Repository navigation
Conversation
Kube Lint fails on main for unpinned images and a Plausible Service with no namespace. Pin the public images to the digest currently published as latest, and set the Service namespace so it selects the existing Deployment. Co-authored-by: Chase 李 <clee231@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #220. That PR's new AppProject files are clean, but Kube Lint (
kubelint.yml, KubeLinter 0.8.3,.github/kubelintcfg.yml) scans all ofkubernetes/and fails on pre-existing manifests already on main. This pins the images that check flags and wires the dangling Plausible Service. Rules are unchanged, and no AppProject files from #220 are modified.KubeLinter 0.8.3 against
.github/kubelintcfg.ymlgoes from 7 findings to 1. The remaining finding is the private FreeRADIUS image, called out below.Image pins
Each pin is the registry digest that the previous tag resolves to today, so a rollout keeps the same bytes.
stump-the-profs.ymlghcr.io/acm-uic/stump-the-profs-website:latest3b74d22@sha256:918819127c02b796c84991af9e070866743111468667b93acd2a82a873f7871b3b74d22(2026-11-04) ismainand the image:latestcurrently publishes. #216 floated:latestso website commits would not need an IaC PR; shipping a newer build means bumping this tag again, same as #215.vaultwarden.ymlvaultwarden/server:latest1.37.5@sha256:4fe17f415f90087377d37c755e0ea3cf189dcc6794e49cdd2a9adbb4937d9e1f:latest. Debian variant, not1.37.5-alpine.openid-configuration-serve.ymlnginxnginx(implicit 8000:latest)1.31.8@sha256:165ddde8751e75a1c907d24ef10d9f6deb08b57e0fe56caf67512486aff76d82nginxisnginx:latest, which is mainline1.31.8. Stable is1.30.6(nginx:stable); that would change the image, so this pin keeps mainline.openid-configuration-serve.ymlinitbitnami/kubectl@sha256:8f59408f9e896fc8992a0660a56687545bd06751f26531b4a26fca6d5dc7562d:latest. That digest is kubectl1.37.2(built 2026-11-04). The image contains/bin/sh(viabin->usr/bin),jq, andkubectlonPATH, which the init script needs.plausible/smtp.ymlbytemark/smtp@sha256:9fd6ff05ac25141fe10ae4f9db0df361ad6139244ac280c398cc175bd2356a98:latest(2018-07-17). The only other tag,stretch, is a different digest (sha256:438e9a88…), so it is not used.Plausible Service
plausible/plausible.ymlServiceplausiblehad no namespace, so Kube Lint saw it in the default namespace and reporteddangling-service(no pods withapp.kubernetes.io/name=plausible). The Deployment in that file, the IngressRoute, and the Argo CD Application destination are all namespaceplausible, and the selector already matches the Deployment labels. The Service now setsnamespace: plausible.Still red: FreeRADIUS
kubernetes/argocd/stacks/radius/radius.ymlstill usesacmuic.azurecr.io/acm-uic/freeradius-active-directory:latest. That is the only tag the image's CI publishes (both GHCR and ACR), from acm-uic/freeradius-active-directory commitadb1dc651e(2023-12-01). There are no recorded workflow runs, ACR is private, and this token cannot read the GHCR package, so the digest of the image that is actually running is not available here.A guessed tag would fail the pull. Rebuilding would replace the 2023 image (
FROM debian:stable) and also move:latest. Left unchanged on purpose.Someone with registry access can finish it with:
and replace
:latestwith@sha256:….Not flagged, left alone
umpf.ymlusespathfinder:latest, but the Deployment setskube-linter.io/ignore-all, so Kube Lint does not report it.:main. That tag is not in thelatest-tagblock list.ghcr.io/actions/actions-runner:latest. They are not Deployment manifests, and Kube Lint does not flag them.