Check kube-version inside the build recipe

Render charts with --helm-kube-version from ci/kube-version so kustomize
no longer inherits the local helm binary's default Kubernetes version.

AGENTS.md

@@ -22,10 +22,10 @@ make kubeconform
 make clean
 
 # Quick build + inspect without persisting output
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
 
 # Check all resource kinds produced by an overlay
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c
 
 # Run pre-commit checks against all files
 uvx pre-commit run --all-files
@@ -118,7 +118,7 @@ In `argocd/projects/platform.yaml` (or `storage.yaml`):
 
 ### 5. Validate
 ```bash
-kustomize build --enable-helm apps/overlays/au-syd1/<app-name>
+kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>
 make kubeconform
 ```
 
@@ -215,7 +215,7 @@ Examples:
 
 Some overlays vendor Helm charts locally under `apps/overlays/au-syd1/<app-name>/charts/<chart-name>/`. When a chart is vendored, the overlay's `kustomization.yaml` references the local path. When not vendored, it references the OCI or HTTP repo directly.
 
-Current Kubernetes target version: **1.33.7** (used by kubeconform in CI).
+The Kubernetes target version lives in `ci/kube-version`; the Makefile and CI scripts read it for both the Helm capabilities version and kubeconform.
 
 ---
 

Makefile

@@ -3,8 +3,11 @@
 # Build a kustomization path to manifests directory
 # Usage: make build clusters/au-syd1/bootstrap
 build:
-	@mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS))
-	@kustomize build --enable-helm $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS))
+	@kube_version="$$(cat ci/kube-version)"; \
+	if [ -z "$$kube_version" ]; then echo "cannot read ci/kube-version" >&2; exit 1; fi; \
+	target="$(filter-out $@,$(MAKECMDGOALS))"; \
+	mkdir -p "manifests/$$target"; \
+	kustomize build --enable-helm --helm-kube-version "$$kube_version" "$$target" --output "manifests/$$target"
 
 # Generate JSON schemas from CRDs and Kubernetes swagger spec (run manually, results committed)
 schemas:

ci/kube-version

@@ -0,0 +1 @@
+1.33.13

ci/validate-apps.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-KUBE_VERSION="1.33.7"
+KUBE_VERSION="$(cat ci/kube-version)"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 
@@ -15,7 +15,7 @@ while IFS= read -r -d "" k; do
   dir="$(dirname "$k")"
   echo "==> kubeconform: $dir" >&2
 
-  kustomize build --enable-helm "$dir" \
+  kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \
     | kubeconform \
         -kubernetes-version "$KUBE_VERSION" \
         -summary \

ci/validate-clusters.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-KUBE_VERSION="1.33.7"
+KUBE_VERSION="$(cat ci/kube-version)"
 
 SCHEMA_DIR="${SCHEMA_DIR:-schemas}"
 
@@ -15,7 +15,7 @@ while IFS= read -r -d "" k; do
   dir="$(dirname "$k")"
   echo "==> kubeconform: $dir" >&2
 
-  kustomize build --enable-helm "$dir" \
+  kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \
     | kubeconform \
         -kubernetes-version "$KUBE_VERSION" \
         -summary \

migration.md

@@ -49,8 +49,8 @@
 - Use existing patterns like `apps/overlays/*/csi-*` or `apps/overlays/*/<app-name>`
 
 ### 9. Validation
-- Run `kustomize build --enable-helm apps/overlays/au-syd1/<app-name>` to generate all resources
-- Check resource types: `kustomize build --enable-helm apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
+- Run `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name>` to generate all resources
+- Check resource types: `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/<app-name> | grep "^kind:" | sort | uniq -c`
 - Verify all resource types are permitted in the target project's `clusterResourceWhitelist` and `namespaceResourceWhitelist`
 - Run `make kubeconform` to validate all resources
 - Fix any validation errors