🌱 sync: forward-port v4.17.1 into v5 with ancestry - #6060
Merged
Conversation
Closes #6036 Signed-off-by: Andy Anderson <andy@clubanderson.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v4.17.0 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>
release: v4.17.0
Automated release commit. Compiles changelog.d/ fragments and moves the CHANGELOG.md Unreleased section into a dated v4.17.1 entry. See src/docs/releases.md. Signed-off-by: hive-release-bot <actions@github.com>
release: v4.17.1
…ke (#5977) (#6010) * 🌱 feat(hub): watch the wildcard certificate that now serves every spoke (#5977) #5981 landed item 2: on a cluster that opts in with wildcard_tls_secret, provisioned spoke Ingresses omit their per-host tls: block and the ingress controller's --default-ssl-certificate serves them instead. That trades ~60 certificates for one, and it trades the blast radius with them. A per-host certificate that failed to renew took down ONE dashboard. The wildcard stands behind every hosted spoke on the cluster — ~263 hostnames across the two clusters in the issue — so a renewal that fails silently takes all of them at once. Nothing was watching. The issue named that as the "renewal consideration", and src/docs/spoke-wildcard-tls.md named monitoring as a prerequisite for enabling the opt-in fleet-wide. wildcard_tls_health.go reads the asserted secret once per cluster-health build and reports it as PerClusterHealth.WildcardTLS. Statuses: ok, expiring, expired, missing, domain_mismatch, unreadable. Non-ok renders on the cluster row of the fleet-health panel and logs a warning; ok renders nothing, so a healthy fleet stays quiet. ## It is also the first check on the opt-in itself wildcard_tls_secret is an operator ASSERTION, and wildcard_tls.go is explicit that the provisioner cannot verify it — it has to decide without a cluster round-trip, and guessing wrong takes the cluster down. That is right at provision time and is not a reason never to check. The health build already talks to every cluster on a timer, where being wrong costs a warning rather than an outage, so the assertion is verified there. Two statuses are exactly that assertion turning out to be false, and neither is visible from clusters.json: - missing: the flag is set and the secret is not there. Every wildcard-served spoke on the cluster is being handed ingress-nginx's built-in self-signed certificate right now. - domain_mismatch: the secret is there and does not carry "*.<cluster domain>". servesHostFromWildcard decides coverage from the domain in clusters.json; this is the only place the CERTIFICATE gets a say. Coverage is judged on the WILDCARD SAN, not on whether today's hosts happen to be listed: the hub omits the tls: block for every single-label host under the domain including hives that do not exist yet, so a certificate enumerating today's hosts would pass a per-host check and break the next hive provisioned. ## Thresholds and failure directions - expiring fires under 21 days, which means renewal is OVERDUE rather than upcoming. cert-manager's default renewBefore starts renewing a 90-day Let's Encrypt certificate at 30 days out, so warning at 30 would fire on every healthy renewal, every quarter, on every opted-in cluster. - A cluster the hub cannot reach reports NOTHING, never a reassuring ok — the same unknown-is-not-healthy contract StuckPods and LeakedNamespaces carry on this surface. kubectlSaysNotFound separates "the secret is gone" from "the cluster was unreachable" on kubectl's stderr and fails toward unknown, so an RBAC denial or a network blip is never reported as a vanished certificate. - Read-only, and only on opted-in clusters: one `kubectl get secret`. Clusters without the opt-in still carry per-host certificates and issue no request. - Coverage is judged before expiry: a certificate that cannot serve the domain is already failing every request, and calling it "expiring" would send an operator to renew a certificate that would still be wrong. ## Tests Every pure function at 100%: the parse (7 fail-closed shapes plus a chain, where taking the last block instead of the leaf would report the CA's expiry years out and never warn), coverage, every status with its boundary (30 days quiet, exactly 21 quiet, a minute inside noisy, exactly at notAfter expired), the not-found/unreachable split, and the JSON keys the dashboard switches on. collectWildcardTLSHealth is covered end to end against a scripted kubectl, including the missing-secret finding. pkg/hub coverage 91.7% against the gate's floor of 87. Items 1 and 3 of the issue remain operator work; this does not touch them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016gdK4wp8g7YFfiatUzdbgj Signed-off-by: Danathar <doug.baggett@gmail.com> * 🐛 verify wildcard ingress default Report opted-in clusters where ingress-nginx is not configured to serve the asserted wildcard secret as its default SSL certificate. Refs #5977 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Andy Anderson <andy@clubanderson.com> --------- Signed-off-by: Danathar <doug.baggett@gmail.com> Signed-off-by: Andy Anderson <andy@clubanderson.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: Andy Anderson <andy@clubanderson.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Capture request watcher directories for the lifetime of each loop and join the issue watcher in tests before restoring package-level test seams. Closes #6045 v5 note: pkg/github/requestwatch needs the same fix after the v4→v5 sync. Signed-off-by: Andy Anderson <andy@clubanderson.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…nc-policy.md) (#6052) * [strategist] planning: document v4→v5 forward-port sync policy Adds src/docs/v5-sync-policy.md proposing cadence (v4 minor release or 50-commit drift), single-owner rotation, the merge-commit top-up procedure already used by #5845/#6046, DCO expectations, and explicit PR-body and review contracts for sync PRs. Links it from the docs index. Refs #6051 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: sec-check <sec-check@hive.kubestellar.io> * 📖 document active v5 sync policy Align the v4-to-v5 sync policy with the current merge-commit top-up process, weekly/release cadence, maintainer ownership, verification checklist, and zero-delta check. Closes #6051 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Andy Anderson <andy@clubanderson.com> --------- Signed-off-by: sec-check <sec-check@hive.kubestellar.io> Signed-off-by: Andy Anderson <andy@clubanderson.com> Co-authored-by: sec-check <sec-check@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Andy Anderson <andy@clubanderson.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Andy Anderson <andy@clubanderson.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Andy Anderson <andy@clubanderson.com>
kubestellar-prow
Bot
added
the
dco-signoff: yes
clubanderson
added
no-changelog
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubestellar-prow
Bot
added
the
size/XXL
Contributor
|
Thank you for your contribution! Your PR has been merged. We'd love to hear how your experience was: share feedback |
This was referenced Sep 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Conflict resolutions
Validation