config: clarify Kubernetes networking ownership - #206
Merged
Conversation
Keep cluster-wide Pod and Service CIDRs and kube-proxy policy on the bounded native kubeadm interface, with compiler-backed operator guidance. Prove that management address changes remain workstation targeting only and do not plan node mutation.
Zariel
enabled auto-merge (squash)
August 5, 2026 22:53
Greptile SummaryThe PR documents native kubeadm ownership of cluster-wide networking settings and adds regression coverage for preserving those settings and treating management addresses as workstation routing data.
Confidence Score: 4/5The PR should not merge until the management-address-only guarantee is tested through the production planner rather than a predetermined fake response. The added apply test hard-codes validation as unchanged, so a production planning regression that schedules or rejects node mutation for a management-address-only edit would still leave the test passing. Files Needing Attention: cmd/katlctl/kubeadm_control_plane_config_test.go
|
| Filename | Overview |
|---|---|
| internal/installer/configbundle/bundle_test.go | The revised archive test now includes and validates the preserved KubeProxyConfiguration document, resolving the earlier coverage omission. |
| cmd/katlctl/kubeadm_control_plane_config_test.go | The apply test verifies updated targeting and unchanged rendering, but hard-codes the planner’s NoChanges result instead of exercising production planning. |
| cmd/katlctl/config_inspect_test.go | Adds focused inspection coverage for target-only classification of management-address changes. |
| docs/installing.md | Documents native kubeadm configuration as the stable interface for cluster-wide Kubernetes networking. |
| docs/internal/cluster-manifest-contract.md | Records ownership of CIDRs and kube-proxy policy in the internal configuration contract. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[ClusterConfig with native kubeadm documents] --> B[BuildArchive]
B --> C[Compiled control-plane kubeadm config]
C --> D[InitConfiguration skipPhases]
C --> E[ClusterConfiguration networking]
C --> F[KubeProxyConfiguration policy]
G[management.address change] --> H[Updated agent target]
G --> I[Unchanged rendered node configuration]
I --> J[Production validation planner]
J --> K[No node mutation]
Reviews (2): Last reviewed commit: "config: prove networking and target boun..." | Re-trigger Greptile
Address focused review by structurally asserting native kube-proxy and cluster-networking preservation. Exercise the cluster apply planner to prove a management-address-only edit changes the dial target while rendering identical node state and submitting no mutation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
management.address-only diff is target-only and plans no node mutationWhy
These cluster-wide networking settings already belong to kubeadm's native API; duplicating them would create two sources of truth. Management addresses are workstation routing information, so their lifecycle classification should be explicit and independently tested.