chore: backport kubefleet main (2026-08-20) - #1336
Open
Britania Rodriguez Reyes (britaniar) wants to merge 24 commits into
Open
chore: backport kubefleet main (2026-08-20)#1336Britania Rodriguez Reyes (britaniar) wants to merge 24 commits into
Britania Rodriguez Reyes (britaniar) wants to merge 24 commits into
Conversation
* fix: apply overrides to resources inside envelope objects Override rules targeting resources wrapped in ResourceEnvelope or ClusterResourceEnvelope were silently ignored. Two coupled defects caused this: - Override snapshot selection built candidates only from the resource snapshot's selected resources. For an envelope placement that is the wrapper alone, so overrides targeting inner resources never reached the binding. - The work generator applied overrides before envelope detection, so rules were evaluated against the wrapper instead of the resources it carries. Overrides now resolve and apply against the resources inside an envelope. Overrides no longer apply to the envelope wrapper itself, including /data/... A Delete override on an inner resource drops only that manifest. The Work is still created when this empties the envelope. Override failures inside an envelope are now reported on the Overridden condition rather than being misattributed to WorkSynchronized. Collecting override candidates is a best-effort selection concern, so an inner manifest that is invalid or cannot be parsed is skipped rather than failing the caller. Candidate collection runs in the rollout controller, upstream of the work generator; returning an error there would abort the rollout before the work generator could report the failure. The work generator remains the authoritative validator of envelope contents and still surfaces these as sync failures. Fixes Azure#607 Signed-off-by: Stéphane Erbrech <stephane.erbrech@gmail.com>
… Cluster Request API objects (Azure#781)
…#801) * chore: bump github/codeql-action/analyze from 4.35.4 to 4.37.5 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.35.4 to 4.37.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@68bde55...d1ba80a) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * chore: bump codeql init and autobuild to v4.37.5 pin Co-authored-by: michaelawyu <14261500+michaelawyu@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: michaelawyu <14261500+michaelawyu@users.noreply.github.com>
…els (Azure#777) * ci: automate cherry-picks to release branches via cherry-pick/0.Y labels Adds a backport workflow: when a merged PR carries a cherry-pick/0.Y label (added before or after merge), the workflow cherry-picks the squash commit onto release-0.Y and opens a backport PR. Explicit policy, also documented in CONTRIBUTING.md: - squash merges only: merge commits and multi-commit rebases are skipped with a comment asking for a manual backport - conflicts are never pushed: the pick is aborted and manual instructions are commented on the original PR - bot-owned cherry-pick/0.Y/pr-N branches are force-pushed so re-labeling retries idempotently Part of the Phase 1 release-process revamp (Azure#693). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com> * ci: resolve github-actions[bot] user ID dynamically for backport commits Resolve the bot user ID from the API instead of hardcoding it, with a numeric-validated fallback to the known ID (41898282): gh api prints the error body to stdout on failure, so a plain || fallback would corrupt the value. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com> * ci: soft-fail on missing release branch and fix title-suffix comment Address review feedback: - A missing release-0.Y branch now comments and keeps the run green (matching the documented soft-fail behavior) instead of exiting 1: labels may legitimately be applied before the release branch is cut. - Correct the comment that claimed the target is prefixed to the PR title; it is suffixed because PR-title lint requires the conventional prefix at the start. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com> --------- Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…napshot, Placement Binding, and Work API objects (Azure#802)
…re#814) * chore: bump github/codeql-action/autobuild from 4.37.5 to 4.37.6 Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.37.5 to 4.37.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@d1ba80a...5595cca) --- updated-dependencies: - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore: bump codeql-action init/analyze to 4.37.6 for consistency Co-authored-by: michaelawyu <14261500+michaelawyu@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: michaelawyu <14261500+michaelawyu@users.noreply.github.com>
Update maintainer details and contacts Signed-off-by: Simon Waight <simon.waight@microsoft.com> Co-authored-by: Chen Yu <chenyu1@microsoft.com>
Three small hardening changes to how a release tag reaches the release
workflows. All of these require repository write access to reach, so this is
defence in depth rather than a fix for an externally reachable flaw.
setup-release.yml interpolated ${{ inputs.tag }} directly into its script
body, which expands the value in the shell before the tag regex can reject
it. Backticks and $(...) are legal in git ref names and match the v*.*.*
push filter, so both trigger paths were affected, not just
workflow_dispatch. The tag now arrives as an environment variable, so
validation runs before expansion. This makes that regex the single trust
boundary for the outputs every downstream job interpolates into its own
shell, in release.yml and chart.yml alike.
The export job also declared no permissions, so it inherited the caller's -
including contents: write and packages: write from chart.yml. It validates
an input and writes step outputs, so it needs no token at all.
`gh release create` gains --verify-tag. A tag that does not exist already
fails earlier, at the checkout in build-and-publish, so this is not the
last line of defence; it closes the narrower case where the ref resolves to
something that is not the tag, after which gh would create the tag itself
at the head of the default branch and the release would point at a
different commit than the images.
Part of Azure#693.
Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com>
Pin every actions/checkout reference to the v7.0.1 commit, and update the Squad workflows that track the floating v7 tag to v7.0.1. Also correct the codespell workflow's version comment, which still read v4.1.7 next to a v7 commit pin. Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com> Co-authored-by: Yetkin Timocin <ytimocin@microsoft.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: michaelawyu <14261500+michaelawyu@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Use the actively maintained MCR Trivy database source so image scans receive current vulnerability advisories. Signed-off-by: Britania Rodriguez Reyes <britaniar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* fix: notify security team for scheduled Trivy findings Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Britania Rodriguez Reyes <britaniar@microsoft.com> * ci: ignore authenticated Slack links Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Britania Rodriguez Reyes <britaniar@microsoft.com> * chore: keep Trivy fix scoped Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Britania Rodriguez Reyes <britaniar@microsoft.com> --------- Signed-off-by: Britania Rodriguez Reyes <britaniar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
) * test: add coverage for pod and replicaset validating webhooks The pod and replicaset validating webhooks were the only webhook packages without unit tests. Both deny creation outside the reserved fleet- and kube- namespaces, and both were untested for every branch of Handle. Add table-driven tests covering denial in a non-reserved namespace, admission in each reserved namespace prefix, pass-through of non-CREATE operations, and the decode failure path, following the existing pdb webhook test. Signed-off-by: Akshita <110122283+akshita317@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Akshita <110122283+akshita317@users.noreply.github.com> --------- Signed-off-by: Akshita <110122283+akshita317@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Initial plan * fix: update Go patch versions for CVE remediation Co-authored-by: britaniar <145056127+britaniar@users.noreply.github.com> * fix: align Go tooling to 1.26.6 Co-authored-by: britaniar <145056127+britaniar@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: britaniar <145056127+britaniar@users.noreply.github.com>
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.6.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...dbcb813) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Yetkin Timocin (ytimocin)
approved these changes
Aug 20, 2026
Yetkin Timocin (ytimocin)
left a comment
Yetkin Timocin (ytimocin)
left a comment
Contributor
There was a problem hiding this comment.
My part LGTM...
Chen Yu (michaelawyu)
approved these changes
Aug 21, 2026
Chen Yu (michaelawyu)
left a comment
Chen Yu (michaelawyu)
left a comment
Contributor
There was a problem hiding this comment.
LGTM ;) Thanks, Britania
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
kubefleet-dev/kubefleetmain branch into Azure/fleet.go.goms.io/fleetand retain Azure/fleet support links.Validation
make reviewableBackported commits