Skip to content

KFLUXVNGD-1283: enable Cargo config.json subFilters on production (ring-2, ring-3) - #13753

Merged
openshift-merge-bot[bot] merged 1 commit into
redhat-appstudio:mainfrom
kelchen123:feat/KFLUXVNGD-1283-cargo-subfilters-production-ring-2
Aug 31, 2026
Merged

KFLUXVNGD-1283: enable Cargo config.json subFilters on production (ring-2, ring-3)#13753
openshift-merge-bot[bot] merged 1 commit into
redhat-appstudio:mainfrom
kelchen123:feat/KFLUXVNGD-1283-cargo-subfilters-production-ring-2

Conversation

@kelchen123

Copy link
Copy Markdown
Contributor

Promote ring-1-validated nginx subFilters for cargo-proxy config.json to
remaining production squid overlays. Bump caching-helm to 0.1.1889+ca96506.

Clusters: stone-prod-p02, kflux-rhel-p01, kflux-ocp-p01, stone-prd-rh01,
kflux-prd-rh02, kflux-prd-rh03

Validation

Risk Assessment

Risk Level: Medium
Description: Production rollout of cargo-proxy config.json rewrites (auth-required

  • Nexus URL -> cluster proxy) to the remaining six prod squid clusters after
    ring-1 soak. Misconfiguration could break Cargo builds on those clusters.
    Rollback: Revert this PR to restore chart 0.1.1775+d865e45 and remove
    subFilters on the six overlays in this PR.

Assisted-by: Cursor

@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

Kustomize Render Diff

Comparing d7d9a2605c11e00a43

Component Environment Changes
components/squid/production/kflux-ocp-p01 production +41 -41
components/squid/production/kflux-prd-rh02 production +41 -41
components/squid/production/kflux-prd-rh03 production build error
components/squid/production/kflux-rhel-p01 production +41 -41
components/squid/production/stone-prd-rh01 production +41 -41
components/squid/production/stone-prod-p02 production +41 -41

Total: 6 components, +205 -205 lines

📋 Full diff available in the workflow summary and as a downloadable artifact.

@qodo-for-redhat-appstudio

qodo-for-redhat-appstudio Bot commented Aug 30, 2026

Copy link
Copy Markdown

PR Summary by Qodo

Enable Cargo config rewrites across production Squid rings 2–3

✨ Enhancement ⚙️ Configuration changes 🕐 20-40 Minutes

Grey Divider

AI Description

• Enables validated Cargo config rewrites across six ring-2 and ring-3 production clusters.
• Disables Cargo registry authentication and routes Nexus URLs through cluster-local proxies.
• Upgrades caching-helm to 0.1.1889+ca96506 to support nginx subFilters.
Diagram

graph TD
  Chart["Caching Helm"] --> Overlays["Six prod overlays"] --> Proxy["Artifact proxy"]
  Builds["Cargo builds"] --> Proxy --> Nexus["Nexus upstream"] --> Config["Cargo config"] --> Rewrites["Response rewrites"] --> Builds
Loading
High-Level Assessment

The following are alternative approaches to this PR:

1. Centralize shared production values
  • ➕ Eliminates duplicated subFilter blocks
  • ➕ Reduces future chart-version drift across clusters
  • ➖ Requires a broader Kustomize restructuring
  • ➖ Could complicate legitimate per-cluster overrides
  • ➖ Adds unrelated rollout risk to a production behavior change

Recommendation: Keep the current explicit per-overlay promotion for this rollout because it mirrors the validated ring-1 configuration, preserves existing cluster ownership boundaries, and supports a simple revert. Consider centralizing common production caching values separately after all rings stabilize.

Files changed (6) +66 / -6

Other (6) +66 / -6
caching-helm-generator.yamlEnable Cargo response rewrites on kflux-ocp-p01 +11/-1

Enable Cargo response rewrites on kflux-ocp-p01

• Bumps caching-helm to 0.1.1889+ca96506. Adds nginx filters for cargo-proxy config.json that disable authentication and replace the external Nexus URL with the cluster-local proxy.

components/squid/production/kflux-ocp-p01/caching-helm-generator.yaml

caching-helm-generator.yamlEnable Cargo response rewrites on kflux-prd-rh02 +11/-1

Enable Cargo response rewrites on kflux-prd-rh02

• Bumps caching-helm to 0.1.1889+ca96506. Adds the validated Cargo config substitutions for authentication and cluster-local proxy routing.

components/squid/production/kflux-prd-rh02/caching-helm-generator.yaml

caching-helm-generator.yamlEnable Cargo response rewrites on kflux-prd-rh03 +11/-1

Enable Cargo response rewrites on kflux-prd-rh03

• Bumps caching-helm to 0.1.1889+ca96506. Configures nginx to rewrite all matching values in cargo-proxy config.json responses.

components/squid/production/kflux-prd-rh03/caching-helm-generator.yaml

caching-helm-generator.yamlEnable Cargo response rewrites on kflux-rhel-p01 +11/-1

Enable Cargo response rewrites on kflux-rhel-p01

• Bumps caching-helm to 0.1.1889+ca96506. Adds the production Cargo config response filters validated in staging and ring-1.

components/squid/production/kflux-rhel-p01/caching-helm-generator.yaml

caching-helm-generator.yamlEnable Cargo response rewrites on stone-prd-rh01 +11/-1

Enable Cargo response rewrites on stone-prd-rh01

• Bumps caching-helm to 0.1.1889+ca96506. Rewrites Cargo authentication and registry URL fields to use the in-cluster artifact proxy.

components/squid/production/stone-prd-rh01/caching-helm-generator.yaml

caching-helm-generator.yamlEnable Cargo response rewrites on stone-prod-p02 +11/-1

Enable Cargo response rewrites on stone-prod-p02

• Bumps caching-helm to 0.1.1889+ca96506. Applies the same cargo-proxy config.json filters used by the validated production ring-1 overlays.

components/squid/production/stone-prod-p02/caching-helm-generator.yaml

@qodo-for-redhat-appstudio

qodo-for-redhat-appstudio Bot commented Aug 30, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

Grey Divider


Remediation recommended

1. Ring-2 and ring-3 combined 📘 Rule violation ☼ Reliability
Description
The rollout adds the same production Cargo subfilters to documented ring-2 and ring-3 clusters in
one PR. This bypasses the required ring-by-ring isolation and increases the blast radius of a faulty
rewrite.
Code

components/squid/production/kflux-prd-rh02/caching-helm-generator.yaml[R31-32]

+    subFilters:
+      - location: '^/repository/cargo-proxy/config\.json$'
Relevance

●● Moderate

Explicit ring-isolation rule supports acceptance, but no close historical precedent confirms this
team rejects combined ring rollouts.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Rule 491 requires a production change to target one ring or gated subset. The repository maps
stone-prod-p02, kflux-rhel-p01, and kflux-ocp-p01 to ring 2, while stone-prd-rh01,
kflux-prd-rh02, and kflux-prd-rh03 are ring 3; the focused diff deploys the same subfilters to
all six.

Rule 491: Split production rollouts into rings, never all clusters at once
components/pipeline-service/production/ring-mappings.yaml[9-18]
components/squid/production/kflux-ocp-p01/caching-helm-generator.yaml[31-40]
components/squid/production/kflux-prd-rh02/caching-helm-generator.yaml[31-40]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
This PR deploys the Cargo subfilters to production ring 2 and ring 3 simultaneously, contrary to the required ring-scoped rollout process.

## Issue Context
Keep one ring in this PR and promote the other ring through a separate PR or explicitly gated deployment stage after validation.

## Fix Focus Areas
- components/squid/production/kflux-ocp-p01/caching-helm-generator.yaml[7-40]
- components/squid/production/kflux-prd-rh02/caching-helm-generator.yaml[7-40]
- components/squid/production/kflux-prd-rh03/caching-helm-generator.yaml[7-40]
- components/squid/production/kflux-rhel-p01/caching-helm-generator.yaml[7-40]
- components/squid/production/stone-prd-rh01/caching-helm-generator.yaml[7-40]
- components/squid/production/stone-prod-p02/caching-helm-generator.yaml[7-40]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Context sources
✅ Compliance rules (platform): 3 rules

Grey Divider

Tip of the day
💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Previous reviews

Review updated until commit 072d2c9 ⚖️ Balanced

Results up to commit 5e9f72f ⚖️ Balanced


No changes from previous review

Grey Divider

Qodo Logo

…ngs 2-3)

Promote ring-1-validated nginx subFilters for cargo-proxy config.json to
remaining production squid overlays. Bump caching-helm to 0.1.1889+ca96506.

Clusters: stone-prod-p02, kflux-rhel-p01, kflux-ocp-p01, stone-prd-rh01,
kflux-prd-rh02, kflux-prd-rh03

## Validation

- Staging: redhat-appstudio#13561, redhat-appstudio#13657
- Ring-1 production: redhat-appstudio#13702 (merged)
- subFilters block matches ring-1 overlays for all six clusters in this PR

## Risk Assessment

**Risk Level:** Medium
**Description:** Production rollout of cargo-proxy config.json rewrites (auth-required
+ Nexus URL -> cluster proxy) to the remaining six prod squid clusters after
ring-1 soak. Misconfiguration could break Cargo builds on those clusters.
**Rollback:** Revert this PR to restore chart 0.1.1775+d865e45 and remove
subFilters on the six overlays in this PR.

Assisted-by: Cursor
Co-authored-by: Cursor <cursoragent@cursor.com>
@kelchen123
kelchen123 force-pushed the feat/KFLUXVNGD-1283-cargo-subfilters-production-ring-2 branch from 5e9f72f to 072d2c9 Compare August 31, 2026 18:27
@codecov

codecov Bot commented Aug 31, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.38%. Comparing base (d7d9a26) to head (072d2c9).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main   #13753   +/-   ##
=======================================
  Coverage   60.38%   60.38%           
=======================================
  Files          24       24           
  Lines        1628     1628           
=======================================
  Hits          983      983           
  Misses        563      563           
  Partials       82       82           
Flag Coverage Δ
go 60.38% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@openshift-ci

openshift-ci Bot commented Aug 31, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amisstea, kelchen123

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kelchen123
kelchen123 marked this pull request as ready for review August 31, 2026 19:10
@openshift-ci
openshift-ci Bot requested a review from ifireball August 31, 2026 19:10
Comment on lines +31 to +32
subFilters:
- location: '^/repository/cargo-proxy/config\.json$'

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Ring-2 and ring-3 combined 📘 Rule violation ☼ Reliability

The rollout adds the same production Cargo subfilters to documented ring-2 and ring-3 clusters in
one PR. This bypasses the required ring-by-ring isolation and increases the blast radius of a faulty
rewrite.
Agent Prompt
## Issue description
This PR deploys the Cargo subfilters to production ring 2 and ring 3 simultaneously, contrary to the required ring-scoped rollout process.

## Issue Context
Keep one ring in this PR and promote the other ring through a separate PR or explicitly gated deployment stage after validation.

## Fix Focus Areas
- components/squid/production/kflux-ocp-p01/caching-helm-generator.yaml[7-40]
- components/squid/production/kflux-prd-rh02/caching-helm-generator.yaml[7-40]
- components/squid/production/kflux-prd-rh03/caching-helm-generator.yaml[7-40]
- components/squid/production/kflux-rhel-p01/caching-helm-generator.yaml[7-40]
- components/squid/production/stone-prd-rh01/caching-helm-generator.yaml[7-40]
- components/squid/production/stone-prod-p02/caching-helm-generator.yaml[7-40]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

@qodo-for-redhat-appstudio

Copy link
Copy Markdown

Code review by qodo was updated up to the latest commit 072d2c9

@svatares

Copy link
Copy Markdown
Member

Production Approval Record

Field Value
Action APPROVED
Reviewer @svatares
Timestamp 2026-08-31T19:13:38.196Z
Risk Level medium
Criteria Override User announcement not acknowledged (konflux-announce)

Approved

@openshift-merge-bot
openshift-merge-bot Bot merged commit 8b786e2 into redhat-appstudio:main Aug 31, 2026
45 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants