chore(deps): update networkpolicy docker tag to v5 - #182
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Owner
Renovate Review:
|
| Check | Result |
|---|---|
| Inputs | Degraded — Release Notes present with an explicit BREAKING CHANGES block, but zero diff-bot comments exist on this PR. |
| Description vs. diff | Mismatch — see Details: this silently touches every app that inherits the fleet default. |
| Rendered diff | None available — no app-level evidence at all. |
| Changelog vs. config | No overlap found for the consuming apps' own live overrides (see Details). |
Details:
- The only file this PR changes is
03_apps/values.yaml, bumping the fleet-wide defaultnetworkPolicyChartVersion(4.6.0→5.0.0). That path is outside both globs the rendered-diff workflow watches (03_apps/apps/**and02_bootstrap/**), so the absence of any diff comment is expected behavior, not a defect — but it also means this PR carries zero rendered evidence for any of the apps it actually affects. - This default is consumed by
03_apps/charts/application-wrapper/templates/_application.tplfor every app that has anetwork.yamlfile without its ownversion:override. A repo-wide search found the default is inherited by at least:step-ca,crowdsec,authentik,smb-driver,hello-world,hello-world-simple,cert-manager,local-path-provisioner,kyverno, and cloudnative-pg'scloudnative-pg-operator,cnpg-plugin-barman-cloud, andpostgresdb-user-operatornetwork files — none of these pins its ownnetwork.yamlversion. (longhorn's network policy is currentlynetwork.yaml.disabled, so it's unaffected while disabled.) None of these ~12 apps is named anywhere in this PR, and none has any file changed or diff comment. - The
networkpolicychart (per its release notes) generatesNetworkPolicy/CiliumNetworkPolicy-style resources from apreset:block — none of the consuming apps'network.yamlfiles (spot-checked:step-ca,crowdsec,authentik,kyverno,cloudnative-pg/*) referenceserviceAccount/automountTokenkeys, and this chart class doesn't appear to run its own long-lived Pod, so the "stop mounting the API token into pods by default" breaking change most likely has no live surface here — but this is inferred from the preset/values shape, not confirmed by any render, since none exists.
Why MEDIUM: Major bump whose actual scope silently reaches roughly a dozen apps via a fleet-wide default, none of which are named in the PR or have any rendered evidence — a missing-input and scope-mismatch condition per the review criteria. Not High: no breaking-changelog item was found to intersect any of the consuming apps' actual overrides based on what their network.yaml files configure, and there is no introduced render error (there is no render at all to judge).
Generated by Claude Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.6.0→5.0.0Release Notes
lunarys/generic-helm-chart (networkpolicy)
v5.0.0Compare Source
Features
BREAKING CHANGES
serviceAccount.automountToken is set to true. Workloads using an
in-cluster Kubernetes client, or sidecars injected by a mutating webhook
that needs the token, must opt in.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.