jakman85andClaude Opus 5.5
3d7ecbcfe9
PR #136 bumps the renderer's OAUTH2_PROXY_IMAGE; the container-workload and egress-class (vpn + internet) goldens still pinned v7.8.1. Regenerated with the check scripts' own invocation; each diff is the image tag only. Also updates the crafty README's current-pin row. Co-Authored-By: Claude Opus 5.5 <[email protected]>
3.0 KiB
3.0 KiB
date, branch, title
| date | branch | title |
|---|---|---|
| 2026-11-08 | rework/136 | PR #136 rework: regenerate L1 render goldens for the oauth2-proxy v7.15.6 sidecar bump |
What changed
- Renovate PR #136 bumps
OAUTH2_PROXY_IMAGEincatalog/render.py(and the generatedapps/wave-*/platform/craftypins) fromv7.8.1tov7.15.6. Its gate failed at L1 because three byte-for-byte render goldens still carried the old tag:conformance/tests/l1-rendering/container-workload-render/golden/expected.yamlconformance/tests/l1-rendering/egress-class-render/golden/egress-vpn.expected.yamlconformance/tests/l1-rendering/egress-class-render/golden/egress-internet.expected.yaml(CI only reported the vpn one becauserender-check.shstops at the first failing diff; the internet golden had drifted too.)
- Regenerated all three in the pinned toolbox with the exact invocation the check scripts use:
python3 catalog/render.py <fixture> > <golden>. The diff in each is one line:image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1->...:v7.15.6. Nothing else moved. platform/crafty/README.md: the "Sidecar" row described the current pin; updated to v7.15.6.- Deliberately NOT changed (they record history, not the current pin):
catalog/render.pycomments / assertion messages saying a flag was "confirmed present in the PINNED v7.8.1 binary" or that--api-routes"does not exist in v7.8.1". Rewriting them to v7.15.6 would assert a--helpverification nobody has done against v7.15.6.conformance/tests/l0-static/oauth2-proxy-api-routes-per-app/check.sh, the schema description,runbooks/oauth2-proxy-session.md,docs/plans/...— same reasoning.platform/oauth2-proxy/auth-visibility-alerts.promtool-test.yaml— v7.8.1 appears in synthetic kube-state-metrics series (test input data), not as a pin..gitea/workflows/renovate.yamlcomment — a dated measurement of the pre-Renovate state.
- Branch was 55 commits behind
origin/main, but main touches neithercatalog/render.pynor the L1 goldens, and the merge is conflict-free; no merge of main was needed for the gate.
What I verified
- The golden diff is exactly the image tag in each of the three files (
git diff -U0). - No remaining
oauth2-proxy:v7.8.1in any rendered/generated/golden file (git grep). - Local toolbox gate result: see the PR #136 comment posted with this push (rc and per-stage results are quoted there and in the worker report).
What I did NOT verify
- That the v7.15.6 sidecar actually starts and authenticates in the cluster with the rendered
args. Earlier research said no flag used here was removed/renamed between 7.8.1 and 7.15.6;
I did not re-run
oauth2-proxy --helpagainst the v7.15.6 image. - L2/L3 conformance (does not run in CI:
CLUSTER_AVAILABLEunset). approval-policy:conformance/**is a sensitive path, so this PR is CI-red until the operator posts/approve-override <reason>as a PR review. The local gate cannot evaluate it.- Whether Renovate keeps rebasing this branch now that it carries a non-Renovate commit.