From fb458ea90e836e7dd323ff0ee156f896a122dc40 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 12:28:16 +1000 Subject: [PATCH 1/3] Pin helm capabilities version to the validation target Render charts with --helm-kube-version from ci/kube-version so kustomize no longer inherits the local helm binary's default Kubernetes version. --- Makefile | 4 +++- ci/kube-version | 1 + ci/validate-apps.sh | 5 +++-- ci/validate-clusters.sh | 5 +++-- 4 files changed, 10 insertions(+), 5 deletions(-) create mode 100644 ci/kube-version diff --git a/Makefile b/Makefile index 37ed939..100ae8a 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,12 @@ .PHONY: build clean schemas +KUBE_VERSION := $(shell cat ci/kube-version) + # Build a kustomization path to manifests directory # Usage: make build clusters/au-syd1/bootstrap build: @mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS)) - @kustomize build --enable-helm $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS)) + @kustomize build --enable-helm --helm-kube-version $(KUBE_VERSION) $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS)) # Generate JSON schemas from CRDs and Kubernetes swagger spec (run manually, results committed) schemas: diff --git a/ci/kube-version b/ci/kube-version new file mode 100644 index 0000000..1304b01 --- /dev/null +++ b/ci/kube-version @@ -0,0 +1 @@ +1.33.7 diff --git a/ci/validate-apps.sh b/ci/validate-apps.sh index 2e6c1e7..c925d52 100755 --- a/ci/validate-apps.sh +++ b/ci/validate-apps.sh @@ -1,7 +1,8 @@ #!/usr/bin/env bash set -euo pipefail -KUBE_VERSION="1.33.7" +REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)" +KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")" SCHEMA_DIR="${SCHEMA_DIR:-schemas}" @@ -15,7 +16,7 @@ while IFS= read -r -d "" k; do dir="$(dirname "$k")" echo "==> kubeconform: $dir" >&2 - kustomize build --enable-helm "$dir" \ + kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \ | kubeconform \ -kubernetes-version "$KUBE_VERSION" \ -summary \ diff --git a/ci/validate-clusters.sh b/ci/validate-clusters.sh index eb1dee0..9395d7f 100755 --- a/ci/validate-clusters.sh +++ b/ci/validate-clusters.sh @@ -1,7 +1,8 @@ #!/usr/bin/env bash set -euo pipefail -KUBE_VERSION="1.33.7" +REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)" +KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")" SCHEMA_DIR="${SCHEMA_DIR:-schemas}" @@ -15,7 +16,7 @@ while IFS= read -r -d "" k; do dir="$(dirname "$k")" echo "==> kubeconform: $dir" >&2 - kustomize build --enable-helm "$dir" \ + kustomize build --enable-helm --helm-kube-version "$KUBE_VERSION" "$dir" \ | kubeconform \ -kubernetes-version "$KUBE_VERSION" \ -summary \ -- 2.47.3 From 1d77e8c9706d92b7a9161ea1337a508cfd68be90 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 12:39:10 +1000 Subject: [PATCH 2/3] Harden kube-version lookup and match the live cluster --- AGENTS.md | 8 ++++---- Makefile | 6 +++++- ci/kube-version | 2 +- ci/validate-apps.sh | 3 +-- ci/validate-clusters.sh | 3 +-- migration.md | 4 ++-- 6 files changed, 14 insertions(+), 12 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index fc49a75..3f71ce2 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -22,10 +22,10 @@ make kubeconform make clean # Quick build + inspect without persisting output -kustomize build --enable-helm apps/overlays/au-syd1/ +kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/ # Check all resource kinds produced by an overlay -kustomize build --enable-helm apps/overlays/au-syd1/ | grep "^kind:" | sort | uniq -c +kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/ | grep "^kind:" | sort | uniq -c # Run pre-commit checks against all files uvx pre-commit run --all-files @@ -118,7 +118,7 @@ In `argocd/projects/platform.yaml` (or `storage.yaml`): ### 5. Validate ```bash -kustomize build --enable-helm apps/overlays/au-syd1/ +kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/ make kubeconform ``` @@ -215,7 +215,7 @@ Examples: Some overlays vendor Helm charts locally under `apps/overlays/au-syd1//charts//`. When a chart is vendored, the overlay's `kustomization.yaml` references the local path. When not vendored, it references the OCI or HTTP repo directly. -Current Kubernetes target version: **1.33.7** (used by kubeconform in CI). +The Kubernetes target version lives in `ci/kube-version`; the Makefile and CI scripts read it for both the Helm capabilities version and kubeconform. --- diff --git a/Makefile b/Makefile index 100ae8a..4d8f68b 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,10 @@ .PHONY: build clean schemas -KUBE_VERSION := $(shell cat ci/kube-version) +MAKEFILE_DIR := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))) +KUBE_VERSION := $(strip $(shell cat $(MAKEFILE_DIR)/ci/kube-version 2>/dev/null)) +ifeq ($(KUBE_VERSION),) +$(error cannot read $(MAKEFILE_DIR)/ci/kube-version) +endif # Build a kustomization path to manifests directory # Usage: make build clusters/au-syd1/bootstrap diff --git a/ci/kube-version b/ci/kube-version index 1304b01..91a50ee 100644 --- a/ci/kube-version +++ b/ci/kube-version @@ -1 +1 @@ -1.33.7 +1.33.13 diff --git a/ci/validate-apps.sh b/ci/validate-apps.sh index c925d52..f7b8fd1 100755 --- a/ci/validate-apps.sh +++ b/ci/validate-apps.sh @@ -1,8 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)" -KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")" +KUBE_VERSION="$(cat ci/kube-version)" SCHEMA_DIR="${SCHEMA_DIR:-schemas}" diff --git a/ci/validate-clusters.sh b/ci/validate-clusters.sh index 9395d7f..a4efc6e 100755 --- a/ci/validate-clusters.sh +++ b/ci/validate-clusters.sh @@ -1,8 +1,7 @@ #!/usr/bin/env bash set -euo pipefail -REPO_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)" -KUBE_VERSION="$(cat "$REPO_ROOT/ci/kube-version")" +KUBE_VERSION="$(cat ci/kube-version)" SCHEMA_DIR="${SCHEMA_DIR:-schemas}" diff --git a/migration.md b/migration.md index 2238279..13865c2 100644 --- a/migration.md +++ b/migration.md @@ -49,8 +49,8 @@ - Use existing patterns like `apps/overlays/*/csi-*` or `apps/overlays/*/` ### 9. Validation -- Run `kustomize build --enable-helm apps/overlays/au-syd1/` to generate all resources -- Check resource types: `kustomize build --enable-helm apps/overlays/au-syd1/ | grep "^kind:" | sort | uniq -c` +- Run `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/` to generate all resources +- Check resource types: `kustomize build --enable-helm --helm-kube-version "$(cat ci/kube-version)" apps/overlays/au-syd1/ | grep "^kind:" | sort | uniq -c` - Verify all resource types are permitted in the target project's `clusterResourceWhitelist` and `namespaceResourceWhitelist` - Run `make kubeconform` to validate all resources - Fix any validation errors -- 2.47.3 From 004343437aeeb259b6a33d3db78a9f41e68195b0 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 12:50:11 +1000 Subject: [PATCH 3/3] Check kube-version inside the build recipe --- Makefile | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/Makefile b/Makefile index 4d8f68b..a3996e4 100644 --- a/Makefile +++ b/Makefile @@ -1,16 +1,13 @@ .PHONY: build clean schemas -MAKEFILE_DIR := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))) -KUBE_VERSION := $(strip $(shell cat $(MAKEFILE_DIR)/ci/kube-version 2>/dev/null)) -ifeq ($(KUBE_VERSION),) -$(error cannot read $(MAKEFILE_DIR)/ci/kube-version) -endif - # Build a kustomization path to manifests directory # Usage: make build clusters/au-syd1/bootstrap build: - @mkdir -p manifests/$(filter-out $@,$(MAKECMDGOALS)) - @kustomize build --enable-helm --helm-kube-version $(KUBE_VERSION) $(filter-out $@,$(MAKECMDGOALS)) --output manifests/$(filter-out $@,$(MAKECMDGOALS)) + @kube_version="$$(cat ci/kube-version)"; \ + if [ -z "$$kube_version" ]; then echo "cannot read ci/kube-version" >&2; exit 1; fi; \ + target="$(filter-out $@,$(MAKECMDGOALS))"; \ + mkdir -p "manifests/$$target"; \ + kustomize build --enable-helm --helm-kube-version "$$kube_version" "$$target" --output "manifests/$$target" # Generate JSON schemas from CRDs and Kubernetes swagger spec (run manually, results committed) schemas: -- 2.47.3