2982707343117ef44d98083d8e4c36a. Part of #8073.

The existing chart-values fixture reproduced the real Helm 4 unknown flag: --all failure before the correction. It now exercises Helm 4 by default and retains Helm 3 coverage for all four component trials. Pending and failed latest releases, duplicate matches, ownership failures and unsupported major versions remain rejection cases. Helm 4 uses its all-status default and documented rollback flag; Helm 3 retains its existing flags. Native Helm 4.3.1 confirms --all is rejected; --atomic is a deprecated alias, not a removed option.

Validation: full Go suite passed; the complete CI harness passed; the final values-trial tests also passed under Bash 3.2. Build and CLI help passed. Focused Go lint, ShellCheck, shfmt with the repository indentation, and diff checks passed. The native Helm 4 list and upgrade argument forms parse successfully. These local checks do not establish the real cluster upgrade and repeated no-op. Correctness and scope review found no additional blocking issue in the adaptation.

Dependency review: this remains the ghcr.io/loft-sh/kubernetes:v1.37.2 digest move from 77fe896b7130f4252cbb89a8e65da2d8a09d569ed554a1a53390d486a8439edb to dff90874d0ab8b63d5ccf277a0dcb990547f4f19df139e3c84169593b855b969. Both public registry indexes retain Linux amd64 and arm64 images. Config creation times and layers changed, while the published descriptive labels are unchanged and identify no source revision. The index annotations and config labels do not identify the build changes, so the upstream release range remains UNVERIFIABLE; no feature, security or workaround-removal benefit is inferred, and no release-review cursor advances. Product tests and hosted system tests remain necessary.

This PR stays draft with auto-merge disabled. Next gates: ordinary CI at this exact head must reach and pass the real component-values upgrade and repeated no-op, then obtain an independent current-head review. The separate main cancellation repair is #8077; no main recovery is claimed here.

@github-code-quality

Copy link
Copy Markdown
Contributor

Code coverage overview

Languages: Go

Go / code-coverage/go

main 51afad3 dependabot/docker/pk... e91bdd8 +/-
71% 71% 0%
View coverage of the 3 most impacted files.
File main 51afad3 dependabot/docker/pk... e91bdd8 +/-
pkg/client/reconciler/poll.go 85% 79% -6%
pkg/svc/provisi...etzner/token.go 75% 71% -4%
pkg/svc/mirror/...unnelsession.go 96% 98% +2%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

@devantler devantler left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Generated by the Agentic Engineer

The Helm 4 adaptation at e91bdd8c35651e0a2e77c33c0553c8aa3ede7599 still leaves the Calico migration trial unable to run. The Vanilla job and K3s job both stop with Error: unknown flag: --all before proving migration.

The unchanged Calico trial invokes helm list --all for both its before and after release snapshots (lines 48 and 145). I independently reproduced the parser rejection with installed Helm v4.3.1 using an empty kubeconfig; no cluster was contacted.

Extend the major-version handling to both snapshots and make the Calico fixture reject Helm 3-only flags when emulating Helm 4, while retaining Helm 3 and failed/pending-release controls. This is remaining work under #8073, not a new issue. The separate Vanilla chart-values job also failed; its cause and the actual values-upgrade/repeated-no-op proof remain unverified. This review does not establish merge readiness.

@devantler

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

The system tests here still fail on Helm 4 after e91bdd8c, for two reasons outside the chart-values listing fix:

  • The Calico migration trial still calls helm list --all (Vanilla, K3s and VCluster legs).
  • The cert-manager seed upgrade now fails silently: Helm 4 upgrades through server-side apply and conflicts with the fields KSail owns through its Helm 4 SDK install (seed-upgrade.log in the leg's log artifact shows the field-manager conflicts with ksail).

#8083 carries e91bdd8c plus both corrections and closes #8073. Once it merges, this update needs only its own version bump on a fresh main.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: 🫴 Ready

Development

Successfully merging this pull request may close these issues.

1 participant