feat(t8s-cluster/management-cluster): switch to hcp#1759
Conversation
cwrau
requested review from
marvinWolff,
tasches and
teutonet-bot
as code owners
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughRefactors control-plane templates toward a hosted control plane, removes Kubernetes audit policy and its plumbing, adds containerd plugin config, forces Kubeadm bootstrap usage, introduces a hosted control plane spec and Cilium test Job, tightens OpenStack flavor validation, adjusts kubelet/timeout/nodeSelector logic, and adds an autoscaling values file. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Helm as Helm Render
participant CC as ClusterClass templates
participant Hosted as HostedControlPlaneTemplate
participant Kubeadm as KubeadmConfigTemplate
Helm->>CC: render clusterClass.yaml
CC->>CC: evaluate .Values.controlPlane.hosted
alt hosted == true
CC->>Hosted: include hostedControlPlaneTemplate.spec
Hosted->>Hosted: merge static/dynamic files, build apiServer/audit/webhook
Hosted->>Kubeadm: reference KubeadmConfigTemplate for worker bootstrap
else hosted == false
CC->>Kubeadm: use Kubeadm/KubeadmControlPlaneTemplate paths (v1beta1)
end
sequenceDiagram
autonumber
participant Job as Cilium Test Job
participant InitKube as init: test-kubeconfig
participant InitConn as init: connectivity-test
participant Cleaner as main: delete-namespace
Job->>InitKube: mount workload-kubeconfig, run kubectl to prepare
InitKube-->>Job: kubeconfig ready
Job->>InitConn: run cilium connectivity test
InitConn-->>Job: test result
Job->>Cleaner: delete test namespace (cleanup)
Cleaner->>Cleaner: cleanup completes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (18)
💤 Files with no reviewable changes (7)
🚧 Files skipped from review as they are similar to previous changes (5)
🧰 Additional context used🪛 YAMLlint (1.37.1)charts/t8s-cluster/templates/workload-cluster/tests/cni-cilium.yaml[error] 1-1: syntax error: expected the node content, but found '-' (syntax) charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml[error] 6-6: syntax error: expected '', but found '{' (syntax) charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/hostedControlPlaneTemplate.yaml[error] 1-1: syntax error: expected the node content, but found '-' (syntax) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (12)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull Request Overview
This PR switches the management cluster from k0smotron to HCP (Hosted Control Plane) for hosted control plane deployments. The main changes include removing k0smotron-specific templates and configuration, introducing HCP templates, and simplifying cloud controller manager tolerations while removing version-specific logic.
Key Changes:
- Replaced K0smotronControlPlaneTemplate with HostedControlPlaneTemplate for hosted control planes
- Removed k0smotron-specific bootstrap configuration and worker config templates
- Consolidated cloud controller manager tolerations and removed Kubernetes version checks
Reviewed Changes
Copilot reviewed 18 out of 19 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| charts/t8s-cluster/values.schema.json | Removed required constraint on flavor field |
| charts/t8s-cluster/templates/workload-cluster/tests/cni-cilium.yaml | Added new Cilium CNI connectivity test job |
| charts/t8s-cluster/templates/workload-cluster/cloud-controller-manager.yaml | Simplified tolerations configuration and removed version checks |
| charts/t8s-cluster/templates/workload-cluster/cinder-csi-plugin/cinder-csi-plugin.yaml | Removed k0s-specific kubelet directory workaround |
| charts/t8s-cluster/templates/management-cluster/etcd-defrag.yaml | Removed etcd defrag configuration for hosted control planes |
| charts/t8s-cluster/templates/management-cluster/clusterClass/patches/_kubelet.tpl | Removed Kubernetes version check for image pull configuration |
| charts/t8s-cluster/templates/management-cluster/clusterClass/openStackMachineTemplates/_openstackMachineTemplateSpec.yaml | Added explicit validation for required flavor field |
| charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/k0smotronControlPlaneTemplate.yaml | Removed k0smotron control plane template |
| charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/_k0smotronControlPlaneTemplateSpec.yaml | Removed k0smotron control plane spec |
| charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/hostedControlPlaneTemplate.yaml | Added new HCP template |
| charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml | Added HCP specification with audit webhook configuration |
| charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_helpers.tpl | Updated helpers for HCP spec hash generation |
| charts/t8s-cluster/templates/management-cluster/clusterClass/clusterClass.yaml | Updated to reference HCP templates and changed bootstrap to use KubeadmConfigTemplate |
| charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_k0smotronConfigTemplateSpec.yaml | Removed k0smotron bootstrap config spec |
| charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_bootstrapConfigTemplate.yaml | Simplified to always use KubeadmConfigTemplate |
| charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl | Removed audit config helpers and shared args configuration |
| charts/t8s-cluster/files/audit-config.yaml | Removed standalone audit config file |
| charts/t8s-cluster/ci/autoscaling-values.yaml | Added autoscaling test configuration |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
...agement-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml
Outdated
Show resolved
Hide resolved
charts/t8s-cluster/templates/management-cluster/clusterClass/clusterClass.yaml
Show resolved
Hide resolved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl (1)
50-55: Update TODO comments to reference the correct issue.The TODO comments reference containerd issue #5837, but that issue is about config merge via imports, not SystemdCgroup. The
SystemdCgroup = truesetting is a legitimate requirement for containerd + runc when cgroup v2 is in use, not a workaround. Update the TODO comments to either remove them or reference the correct containerd documentation/issue about cgroup v2 and runc configuration requirements.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (18)
charts/t8s-cluster/ci/autoscaling-values.yaml(1 hunks)charts/t8s-cluster/files/audit-config.yaml(0 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_bootstrapConfigTemplate.yaml(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_k0smotronConfigTemplateSpec.yaml(0 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/clusterClass.yaml(3 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_helpers.tpl(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/hostedControlPlaneTemplate.yaml(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/_k0smotronControlPlaneTemplateSpec.yaml(0 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/k0smotronControlPlaneTemplate.yaml(0 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/openStackMachineTemplates/_openstackMachineTemplateSpec.yaml(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/patches/_kubelet.tpl(1 hunks)charts/t8s-cluster/templates/management-cluster/etcd-defrag.yaml(0 hunks)charts/t8s-cluster/templates/workload-cluster/cinder-csi-plugin/cinder-csi-plugin.yaml(0 hunks)charts/t8s-cluster/templates/workload-cluster/cloud-controller-manager.yaml(1 hunks)charts/t8s-cluster/templates/workload-cluster/tests/cni-cilium.yaml(1 hunks)charts/t8s-cluster/values.schema.json(0 hunks)
💤 Files with no reviewable changes (7)
- charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_k0smotronConfigTemplateSpec.yaml
- charts/t8s-cluster/values.schema.json
- charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/_k0smotronControlPlaneTemplateSpec.yaml
- charts/t8s-cluster/templates/workload-cluster/cinder-csi-plugin/cinder-csi-plugin.yaml
- charts/t8s-cluster/files/audit-config.yaml
- charts/t8s-cluster/templates/management-cluster/etcd-defrag.yaml
- charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/k0smotronControlPlaneTemplate.yaml
🧰 Additional context used
🪛 YAMLlint (1.37.1)
charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml
[error] 6-6: syntax error: expected '', but found '{'
(syntax)
charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/hostedControlPlaneTemplate.yaml
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
charts/t8s-cluster/templates/workload-cluster/tests/cni-cilium.yaml
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
🔇 Additional comments (18)
charts/t8s-cluster/templates/workload-cluster/cloud-controller-manager.yaml (2)
65-69: Verify toleration matches node taint structure and consistency.The first toleration (line 65–66) lacks an explicit
valueandoperator, which means it will tolerate any taint with the keynode.cluster.x-k8s.io/uninitializedregardless of the taint's value. The second toleration (line 67–69) explicitly specifiesvalue: "true". This inconsistency could lead to scheduling mismatches if:
- The actual node taints have specific values that don't align with the toleration definitions.
- The first toleration's intent differs from the second (one is a "flag," the other a keyed value).
To verify the actual node taints and ensure the tolerations are correct, please check:
- The node taints for both
node.cluster.x-k8s.io/uninitializedandnode.cloudprovider.kubernetes.io/uninitializedkeys- Whether the first toleration should explicitly include
value: ""andoperator: Equalfor clarity and consistencyFor consistency, consider aligning the toleration definitions:
- key: node.cluster.x-k8s.io/uninitialized + operator: Equal + value: "" effect: NoSchedule
63-70: Confirm backward compatibility for non-hosted deployments.The tolerations block is now conditional on
.Values.controlPlane.hosted(line 63). This means non-hosted deployments receive no tolerations at all. According to the PR summary, a previous block "added a control-plane specific toleration and nodeSelector when not hosted"—implying non-hosted deployments may have previously had tolerations.Verify that:
- Non-hosted deployments do not need any tolerations for the CCM to function correctly.
- Removing these tolerations from non-hosted deployments is intentional and tested.
- Existing non-hosted clusters will not experience scheduling failures after this change.
charts/t8s-cluster/ci/autoscaling-values.yaml (1)
1-6: Configuration looks good.The autoscaling setup is well-formed and provides a reasonable test range (1–3 replicas) for CI validation of the standard.2.4096 flavor.
charts/t8s-cluster/templates/workload-cluster/tests/cni-cilium.yaml (1)
1-1: YAML lint error is a false positive.The YAMLlint error about syntax is a false positive caused by Helm template syntax not being recognized by the linter. The Go template conditional is valid Helm syntax once the boolean negation syntax is corrected (see above).
charts/t8s-cluster/templates/management-cluster/clusterClass/openStackMachineTemplates/_openstackMachineTemplateSpec.yaml (1)
7-7: Clarify the intent of the required constraint with placeholder fallback.The
required "flavor is required"constraint is combined with a ternary that provides"compute-plane-placeholder"as a fallback for non-control-plane machines. This means:
- For
control-plane: The required check validates.Values.controlPlane.flavor(intended behavior).- For non-control-plane: The placeholder value always satisfies the required check, making it ineffective.
If the intention is to only validate control-plane flavor, this is working correctly. However, if all machine templates should have a valid flavor, the placeholder approach should be reconsidered.
charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_bootstrapConfigTemplate.yaml (1)
4-11: LGTM! Simplification aligns with hosted control plane migration.The removal of host-based conditional logic and the switch to always use
KubeadmConfigTemplatewith a fixed spec path simplifies the template and aligns with the PR's objective to standardize on hosted control planes.charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/hostedControlPlaneTemplate.yaml (1)
1-11: LGTM! Proper implementation of hosted control plane template.The template is correctly gated by
.Values.controlPlane.hostedand follows the immutable template pattern using a spec hash suffix. The YAML structure properly references the spec definition with normalization viafromYaml | toYaml.Note: The YAMLlint syntax error is a false positive—it doesn't understand Helm template delimiters.
charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_helpers.tpl (1)
1-5: LGTM! Consistent renaming for hosted control plane.The helper has been properly renamed from
k0smotronControlPlaneTemplatetohostedControlPlaneTemplate, with all internal references updated accordingly. This aligns with the broader migration to hosted control planes.charts/t8s-cluster/templates/management-cluster/clusterClass/clusterClass.yaml (3)
32-39: LGTM! Proper API version and kind selection for hosted vs non-hosted control planes.The dynamic selection between:
controlplane.cluster.x-k8s.io/v1alpha1withHostedControlPlaneTemplatefor hostedcontrolplane.cluster.x-k8s.io/v1beta1withKubeadmControlPlaneTemplatefor non-hostedcorrectly aligns with CAPI conventions and the PR's migration strategy.
168-169: LGTM! Bootstrap template simplification.The removal of conditional logic to always use
KubeadmConfigTemplateis consistent with the broader hosted control plane migration and matches the changes in_bootstrapConfigTemplate.yaml.
150-151: Based on my verification of the CAPI ClusterClass schema and the codebase patterns:Kubernetes metav1.Duration fields are serialized in YAML as strings formatted according to Go's time.ParseDuration function. The unquoted format (
8m,15m) used at lines 150-151 is valid and consistent with how duration values are handled throughout the codebase—all other timeout fields use the same unquoted format (600s,5m,10m0s, etc.).The change from quoted format (
"8m") to unquoted format (8m) aligns with standard Kubernetes and CAPI practices. No formatting correction is needed.charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml (4)
21-27: Review hardcoded namespace in audit webhook configuration.The audit webhook configuration uses a hardcoded namespace:
secretNamespace: capi-hosted-control-plane-system(line 27)serverURL includes dynamic namespace:.Release.Namespace(line 24)While the webhook server URL dynamically uses the release namespace, the authentication secret namespace is hardcoded. This could cause issues if:
- Deployments use a different namespace convention
- Multi-tenancy requires namespace isolation
Consider making the secret namespace configurable via
.Valuesor aligning it with.Release.Namespaceif appropriate.
28-59: LGTM! Well-structured audit policy.The audit policy is comprehensive and follows best practices:
- Filters out high-volume, low-value events (leases, events)
- Reduces noise from system components (controller-manager, scheduler, apiserver)
- Logs metadata for secrets (not full content)
- Captures mutating operations at Metadata level
- Uses appropriate omitStages to avoid duplicate RequestReceived events
68-70: Review hardcoded gateway namespace.The gateway configuration uses a hardcoded namespace:
namespace: capi-hosted-control-plane-systemSimilar to the audit webhook secret namespace, this may need to be configurable for deployments that don't follow this namespace convention. Consider parameterizing this via
.Valuesfor flexibility.
7-20: LGTM! Proper API server deployment configuration.The API server configuration correctly:
- Mounts config from a dynamically named ConfigMap
- Aggregates static and dynamic files with validation
- References args and resources via includes
- Uses proper path resolution
The file aggregation logic with
mustMergeandrequiredensures all files have the necessaryfileNameattribute.charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl (3)
131-134: Verify removed API server arguments are handled by HCP.The
authorization-always-allow-pathsandbind-addressarguments have been removed from the shared configuration. Ensure that:
- The hosted control plane (HCP) handles these configurations appropriately
- Authorization bypass paths (if needed) are configured at the HCP level
- API server binding is correctly managed by the HCP infrastructure
199-222: Audit logging is handled by the hosted control plane provider—no action needed.Managed Kubernetes control planes (GKE, EKS, AKS) provide API-server audit logging through their respective logging systems. Control-plane audit logs are exposed and can be enabled/exported to provider logging systems (Cloud Logging/BigQuery, CloudWatch Logs, Azure logs). The removal of audit-config references is correct for HCP deployments since audit logging is configured and managed through the provider's platform rather than the Helm chart. Ensure your HCP provider's audit logging is enabled in their console.
48-48: The review comment is incorrect and based on a misunderstanding of gpu-operator behavior.The design is actually correct: NVIDIA gpu-operator (v1.7+) automatically creates the nvidia RuntimeClass and can create runtime classes like nvidia-cdi and nvidia-legacy.
The
default_runtime_name = "runc"should remain as-is—it is intentionally not set to "nvidia" because:
- Only GPU workloads should use the nvidia runtime
- GPU pods request resources (e.g.,
nvidia.com/gpu), and the gpu-operator/device-plugin automatically handles runtime selection- Setting the default globally to "nvidia" would incorrectly affect all pods, breaking non-GPU workloads
The conditional NVIDIA runtime configuration (lines 57–63) correctly uses the standard
/usr/local/nvidia/toolkit/nvidia-container-runtimepath, which the gpu-operator provisions on GPU-enabled nodes. No manual runtime class configuration or explicit pod-level runtimeClassName specifications are needed—the gpu-operator handles this automatically.Likely an incorrect or invalid review comment.
charts/t8s-cluster/templates/management-cluster/clusterClass/patches/_kubelet.tpl
Show resolved
Hide resolved
cwrau
force-pushed
the
feat/t8s-cluster/switch-to-hcp
branch
2 times, most recently
from
68ba1cd to
b19c4ef
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (4)
charts/t8s-cluster/templates/workload-cluster/tests/cni-cilium.yaml (2)
1-1: Fix Go template syntax for boolean negation.The conditional uses
.Release.IsUpgrade false, which is invalid Go template syntax. Use thenotfunction to check if an upgrade is NOT occurring.-{{- if and (eq (include "t8s-cluster.cni" .) "cilium") .Release.IsUpgrade false -}} +{{- if and (eq (include "t8s-cluster.cni" .) "cilium") (not .Release.IsUpgrade) -}}
45-67: Resolve namespace mismatch between test and cleanup.The connectivity test runs with
--test-namespace=cilium-test(line 55), but cleanup targetscilium-test-1(line 67). This will leave the test namespace orphaned and attempt to delete a non-existent namespace.Ensure both reference the same namespace:
- - cilium-test-1 + - cilium-testAlternatively, if
cilium-test-1is correct, update line 55 instead:- - --test-namespace=cilium-test + - --test-namespace=cilium-test-1charts/t8s-cluster/templates/management-cluster/clusterClass/patches/_kubelet.tpl (1)
4-4: The Kubernetes version check is still missing.As flagged in the previous review, the
maxParallelImagePullsfield requires Kubernetes 1.27+. Without a version check, this patch will cause errors on older clusters.charts/t8s-cluster/templates/management-cluster/clusterClass/clusterClass.yaml (1)
150-151: Quote the duration values for clarity.Duration strings like
8mand15mshould be quoted to ensure consistent parsing and match Kubernetes conventions.Apply this diff:
- nodeDrainTimeout: 8m - nodeDeletionTimeout: 15m + nodeDrainTimeout: "8m" + nodeDeletionTimeout: "15m"
🧹 Nitpick comments (1)
charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml (1)
24-24: Minor: Add space before closing braces for consistency.While this doesn't affect parsing, add a space before
}}to match the formatting on line 69.Apply this diff:
- - server: https://k8s.master.wazuh.teuto.net/{{ .Release.Namespace}}/{{ .Release.Name }} + - server: https://k8s.master.wazuh.teuto.net/{{ .Release.Namespace }}/{{ .Release.Name }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (18)
charts/t8s-cluster/ci/autoscaling-values.yaml(1 hunks)charts/t8s-cluster/files/audit-config.yaml(0 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_bootstrapConfigTemplate.yaml(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_k0smotronConfigTemplateSpec.yaml(0 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/clusterClass.yaml(3 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_helpers.tpl(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/hostedControlPlaneTemplate.yaml(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/_k0smotronControlPlaneTemplateSpec.yaml(0 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/k0smotronControlPlaneTemplate.yaml(0 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/openStackMachineTemplates/_openstackMachineTemplateSpec.yaml(1 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/patches/_kubelet.tpl(1 hunks)charts/t8s-cluster/templates/management-cluster/etcd-defrag.yaml(0 hunks)charts/t8s-cluster/templates/workload-cluster/cinder-csi-plugin/cinder-csi-plugin.yaml(0 hunks)charts/t8s-cluster/templates/workload-cluster/cloud-controller-manager.yaml(1 hunks)charts/t8s-cluster/templates/workload-cluster/tests/cni-cilium.yaml(1 hunks)charts/t8s-cluster/values.schema.json(0 hunks)
💤 Files with no reviewable changes (7)
- charts/t8s-cluster/templates/workload-cluster/cinder-csi-plugin/cinder-csi-plugin.yaml
- charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/_k0smotronControlPlaneTemplateSpec.yaml
- charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_k0smotronConfigTemplateSpec.yaml
- charts/t8s-cluster/templates/management-cluster/etcd-defrag.yaml
- charts/t8s-cluster/templates/management-cluster/clusterClass/k0smotronControlPlaneTemplate/k0smotronControlPlaneTemplate.yaml
- charts/t8s-cluster/values.schema.json
- charts/t8s-cluster/files/audit-config.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- charts/t8s-cluster/templates/management-cluster/clusterClass/openStackMachineTemplates/_openstackMachineTemplateSpec.yaml
- charts/t8s-cluster/ci/autoscaling-values.yaml
- charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl
🧰 Additional context used
🪛 YAMLlint (1.37.1)
charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml
[error] 6-6: syntax error: expected '', but found '{'
(syntax)
charts/t8s-cluster/templates/workload-cluster/tests/cni-cilium.yaml
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/hostedControlPlaneTemplate.yaml
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
🔇 Additional comments (10)
charts/t8s-cluster/templates/management-cluster/clusterClass/bootstrapConfigTemplate/_bootstrapConfigTemplate.yaml (1)
4-11: LGTM! Bootstrap template simplified.The hardcoded
KubeadmConfigTemplateapproach is cleaner and aligns with the hosted control plane migration.charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/hostedControlPlaneTemplate.yaml (1)
1-11: LGTM! Hosted control plane template structure is sound.The conditional rendering, spec hash generation, and YAML normalization are all correctly implemented.
charts/t8s-cluster/templates/management-cluster/clusterClass/clusterClass.yaml (2)
32-39: LGTM! Dynamic control plane apiVersion correctly implemented.The ternary logic properly selects between v1alpha1 for hosted and v1beta1 for standard control planes, with appropriate template references.
168-169: LGTM! Bootstrap template reference simplified.Hardcoding
KubeadmConfigTemplateis consistent with the HCP migration and removes unnecessary conditional complexity.charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_helpers.tpl (1)
1-5: LGTM! Template rename aligns with HCP migration.The rename from
k0smotronControlPlaneTemplatetohostedControlPlaneTemplateis consistent with the broader architectural change.charts/t8s-cluster/templates/management-cluster/clusterClass/hostedControlPlaneTemplate/_hostedControlPlaneTemplateSpec.yaml (3)
21-27: Verify the hardcoded audit webhook endpoint.The audit webhook target uses a hardcoded URL
https://k8s.master.wazuh.teuto.net/{{ .Release.Namespace}}/{{ .Release.Name }}. Ensure this external dependency is appropriate and that the endpoint will be available for all hosted control planes.
28-59: LGTM! Audit policy is well-structured.The audit rules appropriately filter system noise while capturing meaningful events at the Metadata level for secrets and mutations.
60-70: LGTM! Component configurations are appropriate.The controller manager, scheduler, and gateway configurations are correctly structured for a hosted control plane deployment.
charts/t8s-cluster/templates/workload-cluster/cloud-controller-manager.yaml (2)
63-70: Toleration structure and hosted behavior.The tolerations are correctly structured as a list with two entries. The change from a minor-version conditional to a hosted conditional is appropriate for the hosted control plane model. However, verify that non-hosted deployments have access to necessary tolerations elsewhere, or confirm that running without these specific tolerations is acceptable for non-hosted scenarios.
58-59: Verify minimum Kubernetes version compatibility for hosted control plane patches.The
op: removeoperation at line 59 unconditionally removes/spec/template/spec/nodeSelectorfor all hosted control planes. According to RFC 6902, theremoveoperation requires the target path to exist; if it doesn't, the patch will fail.The dynamic version selection
openstack-cloud-controller-manager 2.${minorVersion}.xcan map to older chart versions (e.g., 2.28.x for Kubernetes 1.28). The enriched summary notes that the conditional guard previously restricting this tominorVersion > 28was removed. Confirm that all supported chart versions (especially pre-1.29) include nodeSelector on the DaemonSet before this change is deployed, or add version-conditional logic to only apply the patch for compatible chart versions.
cwrau
force-pushed
the
feat/t8s-cluster/switch-to-hcp
branch
from
b19c4ef to
aa16abe
Compare
🤖 I have created a release *beep* *boop* --- ## [9.5.0](t8s-cluster-v9.4.1...t8s-cluster-v9.5.0) (2026-01-15) ### Features * **t8s-cluster/artifacthub:** use centralised helmRepositories template ([#1846](#1846)) ([73a41f9](73a41f9)) * **t8s-cluster/cilium:** enable kubeProxy replacement ([#1815](#1815)) ([b3c412d](b3c412d)) * **t8s-cluster/management-cluster:** add cluster-autoscaler deployment ([#1756](#1756)) ([5b6ead9](5b6ead9)) * **t8s-cluster/management-cluster:** enable ImageVolume feature flag ([#1786](#1786)) ([9676ee0](9676ee0)) * **t8s-cluster/management-cluster:** set apiServerLoadBalancer.provider via TeutonetesCloud ([#1898](#1898)) ([6bf8889](6bf8889)) * **t8s-cluster/management-cluster:** switch to hcp ([#1759](#1759)) ([303b0b6](303b0b6)) * **t8s-cluster/management-cluster:** use new KubeletEnsureSecretPulledImages feature gate ([#1858](#1858)) ([40d7bef](40d7bef)) * **t8s-cluster:** migrate to CAPI v1beta2 ([#1685](#1685)) ([dc5f071](dc5f071)) ### Bug Fixes * **t8s-cluster/autoscaler:** these names are inside the workload cluster ([#1877](#1877)) ([f345cea](f345cea)) * **t8s-cluster/management-cluster:** leave out protocol if `nil` ([#1837](#1837)) ([f370dac](f370dac)) * **t8s-cluster:** only allow nodePools with valid k8s names ([#1851](#1851)) ([b9431c5](b9431c5)) ### Miscellaneous Chores * **t8s-cluster/dependencies:** update common docker tag to v1.6.0 ([#1811](#1811)) ([b3b4c94](b3b4c94)) * **t8s-cluster/dependencies:** update common docker tag to v1.7.0 ([#1873](#1873)) ([71e062f](71e062f)) * **t8s-cluster/dependencies:** update helm release cilium to v1.18.6 ([#1894](#1894)) ([e1adc88](e1adc88)) * **t8s-cluster/dependencies:** update helm release cluster-autoscaler to v9.53.0 ([#1856](#1856)) ([dc67fcd](dc67fcd)) * **t8s-cluster/dependencies:** update helm release openstack-cloud-controller-manager to v2.34.1 ([#1553](#1553)) ([e984d19](e984d19)) * **t8s-cluster/dependencies:** update registry.k8s.io/etcd docker tag to v3.5.24 ([#1793](#1793)) ([a5098e3](a5098e3)) * **t8s-cluster/dependencies:** update registry.k8s.io/etcd docker tag to v3.6.6 ([#1813](#1813)) ([e07ffa7](e07ffa7)) * **t8s-cluster/dependencies:** update registry.k8s.io/etcd docker tag to v3.6.7 ([#1895](#1895)) ([cf1d3b4](cf1d3b4)) * **t8s-cluster/flux:** use centralised HelmRepositories instead of per-instance ([#1758](#1758)) ([3deff65](3deff65)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
Summary by CodeRabbit
New Features
Improvements
Chores