Repository navigation
chore(chart): release 0.10.0 with Edge v3.10.0 - #26
Merged
Merged
Conversation
Bump the chart version to 0.10.0 and appVersion and the default image tag to v3.10.0 (Chart.yaml, values.yaml, examples/production-values.yaml, manifests.yaml). Edge v3.10.0 adds informers for MutatingWebhookConfiguration and ValidatingWebhookConfiguration (NOFireAI/edge#166). Add both kinds to the default kube.resources list so the agent publishes them without a values change. The ClusterRole has granted get, list and watch on both kinds since 0.9.0. The configmap unit test now asserts both kinds render by default. Refs NOFireAI/brain-go#5355 Signed-off-by: Panagiotis Moustafellos <pmoust@nofire.ai>
alextoulps
approved these changes
Nov 10, 2026
stheppi
reviewed
Nov 10, 2026
Comment on lines
+223
to
+224
| - "mutatingwebhookconfigurations" | ||
| - "validatingwebhookconfigurations" |
Collaborator
There was a problem hiding this comment.
Critical: these two lines make every 0.10.0 install push admission webhook annotations to brain, and those can carry webhook credentials.
- Edge v3.10.0 (d3cea10) and its README leave both kinds out of the default
kube.resourceson purpose, so operators opt in. This PR turns them on by default and does not say it reverses that. - The edge README says the agent never sends the
caBundleor the URL's user info. The webhook fields are scrubbed, but the node also carriesmeta.Annotations(rbacNode->WithAnnotations), andsensitiveAnnotations(internal/edge/informers/resource_node_utils.go) drops onlykubectl.kubernetes.io/last-applied-configurationandkubernetes.io/change-cause. This is still true at v3.10.0, the latest tag. - Deploy tools such as kapp keep a full copy of the object in their own annotation (
kapp.k14s.io/original). For a webhook configuration that copy includes thecaBundleandclientConfig.urlwith anyuser:pass@. The agent sends it unchanged. A probe test on edge#166's ownassertNoWebhookLeakfails on exactly this input. - The chart has no annotation filter, so an operator cannot stop it short of removing both kinds by hand from a copied 30-entry list.
The same annotation gap exists for the kinds already on by default. These two are where it most often holds credentials.
0.10.0 is merged and released, so this is live for anyone who upgrades. Options:
- Ship 0.10.1 with both kinds moved back into the commented opt-in block until edge filters annotations.
- Fix the edge filter first (an annotation allowlist, or no annotations on these two kinds), release it, and pin that image.
Option 2 also closes the gap for the existing kinds. Option 1 can ship today.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump the chart to 0.10.0 and the default Edge image to v3.10.0.
Edge v3.10.0 watches MutatingWebhookConfiguration and ValidatingWebhookConfiguration (NOFireAI/edge#166). This adds both kinds to the default
kube.resourceslist, so the agent publishes them on upgrade. The ClusterRole has granted get, list and watch on both since 0.9.0, so RBAC does not change.An install that sets its own
kube.resourceskeeps its list and needs both kinds added by hand.The configmap unit test now asserts that both kinds render by default.
Merge only after the Edge v3.10.0 release workflow has published
nofireai/edge:v3.10.0.Refs NOFireAI/brain-go#5355