chore: add kube-proxy removal

[Despire]

Add kube-proxy removal for clusters that will upgrade from v0.12.x to the next release with ebpf cilium

Summary by CodeRabbit

• New Features

  • kubectl is now available in the runtime environment.
  • Automatic removal of legacy cluster proxy components during Kubernetes version upgrades.

• Chores

  • Updated deployment images to the new release tag across manifests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3741001d-df64-40bc-a6f3-f1fea574cece

📥 Commits

Reviewing files that changed from the base of the PR and between e249a92 and ee505b3.

📒 Files selected for processing (2)

• manifests/claudie/kustomization.yaml
• manifests/testing-framework/kustomization.yaml

✅ Files skipped from review due to trivial changes (2)

• manifests/testing-framework/kustomization.yaml
• manifests/claudie/kustomization.yaml

---

Walkthrough

The PR adds kubectl to the kube-eleven runtime image, invokes a new removeKubeProxy helper from the worker during Kubernetes version upgrades to delete kube-proxy ConfigMap and DaemonSet, and updates kustomization image tags to 4f00447-4209.

Changes

Kubectl integration and kube-proxy removal

Layer / File(s)	Summary
Dockerfile kubectl installation services/kube-eleven/Dockerfile	Kubectl binary is downloaded during the build stage for the target architecture (TARGETARCH) and copied into the final Alpine image at /usr/local/bin/kubectl with executable permissions.
Kube-proxy removal on upgrade services/kube-eleven/internal/worker/service/task_reconcile_infrastructure.go	Adds imports for command and kubectl; calls removeKubeProxy during the upgrade detection path in Reconcile; implements the helper to run kubectl delete for the kube-proxy ConfigMap and DaemonSet in the kube-system namespace, wiring output through command.GetStdOut/GetStdErr and logging errors on failure.
Kustomize image tag updates manifests/claudie/kustomization.yaml, manifests/testing-framework/kustomization.yaml	Updates ghcr.io/berops/claudie/* image newTag values to 4f00447-4209.

Sequence Diagram(s)

sequenceDiagram
  participant Worker as kube-eleven worker
  participant Kubectl as kubectl binary
  participant KubeAPI as Kubernetes API
  Worker->>Kubectl: execute delete ConfigMap `kube-proxy` (kube-system)
  Kubectl->>KubeAPI: DELETE configmap kube-proxy (kube-system)
  Worker->>Kubectl: execute delete DaemonSet `kube-proxy` (kube-system)
  Kubectl->>KubeAPI: DELETE daemonset kube-proxy (kube-system)
  KubeAPI-->>Worker: return deletion results

Loading

Possibly related PRs

• berops/claudie#2091: Related to kube-proxy handling in Cilium setups; that PR configures Cilium to skip kube-proxy installation.
• berops/claudie#2080: Touches the same manifest/image tag wiring for kube-eleven and testing-framework.
• berops/claudie#2107: Also updates claudie/testing-framework kustomization image newTag references.

Suggested labels

test-set-proxy

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: add kube-proxy removal' accurately describes the main change: adding functionality to remove kube-proxy components during Kubernetes upgrades.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/kube-proxy-removal

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@services/kube-eleven/Dockerfile`:
- Around line 12-13: The Dockerfile currently downloads kubectl using the
KC_VERSION variable but does not verify its integrity; update the RUN step that
sets KC_VERSION and fetches kubectl to also download the corresponding
kubectl.sha256 (or kubectl.sha256sum) from dl.k8s.io, verify the binary with
sha256sum -c (or by computing sha256 and comparing) before marking it
executable, and fail the build if the checksum check fails; reference the
KC_VERSION variable and the kubectl binary name so the verification uses the
exact downloaded artifact and apply the same pattern to the other Dockerfiles
(services/testing-framework/Dockerfile, services/kuber/Dockerfile,
services/manager/Dockerfile).

In
`@services/kube-eleven/internal/worker/service/task_reconcile_infrastructure.go`:
- Line 37: The call to removeKubeProxy is executing on every update; wrap the
removeKubeProxy(logger, k8s.ClusterInfo.Id(), k8s.Kubeconfig) invocation inside
the same upgrade-only predicate used elsewhere in this reconcile (i.e., only
when an upgrade is requested or desired version changes) so it runs only during
upgrade reconciles; locate the existing upgrade check in
task_reconcile_infrastructure.go (the predicate that detects an upgrade) and
move or guard the removeKubeProxy call with that condition.
- Around line 93-105: The current loop in task_reconcile_infrastructure.go
treats any error from KubectlDeleteResource as "kube-proxy not deployed"; change
this to inspect each returned error from KubectlDeleteResource for the specific
"not found" case (or translate it into an IsNotFound/kube resource-not-exist
check) and only ignore those, while logging and returning non-NotFound errors
(including auth/RBAC/connectivity) with their details; update the anyerror logic
(and the surrounding function that calls KubectlDeleteResource) to aggregate or
fail fast on real errors instead of collapsing them into the generic
logger.Error message so the code logs the specific error and halts/propagates
appropriately.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 68149b4b-ba7a-4217-a56a-4c6142b82e97

📥 Commits

Reviewing files that changed from the base of the PR and between fe02978 and e249a92.

📒 Files selected for processing (2)

• services/kube-eleven/Dockerfile
• services/kube-eleven/internal/worker/service/task_reconcile_infrastructure.go

[bernardhalas]

Thank you.