feat(t8s-cluster/management-cluster): use new KubeletEnsureSecretPulledImages feature gate #1858
Conversation
cwrau
requested review from
marvinWolff,
tasches and
teutonet-bot
as code owners
Summary of ChangesHello @cwrau, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request refactors the cluster configuration to adopt the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughTemplates now propagate a context dict through Helm includes, enabling Kubernetes-version-aware feature-gate and admission-plugin generation; AlwaysPullImages is conditionally included for Kubernetes <1.33.0, KubeletEnsureSecretPulledImages added for ≥1.33.0, and outputs are sorted before emission. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Helm chart to use the new KubeletEnsureSecretPulledImages feature gate for Kubernetes versions 1.33.0 and newer, while retaining the AlwaysPullImages admission plugin for older versions. The changes correctly implement this version-based logic by modifying several Helm templates to conditionally enable the feature gate and the admission plugin. The necessary context is propagated through various template includes to facilitate the version check. The changes are logical and well-implemented. I have one minor suggestion to improve code clarity.
charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Pull request overview
This PR updates the t8s-cluster Helm chart to use the new KubeletEnsureSecretPulledImages feature gate for Kubernetes 1.33.0 and later, replacing the deprecated AlwaysPullImages admission plugin. The changes ensure backward compatibility by conditionally applying the appropriate mechanism based on the Kubernetes version.
Key Changes:
- Introduces version-aware feature gate configuration for
KubeletEnsureSecretPulledImages(K8s >=1.33.0) - Makes
AlwaysPullImagesadmission plugin conditional (only for K8s <1.33.0) - Adds proper context passing to template helpers that require access to version information
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| charts/t8s-cluster/templates/management-cluster/clusterClass/patches/_kubelet.tpl | Updated kubelet template helpers to pass context for version-aware feature gate configuration |
| charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl | Added conditional logic for KubeletEnsureSecretPulledImages feature gate and AlwaysPullImages admission plugin based on K8s version; updated context passing throughout |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl (1)
162-169: UnusedmustMergefor Values context.The
mustMergeon line 163 extracts.Valuesbut it's not used in this template—only.contextis needed for the version check. This appears to be leftover code.Consider removing the unused merge:
{{- define "t8s-cluster.clusterClass.apiServer.admissionPlugins" -}} - {{- $_ := mustMerge . (pick .context "Values") -}} {{- $admissionPlugins := list "NodeRestriction" "EventRateLimit" -}} {{- if semverCompare "<1.33.0" (include "t8s-cluster.k8s-version" .context) -}} {{- $admissionPlugins = append $admissionPlugins "AlwaysPullImages" -}} {{- end -}} {{- toYaml ($admissionPlugins | sortAlpha) -}} {{- end -}}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl(3 hunks)charts/t8s-cluster/templates/management-cluster/clusterClass/patches/_kubelet.tpl(3 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: cwrau
Repo: teutonet/teutonet-helm-charts PR: 1604
File: charts/base-cluster/templates/monitoring/metrics-server/metrics-server.yaml:20-21
Timestamp: 2025-07-24T09:41:28.072Z
Learning: The kubernetes-sigs/metrics-server Helm chart uses `v{{ .Chart.AppVersion }}` as the default image tag when `image.tag` is empty, which provides pinned versioning through the chart's AppVersion rather than using floating tags like "latest".
Learnt from: cwrau
Repo: teutonet/teutonet-helm-charts PR: 1602
File: charts/base-cluster/templates/monitoring/kube-prometheus-stack/oauth-proxy.yaml:38-40
Timestamp: 2025-07-24T09:49:40.961Z
Learning: Official Helm charts like oauth2-proxy manage image versioning automatically through their Chart.yaml appVersion field, making manual tag pinning in consumer values unnecessary and potentially harmful. The chart version itself provides reproducibility by ensuring the correct image tag is used.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Agent
- GitHub Check: lint helm chart (t8s-cluster)
🔇 Additional comments (7)
charts/t8s-cluster/templates/management-cluster/clusterClass/patches/_kubelet.tpl (3)
10-12: LGTM! Context propagation for version-aware feature gates.The context is correctly propagated to enable downstream access to the Kubernetes version for conditional feature gate handling.
28-28: Context propagation is consistent.Correctly passes context to
t8s-cluster.kubelet.featureGatesfor version-aware evaluation.
41-46: Context propagation chain is complete.The context flows correctly through the patch generation pipeline, ensuring version-aware behavior is available throughout.
charts/t8s-cluster/templates/management-cluster/clusterClass/_helpers.tpl (4)
81-90: LGTM! Context propagation for component-specific feature gates.The context flows correctly to the base
featureGatestemplate for version-aware evaluation.
204-204: LGTM! Context propagation for admission plugins.Correctly passes context to enable version-aware conditional inclusion of
AlwaysPullImages.
207-213: LGTM! Feature gates correctly wired for API server.Context is properly passed to
featureGates.forComponentfor version-aware feature flag resolution. The existingImageVolumefeature gate (which targets "apiserver") will be correctly included via this path.
73-79: Well-structured conditional feature gate handling.The logic correctly adds
KubeletEnsureSecretPulledImagesonly for Kubernetes >= 1.33.0 when the feature becomes available. The feature gate is appropriately scoped to only thekubeletcomponent. Thet8s-cluster.k8s-versiontemplate exists and properly returns a valid semver string in the formatvX.Y.Z, enabling correct version comparisons withsemverCompare.
…edImages feature gate This supersedes the old AlwaysPullImages admission plugin.
cwrau
force-pushed
the
feat/t8s-cluster/use-new-image-pull-verification
branch
from
a6222ae to
cd043b2
Compare
This supersedes the old AlwaysPullImages admission plugin.
Summary by CodeRabbit
New Features
Refactor
✏️ Tip: You can customize this high-level summary in your review settings.