Skip to content

fix(etcd-operator): replace deprecated kube-rbac-proxy image#2181

Merged
kvaps merged 1 commit intomainfrom
fix/replace-kube-rbac-proxy-image
Mar 10, 2026
Merged

fix(etcd-operator): replace deprecated kube-rbac-proxy image#2181
kvaps merged 1 commit intomainfrom
fix/replace-kube-rbac-proxy-image

Conversation

@kvaps
Copy link
Member

@kvaps kvaps commented Mar 10, 2026

Summary

  • Replace deprecated gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0 with quay.io/brancz/kube-rbac-proxy:v0.18.1 in the vendored etcd-operator chart
  • The GCR-hosted image became unavailable after March 18, 2025

Fixes #2172 #488

Summary by CodeRabbit

  • Chores
    • Updated proxy component to v0.18.1 with configuration changes for improved stability and compatibility.

The gcr.io/kubebuilder/kube-rbac-proxy image is no longer available
since GCR was deprecated. Replace it with quay.io/brancz/kube-rbac-proxy
from the original upstream author.

Co-Authored-By: Claude <[email protected]>
Signed-off-by: Andrei Kvapil <[email protected]>
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Mar 10, 2026

📝 Walkthrough

Walkthrough

The etcd-operator Helm chart's kube-rbac-proxy container image configuration is updated across two files. The image repository is changed from a Google Container Registry source to Quay.io, and the version is bumped from v0.16.0 to v0.18.1.

Changes

Cohort / File(s) Summary
kube-rbac-proxy configuration
packages/system/etcd-operator/charts/etcd-operator/values.yaml, packages/system/etcd-operator/charts/etcd-operator/README.md
Updated kubeRbacProxy.image.repository from gcr.io/kubebuilder/kube-rbac-proxy to quay.io/brancz/kube-rbac-proxy and bumped kubeRbacProxy.image.tag from v0.16.0 to v0.18.1.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A rabbit hops through registries with glee,
From Google's vault to Quay's repository!
v0.16 becomes v0.18.1 so fine,
The RBAC proxy now pulls right on line! ✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: replacing a deprecated kube-rbac-proxy image reference with a newer one.
Linked Issues check ✅ Passed The PR fully addresses issue #2172 by replacing the unavailable gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0 with quay.io/brancz/kube-rbac-proxy:v0.18.1, resolving the failed deployment and image pull errors.
Out of Scope Changes check ✅ Passed All changes are focused solely on updating the kube-rbac-proxy image repository and tag values, directly addressing the linked issue with no extraneous modifications.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/replace-kube-rbac-proxy-image

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@kvaps kvaps marked this pull request as ready for review March 10, 2026 07:32
@dosubot dosubot bot added size:XS This PR changes 0-9 lines, ignoring generated files. bug Something isn't working labels Mar 10, 2026
@kvaps kvaps added backport Should change be backported on previus release backport-previous and removed bug Something isn't working size:XS This PR changes 0-9 lines, ignoring generated files. labels Mar 10, 2026
@dosubot dosubot bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Mar 10, 2026
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/system/etcd-operator/charts/etcd-operator/values.yaml`:
- Around line 101-107: The change to the image (repository/pullPolicy/tag in
values.yaml) was made in a generated vendored chart and will be overwritten by
"make update"; instead, apply the image override in the umbrella chart's Helm
values (add an override for the etcd-operator chart setting repository and tag),
or update the chart source used by the vendoring process (open an issue/PR to
the upstream etcd-operator chart at https://github.com/aenix-io/charts to update
the image), and then re-run the vendor regeneration so the change persists.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fee8e5a2-6c17-458a-b929-fea633c7930c

📥 Commits

Reviewing files that changed from the base of the PR and between 25f0b91 and 4946383.

📒 Files selected for processing (2)
  • packages/system/etcd-operator/charts/etcd-operator/README.md
  • packages/system/etcd-operator/charts/etcd-operator/values.yaml

Comment on lines +101 to +107
repository: quay.io/brancz/kube-rbac-proxy

# -- Image pull policy
pullPolicy: IfNotPresent

# -- Version of image
tag: v0.16.0
tag: v0.18.1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the image replacement is tracked somewhere outside the vendored chart output.
rg -n -C2 \
  --glob '!packages/system/etcd-operator/charts/etcd-operator/**' \
  'quay\.io/brancz/kube-rbac-proxy|v0\.18\.1|gcr\.io/kubebuilder/kube-rbac-proxy|v0\.16\.0'

Repository: cozystack/cozystack

Length of output: 11226


🏁 Script executed:

#!/bin/bash
# Check if etcd-operator charts are vendored upstream
head -20 packages/system/etcd-operator/charts/etcd-operator/Chart.yaml
echo "---"
# Check for vendoring metadata or references
ls -la packages/system/etcd-operator/charts/
echo "---"
# Check Makefile for vendoring mechanism
if [ -f packages/system/etcd-operator/Makefile ]; then
  grep -n "vendor\|update\|chart" packages/system/etcd-operator/Makefile | head -20
fi

Repository: cozystack/cozystack

Length of output: 438


🏁 Script executed:

#!/bin/bash
# Check for overlay, patch, or kustomization mechanisms for etcd-operator
find packages/system/etcd-operator -type f \( -name "*.patch" -o -name "kustomization.yaml" -o -name "*.yaml" \) ! -path "*/charts/*" | head -20
echo "---"
# Check parent directory structure for patches
ls -la packages/system/etcd-operator/
echo "---"
# Check if there's a values override mechanism outside charts
find packages/system/etcd-operator -type f -name "values*.yaml" ! -path "*/charts/*"

Repository: cozystack/cozystack

Length of output: 470


🏁 Script executed:

#!/bin/bash
# Check the parent Chart.yaml to understand the umbrella structure
cat packages/system/etcd-operator/Chart.yaml
echo "---"
# Check the git history to see if this file is regenerated
git log --oneline packages/system/etcd-operator/charts/etcd-operator/values.yaml | head -5
echo "---"
# Check if values.yaml modification is recent or part of vendored output
git diff HEAD~1 packages/system/etcd-operator/charts/etcd-operator/values.yaml | head -30

Repository: cozystack/cozystack

Length of output: 469


🏁 Script executed:

#!/bin/bash
# Get details on the fix commit
git show 4946383c --stat
echo "---"
# Show the actual changes in that commit
git show 4946383c

Repository: cozystack/cozystack

Length of output: 50378


🏁 Script executed:

#!/bin/bash
# Get just the diff for the etcd-operator values file
git show 4946383c -- packages/system/etcd-operator/charts/etcd-operator/values.yaml | head -100

Repository: cozystack/cozystack

Length of output: 2707


🏁 Script executed:

#!/bin/bash
# Check how values.yaml is used in the umbrella chart
cat packages/system/etcd-operator/Chart.yaml
echo "---"
# Check the templates directory to see if custom values are applied
ls -la packages/system/etcd-operator/templates/ 2>/dev/null || echo "No templates dir"
echo "---"
# Look for helmrelease or helm deployment mechanism
find packages/system/etcd-operator -type f -name "*.yaml" ! -path "*/charts/*" | xargs cat 2>/dev/null | head -50

Repository: cozystack/cozystack

Length of output: 337


Ensure the image replacement is tracked in the chart's vendoring source, not just the vendored output.

This file lives under packages/system/etcd-operator/charts/etcd-operator/, which is completely regenerated by make update. Editing values.yaml directly here will be lost on the next vendor refresh. Either apply this fix in a Helm values override at the umbrella chart level or report the image deprecation to the upstream etcd-operator chart maintainers at https://github.com/aenix-io/charts.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@packages/system/etcd-operator/charts/etcd-operator/values.yaml` around lines
101 - 107, The change to the image (repository/pullPolicy/tag in values.yaml)
was made in a generated vendored chart and will be overwritten by "make update";
instead, apply the image override in the umbrella chart's Helm values (add an
override for the etcd-operator chart setting repository and tag), or update the
chart source used by the vendoring process (open an issue/PR to the upstream
etcd-operator chart at https://github.com/aenix-io/charts to update the image),
and then re-run the vendor regeneration so the change persists.

@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request proactively resolves an upcoming issue where the kube-rbac-proxy image used by the etcd-operator would become inaccessible. By updating the image source and version, it ensures the continued stability and functionality of the etcd-operator component, preventing potential disruptions caused by deprecated dependencies.

Highlights

  • Deprecated Image Replacement: The kube-rbac-proxy image has been updated from gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0 to quay.io/brancz/kube-rbac-proxy:v0.18.1 within the vendored etcd-operator chart. This change addresses the deprecation of the GCR-hosted image, which is scheduled to become unavailable after March 18, 2025.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • packages/system/etcd-operator/charts/etcd-operator/README.md
    • Updated the kubeRbacProxy.image.repository and kubeRbacProxy.image.tag entries to reflect the new image source and version.
  • packages/system/etcd-operator/charts/etcd-operator/values.yaml
    • Modified the kubeRbacProxy.image.repository and kubeRbacProxy.image.tag values to point to the new quay.io registry and v0.18.1 version.
Activity
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@dosubot dosubot bot added the lgtm This PR has been approved by a maintainer label Mar 10, 2026
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request correctly replaces a deprecated kube-rbac-proxy image. No security vulnerabilities were found in this change. For best practices, it is recommended to use the official Kubernetes container registry for the image to ensure long-term support and stability, with specific suggestions provided in values.yaml and README.md.

| kubeRbacProxy.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
| kubeRbacProxy.image.repository | string | `"gcr.io/kubebuilder/kube-rbac-proxy"` | Image repository |
| kubeRbacProxy.image.tag | string | `"v0.16.0"` | Version of image |
| kubeRbacProxy.image.repository | string | `"quay.io/brancz/kube-rbac-proxy"` | Image repository |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To keep the documentation consistent with the recommended change in values.yaml, please update the default repository value here to point to the official kube-rbac-proxy image from registry.k8s.io.

Suggested change
| kubeRbacProxy.image.repository | string | `"quay.io/brancz/kube-rbac-proxy"` | Image repository |
| kubeRbacProxy.image.repository | string | `"registry.k8s.io/kube-rbac-proxy/kube-rbac-proxy"` | Image repository |


# -- Image repository
repository: gcr.io/kubebuilder/kube-rbac-proxy
repository: quay.io/brancz/kube-rbac-proxy
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

While quay.io/brancz/kube-rbac-proxy is a valid image, it is recommended to use images from the official Kubernetes registry for better long-term support and stability. The kube-rbac-proxy project's official images are hosted at registry.k8s.io.

    repository: registry.k8s.io/kube-rbac-proxy/kube-rbac-proxy

@kvaps kvaps merged commit 9bb6625 into main Mar 10, 2026
20 of 21 checks passed
@kvaps kvaps deleted the fix/replace-kube-rbac-proxy-image branch March 10, 2026 11:36
@github-actions
Copy link

Successfully created backport PR for release-1.1:

@github-actions
Copy link

Successfully created backport PR for release-1.0:

kvaps added a commit that referenced this pull request Mar 10, 2026
## Summary
- Replace deprecated `gcr.io/kubebuilder/kube-rbac-proxy:v0.16.0` with
`quay.io/brancz/kube-rbac-proxy:v0.18.1` in the vendored etcd-operator
chart
- The GCR-hosted image became unavailable after March 18, 2025

Fixes #2172 #488

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated proxy component to v0.18.1 with configuration changes for
improved stability and compatibility.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
kvaps added a commit that referenced this pull request Mar 10, 2026
…ac-proxy image (#2183)

# Description
Backport of #2181 to `release-1.0`.
kvaps added a commit that referenced this pull request Mar 10, 2026
…ac-proxy image (#2182)

# Description
Backport of #2181 to `release-1.1`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport Should change be backported on previus release backport-previous lgtm This PR has been approved by a maintainer size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

The etcd operator controller deployment failed

2 participants