feat(t8s-cluster/rbac): use Users instead of the whole Group#2020
feat(t8s-cluster/rbac): use Users instead of the whole Group#2020
Conversation
cwrau
requested review from
marvinWolff,
tasches and
teutonet-bot
as code owners
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request primarily addresses issues with the healthchecks.io integration within the Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis pull request modifies a Kubernetes ClusterRoleBinding YAML resource to change access permissions from a group (teuto.net:staff) to three individual users, and adds an explicit cluster role name reference. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request fixes the Alertmanager healthchecks URL and refactors how the check name is generated. The changes for this are correct.
However, I've identified two issues:
- In
charts/base-cluster/templates/monitoring/deadMansSwitch/unregister.yaml, removing the conditional check for deleting the monitoring healthcheck exposes a bug in thedeleteCheckfunction. The function is not robust and will cause thepre-deletehook to fail if a check doesn't exist. This should be fixed to prevent deployment issues. - In
charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml, aClusterRoleBindingis changed from using a group to a list of hardcoded users. This is a significant step back for maintainability and security best practices. This change seems unrelated to the PR's main goal and I strongly recommend reverting it.
Please keep pull requests focused on a single logical change to make them easier to review and manage.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml (1)
9-14: Consider parameterizing subjects via values.yaml for maintainability.Hardcoding user emails in the template requires template modifications when users need to be added or removed. The
base-clusterchart demonstrates a more maintainable pattern using thebase-cluster.rbac.subjectshelper that reads from.Values.rbac.accounts(seecharts/base-cluster/templates/rbac/roleBindings.yaml).Consider either:
- Creating a similar helper function for
t8s-cluster, or- Reading from a values configuration like
.Values.rbac.teutoStaff♻️ Suggested approach using values
In
values.yaml:rbac: teutoStaff: - cwr@teuto.net - mw@teuto.net - st@teuto.netThen in the template:
subjects: - - kind: User - name: cwr@teuto.net - - kind: User - name: mw@teuto.net - - kind: User - name: st@teuto.net + {{- range .Values.rbac.teutoStaff }} + - kind: User + name: {{ . }} + {{- end }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml` around lines 9 - 14, The template currently hardcodes user subjects (cwr@teuto.net, mw@teuto.net, st@teuto.net) in teuto-clusterrolebinding.yaml; change this to read from values instead (e.g. .Values.rbac.teutoStaff) or create a helper similar to base-cluster.rbac.subjects that maps each account to a subject object and use that helper in the teuto ClusterRoleBinding template so adding/removing users only requires updating values.yaml; update values.yaml with an rbac.teutoStaff array and replace the hardcoded entries in the template to iterate over that array (or call the new helper) to generate subjects.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In
`@charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml`:
- Around line 9-14: The template currently hardcodes user subjects
(cwr@teuto.net, mw@teuto.net, st@teuto.net) in teuto-clusterrolebinding.yaml;
change this to read from values instead (e.g. .Values.rbac.teutoStaff) or create
a helper similar to base-cluster.rbac.subjects that maps each account to a
subject object and use that helper in the teuto ClusterRoleBinding template so
adding/removing users only requires updating values.yaml; update values.yaml
with an rbac.teutoStaff array and replace the hardcoded entries in the template
to iterate over that array (or call the new helper) to generate subjects.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a2e79235-0f5f-424d-be96-91145ef84698
📒 Files selected for processing (4)
charts/base-cluster/templates/monitoring/deadMansSwitch/cronjob.yamlcharts/base-cluster/templates/monitoring/deadMansSwitch/unregister.yamlcharts/base-cluster/templates/monitoring/kube-prometheus-stack/_alertmanager-config.yamlcharts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml
There was a problem hiding this comment.
Pull request overview
This PR updates the Dead Man’s Switch / Healthchecks integration so Alertmanager pings the intended *-monitoring check and aligns check-name generation across templates. It also includes an unrelated RBAC subject change in the t8s-cluster chart.
Changes:
- Fix Alertmanager Healthchecks ping URL to target the
-monitoringcheck. - Reuse the shared
base-cluster.deadMansSwitch.checkNamehelper in cronjob/unregister templates and fix an API key variable reference. - Change
teuto-staffClusterRoleBinding subjects from a group to three individual users.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml | Changes RBAC binding subjects (Group → Users). |
| charts/base-cluster/templates/monitoring/kube-prometheus-stack/_alertmanager-config.yaml | Adjusts healthchecks webhook URL to ping the -monitoring check. |
| charts/base-cluster/templates/monitoring/deadMansSwitch/unregister.yaml | Uses shared checkName helper; fixes API key variable usage for API calls. |
| charts/base-cluster/templates/monitoring/deadMansSwitch/cronjob.yaml | Uses shared checkName helper for the scheduling ping URL. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
cwrau
force-pushed
the
feat/t8s-cluster/granular-rbac
branch
from
81ccf7e to
f8dac7c
Compare
cwrau
changed the title
|
@coderabbitai update the descriptions release notes |
|
✅ Actions performedSummary regeneration triggered. |
|
This excludes everyone except us from the on-call service. This can't be merged withouth furhter discussion |
Summary by CodeRabbit