update dependencies - #2107
Merged
Merged
Conversation
Despire
added
test-set-autoscaling
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
WalkthroughThis PR updates CI Kubernetes actions to v5, bumps Go module versions (direct and indirect), updates Python requirements, upgrades build-stage Go images in service Dockerfiles to 1.26.3, and changes kustomize image tags to a new unified ChangesDependency and Tooling Updates
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
services/manager/Dockerfile (1)
32-50:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRun the runtime container as a non-root user
Line 32 onward defines the final runtime image, but there is no
USERdirective, so the process runs as root. Please add a dedicated non-root user/group and switch beforeENTRYPOINT.Suggested fix
FROM docker.io/library/alpine:3.23 @@ COPY --from=build /go/kubectl /usr/local/bin/kubectl COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt COPY --from=build /go/services/manager/cmd/api-server/api-server /bin/services/manager/api-server WORKDIR /bin -RUN chmod +x /usr/local/bin/kubectl && apk add -q bash +RUN apk add -q bash && \ + addgroup -S claudie && adduser -S -G claudie claudie && \ + chmod +x /usr/local/bin/kubectl /bin/services/manager/api-server && \ + chown -R claudie:claudie /bin/services/manager /usr/local/bin/kubectl +USER claudie @@ ENTRYPOINT [ "./services/manager/api-server" ]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@services/manager/Dockerfile` around lines 32 - 50, Add a non-root user and switch to it before ENTRYPOINT: create a dedicated group/user (e.g., manager), chown the runtime binaries (/bin/services/manager/api-server and /usr/local/bin/kubectl) and any required directories (WORKDIR /bin) to that user, and add a USER manager (or similar) directive before ENTRYPOINT; update the RUN line that currently does chmod +x /usr/local/bin/kubectl to also create the group/user and chown the files so the container process (ENTRYPOINT "./services/manager/api-server") runs as the non-root manager user.services/testing-framework/Dockerfile (1)
27-43:⚠️ Potential issue | 🟠 Major | ⚡ Quick winTesting image should not execute tests as root
Line 27 onward defines the final container, but it keeps root privileges through
ENTRYPOINT(Line 43). Add a non-root runtime user and ownership for copied test artifacts.Suggested fix
FROM docker.io/library/alpine:3.23 @@ RUN chmod +x /usr/local/bin/kubectl && \ - apk add -q bash + apk add -q bash && \ + addgroup -S claudie && adduser -S -G claudie claudie && \ + chown -R claudie:claudie /go/services/testing-framework /usr/local/bin/kubectl `#Run` server WORKDIR /go/services/testing-framework +USER claudie ENTRYPOINT [ "./testing-framework.test", "-test.run", "TestClaudie", "-test.timeout=25000s", "-test.v", "./..." ]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@services/testing-framework/Dockerfile` around lines 27 - 43, The container currently runs tests as root via ENTRYPOINT and must run as a non-root user: create a non-root user (e.g., "tester"), chown the copied artifacts (/usr/local/bin/kubectl and /go/services/testing-framework/testing-framework.test) and the WORKDIR (/go/services/testing-framework) to that user, ensure executables keep their +x bit, and add a USER tester (and optionally set HOME) before ENTRYPOINT so testing-framework.test is executed without root privileges; target symbols: COPY lines that place testing-framework.test and kubectl, RUN chmod +x ..., WORKDIR, and ENTRYPOINT.services/terraformer/Dockerfile (1)
30-49:⚠️ Potential issue | 🟠 Major | ⚡ Quick winFinal image still runs as root
From Line 30 to Line 49, the runtime stage never switches away from root. Add a non-root user and run
workerunder it.Suggested fix
FROM docker.io/library/alpine:3.23 @@ RUN apk --no-cache add bash git `#Run` worker WORKDIR /bin +RUN addgroup -S claudie && adduser -S -G claudie claudie && \ + chown -R claudie:claudie /bin/services/terraformer /usr/local/bin/tofu +USER claudie ENTRYPOINT [ "./services/terraformer/worker" ]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@services/terraformer/Dockerfile` around lines 30 - 49, The image still runs as root; create a non-root user/group in the runtime stage (e.g., add a system group and user), chown the service binary and any needed directories (referencing /bin/services/terraformer/worker and /bin as targets) to that user, and switch to that user with USER before the ENTRYPOINT so the worker defined by ENTRYPOINT ["./services/terraformer/worker"] runs non-root; ensure any created home/workdir permissions are updated accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 43-47: The go.mod requires k8s modules at v0.36.0 while existing
replace directives force v0.34.0, causing inconsistent dependencies; update the
require entries for k8s.io/api, k8s.io/apimachinery, k8s.io/client-go and any
other k8s-related requires (e.g., sigs.k8s.io/controller-runtime,
k8s.io/autoscaler/cluster-autoscaler if present) to v0.34.0 to match the replace
directives, or alternatively remove/update the replace directives to
v0.36.0—make the change consistently for the module names listed so the require
and replace versions align.
---
Outside diff comments:
In `@services/manager/Dockerfile`:
- Around line 32-50: Add a non-root user and switch to it before ENTRYPOINT:
create a dedicated group/user (e.g., manager), chown the runtime binaries
(/bin/services/manager/api-server and /usr/local/bin/kubectl) and any required
directories (WORKDIR /bin) to that user, and add a USER manager (or similar)
directive before ENTRYPOINT; update the RUN line that currently does chmod +x
/usr/local/bin/kubectl to also create the group/user and chown the files so the
container process (ENTRYPOINT "./services/manager/api-server") runs as the
non-root manager user.
In `@services/terraformer/Dockerfile`:
- Around line 30-49: The image still runs as root; create a non-root user/group
in the runtime stage (e.g., add a system group and user), chown the service
binary and any needed directories (referencing /bin/services/terraformer/worker
and /bin as targets) to that user, and switch to that user with USER before the
ENTRYPOINT so the worker defined by ENTRYPOINT ["./services/terraformer/worker"]
runs non-root; ensure any created home/workdir permissions are updated
accordingly.
In `@services/testing-framework/Dockerfile`:
- Around line 27-43: The container currently runs tests as root via ENTRYPOINT
and must run as a non-root user: create a non-root user (e.g., "tester"), chown
the copied artifacts (/usr/local/bin/kubectl and
/go/services/testing-framework/testing-framework.test) and the WORKDIR
(/go/services/testing-framework) to that user, ensure executables keep their +x
bit, and add a USER tester (and optionally set HOME) before ENTRYPOINT so
testing-framework.test is executed without root privileges; target symbols: COPY
lines that place testing-framework.test and kubectl, RUN chmod +x ..., WORKDIR,
and ENTRYPOINT.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 54e73945-7366-4220-bbde-8489538aac33
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (11)
.github/workflows/CI-pipeline.ymlgo.modrequirements.txtservices/ansibler/Dockerfileservices/autoscaler-adapter/Dockerfileservices/claudie-operator/Dockerfileservices/kube-eleven/Dockerfileservices/kuber/Dockerfileservices/manager/Dockerfileservices/terraformer/Dockerfileservices/testing-framework/Dockerfile
m-brando
approved these changes
May 18, 2026
samuelstolicny
approved these changes
May 18, 2026
This was referenced May 29, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit