[CI] Publish truefoundry to version 0.136.6#2659
Conversation
Signed-off-by: innoavator <innoavator@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 437a251. Configure here.
| {{- include "mlfoundry-server.serviceAccountLabels" . | nindent 4 }} | ||
| annotations: | ||
| {{- include "mlfoundry-server.serviceAccountAnnotations" . | nindent 4 }} | ||
| {{- include "mlfoundry-server.serviceAccountAnnotations" . | indent 4 }} |
There was a problem hiding this comment.
Switching nindent to indent breaks YAML annotations formatting
High Severity
Changing nindent 4 to indent 4 after {{- (which strips the preceding newline) causes annotation content to render on the same line as annotations: instead of on a new line. When annotations are non-empty (e.g., user-provided service account annotations like IAM role ARNs), this produces malformed YAML like annotations: key: value instead of a proper block mapping. This affects all six templates changed from nindent to indent: mlfoundry-server, s3proxy, spark-history-server, tfy-workflow-admin, and tfy-proxy (both serviceaccount and service).
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 437a251. Configure here.
| } | ||
| {{- end }} | ||
|
|
||
| {{- if .Values.s3proxy.enabled }} |
There was a problem hiding this comment.
Proxy routes rendered for potentially disabled services
Medium Severity
Conditional guards (tfyController.enabled, s3proxy.enabled, and tags.llmGatewayRequestLogging/tags.tracing) were removed from the Caddy proxy config, so reverse_proxy routes for the proxy-server, s3proxy, and otel-collector are now always rendered even when those backing services are disabled. Requests to these paths will get connection errors (502) when the upstream services don't exist.
Reviewed by Cursor Bugbot for commit 437a251. Configure here.
| {{- $volumes = concat $volumes $caData.items -}} | ||
| {{- end -}} | ||
| {{- $tmpVolume := include "truefoundry.tmpDirVolume" (dict "context" . "resourceTierHelper" "tfy-k8s-controller.resourceTier" "defaultResourcesPrefix" "tfy-k8s-controller.defaultResources" "resourcesValues" .Values.tfyK8sController.resources) | fromYaml }} | ||
| {{- $volumes = append $volumes $tmpVolume -}} |
There was a problem hiding this comment.
Removed /tmp emptyDir with read-only root filesystem
Medium Severity
The /tmp emptyDir volume and mount were removed from tfy-k8s-controller, tfy-controller, deltafusion-ingestor, and deltafusion-compaction, while the default securityContext still sets readOnlyRootFilesystem: true. Any container process that writes to /tmp will fail at runtime because the filesystem is read-only and no writable tmpdir is mounted.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 437a251. Configure here.
2 participants
Automated changes by create-pull-request GitHub action
Note
Medium Risk
Touches Helm templating that affects deployed RBAC, volumes, and CORS headers, so misconfigurations could break upgrades or runtime behavior. Version downgrades of chart dependencies/images also risk regressions if clusters expected
0.138.xbehavior.Overview
Publishes the
truefoundryHelm chart as v0.136.6 and updates the lockfile, including downgradingtfy-llm-gateway/tfy-otel-collectordependency versions and multiple default image/control-plane version values to the0.136.xline.Removes Workload Identity Federation (
global.wif) RBAC templates (the sharedRoleand per-componentRoleBindings) and dropsmlfoundryServerServiceMonitorsupport/values.Hardens and simplifies templating: the custom-CA initContainer now uses a fixed restrictive
securityContext, several components stop injecting thetmp-diremptyDir (andmlfoundry-server/servicefoundry-serverrename it totruefoundry-tmpdir),tfy-controlleronly mounts custom-CA volumes when enabled, andtfy-proxyCORS no longer setsAccess-Control-Allow-Private-Network. Minor Helm indentation fixes applied to several Service/ServiceAccount templates.Reviewed by Cursor Bugbot for commit 437a251. Bugbot is set up for automated code reviews on this repo. Configure here.