diff --git a/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml b/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml index d223564..137c48d 100644 --- a/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml +++ b/conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml @@ -62,7 +62,7 @@ spec: ports: - containerPort: 8080 - name: oauth2-proxy - image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1 + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6 imagePullPolicy: IfNotPresent args: - --http-address=0.0.0.0:4180 diff --git a/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml b/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml index 7d9c51b..bc85a92 100644 --- a/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml +++ b/conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml @@ -85,7 +85,7 @@ spec: - name: config mountPath: /data/config - name: oauth2-proxy - image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1 + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6 imagePullPolicy: IfNotPresent args: - --http-address=0.0.0.0:4180 diff --git a/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml b/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml index d88db79..b35c395 100644 --- a/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml +++ b/conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml @@ -85,7 +85,7 @@ spec: - name: config mountPath: /data/config - name: oauth2-proxy - image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1 + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.6 imagePullPolicy: IfNotPresent args: - --http-address=0.0.0.0:4180 diff --git a/decisions/2026-11-08-rework-136.md b/decisions/2026-11-08-rework-136.md new file mode 100644 index 0000000..9ddd5af --- /dev/null +++ b/decisions/2026-11-08-rework-136.md @@ -0,0 +1,48 @@ +--- +date: 2026-11-08 +branch: rework/136 +title: "PR #136 rework: regenerate L1 render goldens for the oauth2-proxy v7.15.6 sidecar bump" +--- + +## What changed + +- Renovate PR #136 bumps `OAUTH2_PROXY_IMAGE` in `catalog/render.py` (and the generated + `apps/wave-*` / `platform/crafty` pins) from `v7.8.1` to `v7.15.6`. Its gate failed at L1 + because three byte-for-byte render goldens still carried the old tag: + - `conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml` + - `conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml` + - `conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml` + (CI only reported the vpn one because `render-check.sh` stops at the first failing diff; + the internet golden had drifted too.) +- Regenerated all three in the pinned toolbox with the exact invocation the check scripts use: + `python3 catalog/render.py > `. The diff in each is **one line**: + `image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1` -> `...:v7.15.6`. Nothing else moved. +- `platform/crafty/README.md`: the "Sidecar" row described the current pin; updated to v7.15.6. +- Deliberately NOT changed (they record history, not the current pin): + - `catalog/render.py` comments / assertion messages saying a flag was "confirmed present in the + PINNED v7.8.1 binary" or that `--api-routes` "does not exist in v7.8.1". Rewriting them to + v7.15.6 would assert a `--help` verification nobody has done against v7.15.6. + - `conformance/tests/l0-static/oauth2-proxy-api-routes-per-app/check.sh`, the schema + description, `runbooks/oauth2-proxy-session.md`, `docs/plans/...` — same reasoning. + - `platform/oauth2-proxy/auth-visibility-alerts.promtool-test.yaml` — v7.8.1 appears in + synthetic kube-state-metrics series (test input data), not as a pin. + - `.gitea/workflows/renovate.yaml` comment — a dated measurement of the pre-Renovate state. +- Branch was 55 commits behind `origin/main`, but main touches neither `catalog/render.py` nor + the L1 goldens, and the merge is conflict-free; no merge of main was needed for the gate. + +## What I verified + +- The golden diff is exactly the image tag in each of the three files (`git diff -U0`). +- No remaining `oauth2-proxy:v7.8.1` in any rendered/generated/golden file (`git grep`). +- Local toolbox gate result: see the PR #136 comment posted with this push (rc and per-stage + results are quoted there and in the worker report). + +## What I did NOT verify + +- That the v7.15.6 sidecar actually starts and authenticates in the cluster with the rendered + args. Earlier research said no flag used here was removed/renamed between 7.8.1 and 7.15.6; + I did not re-run `oauth2-proxy --help` against the v7.15.6 image. +- L2/L3 conformance (does not run in CI: `CLUSTER_AVAILABLE` unset). +- `approval-policy`: `conformance/**` is a sensitive path, so this PR is CI-red until the + operator posts `/approve-override ` as a PR review. The local gate cannot evaluate it. +- Whether Renovate keeps rebasing this branch now that it carries a non-Renovate commit. diff --git a/platform/crafty/README.md b/platform/crafty/README.md index c110fed..c7becaa 100644 --- a/platform/crafty/README.md +++ b/platform/crafty/README.md @@ -16,7 +16,7 @@ Cilium L2 LoadBalancer (game protocols authenticate players themselves). |---|---| | Image | `registry.gitlab.com/crafty-controller/crafty-4:4.10.8` (current stable; bare-semver tags, no `v`) | | Web UI | HTTPS **self-signed** on `:8443` (reached only via the sidecar / same-pod) | -| Sidecar | `quay.io/oauth2-proxy/oauth2-proxy:v7.8.1`, reverse-proxy on `:4180` | +| Sidecar | `quay.io/oauth2-proxy/oauth2-proxy:v7.15.6`, reverse-proxy on `:4180` | | Data | ONE Longhorn RWO PVC `crafty-data` (20Gi), mounted 5× by subPath | | PVC subPaths | `servers`→`/crafty/servers`, `backups`→`/crafty/backups`, `logs`→`/crafty/logs`, `import`→`/crafty/import`, `config`→`/crafty/app/config` | | Identity | `runAsUser:1000 runAsGroup:0 fsGroup:0 runAsNonRoot:true` (see below) |