feat(conformance): L0 guard — external-dns annotationPrefix must match the tree (stacked on #140) #141

2026-11-07T23:59:36Z

gitea-admin commented

2026-11-07 23:59:36 +00:00

This is stacked on #140. Merge #140 first. Until then this diff includes #140's commit, and assertion (8a) correctly fails without it.

Sensitive path: conformance/**. This needs the operator's approving review or /approve-override. The agent has not posted one and will not.

What

New assertion (8) in the whole-repo L0 check internal-services-publish-no-public-dns:

(8a) the external-dns HelmRelease must set values.annotationPrefix explicitly, and it must equal the prefix the tree uses (external-dns.alpha.kubernetes.io/);
(8b) extraArgs must not set --annotation-prefix or --enable-legacy-annotation-prefix;
(8c) every external-dns-looking annotation key under apps/, platform/ and runbooks/ must use that prefix;
(8d) catalog/render.py must emit no external-dns key under any other prefix.

Why

On 2026-11-07, external-dns v0.23.0 (default prefix GA) ignored every alpha annotation (controller: none, Gateway target, Service hostname). Internal names went public and public names answered with RFC1918 addresses. Assertions (1) to (3) stayed green, because they prove the annotations are present, not that the controller reads them.

Proof

On the host, the check passes on this tree (check OK: 62 assertions passed).
It fails (8a) with origin/main's HelmRelease.
It fails (8c) with the Gateway target rewritten to the GA prefix.

Gate (toolbox, worktree, §3 workarounds, commit `9c51f60`)

rc=3. Ran and passed: spec-immutability, decisions-log, lint, l0 (internal-services-publish-no-public-dns PASS), render-golden, l1. approval-policy also reports pass, but that stage cannot evaluate offline.

Not run:

gitea-settings: CI-only token.
conformance: L2/L3 needs a cluster.

approval-policy will go red in CI until the operator reviews this PR.

Not verified

This does not render the chart. If a future chart renamed the annotationPrefix value, (8a) would still pass. See decisions/2026-11-07-l0-externaldns-annotation-prefix.md.

🤖 Generated with Claude Code

**This is stacked on #140.** Merge #140 first. Until then this diff includes #140's commit, and assertion (8a) correctly fails without it. **Sensitive path: `conformance/**`.** This needs the operator's approving review or `/approve-override`. The agent has not posted one and will not. ## What New assertion (8) in the whole-repo L0 check `internal-services-publish-no-public-dns`: - (8a) the external-dns HelmRelease must set `values.annotationPrefix` explicitly, and it must equal the prefix the tree uses (`external-dns.alpha.kubernetes.io/`); - (8b) `extraArgs` must not set `--annotation-prefix` or `--enable-legacy-annotation-prefix`; - (8c) every external-dns-looking annotation key under apps/, platform/ and runbooks/ must use that prefix; - (8d) `catalog/render.py` must emit no external-dns key under any other prefix. ## Why On 2026-11-07, external-dns v0.23.0 (default prefix GA) ignored every alpha annotation (`controller: none`, Gateway `target`, Service `hostname`). Internal names went public and public names answered with RFC1918 addresses. Assertions (1) to (3) stayed green, because they prove the annotations are present, not that the controller reads them. ## Proof - On the host, the check passes on this tree (`check OK: 62 assertions passed`). - It **fails (8a)** with origin/main's HelmRelease. - It **fails (8c)** with the Gateway `target` rewritten to the GA prefix. ## Gate (toolbox, worktree, §3 workarounds, commit 9c51f60) rc=**3**. Ran and passed: spec-immutability, decisions-log, lint, l0 (`internal-services-publish-no-public-dns` PASS), render-golden, l1. `approval-policy` also reports pass, but that stage cannot evaluate offline. Not run: - `gitea-settings`: CI-only token. - `conformance`: L2/L3 needs a cluster. `approval-policy` *will* go red in CI until the operator reviews this PR. ## Not verified This does not render the chart. If a future chart renamed the `annotationPrefix` value, (8a) would still pass. See `decisions/2026-11-07-l0-externaldns-annotation-prefix.md`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 2 commits 2026-11-07 23:59:36 +00:00

fix(dns): pin external-dns annotationPrefix to the alpha prefix

gate / gate (pull_request) Successful in 2m58s

Details

gate / conformance (pull_request) Skipped

Details

267446c68f

external-dns v0.22 changed its default annotation prefix to
external-dns.kubernetes.io/ with no fallback. Renovate #129 moved the chart
to 1.23.0 (app v0.23.0), and at 12:13Z it ignored every alpha-prefixed
annotation in this repo: the Gateway target (public names went to A
192.168.2.20), controller: none (jackett, pihole and semaphore got
published), and the L4 Service hostnames (unifi and crafty-mc were deleted).

Set annotationPrefix: external-dns.alpha.kubernetes.io/ to restore the v0.21
reading. Floor the chart at 1.23.0, because the flag needs app >= 0.22.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

feat(conformance): L0 guard that the external-dns annotationPrefix matches the tree

gate / gate (pull_request) Successful in 2m58s

Details

gate / conformance (pull_request) Skipped

Details

9c51f60a35

Add assertion (8) to internal-services-publish-no-public-dns. The external-dns
HelmRelease must declare annotationPrefix explicitly, and every
external-dns annotation in apps/, platform/, runbooks/ and catalog/render.py
must use that prefix. The v0.23.0 default-prefix change on 2026-11-07
ignored the controller: none, target and hostname annotations while
assertions (1)-(3) stayed green.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jakman85 scheduled this pull request to auto merge when all checks succeed 2026-11-08 00:02:08 +00:00

jakman85 approved these changes

2026-11-08 00:02:56 +00:00

jakman85 merged commit 12c28adf4d into main

2026-11-08 00:08:29 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#141