fix(charts): streaming-hub values header still claimed fsGroup replaces the pod security context - #1804
Merged
Merged
Conversation
…the pod security context #1769 changed that block from replace to merge, and the comment inside _deployment.tpl was updated with it. This header in values.yaml was not — it still told operators that enabling rolesAnywhere discards streamingHub.podSecurityContext. That is the file people read before turning the feature on, so the stale half is the one that misleads. Now describes what the template actually does: fsGroup is merged in and wins, every other pod-level setting survives, and the old wholesale-replace behaviour is named as past so anyone who remembers it knows it changed. Verified by render, not by reading: with rolesAnywhere on and a custom podSecurityContext, the pod gets fsGroup 65532 alongside runAsNonRoot, seccompProfile and supplementalGroups. helm lint clean. This commit also unblocks the release, and that is deliberate rather than incidental. The Helm Release workflow triggers on push paths, and README.md is in paths-ignore — so #1799, which restored the chart's README section and is what makes the release script succeed, could not itself trigger a release. There is no workflow_dispatch, and re-running the old failed run would check out the tree without the section. A change inside charts/streaming-hub/ is the only trigger available, and this was the one real inconsistency left in it. Claude-Session: https://claude.ai/code/session_01AQHofhVKKGUbSo959SEn5r
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe Roles Anywhere documentation now states that ChangesRoles Anywhere configuration
Possibly related PRs
✨ Finishing Touches✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
fredcamaral
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The
aws.rolesAnywhereheader invalues.yamlstill saysfsGroupREPLACESstreamingHub.podSecurityContext. #1769 changed that to a merge and updated the comment inside_deployment.tpl, but not this one — andvalues.yamlis the file operators read before turning the feature on, so the stale half is the one that misleads.Now it describes what the template does:
fsGroupis merged in and wins, every other pod-level setting survives, and the old replace behaviour is named as past so anyone who remembers it knows it changed.Verification
Render, not reading — with
rolesAnywhereon and a custompodSecurityContext:helm lintclean.It also unblocks the release, and that is deliberate
Stating it plainly rather than letting it look incidental.
#1799 restored this chart's README section, which is what makes the release script succeed — without it,
update-chart-version-readme-binexits 1 and the whole release job dies after semantic-release has already computed the version. But the Helm Release workflow hasREADME.mdinpaths-ignore, so #1799 could not trigger a release itself. There is noworkflow_dispatchon that workflow, and re-running the original failed run would check out the tree that lacks the section.A change inside
charts/streaming-hub/is the only trigger available. Rather than an empty commit, this is the one real inconsistency still left in the chart — created by #1769 and missed by me when I fixed its sibling.Merging this should publish
1.0.0-beta.5on the normal OCI path, whichstg-mt/streaming-hubinlerian-internal-gitopsneeds before its alpha package is deleted byhelm-alpha-cleanuparound 2026-08-03 03:00 UTC — after which that environment's render fails and nothing deploys there.https://claude.ai/code/session_01AQHofhVKKGUbSo959SEn5r