chore: repo-wide simplify pass - #4378
Merged
Merged
Conversation
Contributor
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Aug 6, 2026 9:41p.m. | Review ↗ |
| Shell |  |
Aug 6, 2026 9:41p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
|
Important Review skippedToo many files! This PR contains 115 files, which is 15 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (115)
You can disable this status message by setting the 📝 WalkthroughWalkthroughThe pull request adds shared runner caching and DNS configuration, replaces individual external-service manifests with Flux ResourceSets, refactors Monero dashboard networking, and updates observability, workload, Flux, and Kubernetes configuration. ChangesRunner tool cache
Shared DNS configuration
External service ResourceSets
Monero dashboard and server
Observability configuration
Platform configuration updates
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant FluxResourceSet
participant KubernetesService
participant EndpointSlice
participant GatewayAPI
FluxResourceSet->>KubernetesService: Generate headless Service
FluxResourceSet->>EndpointSlice: Generate external endpoint
FluxResourceSet->>GatewayAPI: Generate HTTPRoute or TLSRoute
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/pvc.yaml (1)
5-15: 🩺 Stability & Availability | 🔵 TrivialBound cache growth before the PVC fills.
Line 5 states that no process prunes old binaries. The 2Gi claim can hold only about 20 Talos versions at roughly 96MiB each. A later cache miss will fail when
curlcannot create its temporary file. Add bounded retention or a capacity alert instead of relying on manual cleanup.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/pvc.yaml` around lines 5 - 15, Update the runner-tool-cache PVC configuration and its surrounding cache-management setup to prevent unbounded Talos binary growth: add an automatic retention/pruning mechanism for old versions or configure an alert when storage approaches capacity. Preserve the existing shared 2Gi volume unless the selected solution requires otherwise, and remove the manual-cleanup-only assumption in the comment.kubernetes/components/ndots-1/configmap.yaml (1)
10-16: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winEnable immediate reconciliation for the shared
ndots-1values ConfigMap.
helm-controllerhas--watch-configs-label-selector=owner!=helm, butndots-1has no matching label and noreconcile.fluxcd.io/watch: Enabledlabel. Later ConfigMap edits will wait for the consuming HelmRelease 30-minute reconcile interval unless the object watch label is added.Propposed metadata update
metadata: name: ndots-1 + labels: + reconcile.fluxcd.io/watch: Enabled🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@kubernetes/components/ndots-1/configmap.yaml` around lines 10 - 16, Add the `reconcile.fluxcd.io/watch: Enabled` label to the ndots-1 values ConfigMap metadata so helm-controller watches changes and immediately reconciles consuming releases. Preserve the existing values.yaml data unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/flate.yaml:
- Around line 119-126: Update the cache-miss download flow around the cached
talosctl path to create the temporary file with mktemp in /tool-cache, ensuring
uniqueness across concurrent runner pods. Preserve the existing download, chmod,
and atomic mv behavior, and add cleanup so the temporary file is removed if any
download or installation step fails.
In
`@kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/helmrelease.yaml`:
- Around line 55-60: Make the /tool-cache mounts read-only so workflow steps
cannot modify the shared ReadWriteMany cache. Ensure cache contents are
populated by a trusted process, or copy binaries to job-local storage and verify
their pinned digests before use. Apply the same protection to the additional
mounts referenced at lines 74–76.
In `@kubernetes/apps/network/external-service/resourceset-http.yaml`:
- Line 2: Replace the hardcoded schema domain in the ResourceSet schema
directives with ${SECRET_DOMAIN} in both
kubernetes/apps/network/external-service/resourceset-http.yaml:2-2 and
kubernetes/apps/network/external-service/resourceset-tls.yaml:2-2, preserving
the existing schema URL structure.
In `@kubernetes/apps/web3/monero/dashboard/resources/dashboard.js`:
- Around line 1235-1242: Update the refresh flow around updateStats so payout
and share requests remain independent from pool_info failures: fetch payouts and
shares without coupling them to pool_info, handle the pool-info request
separately, and fall back to null for the luck-card data when it fails. Preserve
updateRecentPayments() and updateSharesCard() execution even when the pool-info
request rejects, and retain the existing updateWindowLuck() behavior.
---
Nitpick comments:
In
`@kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/pvc.yaml`:
- Around line 5-15: Update the runner-tool-cache PVC configuration and its
surrounding cache-management setup to prevent unbounded Talos binary growth: add
an automatic retention/pruning mechanism for old versions or configure an alert
when storage approaches capacity. Preserve the existing shared 2Gi volume unless
the selected solution requires otherwise, and remove the manual-cleanup-only
assumption in the comment.
In `@kubernetes/components/ndots-1/configmap.yaml`:
- Around line 10-16: Add the `reconcile.fluxcd.io/watch: Enabled` label to the
ndots-1 values ConfigMap metadata so helm-controller watches changes and
immediately reconciles consuming releases. Preserve the existing values.yaml
data unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b415e54e-64a3-42c5-a4b9-b0a695c380ac
📒 Files selected for processing (79)
.github/workflows/flate.yaml.github/workflows/gitleaks.yamlkubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/helmrelease.yamlkubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/kustomization.yamlkubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/pvc.yamlkubernetes/apps/ai/kustomization.yamlkubernetes/apps/ai/llmkube/app/helmrelease.yamlkubernetes/apps/ai/omniroute/app/helmrelease.yamlkubernetes/apps/ai/opencode/app/opencode-vm-endpointslice.yamlkubernetes/apps/ai/opencode/app/opencode-vm-service.yamlkubernetes/apps/default/nextcloud/app/helmrelease.yamlkubernetes/apps/flux-system/flux-instance/app/helmrelease.yamlkubernetes/apps/kube-system/descheduler/app/helmrelease.yamlkubernetes/apps/kube-system/metrics-server/app/helmrelease.yamlkubernetes/apps/media/kustomization.yamlkubernetes/apps/media/seerr/app/helmrelease.yamlkubernetes/apps/network/external-service/arm/endpointslice.yamlkubernetes/apps/network/external-service/arm/httproute.yamlkubernetes/apps/network/external-service/arm/kustomization.yamlkubernetes/apps/network/external-service/arm/service.yamlkubernetes/apps/network/external-service/avr/endpointslice.yamlkubernetes/apps/network/external-service/avr/httproute.yamlkubernetes/apps/network/external-service/avr/kustomization.yamlkubernetes/apps/network/external-service/avr/service.yamlkubernetes/apps/network/external-service/centauri-carbon/endpointslice.yamlkubernetes/apps/network/external-service/centauri-carbon/httproute.yamlkubernetes/apps/network/external-service/centauri-carbon/kustomization.yamlkubernetes/apps/network/external-service/centauri-carbon/service.yamlkubernetes/apps/network/external-service/homeassistant/endpointslice.yamlkubernetes/apps/network/external-service/homeassistant/httproute.yamlkubernetes/apps/network/external-service/homeassistant/kustomization.yamlkubernetes/apps/network/external-service/homeassistant/service.yamlkubernetes/apps/network/external-service/ipmi/endpointslice.yamlkubernetes/apps/network/external-service/ipmi/kustomization.yamlkubernetes/apps/network/external-service/ipmi/service.yamlkubernetes/apps/network/external-service/ipmi/tlsroute.yamlkubernetes/apps/network/external-service/kustomization.yamlkubernetes/apps/network/external-service/ntopg/endpointslice.yamlkubernetes/apps/network/external-service/ntopg/httproute.yamlkubernetes/apps/network/external-service/ntopg/kustomization.yamlkubernetes/apps/network/external-service/ntopg/service.yamlkubernetes/apps/network/external-service/opnsense/endpointslice.yamlkubernetes/apps/network/external-service/opnsense/kustomization.yamlkubernetes/apps/network/external-service/opnsense/service.yamlkubernetes/apps/network/external-service/opnsense/tlsroute.yamlkubernetes/apps/network/external-service/resourceset-http.yamlkubernetes/apps/network/external-service/resourceset-tls.yamlkubernetes/apps/network/external-service/scrutiny/endpointslice.yamlkubernetes/apps/network/external-service/scrutiny/httproute.yamlkubernetes/apps/network/external-service/scrutiny/kustomization.yamlkubernetes/apps/network/external-service/scrutiny/service.yamlkubernetes/apps/network/external-service/truenas/endpointslice.yamlkubernetes/apps/network/external-service/truenas/kustomization.yamlkubernetes/apps/network/external-service/truenas/service.yamlkubernetes/apps/network/external-service/truenas/tlsroute.yamlkubernetes/apps/network/external-service/vaultwarden/endpointslice.yamlkubernetes/apps/network/external-service/vaultwarden/httproute.yamlkubernetes/apps/network/external-service/vaultwarden/kustomization.yamlkubernetes/apps/network/external-service/vaultwarden/service.yamlkubernetes/apps/observability/exporters/blackbox-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/drm-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/prowlarr-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/qbittorrent-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/sonarr-exporter/app/helmrelease.yamlkubernetes/apps/observability/gatus/app/helmrelease.yamlkubernetes/apps/observability/gatus/app/resources/config.yamlkubernetes/apps/observability/kube-state-metrics/app/helmrelease.yamlkubernetes/apps/observability/kustomization.yamlkubernetes/apps/observability/victoria-metrics/app/helmrelease.yamlkubernetes/apps/security/crowdsec/app/helmrelease.yamlkubernetes/apps/security/crowdsec/bouncers/envoy/helmrelease.yamlkubernetes/apps/web3/monero/dashboard/resources/dashboard.jskubernetes/apps/web3/monero/dashboard/resources/server.pykubernetes/apps/web3/monero/xmrig/resourceset.yamlkubernetes/apps/web3/xmrig-guard/app/resources/controller.pykubernetes/components/kopiur/privileged-movers/kustomization.yamlkubernetes/components/ndots-1/configmap.yamlkubernetes/components/ndots-1/kustomization.yamlkubernetes/flux/cluster/ks.yaml
💤 Files with no reviewable changes (53)
- .github/workflows/gitleaks.yaml
- kubernetes/apps/network/external-service/vaultwarden/service.yaml
- kubernetes/apps/ai/opencode/app/opencode-vm-service.yaml
- kubernetes/apps/network/external-service/ipmi/service.yaml
- kubernetes/apps/network/external-service/avr/service.yaml
- kubernetes/apps/network/external-service/avr/kustomization.yaml
- kubernetes/apps/network/external-service/scrutiny/endpointslice.yaml
- kubernetes/apps/network/external-service/ipmi/tlsroute.yaml
- kubernetes/apps/observability/gatus/app/helmrelease.yaml
- kubernetes/apps/network/external-service/ipmi/kustomization.yaml
- kubernetes/apps/network/external-service/vaultwarden/endpointslice.yaml
- kubernetes/apps/network/external-service/opnsense/tlsroute.yaml
- kubernetes/apps/network/external-service/opnsense/kustomization.yaml
- kubernetes/apps/network/external-service/avr/endpointslice.yaml
- kubernetes/apps/network/external-service/ntopg/kustomization.yaml
- kubernetes/apps/network/external-service/vaultwarden/httproute.yaml
- kubernetes/apps/network/external-service/homeassistant/service.yaml
- kubernetes/apps/ai/opencode/app/opencode-vm-endpointslice.yaml
- kubernetes/apps/observability/exporters/blackbox-exporter/app/helmrelease.yaml
- kubernetes/apps/network/external-service/ntopg/service.yaml
- kubernetes/apps/network/external-service/scrutiny/httproute.yaml
- kubernetes/apps/network/external-service/arm/service.yaml
- kubernetes/apps/security/crowdsec/app/helmrelease.yaml
- kubernetes/apps/network/external-service/opnsense/endpointslice.yaml
- kubernetes/apps/network/external-service/homeassistant/kustomization.yaml
- kubernetes/apps/network/external-service/ntopg/httproute.yaml
- kubernetes/apps/network/external-service/scrutiny/kustomization.yaml
- kubernetes/apps/network/external-service/arm/kustomization.yaml
- kubernetes/apps/network/external-service/homeassistant/endpointslice.yaml
- kubernetes/apps/network/external-service/scrutiny/service.yaml
- kubernetes/apps/network/external-service/centauri-carbon/httproute.yaml
- kubernetes/apps/network/external-service/centauri-carbon/service.yaml
- kubernetes/apps/network/external-service/truenas/endpointslice.yaml
- kubernetes/apps/kube-system/descheduler/app/helmrelease.yaml
- kubernetes/apps/network/external-service/homeassistant/httproute.yaml
- kubernetes/apps/security/crowdsec/bouncers/envoy/helmrelease.yaml
- kubernetes/apps/network/external-service/ipmi/endpointslice.yaml
- kubernetes/apps/network/external-service/arm/endpointslice.yaml
- kubernetes/apps/ai/llmkube/app/helmrelease.yaml
- kubernetes/apps/network/external-service/vaultwarden/kustomization.yaml
- kubernetes/apps/network/external-service/opnsense/service.yaml
- kubernetes/apps/network/external-service/avr/httproute.yaml
- kubernetes/apps/network/external-service/truenas/tlsroute.yaml
- kubernetes/apps/network/external-service/truenas/kustomization.yaml
- kubernetes/apps/network/external-service/ntopg/endpointslice.yaml
- kubernetes/apps/observability/victoria-metrics/app/helmrelease.yaml
- kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml
- kubernetes/apps/network/external-service/centauri-carbon/kustomization.yaml
- kubernetes/apps/network/external-service/arm/httproute.yaml
- kubernetes/apps/web3/monero/xmrig/resourceset.yaml
- kubernetes/apps/network/external-service/centauri-carbon/endpointslice.yaml
- kubernetes/apps/observability/exporters/drm-exporter/app/helmrelease.yaml
- kubernetes/apps/network/external-service/truenas/service.yaml
Owner
Author
|
Review round 1 resolved in
Nitpicks:
Cache behaviour was exercised across all six branches before pushing: cold miss, warm hit, poisoned entry (detected, re-downloaded, cache healed), stale version pruned, mount absent entirely (the state of the live runner until this PR rolls out), and the resulting binary running |
Tanguille
force-pushed
the
chore/simplify-pass-2026-08
branch
from
August 6, 2026 18:35
5f4f771 to
3a0e93b
Compare
Tanguille
force-pushed
the
chore/simplify-pass-2026-08
branch
from
August 6, 2026 19:01
efd597b to
efb61b3
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/flate.yaml:
- Line 143: Update the talosctl cache-pruning find command to include the
-ignore_readdir_race option, preserving the existing name filters and deletion
behavior while preventing concurrent removal of the same cache entry from
failing the job.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 9161261a-58d5-4a58-8fb0-2eaa02e719c1
📒 Files selected for processing (79)
.github/workflows/flate.yaml.github/workflows/gitleaks.yamlkubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/helmrelease.yamlkubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/kustomization.yamlkubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/pvc.yamlkubernetes/apps/ai/kustomization.yamlkubernetes/apps/ai/llmkube/app/helmrelease.yamlkubernetes/apps/ai/omniroute/app/helmrelease.yamlkubernetes/apps/ai/opencode/app/opencode-vm-endpointslice.yamlkubernetes/apps/ai/opencode/app/opencode-vm-service.yamlkubernetes/apps/default/nextcloud/app/helmrelease.yamlkubernetes/apps/flux-system/flux-instance/app/helmrelease.yamlkubernetes/apps/kube-system/descheduler/app/helmrelease.yamlkubernetes/apps/kube-system/metrics-server/app/helmrelease.yamlkubernetes/apps/media/kustomization.yamlkubernetes/apps/media/seerr/app/helmrelease.yamlkubernetes/apps/network/external-service/arm/endpointslice.yamlkubernetes/apps/network/external-service/arm/httproute.yamlkubernetes/apps/network/external-service/arm/kustomization.yamlkubernetes/apps/network/external-service/arm/service.yamlkubernetes/apps/network/external-service/avr/endpointslice.yamlkubernetes/apps/network/external-service/avr/httproute.yamlkubernetes/apps/network/external-service/avr/kustomization.yamlkubernetes/apps/network/external-service/avr/service.yamlkubernetes/apps/network/external-service/centauri-carbon/endpointslice.yamlkubernetes/apps/network/external-service/centauri-carbon/httproute.yamlkubernetes/apps/network/external-service/centauri-carbon/kustomization.yamlkubernetes/apps/network/external-service/centauri-carbon/service.yamlkubernetes/apps/network/external-service/homeassistant/endpointslice.yamlkubernetes/apps/network/external-service/homeassistant/httproute.yamlkubernetes/apps/network/external-service/homeassistant/kustomization.yamlkubernetes/apps/network/external-service/homeassistant/service.yamlkubernetes/apps/network/external-service/ipmi/endpointslice.yamlkubernetes/apps/network/external-service/ipmi/kustomization.yamlkubernetes/apps/network/external-service/ipmi/service.yamlkubernetes/apps/network/external-service/ipmi/tlsroute.yamlkubernetes/apps/network/external-service/kustomization.yamlkubernetes/apps/network/external-service/ntopg/endpointslice.yamlkubernetes/apps/network/external-service/ntopg/httproute.yamlkubernetes/apps/network/external-service/ntopg/kustomization.yamlkubernetes/apps/network/external-service/ntopg/service.yamlkubernetes/apps/network/external-service/opnsense/endpointslice.yamlkubernetes/apps/network/external-service/opnsense/kustomization.yamlkubernetes/apps/network/external-service/opnsense/service.yamlkubernetes/apps/network/external-service/opnsense/tlsroute.yamlkubernetes/apps/network/external-service/resourceset-http.yamlkubernetes/apps/network/external-service/resourceset-tls.yamlkubernetes/apps/network/external-service/scrutiny/endpointslice.yamlkubernetes/apps/network/external-service/scrutiny/httproute.yamlkubernetes/apps/network/external-service/scrutiny/kustomization.yamlkubernetes/apps/network/external-service/scrutiny/service.yamlkubernetes/apps/network/external-service/truenas/endpointslice.yamlkubernetes/apps/network/external-service/truenas/kustomization.yamlkubernetes/apps/network/external-service/truenas/service.yamlkubernetes/apps/network/external-service/truenas/tlsroute.yamlkubernetes/apps/network/external-service/vaultwarden/endpointslice.yamlkubernetes/apps/network/external-service/vaultwarden/httproute.yamlkubernetes/apps/network/external-service/vaultwarden/kustomization.yamlkubernetes/apps/network/external-service/vaultwarden/service.yamlkubernetes/apps/observability/exporters/blackbox-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/drm-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/prowlarr-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/qbittorrent-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/sonarr-exporter/app/helmrelease.yamlkubernetes/apps/observability/gatus/app/helmrelease.yamlkubernetes/apps/observability/gatus/app/resources/config.yamlkubernetes/apps/observability/kube-state-metrics/app/helmrelease.yamlkubernetes/apps/observability/kustomization.yamlkubernetes/apps/observability/victoria-metrics/app/helmrelease.yamlkubernetes/apps/security/crowdsec/app/helmrelease.yamlkubernetes/apps/security/crowdsec/bouncers/envoy/helmrelease.yamlkubernetes/apps/web3/monero/dashboard/resources/dashboard.jskubernetes/apps/web3/monero/dashboard/resources/server.pykubernetes/apps/web3/monero/xmrig/resourceset.yamlkubernetes/apps/web3/xmrig-guard/app/resources/controller.pykubernetes/components/kopiur/privileged-movers/kustomization.yamlkubernetes/components/ndots-1/configmap.yamlkubernetes/components/ndots-1/kustomization.yamlkubernetes/flux/cluster/ks.yaml
💤 Files with no reviewable changes (53)
- kubernetes/apps/network/external-service/avr/endpointslice.yaml
- kubernetes/apps/ai/opencode/app/opencode-vm-endpointslice.yaml
- kubernetes/apps/network/external-service/arm/endpointslice.yaml
- kubernetes/apps/network/external-service/vaultwarden/service.yaml
- kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml
- kubernetes/apps/network/external-service/truenas/tlsroute.yaml
- kubernetes/apps/network/external-service/ipmi/service.yaml
- kubernetes/apps/network/external-service/centauri-carbon/service.yaml
- kubernetes/apps/network/external-service/centauri-carbon/kustomization.yaml
- kubernetes/apps/kube-system/descheduler/app/helmrelease.yaml
- kubernetes/apps/network/external-service/ntopg/httproute.yaml
- kubernetes/apps/network/external-service/scrutiny/kustomization.yaml
- kubernetes/apps/security/crowdsec/bouncers/envoy/helmrelease.yaml
- kubernetes/apps/network/external-service/avr/service.yaml
- kubernetes/apps/network/external-service/ntopg/service.yaml
- kubernetes/apps/network/external-service/truenas/service.yaml
- kubernetes/apps/network/external-service/scrutiny/service.yaml
- kubernetes/apps/network/external-service/homeassistant/kustomization.yaml
- kubernetes/apps/observability/exporters/drm-exporter/app/helmrelease.yaml
- kubernetes/apps/network/external-service/scrutiny/httproute.yaml
- kubernetes/apps/ai/llmkube/app/helmrelease.yaml
- kubernetes/apps/network/external-service/centauri-carbon/endpointslice.yaml
- kubernetes/apps/network/external-service/homeassistant/endpointslice.yaml
- kubernetes/apps/network/external-service/ipmi/kustomization.yaml
- kubernetes/apps/network/external-service/arm/kustomization.yaml
- kubernetes/apps/network/external-service/centauri-carbon/httproute.yaml
- kubernetes/apps/network/external-service/homeassistant/httproute.yaml
- kubernetes/apps/network/external-service/avr/kustomization.yaml
- kubernetes/apps/network/external-service/ipmi/endpointslice.yaml
- kubernetes/apps/network/external-service/homeassistant/service.yaml
- kubernetes/apps/network/external-service/opnsense/endpointslice.yaml
- kubernetes/apps/observability/victoria-metrics/app/helmrelease.yaml
- kubernetes/apps/network/external-service/avr/httproute.yaml
- kubernetes/apps/network/external-service/opnsense/kustomization.yaml
- kubernetes/apps/observability/gatus/app/helmrelease.yaml
- kubernetes/apps/network/external-service/vaultwarden/endpointslice.yaml
- kubernetes/apps/network/external-service/truenas/kustomization.yaml
- kubernetes/apps/network/external-service/ipmi/tlsroute.yaml
- kubernetes/apps/observability/exporters/blackbox-exporter/app/helmrelease.yaml
- kubernetes/apps/network/external-service/vaultwarden/kustomization.yaml
- kubernetes/apps/web3/monero/xmrig/resourceset.yaml
- kubernetes/apps/network/external-service/arm/service.yaml
- kubernetes/apps/security/crowdsec/app/helmrelease.yaml
- kubernetes/apps/network/external-service/opnsense/service.yaml
- kubernetes/apps/network/external-service/ntopg/kustomization.yaml
- kubernetes/apps/network/external-service/vaultwarden/httproute.yaml
- kubernetes/apps/network/external-service/arm/httproute.yaml
- kubernetes/apps/network/external-service/opnsense/tlsroute.yaml
- kubernetes/apps/network/external-service/ntopg/endpointslice.yaml
- kubernetes/apps/network/external-service/scrutiny/endpointslice.yaml
- kubernetes/apps/ai/opencode/app/opencode-vm-service.yaml
- kubernetes/apps/network/external-service/truenas/endpointslice.yaml
- .github/workflows/gitleaks.yaml
🚧 Files skipped from review as they are similar to previous changes (24)
- kubernetes/apps/network/external-service/kustomization.yaml
- kubernetes/apps/ai/omniroute/app/helmrelease.yaml
- kubernetes/apps/media/seerr/app/helmrelease.yaml
- kubernetes/apps/ai/kustomization.yaml
- kubernetes/apps/observability/exporters/prowlarr-exporter/app/helmrelease.yaml
- kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/kustomization.yaml
- kubernetes/apps/observability/kustomization.yaml
- kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/helmrelease.yaml
- kubernetes/apps/observability/exporters/sonarr-exporter/app/helmrelease.yaml
- kubernetes/apps/web3/xmrig-guard/app/resources/controller.py
- kubernetes/apps/default/nextcloud/app/helmrelease.yaml
- kubernetes/apps/media/kustomization.yaml
- kubernetes/components/ndots-1/configmap.yaml
- kubernetes/apps/observability/gatus/app/resources/config.yaml
- kubernetes/components/ndots-1/kustomization.yaml
- kubernetes/components/kopiur/privileged-movers/kustomization.yaml
- kubernetes/apps/observability/exporters/qbittorrent-exporter/app/helmrelease.yaml
- kubernetes/apps/network/external-service/resourceset-tls.yaml
- kubernetes/apps/network/external-service/resourceset-http.yaml
- kubernetes/flux/cluster/ks.yaml
- kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/pvc.yaml
- kubernetes/apps/web3/monero/dashboard/resources/dashboard.js
- kubernetes/apps/flux-system/flux-instance/app/helmrelease.yaml
- kubernetes/apps/observability/kube-state-metrics/app/helmrelease.yaml
This was referenced Aug 6, 2026
Tanguille
force-pushed
the
chore/simplify-pass-2026-08
branch
from
August 6, 2026 20:44
7e3cf60 to
1a830f5
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@kubernetes/apps/web3/monero/dashboard/resources/server.py`:
- Line 326: Define a ThreadingHTTPServer subclass with daemon_threads set to
False, then instantiate that subclass in the server startup block around Handler
and PORT. Preserve the existing shutdown/finally flow so process termination
waits for active observer request handlers to finish before saving logs and
exiting.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 7e84bc27-57f4-403e-a596-22ae9e567e44
📒 Files selected for processing (79)
.github/workflows/flate.yaml.github/workflows/gitleaks.yamlkubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/helmrelease.yamlkubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/kustomization.yamlkubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/pvc.yamlkubernetes/apps/ai/kustomization.yamlkubernetes/apps/ai/llmkube/app/helmrelease.yamlkubernetes/apps/ai/omniroute/app/helmrelease.yamlkubernetes/apps/ai/opencode/app/opencode-vm-endpointslice.yamlkubernetes/apps/ai/opencode/app/opencode-vm-service.yamlkubernetes/apps/default/nextcloud/app/helmrelease.yamlkubernetes/apps/flux-system/flux-instance/app/helmrelease.yamlkubernetes/apps/kube-system/descheduler/app/helmrelease.yamlkubernetes/apps/kube-system/metrics-server/app/helmrelease.yamlkubernetes/apps/media/kustomization.yamlkubernetes/apps/media/seerr/app/helmrelease.yamlkubernetes/apps/network/external-service/arm/endpointslice.yamlkubernetes/apps/network/external-service/arm/httproute.yamlkubernetes/apps/network/external-service/arm/kustomization.yamlkubernetes/apps/network/external-service/arm/service.yamlkubernetes/apps/network/external-service/avr/endpointslice.yamlkubernetes/apps/network/external-service/avr/httproute.yamlkubernetes/apps/network/external-service/avr/kustomization.yamlkubernetes/apps/network/external-service/avr/service.yamlkubernetes/apps/network/external-service/centauri-carbon/endpointslice.yamlkubernetes/apps/network/external-service/centauri-carbon/httproute.yamlkubernetes/apps/network/external-service/centauri-carbon/kustomization.yamlkubernetes/apps/network/external-service/centauri-carbon/service.yamlkubernetes/apps/network/external-service/homeassistant/endpointslice.yamlkubernetes/apps/network/external-service/homeassistant/httproute.yamlkubernetes/apps/network/external-service/homeassistant/kustomization.yamlkubernetes/apps/network/external-service/homeassistant/service.yamlkubernetes/apps/network/external-service/ipmi/endpointslice.yamlkubernetes/apps/network/external-service/ipmi/kustomization.yamlkubernetes/apps/network/external-service/ipmi/service.yamlkubernetes/apps/network/external-service/ipmi/tlsroute.yamlkubernetes/apps/network/external-service/kustomization.yamlkubernetes/apps/network/external-service/ntopg/endpointslice.yamlkubernetes/apps/network/external-service/ntopg/httproute.yamlkubernetes/apps/network/external-service/ntopg/kustomization.yamlkubernetes/apps/network/external-service/ntopg/service.yamlkubernetes/apps/network/external-service/opnsense/endpointslice.yamlkubernetes/apps/network/external-service/opnsense/kustomization.yamlkubernetes/apps/network/external-service/opnsense/service.yamlkubernetes/apps/network/external-service/opnsense/tlsroute.yamlkubernetes/apps/network/external-service/resourceset-http.yamlkubernetes/apps/network/external-service/resourceset-tls.yamlkubernetes/apps/network/external-service/scrutiny/endpointslice.yamlkubernetes/apps/network/external-service/scrutiny/httproute.yamlkubernetes/apps/network/external-service/scrutiny/kustomization.yamlkubernetes/apps/network/external-service/scrutiny/service.yamlkubernetes/apps/network/external-service/truenas/endpointslice.yamlkubernetes/apps/network/external-service/truenas/kustomization.yamlkubernetes/apps/network/external-service/truenas/service.yamlkubernetes/apps/network/external-service/truenas/tlsroute.yamlkubernetes/apps/network/external-service/vaultwarden/endpointslice.yamlkubernetes/apps/network/external-service/vaultwarden/httproute.yamlkubernetes/apps/network/external-service/vaultwarden/kustomization.yamlkubernetes/apps/network/external-service/vaultwarden/service.yamlkubernetes/apps/observability/exporters/blackbox-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/drm-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/prowlarr-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/qbittorrent-exporter/app/helmrelease.yamlkubernetes/apps/observability/exporters/sonarr-exporter/app/helmrelease.yamlkubernetes/apps/observability/gatus/app/helmrelease.yamlkubernetes/apps/observability/gatus/app/resources/config.yamlkubernetes/apps/observability/kube-state-metrics/app/helmrelease.yamlkubernetes/apps/observability/kustomization.yamlkubernetes/apps/observability/victoria-metrics/app/helmrelease.yamlkubernetes/apps/security/crowdsec/app/helmrelease.yamlkubernetes/apps/security/crowdsec/bouncers/envoy/helmrelease.yamlkubernetes/apps/web3/monero/dashboard/resources/dashboard.jskubernetes/apps/web3/monero/dashboard/resources/server.pykubernetes/apps/web3/monero/xmrig/resourceset.yamlkubernetes/apps/web3/xmrig-guard/app/resources/controller.pykubernetes/components/kopiur/privileged-movers/kustomization.yamlkubernetes/components/ndots-1/configmap.yamlkubernetes/components/ndots-1/kustomization.yamlkubernetes/flux/cluster/ks.yaml
💤 Files with no reviewable changes (53)
- kubernetes/apps/network/external-service/avr/service.yaml
- kubernetes/apps/observability/exporters/drm-exporter/app/helmrelease.yaml
- kubernetes/apps/network/external-service/opnsense/tlsroute.yaml
- kubernetes/apps/network/external-service/scrutiny/service.yaml
- kubernetes/apps/network/external-service/homeassistant/endpointslice.yaml
- kubernetes/apps/web3/monero/xmrig/resourceset.yaml
- kubernetes/apps/kube-system/descheduler/app/helmrelease.yaml
- kubernetes/apps/network/external-service/ipmi/tlsroute.yaml
- kubernetes/apps/network/external-service/centauri-carbon/kustomization.yaml
- kubernetes/apps/network/external-service/ipmi/kustomization.yaml
- kubernetes/apps/network/external-service/homeassistant/kustomization.yaml
- kubernetes/apps/network/external-service/scrutiny/kustomization.yaml
- kubernetes/apps/network/external-service/vaultwarden/httproute.yaml
- kubernetes/apps/network/external-service/avr/endpointslice.yaml
- kubernetes/apps/network/external-service/avr/httproute.yaml
- kubernetes/apps/network/external-service/avr/kustomization.yaml
- kubernetes/apps/network/external-service/centauri-carbon/service.yaml
- kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml
- kubernetes/apps/network/external-service/centauri-carbon/httproute.yaml
- kubernetes/apps/network/external-service/truenas/endpointslice.yaml
- kubernetes/apps/network/external-service/vaultwarden/service.yaml
- .github/workflows/gitleaks.yaml
- kubernetes/apps/network/external-service/ntopg/httproute.yaml
- kubernetes/apps/network/external-service/scrutiny/endpointslice.yaml
- kubernetes/apps/observability/exporters/blackbox-exporter/app/helmrelease.yaml
- kubernetes/apps/network/external-service/truenas/service.yaml
- kubernetes/apps/network/external-service/scrutiny/httproute.yaml
- kubernetes/apps/network/external-service/ntopg/service.yaml
- kubernetes/apps/network/external-service/arm/service.yaml
- kubernetes/apps/network/external-service/opnsense/kustomization.yaml
- kubernetes/apps/network/external-service/centauri-carbon/endpointslice.yaml
- kubernetes/apps/network/external-service/ntopg/kustomization.yaml
- kubernetes/apps/network/external-service/arm/endpointslice.yaml
- kubernetes/apps/network/external-service/homeassistant/httproute.yaml
- kubernetes/apps/network/external-service/ipmi/endpointslice.yaml
- kubernetes/apps/network/external-service/ipmi/service.yaml
- kubernetes/apps/network/external-service/arm/httproute.yaml
- kubernetes/apps/network/external-service/opnsense/endpointslice.yaml
- kubernetes/apps/network/external-service/vaultwarden/kustomization.yaml
- kubernetes/apps/network/external-service/opnsense/service.yaml
- kubernetes/apps/network/external-service/homeassistant/service.yaml
- kubernetes/apps/ai/opencode/app/opencode-vm-endpointslice.yaml
- kubernetes/apps/observability/gatus/app/helmrelease.yaml
- kubernetes/apps/network/external-service/vaultwarden/endpointslice.yaml
- kubernetes/apps/ai/opencode/app/opencode-vm-service.yaml
- kubernetes/apps/security/crowdsec/app/helmrelease.yaml
- kubernetes/apps/network/external-service/ntopg/endpointslice.yaml
- kubernetes/apps/observability/victoria-metrics/app/helmrelease.yaml
- kubernetes/apps/network/external-service/truenas/tlsroute.yaml
- kubernetes/apps/network/external-service/truenas/kustomization.yaml
- kubernetes/apps/ai/llmkube/app/helmrelease.yaml
- kubernetes/apps/security/crowdsec/bouncers/envoy/helmrelease.yaml
- kubernetes/apps/network/external-service/arm/kustomization.yaml
🚧 Files skipped from review as they are similar to previous changes (25)
- kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/kustomization.yaml
- kubernetes/apps/ai/kustomization.yaml
- kubernetes/apps/network/external-service/kustomization.yaml
- kubernetes/components/ndots-1/kustomization.yaml
- kubernetes/apps/default/nextcloud/app/helmrelease.yaml
- kubernetes/apps/media/seerr/app/helmrelease.yaml
- kubernetes/apps/observability/exporters/prowlarr-exporter/app/helmrelease.yaml
- kubernetes/apps/observability/kustomization.yaml
- kubernetes/apps/media/kustomization.yaml
- kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/helmrelease.yaml
- kubernetes/apps/observability/exporters/sonarr-exporter/app/helmrelease.yaml
- kubernetes/apps/observability/exporters/qbittorrent-exporter/app/helmrelease.yaml
- kubernetes/apps/network/external-service/resourceset-tls.yaml
- kubernetes/apps/network/external-service/resourceset-http.yaml
- kubernetes/flux/cluster/ks.yaml
- kubernetes/components/kopiur/privileged-movers/kustomization.yaml
- kubernetes/apps/web3/xmrig-guard/app/resources/controller.py
- kubernetes/apps/ai/omniroute/app/helmrelease.yaml
- kubernetes/apps/web3/monero/dashboard/resources/dashboard.js
- .github/workflows/flate.yaml
- kubernetes/apps/actions-runner-system/actions-runner-controller/runners/cluster/pvc.yaml
- kubernetes/apps/flux-system/flux-instance/app/helmrelease.yaml
- kubernetes/apps/observability/gatus/app/resources/config.yaml
- kubernetes/apps/observability/kube-state-metrics/app/helmrelease.yaml
- kubernetes/components/ndots-1/configmap.yaml
…rceSets Thirty objects across 42 files, differing only in name, IP, port and homepage annotations. Adding a service is now one input entry. flux-operator build resourceset renders all 30 objects identically to the previous kustomize output, apart from the resourceset.fluxcd.controlplane.io ownership labels and three targetPort: 443 lines that restate spec.ports.port.
The same four-line dnsConfig sat in five HelmReleases, documented in one. The two reasons it is there (three NXDOMAIN round-trips per in-cluster FQDN, and an external name being hijacked by a same-named local Service) now live once. Merged value trees are identical for all five apps.
HelmChart, Alert, Provider and Receiver emitted gotk_resource_info that no alert and no dashboard reads: flux-instance/prometheusrule.yaml queries only HelmRelease and Kustomization, and the two pinned upstream dashboards query only Kustomization, HelmRelease, GitRepository, HelmRepository, Bucket and OCIRepository. Their RBAC grants go with them. The seven surviving kinds share one name/namespace/ready/suspend shape, so anchors leave each block showing only what differs. 422 lines to 213, rendered output unchanged.
…ches The observer proxy read whole bodies into memory before writing a byte. /observer/shares?limit=10000 measures 9.2MB, fetched every 10s by every open tab, buffered in a 256Mi container. It now streams with copyfileobj and asks for gzip, which the same request serves in 3.0MB. Also: one send_json and one proxy helper replace seven copies of the response boilerplate, ThreadingHTTPServer replaces ThreadingTCPServer plus a manual allow_reuse_address, and the monerod get_info request is built once. Frontend: initialize() refetched /stats_log.json and rebuilt both charts microseconds before updateStats() did the same; chart options and their four closures were rebuilt every tick and thrown away on the update path; pool_info joins the existing Promise.all instead of costing its own round trip.
The pull job refetched a 96.6MiB talosctl on every container PR, roughly 400 a month over the home uplink, to run a tool that then pulls images. The runner image ships yq but no talosctl, so the download itself is needed. An RWX PVC at /tool-cache is shared by every runner pod, keyed by Talos version, so it is one download per version cluster-wide. fsGroup 1001 because the runner is uid/gid 1001 and the CephFS mount is otherwise root-owned.
Eleven sites across ten charts. Each verified by pulling the pinned chart and diffing helm template before and after: rendered output is identical everywhere (crowdsec and vmstack differ only in per-run generated certs). Also collapses five repeated gatus endpoint alert blocks onto alerting.discord.default-alert; enabled: true already restates the gatus default. Parsed alert state is unchanged for all five endpoints.
…ntics Four near-identical strategic-merge patches setting one memory limit each become two regex-targeted ones, matching the idiom already used twice in the same file. The cluster patch carried a substitute-from opt-out label with no users anywhere in the repo. It was a one-word kill switch for sops decryption and secret substitution across a whole app tree, so it is gone; the note about the patch replacing substituteFrom wholesale stays. privileged-movers used a JSON6902 add into /metadata/annotations, which only resolved because common/namespace.yaml happens to emit an annotations map. A strategic merge creates the map when absent and drops the ~1 escaping.
opencode Service and EndpointSlice: type ClusterIP, protocol TCP and a targetPort equal to port. gitleaks: job permissions identical to the workflow-level block. nextcloud: the fromAddressKey workaround cited chart 9.2.0 while the pin is 9.2.5, rechecked and still required. xmrig resourceset: a sub-comment claiming fast scale-up above a 60s window, inside a block its own header calls inert. controller.py: a `not samples` guard unreachable because max() over an empty set already raised, and a timeout kwarg restating the signature default.
The mount does not exist until the runner HelmRelease in this PR rolls out, so the job would fail on its own CI run, and it disappears if CephFS is down. Falls back to a per-run download in both cases.
DeepSource JS-0116: updateWindowLuck lost its only await when the pool_info fetch moved into the batch, so it no longer needs to be async. DeepSource JS-R1004: /observer/pool_info has no interpolation. The talosctl cache is a shared writable mount, so its contents are untrusted: every read is now checked against the release sha256 and copied to job-local storage before going on PATH, a poisoned or truncated entry falls through to a plain download, and the temporary file uses mktemp rather than $$, which is not unique across pods sharing the mount. Superseded versions are pruned, which also bounds growth on the 2Gi share.
Checking the cache entry and then reading it left a window where another job could swap the file in between, so the local copy reached PATH unverified. Copying first and hashing what was actually copied closes it, and drops a verify call.
40 added comment lines down to 25; no comment loses a measured fact.
Two cache-miss jobs pruning the same stale entry make one find call exit non-zero, which under set -e fails the step. Reproduced at 11/12 rounds with two concurrent pruners; 0/12 with -ignore_readdir_race.
Restated defaults: 22 ServiceMonitor/PodMonitor `scheme: http` and `path: /metrics` (neither has a CRD default; Prometheus and VMAgent both supply them), gatus probe timeoutSeconds/failureThreshold, qbitrr terminationGracePeriodSeconds, xmrig Service targetPort, spegel grafanaDashboard.mode, vmsingle storage.accessModes, llmkube dashboard mode. The three k8s ones were confirmed against the live API server with a server-side dry-run, the chart ones by render diff. Altitude: the kustomize-controller volume patch replaced index 0 rather than merging on name, so it would rewrite whichever volume upstream put first; the crowdsec bouncer reloader annotation used a JSON6902 add that replaces the whole annotations map. Both now strategic merges, matching the rest of the repo. immich-server gains fsGroupChangePolicy: OnRootMismatch — without it kubelet recursively chowns a 100Gi CephFS volume on every pod start. nextcloud cron: run_occ always returns 0, so the "not ready" guard could never fire and the maintenance sequence ran against a down instance. Calls occ directly, and the app-list bootstrap moves below the guard. Also: dead sort and a duplicated bound in dashboard.js, and comments that restate the line below them.
ThreadingTCPServer defaulted daemon_threads to False; ThreadingHTTPServer sets it to True, so swapping the base class quietly changed shutdown semantics. Restored, so server_close() waits for an in-flight observer proxy rather than truncating it.
Tanguille
force-pushed
the
chore/simplify-pass-2026-08
branch
from
August 6, 2026 21:04
2729fb8 to
2a591cb
Compare
This was referenced Aug 6, 2026
CNPG app databases and the flux-instance/victoria-metrics/rook-ceph Grafana dashboards were one near-identical manifest per item. Each collapses to a ResourceSet whose inputs carry only what differs. Dashboard files keep the grafanadashboard.yaml name and a nested grafanaCom map so Renovate's dashboard manager still matches; all 13 revision pins and the memini vchord pin still extract. ResourceSet.spec.wait defaults to false, so every set under a wait: true Kustomization sets it explicitly, external-service included. All 27 dashboards render byte-identical. The 10 databases without managed extensions gain spec.extensions: [], which CNPG short-circuits on (reconcileDatabaseObjects returns early at objectCount == 0).
AI Automated ReviewAnalysis engine: omniroute@http://litellm.ai.svc.cluster.local/v1 (openai) Recommendation: Approve. Well-scoped consolidation with per-change rendering verification; no blockers found. Must-check items:
Findings:
Unknowns / Needs Verification:
Sources: ceph-mixin and flux dashboard JSONs fetched and valid; talos v1.13.8 release confirmed present in the release list. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
@@ spec.logCollector.enabled @@
# ceph.rook.io/v1/CephCluster/rook-ceph/rook-ceph
! ± value change
- false
+ true
|
@@ spec.groups.hermes.rules.rules.HermesCronJobFailed.expr @@
# monitoring.coreos.com/v1/PrometheusRule/ai/hermes-rules
! ± value change in multiline text (one insert, one deletion)
- last_over_time(hermes_cron_last_status_ok[30m]) == 0
- unless on (id) last_over_time(hermes_cron_paused[30m]) == 1
+ last_over_time(hermes_cron_last_status_ok[30m]) == 0
@@ spec.groups.hermes.rules.rules.HermesCronDeliveryFailed.expr @@
# monitoring.coreos.com/v1/PrometheusRule/ai/hermes-rules
! ± value change in multiline text (one insert, one deletion)
- last_over_time(hermes_cron_delivery_failed[30m]) == 1
- unless on (id) last_over_time(hermes_cron_paused[30m]) == 1
+ last_over_time(hermes_cron_delivery_failed[30m]) == 1
@@ spec.env.SGLANG_HICACHE_FILE_BACKEND_MIN_FREE_SPACE.value @@
# inference.llmkube.dev/v1alpha1/InferenceService/ai/qwen36-27b
! ± value change
- 160Gi
+ 100Gi
@@ spec.groups.external-dns.rules.rules.0.expr @@
# monitoring.coreos.com/v1/PrometheusRule/network/external-dns-rules
! ± value change in multiline text (one insert, one deletion)
- # 300s, not 60s: the sync interval is itself 1m, so a 60s threshold trips every cycle.
- time() - external_dns_controller_last_sync_timestamp_seconds > 300
+ time() - external_dns_controller_last_sync_timestamp_seconds > 60
@@ spec.values.cephClusterSpec @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/rook-ceph/rook-ceph-cluster
! - one map entry removed:
- logCollector:
- enabled: false
@@ data.dashboard.js @@
# v1/ConfigMap/web3/dashboard
! ± value change in multiline text (one insert, one deletion)
/* global Chart */
// ==============================
// MONERO MINING DASHBOARD
// ==============================
[891 lines unchanged)]
displayHours < 1
? `${Math.round(timeWindow / 60)}m window`
: displayHours < 24
? `${displayHours.toFixed(1)}h window`
- : `${cappedWindowDays.toFixed(1)}d window`;
+ : `${displayDays.toFixed(1)}d window`;
setTextContent("trueLuckWindow", windowText);
setTooltipContent(
"trueLuckTooltip",
[468 lines unchanged)]
}
// Start the application
initialize();
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Repo-wide
/simplify. 79 files, +431/-1084. Every change verified by rendering before and after; nothing shipped on inspection alone.Verification
helm templatediffflux-operator build resourcesetvskustomize buildtargetPortdefaultsMergeMaps, diffed merged valuesdnsConfigconfirmed in rendered podkustomize buildper-kind comparedefault-alertenabled=true send-on-resolved=truekustomize buildof a consumer namespacepython3 -m unittest test_controllerkustomize buildon all 131 Flux pathsWhat changed
external-service: 42 files to 4. Ten per-app trees differing only in name, IP, port and homepage annotations become two ResourceSets. Adding a service is one input entry.kube-state-metrics: 422 lines to 213. HelmChart/Alert/Provider/Receiver emittedgotk_resource_infothat no alert and no dashboard reads; the seven survivors share one shape via anchors.monero-dashboard: observer proxy streamed instead of buffered./observer/shares?limit=10000measures 9.2MB every 10s per tab, held whole in a 256Mi container; gzip serves the same data in 3.0MB. Frontend drops a duplicate startup fetch, a per-tick chart rebuild, and a serialpool_inforound trip.flateCI: talosctl was refetched at 96.6MiB per container PR, roughly 400 a month over the home uplink. Now an RWX cache keyed by Talos version, one download per version cluster-wide.ndots:1: the same four lines in five HelmReleases, documented in one, now a shared component.substitute-fromopt-out label had zero users and was a one-word kill switch for sops decryption across an app tree.Operational notes
Investigated, not applied
Moving the three Talos node-label patch files into talhelper's native per-node
nodeLabelssilently dropsnode.kubernetes.io/exclude-from-external-load-balancersfrom all three control planes.pkg/talos/nodeconfig.go:122-126assigns the map rather than merging, and runs before patches; the label comes from Talos machineryconfig/generate/init.go:99-105. Reverted, genconfig back to a byte-identical baseline. A sharedcontrolPlane.patchesentry does work if we want it later.Summary by CodeRabbit
New Features
Improvements