Harden kube-version lookup and match the live cluster

AGENTS.md

@@ -22,10 +22,10 @@ make kubeconform
 make clean
 
 # Quick build + inspect without persisting output
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
 
 # Check all resource kinds produced by an overlay
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
 
 # Run pre-commit checks against all files
 uvx pre-commit run --all-files
@@ -118,7 +118,7 @@ In `argocd/projects/platform.yaml` (or `storage.yaml`):
 
 ### 5. Validate
 ```bash
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
 make kubeconform
 ```
 
@@ -215,7 +215,7 @@ Examples:
 
 Some overlays vendor Helm charts locally under `apps/overlays/au-syd1/<app-name>/charts/<chart-name>/`. When a chart is vendored, the overlay's `kustomization.yaml` references the local path. When not vendored, it references the OCI or HTTP repo directly.
 
-Current Kubernetes target version: **1.33.7** (used by kubeconform in CI).
+The Kubernetes target version lives in `ci/kube-version`; the Makefile and CI scripts read it for both the Helm capabilities version and kubeconform.
 
 ---
 

Makefile

@@ -1,6 +1,10 @@
 .PHONY: build clean schemas
 
-KUBE_VERSION := $(shell cat ci/kube-version)
+MAKEFILE_DIR := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST)))))
+KUBE_VERSION := $(strip $(shell cat $(MAKEFILE_DIR)/ci/kube-version 2>/dev/null))
+ifeq ($(KUBE_VERSION),)
+$(error cannot read $(MAKEFILE_DIR)/ci/kube-version)
+endif
 
 # Build a kustomization path to manifests directory
 # Usage: make build clusters/au-syd1/bootstrap

ci/kube-version

@@ -1 +1 @@
-1.33.7
+1.33.13

ci/validate-apps.sh

@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+KUBE_VERSION="$(cat ci/kube-version)"
-KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 

ci/validate-clusters.sh

@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+KUBE_VERSION="$(cat ci/kube-version)"
-KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 

migration.md

@@ -49,8 +49,8 @@
 - Use existing patterns like `apps/overlays/*/csi-*` or `apps/overlays/*/<app-name>`
 
 ### 9. Validation
-- Run `kustomize build --enable-helm apps/overlays/au-syd1/<app-name>` to generate all resources
+- Run `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>` to generate all resources
-- Check resource types: `kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
+- Check resource types: `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
 - Verify all resource types are permitted in the target project's `clusterResourceWhitelist` and `namespaceResourceWhitelist`
 - Run `make kubeconform` to validate all resources
 - Fix any validation errors