Skip to content

chore(kind): bump kind test-environment pins (node v1.37.0, Calico v3.32.2, NGF 2.7.2, CNPG 0.29.1, ESO 2.11.0) - #255

Merged
procoduck merged 1 commit into
mainfrom
chore/kind-pins
Oct 1, 2026
Merged

procoduck merged 1 commit into
mainfrom
chore/kind-pins

Conversation

@procoduck

Copy link
Copy Markdown
Owner

Maintainer-approved (2026-10-01) bump of every kind test-environment pin in deploy/versions.env. GATEWAY_API_VERSION stays at v1.4.1 because it is the product contract.

Pin Old New Notes
KIND_NODE_IMAGE kindest/node:v1.31.4 kindest/node:v1.37.0 kind v0.33.0's default image. helm/kind-action v1.15.0 installs kind v0.33.0. Still tag-only, as scripts/repocheck requires
CALICO_VERSION v3.28.2 v3.32.2 manifest URL verified (HTTP 200). v3.32 removed ANP/BANP enforcement. We use only networking.k8s.io/v1 NetworkPolicy
NGF_CHART_VERSION 2.6.0 2.7.2 kubeVersion floor >= 1.32.0-0. Built against Gateway API 1.6.1. On a different minor, validateCRDVersions reports best-effort and does not refuse (2.6.0 already ran best-effort, since it was built for 1.5.1). The nginx.service.nodePorts[].port/listenerPort values are unchanged
CNPG_CHART_VERSION 0.29.0 0.29.1 operator 1.30.0 to 1.30.1, a patch. Floor still >= 1.29.0-0
EXTERNAL_SECRETS_CHART_VERSION 2.9.0 2.11.0 v2.11.0's CRD bundle still serves external-secrets.io/v1 (and does not serve v1beta1) plus generators.external-secrets.io/v1alpha1 Password. No chart template or values change and no UPGRADING note. 2.10 and 2.11 have no breaking changes

Trade-off: the suite now runs on 1.37, while the chart's kubeVersion floor stays >=1.29. That floor is now documented, not exercised. NGF 2.7's 1.32 floor alone rules out keeping a 1.29–1.31 node.

Docs updated: AGENTS.md image table, docs/kind-test-environment-plan.md pins note, scripts/docs-content/database.html (+ regenerated site/docs/), and the NGF rationale comment in e2e/k8s/route_conformance_test.go.

Local checks passed: go vet -tags e2ek8s ./e2e/k8s/..., make helm-lint, make chart-verify, go test ./scripts/repocheck/ ./deploy/helm/, make lint.

Proof: e2e-k8s (path-filtered to deploy/versions.env) runs on this draft PR. The PR gets marked ready once it passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BPMsuQQBnedAsJ8tJMH3rw

- KIND_NODE_IMAGE kindest/node v1.31.4 -> v1.37.0 (kind v0.33.0's default;
  helm/kind-action v1.15.0 installs kind v0.33.0)
- CALICO_VERSION v3.28.2 -> v3.32.2 (ANP/BANP removal does not affect the
  plain NetworkPolicy this repo uses)
- NGF_CHART_VERSION 2.6.0 -> 2.7.2 (kubeVersion floor now >= 1.32; built
  against Gateway API 1.6.1, runs best-effort on the 1.4.1 floor, which
  stays unchanged)
- CNPG_CHART_VERSION 0.29.0 -> 0.29.1 (operator 1.30.0 -> 1.30.1)
- EXTERNAL_SECRETS_CHART_VERSION 2.9.0 -> 2.11.0 (still serves
  external-secrets.io/v1 and generators v1alpha1; no chart change)

Docs: AGENTS.md image table, kind plan pins note, database docs page.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BPMsuQQBnedAsJ8tJMH3rw
@procoduck
procoduck marked this pull request as ready for review October 1, 2026 13:43
@procoduck
procoduck enabled auto-merge (squash) October 1, 2026 13:43
@procoduck
procoduck merged commit 9604dae into main Oct 1, 2026
23 of 24 checks passed
@procoduck
procoduck deleted the chore/kind-pins branch October 1, 2026 13:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant