feat(tenants): prune-protect the ascoachingogvaner skeleton for the KRO handover#2488
Merged
Merged
Conversation
…RO handover Phase A of the #1932 ownership-transition design: annotate all 10 skeleton objects with kustomize.toolkit.fluxcd.io/prune: disabled so the later skeleton->Tenant-CR swap de-inventories them without Flux garbage-collecting them (kro adopts in place via forced SSA). The tenant Namespace holds the CNPG database and the tenant Kustomization's finalizer would GC the whole app — delete-then-recreate is data loss, so prune-protection must be live before the swap. No runtime behavior change today. Fixes #2486 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe Kustomization manifest at k8s/bases/apps/ascoachingogvaner/kustomization.yaml is updated to add a commonAnnotations entry setting kustomize.toolkit.fluxcd.io/prune: disabled, applied once at the Kustomization level. A comment is added explaining this is part of a Phase A skeleton-to-Tenant-CR handover, ensuring Flux does not garbage-collect objects when the KRO swap occurs. Changes
Sequence Diagram(s)Not applicable — this change is a configuration/annotation update with no observable runtime interaction flow. Related issues: Suggested labels: kubernetes, kustomize, flux, phase-a Suggested reviewers: devantler Poem: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@k8s/bases/apps/ascoachingogvaner/namespace.yaml`:
- Around line 4-9: The transitional `kustomize.toolkit.fluxcd.io/prune:
disabled` annotation and its comment are duplicated across the skeleton
manifests; move this temporary setting to `commonAnnotations` in the base
`kustomization.yaml` so `namespace.yaml` and the other skeleton resources don’t
each carry copy-pasted drift-prone text. Keep the rollout scoped to the relevant
kustomization base, and verify in the `kustomization.yaml` flow that applying
`commonAnnotations` won’t unintentionally affect workload pod templates before
removing the per-manifest annotation.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5f0f04ef-9409-4ee6-b9c1-9c7a5ceb5fc8
📒 Files selected for processing (10)
k8s/bases/apps/ascoachingogvaner/cluster-role-binding.yamlk8s/bases/apps/ascoachingogvaner/external-secret.yamlk8s/bases/apps/ascoachingogvaner/flux-kustomization.yamlk8s/bases/apps/ascoachingogvaner/namespace.yamlk8s/bases/apps/ascoachingogvaner/network-policy.yamlk8s/bases/apps/ascoachingogvaner/oci-repository.yamlk8s/bases/apps/ascoachingogvaner/role-binding-ascoachingogvaner.yamlk8s/bases/apps/ascoachingogvaner/role-binding-external-dns-kube-system.yamlk8s/bases/apps/ascoachingogvaner/role-binding-external-dns.yamlk8s/bases/apps/ascoachingogvaner/service-account.yaml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
devantler-tech/actions(auto-detected)devantler-tech/aws(auto-detected)devantler-tech/ksail(auto-detected)devantler-tech/reusable-workflows(auto-detected)devantler-tech/ascoachingogvaner(auto-detected)devantler-tech/unifi(auto-detected)devantler-tech/wedding-app(auto-detected)devantler-tech/provider-upjet-unifi(auto-detected)devantler-tech/agent-skills(auto-detected)
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Analyze (python)
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{yaml,yml}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{yaml,yml}: Use Kustomize overlays rather than editing base resources directly;k8s/bases/is immutable from overlays and changes should be made withpatches:in provider or cluster overlays.
Keep manifest changes small and use YAML/schema validation before submitting a manifest PR; for files with cluster context, preferksail workload validate/kubectl kustomize/kubectl apply --dry-run=clientas appropriate.
Files:
k8s/bases/apps/ascoachingogvaner/cluster-role-binding.yamlk8s/bases/apps/ascoachingogvaner/role-binding-external-dns-kube-system.yamlk8s/bases/apps/ascoachingogvaner/oci-repository.yamlk8s/bases/apps/ascoachingogvaner/network-policy.yamlk8s/bases/apps/ascoachingogvaner/role-binding-ascoachingogvaner.yamlk8s/bases/apps/ascoachingogvaner/external-secret.yamlk8s/bases/apps/ascoachingogvaner/role-binding-external-dns.yamlk8s/bases/apps/ascoachingogvaner/namespace.yamlk8s/bases/apps/ascoachingogvaner/service-account.yamlk8s/bases/apps/ascoachingogvaner/flux-kustomization.yaml
k8s/**
📄 CodeRabbit inference engine (AGENTS.md)
k8s/**: Respect Flux dependency order:bootstrap→infrastructure-controllers→infrastructure→apps, with the prod-onlyinfrastructure-overprovisioninglayer hanging offinfrastructurewithout gatingapps.
Follow the hierarchical Kustomization flow: base configurations ink8s/bases/feed provider overlays ink8s/providers/, which feed cluster overlays ink8s/clusters/.
Files:
k8s/bases/apps/ascoachingogvaner/cluster-role-binding.yamlk8s/bases/apps/ascoachingogvaner/role-binding-external-dns-kube-system.yamlk8s/bases/apps/ascoachingogvaner/oci-repository.yamlk8s/bases/apps/ascoachingogvaner/network-policy.yamlk8s/bases/apps/ascoachingogvaner/role-binding-ascoachingogvaner.yamlk8s/bases/apps/ascoachingogvaner/external-secret.yamlk8s/bases/apps/ascoachingogvaner/role-binding-external-dns.yamlk8s/bases/apps/ascoachingogvaner/namespace.yamlk8s/bases/apps/ascoachingogvaner/service-account.yamlk8s/bases/apps/ascoachingogvaner/flux-kustomization.yaml
🧠 Learnings (2)
📚 Learning: 2026-07-01T21:13:36.950Z
Learnt from: devantler
Repo: devantler-tech/platform PR: 2359
File: k8s/bases/apps/actual-budget/helm-release.yaml:62-111
Timestamp: 2026-07-01T21:13:36.950Z
Learning: When reviewing Kustomize/Helm YAML in this repo, keep the base vs provider overlay split: `k8s/bases/apps/**` and `k8s/bases/infrastructure/**` should contain each app’s full, environment-agnostic configuration (including base-level postRenderer Kustomize patches such as deployment strategy, topology spread, probes, and env injection). `k8s/providers/{docker,hetzner}/**` should only add small provider-specific deltas (e.g., `interval`, `persistence.size`) via patch files (like `k8s/providers/<provider>/apps/<app>/patches/helm-release-patch.yaml`). If configuration is identical across providers (e.g., OIDC/OAuth env vars where `${domain}` is resolved per cluster via envsubst), it belongs in the base and must not be duplicated into provider overlays.
Applied to files:
k8s/bases/apps/ascoachingogvaner/cluster-role-binding.yamlk8s/bases/apps/ascoachingogvaner/role-binding-external-dns-kube-system.yamlk8s/bases/apps/ascoachingogvaner/oci-repository.yamlk8s/bases/apps/ascoachingogvaner/network-policy.yamlk8s/bases/apps/ascoachingogvaner/role-binding-ascoachingogvaner.yamlk8s/bases/apps/ascoachingogvaner/external-secret.yamlk8s/bases/apps/ascoachingogvaner/role-binding-external-dns.yamlk8s/bases/apps/ascoachingogvaner/namespace.yamlk8s/bases/apps/ascoachingogvaner/service-account.yamlk8s/bases/apps/ascoachingogvaner/flux-kustomization.yaml
📚 Learning: 2026-07-03T03:44:11.507Z
Learnt from: devantler
Repo: devantler-tech/platform PR: 2399
File: k8s/bases/apps/ascoachingogvaner/oci-repository.yaml:25-26
Timestamp: 2026-07-03T03:44:11.507Z
Learning: In Flux `OCIRepository` manifests under `k8s/bases/**/oci-repository.yaml`, keep the existing house convention for `spec.serviceAccountRef.verify.matchOIDCIdentity` subject regexes to use an `@.+` ref suffix (i.e., match any ref) rather than tightening it to a specific SHA/tag pattern.
If a PR adds a transitional dual-subject entry for an ongoing migration (e.g., moving from `devantler-tech/reusable-workflows` to `devantler-tech/actions`), do not request tightening the ref matcher in that PR. Defer any ref-matcher tightening to a separate, focused follow-up PR that consistently tightens `matchOIDCIdentity` subject rules once each file returns to a single subject after migration cleanup.
Applied to files:
k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
🔇 Additional comments (10)
k8s/bases/apps/ascoachingogvaner/namespace.yaml (1)
4-9: LGTM!k8s/bases/apps/ascoachingogvaner/flux-kustomization.yaml (1)
9-13: LGTM!k8s/bases/apps/ascoachingogvaner/network-policy.yaml (1)
11-16: LGTM!k8s/bases/apps/ascoachingogvaner/external-secret.yaml (1)
16-21: LGTM!k8s/bases/apps/ascoachingogvaner/oci-repository.yaml (1)
5-10: LGTM!k8s/bases/apps/ascoachingogvaner/cluster-role-binding.yaml (1)
6-11: LGTM!k8s/bases/apps/ascoachingogvaner/role-binding-ascoachingogvaner.yaml (1)
4-9: LGTM!k8s/bases/apps/ascoachingogvaner/role-binding-external-dns-kube-system.yaml (1)
7-12: LGTM!k8s/bases/apps/ascoachingogvaner/service-account.yaml (1)
4-9: LGTM!k8s/bases/apps/ascoachingogvaner/role-binding-external-dns.yaml (1)
8-18: 🎯 Functional CorrectnessThis is a single-document file; the lone RoleBinding already has
prune: disabled.> Likely an incorrect or invalid review comment.
github-project-automation
Bot
moved this from 🫴 Ready
to 🏃🏻♂️ In Progress
in 🌊 Project Board
Per CodeRabbit review: one commonAnnotations block instead of 10 per-file annotations — same rendered output (verified identical annotated object set), auto-covers any file added before Phase B, and none of these resources carries a pod template so the propagation caveat is void. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-project-automation
Bot
moved this from 🏃🏻♂️ In Progress
to ✅ Done
in 🌊 Project Board
Contributor
|
🎉 This PR is included in version 1.101.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The upcoming skeleton→Tenant-CR swap (#1932 Phase B) removes the tenant's 10 control-plane objects from Flux's inventory, and Flux deletes de-inventoried objects — for the tenant namespace (live database) and the tenant's Flux Kustomization (finalizer GCs the whole app) that is data loss, not churn.
What
Annotates all 10 ascoachingogvaner skeleton objects with
kustomize.toolkit.fluxcd.io/prune: disabledso the swap hands them to KRO in place with no deletes. Behavior-preserving today; both overlays validate clean. Full design + risk register on #1932.Must be merged and reconciled on prod before Phase B starts.
Fixes #2486