---
date: 2026-11-08
branch: rework/136
title: "PR #136 rework: regenerate L1 render goldens for the oauth2-proxy v7.15.6 sidecar bump"
---

## What changed

- Renovate PR #136 bumps `OAUTH2_PROXY_IMAGE` in `catalog/render.py` (and the generated
  `apps/wave-*` / `platform/crafty` pins) from `v7.8.1` to `v7.15.6`. Its gate failed at L1
  because three byte-for-byte render goldens still carried the old tag:
  - `conformance/tests/l1-rendering/container-workload-render/golden/expected.yaml`
  - `conformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yaml`
  - `conformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml`
    (CI only reported the vpn one because `render-check.sh` stops at the first failing diff;
    the internet golden had drifted too.)
- Regenerated all three in the pinned toolbox with the exact invocation the check scripts use:
  `python3 catalog/render.py <fixture> > <golden>`. The diff in each is **one line**:
  `image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1` -> `...:v7.15.6`. Nothing else moved.
- `platform/crafty/README.md`: the "Sidecar" row described the current pin; updated to v7.15.6.
- Deliberately NOT changed (they record history, not the current pin):
  - `catalog/render.py` comments / assertion messages saying a flag was "confirmed present in the
    PINNED v7.8.1 binary" or that `--api-routes` "does not exist in v7.8.1". Rewriting them to
    v7.15.6 would assert a `--help` verification nobody has done against v7.15.6.
  - `conformance/tests/l0-static/oauth2-proxy-api-routes-per-app/check.sh`, the schema
    description, `runbooks/oauth2-proxy-session.md`, `docs/plans/...` — same reasoning.
  - `platform/oauth2-proxy/auth-visibility-alerts.promtool-test.yaml` — v7.8.1 appears in
    synthetic kube-state-metrics series (test input data), not as a pin.
  - `.gitea/workflows/renovate.yaml` comment — a dated measurement of the pre-Renovate state.
- Branch was 55 commits behind `origin/main`, but main touches neither `catalog/render.py` nor
  the L1 goldens, and the merge is conflict-free; no merge of main was needed for the gate.

## What I verified

- The golden diff is exactly the image tag in each of the three files (`git diff -U0`).
- No remaining `oauth2-proxy:v7.8.1` in any rendered/generated/golden file (`git grep`).
- Local toolbox gate result: see the PR #136 comment posted with this push (rc and per-stage
  results are quoted there and in the worker report).

## What I did NOT verify

- That the v7.15.6 sidecar actually starts and authenticates in the cluster with the rendered
  args. Earlier research said no flag used here was removed/renamed between 7.8.1 and 7.15.6;
  I did not re-run `oauth2-proxy --help` against the v7.15.6 image.
- L2/L3 conformance (does not run in CI: `CLUSTER_AVAILABLE` unset).
- `approval-policy`: `conformance/**` is a sensitive path, so this PR is CI-red until the
  operator posts `/approve-override <reason>` as a PR review. The local gate cannot evaluate it.
- Whether Renovate keeps rebasing this branch now that it carries a non-Renovate commit.