Skip to content

fix(kyverno): publish reports watch-planning correction - #5465

Merged
devantler merged 4 commits into
mainfrom
codex/kyverno-watch-image-4929
Oct 28, 2026
Merged

devantler merged 4 commits into
mainfrom
codex/kyverno-watch-image-4929

Conversation

@devantler

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

Why

Background security reporting attempts unrelated reads and misses some resources matched by deployed policies. This creates persistent errors and leaves reporting coverage uncertain.

What

Builds and signs a correction for the deployed release that follows each policy's background scope while preserving errors for incomplete observations. Deployment and live reporting recovery remain separate acceptance steps.

Part of #4929

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration
Commits

Reviewing files that changed from the base of the PR and between 805e34b and 00809fb.

Files selected for processing: 3
  • .github/workflows/publish-kyverno-reports-hotfix.yaml
  • k8s/bases/infrastructure/controllers/kyverno/ReportsWatchPlan.Dockerfile
  • k8s/bases/infrastructure/controllers/kyverno/reports-v1.19.2-watch-plan.patch
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

cr:no-gate@72b7fb5 — CodeRabbit's authenticated repository quota receipt says the next included review is available 30 minutes after 22:28:41 UTC, or 22:59:41 UTC with margin. Its command reply confirms the review did not run. Complete current-head reads show no delivered review or finding, and the no-gate guard admits this record. Advancing once to Codex under this head's owned review lock.

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-27T23:19:36.515658Z 00809fb Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 72b7fb5da4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

cr:no-gate@00809fb — CodeRabbit's authenticated response to this head's request states that the review did not run because it is rate limited. Fresh complete discussion/review/thread reads show no CodeRabbit review or finding at this head, and the live no-gate guard admits this record. The earlier Codex P2 is fixed and its thread resolved. Current Linux image verification and CI are green. Advancing once to Codex under the owned request lock.

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 00809fb62a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

Readiness at 00809fb62a5ace565811b4d98190d7f839d82aa3: Linux image verification succeeded, and the complete head check set has 37 successes and 12 intentional skips. Codex completed the corrected head without findings. The earlier P2 has regression coverage, is fixed, and its thread is resolved. Fresh complete discussion/review/thread reads contain no unresolved finding.

User evaluation exercised the actual controller's Warmup/List/Watch behavior, including healthy-plus-unavailable resources and removal of obsolete watches. The affected resource, aggregation and admission race suites, pinned Go/linter checks, static Linux build and exact release-to-patched-tree replay pass. The factory builds the actual controller into the pinned original runtime image and runs its startup help probe. Private native discovery/RBAC replay was a preflight only; it is not production adoption. The full upstream generator run remains incomplete because its CLI generator requires an unavailable local cluster; no upstream contribution or generator-completion claim is being made.

The signed branch is clean, GitHub reports CLEAN, every readable required check/workflow passes, and the live-health gate exits zero during the active deployment queue. Native code quality remains independently UNVERIFIED and is left to protected enforcement. Promoting for the normal queue. Signed publication, separate image adoption, refreshed native coverage and a quiet error window remain acceptance gates on #4929.

@devantler
devantler marked this pull request as ready for review October 27, 2026 23:20
@devantler
devantler added this pull request to the merge queue Oct 27, 2026
Merged via the queue into main with commit 46431eb Oct 28, 2026
49 checks passed
@devantler
devantler deleted the codex/kyverno-watch-image-4929 branch October 28, 2026 04:23
@github-project-automation github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

1 participant