config: pin system-extension selection - #202
Conversation
Report every tag-only system-extension reference at its effective public node path and provide the exact resolved digest-pinned value operators can commit. Carry the warning through validation, bundle compilation, lifecycle compilation, schema help, and effective configuration inspection while keeping digest pinning optional.
Greptile SummaryThe PR detects tag-only system-extension references after resolution and carries digest-pinning guidance through compilation results and several CLI workflows.
Confidence Score: 4/5The missing warnings on several supported source-compilation commands should be fixed before merging so operators consistently receive the promised digest-pinning recovery guidance. Mutable-reference warnings are correctly generated, but wipe, render-node, resolve, and diff discard them, leaving observable gaps in the newly introduced operator contract. Files Needing Attention: cmd/katlctl/config_input.go, cmd/katlctl/main.go, cmd/katlctl/config_inspect.go
|
| Filename | Overview |
|---|---|
| internal/installer/configbundle/bundle.go | Adds structured warnings for effective tag-only extension references and supplies an exact resolved digest pin. |
| cmd/katlctl/config_input.go | Carries compilation warnings from source loading and formats them, but not every existing caller consumes them. |
| cmd/katlctl/main.go | Exposes warnings through validate, bundle, and bootstrap while render-node and wipe paths remain silent. |
| internal/installer/configbundle/inspect.go | Adds resolved-node mutable-reference guidance using the established public node-path convention. |
| internal/installer/configbundle/schema_rules.go | Documents optional digest pinning and tag-only compilation warnings in generated schema help. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[ClusterConfig source] --> B[Resolve extension OCI manifest]
B --> C[Compile self-contained bundle]
B --> D{Reference already digest-pinned?}
D -->|Yes| E[No mutable-reference warning]
D -->|No| F[Create warning with node path and pinned value]
F --> G[Compilation result]
G --> H[CLI stderr or JSON report]
C --> I[Lifecycle operation]
Prompt To Fix All With AI
### Issue 1
cmd/katlctl/config_input.go:46
**Compilation warnings dropped on commands**
When `cluster wipe`, `config render-node`, `config resolve`, or `config diff` compiles source YAML containing a tag-only system-extension reference, the generated warnings are discarded, so operators receive neither the mutable-reference warning nor the digest-pinned replacement exposed by the other compilation paths.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "config: pin system-extension selection" | Re-trigger Greptile
| return katlConfigInput{}, fmt.Errorf("read compiled --config %s: %w", path, err) | ||
| } | ||
| return katlConfigInput{Archive: archive, Bundle: bundle, Source: true}, nil | ||
| return katlConfigInput{Archive: archive, Bundle: bundle, Source: true, Warnings: result.Warnings}, nil |
There was a problem hiding this comment.
Compilation warnings dropped on commands
When cluster wipe, config render-node, config resolve, or config diff compiles source YAML containing a tag-only system-extension reference, the generated warnings are discarded, so operators receive neither the mutable-reference warning nor the digest-pinned replacement exposed by the other compilation paths.
Context Used: AGENTS.md (source)
Prompt To Fix With AI
This is a comment left during a code review.
Path: cmd/katlctl/config_input.go
Line: 46
Comment:
**Compilation warnings dropped on commands**
When `cluster wipe`, `config render-node`, `config resolve`, or `config diff` compiles source YAML containing a tag-only system-extension reference, the generated warnings are discarded, so operators receive neither the mutable-reference warning nor the digest-pinned replacement exposed by the other compilation paths.
**Context Used:** AGENTS.md ([source](https://github.com/katl-dev/katl/blob/main/AGENTS.md))
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
Summary
Why
Mutable OCI tags could select different extension payloads when the same ClusterConfig was compiled later. Katl still keeps tag-only references convenient, while making the reproducibility tradeoff and recovery action explicit.