RamenDR/ramen

We have repeated and fragile code that can be simplified using ptr.Equal: https://github.com/kubernetes/utils/blob/cf1189d6abe3/ptr/ptr.go#L65

We have two addons that manually pass --server-side=true to work around the annotation size limit with large CRDs: argocd - applicationsets.argoproj.io CRD (#2646) olm - clusterserviceversions.operators.coreos.com CRD (#2539) With client-side apply, kubectl stores the entire resource manifest in the kubectl.kubernetes.io/last-applied-configuration annotation for three-way merge diffs. Large CRDs exceed the 262144 bytes annotation size limit. Rather than adding this flag ad-hoc per addon, we should make server-side apply the default in our kubectl.apply() wrapper. Proposed API: def apply(*args, server_side=True, input=None, context=None, log=print): for arg in args: if "--server-side" in arg: raise ValueError("use server_side argument instead of --server-side flag") if server_side: args = ("--server-side=true",) + args _watch("apply", *args, input=input, context=context, log=log) Default to server_side=True for all apply calls Reject raw --serv

Summary GitHub Actions workflows that do not declare an explicit permissions block inherit the repository-wide default token permissions, which are typically broad (e.g., contents: write). Following the principle of least privilege, each workflow and/or job should declare only the permissions it actually needs, and jobs that do not use GITHUB_TOKEN at all should set permissions: {}. Background This was identified during the review of PR #2598 (#2598), where the podman-maintenance job was flagged as missing an explicit permissions block. The maintainer noted that this applies broadly across all workflows in the repository. Work to be done Audit all workflow files under .github/workflows/ to determine which jobs/workflows use GITHUB_TOKEN and what permissions they actually require. Add explicit permissions blocks to every workflow (and/or job), granting only the minimum required scopes. Jobs that do not use GITHUB_TOKEN at all should set permissions: {}. Use restrictive permissions (rea

Minikube 1.39.0 added --dns-server flag[1]. We can simplify the dns module using this option and keep only the code for detecting if we need to use dns servers. Remove drenv/minikube/dns.configure(), and use dns.is_managed_mac() to determine if we need to configure dns server. If we do add --dns-servers start flag with the dns.SERVERS. [1] kubernetes/minikube#23069

Summary The actions/checkout steps across this repository's GitHub Actions workflows do not set persist-credentials: false. When credentials are persisted (the default), the GitHub token is written to the local git config and remains available to any subsequent steps or processes, which is an unnecessary exposure for jobs that do not require authenticated git operations. Suggested change Add persist-credentials: false to all actions/checkout steps in .github/workflows/ that do not require subsequent authenticated git operations. - name: Checkout source uses: actions/checkout@v6 with: persist-credentials: false References Raised while reviewing PR #2585 (comment: #2585 (comment)) Requested by @nirs /cc @nirs