From 47fbd079e17bbcbc5d63ce7e8e8b13c98d31f251 Mon Sep 17 00:00:00 2001 From: Yuan Chen Date: Fri, 21 Aug 2026 12:17:23 -0700 Subject: [PATCH 1/2] docs(defaults): correct MirrorDefaultKubeVersion rationale comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment claimed the value "tracks the project's minimum supported Kubernetes version declared in recipes/overlays/base.yaml". It does not, and must not: base.yaml declares ">= 1.25" while the constant is 1.33.0. The constant is a render-safe fallback for `helm template --kube-version` used by pkg/helm/render.go and pkg/mirror/discover.go when no version is supplied. Two sentences earlier the same comment explains why it exists — Helm's compiled-in v1.27.0 default is too old for charts declaring `kubeVersion: >=1.32.0-0`. Lowering the value to 1.25 to match base.yaml would reintroduce exactly that failure. The value is correct; only the rationale was wrong. Rewritten to state that this is a fallback rather than a support floor, and to warn against the plausible-looking "fix" of aligning it with base.yaml. Also notes that a recipe declaring K8s.server.version never reaches this default (mirror.KubeVersionFromConstraints returns the recipe's own value). Comment-only; no behavior change. Signed-off-by: Yuan Chen --- pkg/defaults/timeouts.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pkg/defaults/timeouts.go b/pkg/defaults/timeouts.go index d8fdf7faf..9b31ffb0d 100644 --- a/pkg/defaults/timeouts.go +++ b/pkg/defaults/timeouts.go @@ -1254,8 +1254,13 @@ const ( // recipe constraints. Without this flag Helm uses its compiled-in // default (currently v1.27.0 in Helm 3.x), which is too old for // charts that declare a kubeVersion constraint (e.g., >=1.32.0-0). - // The value tracks the project's minimum supported Kubernetes version - // declared in recipes/overlays/base.yaml. + // + // This is a render-safe fallback, not a support floor. It must stay at + // or above the strictest kubeVersion any bundled chart declares. Do NOT + // lower it to match the ">= 1.25" recipe floor in + // recipes/overlays/base.yaml: that is the constraint recipes are + // validated against, and a recipe that declares one never reaches this + // default (see mirror.KubeVersionFromConstraints). MirrorDefaultKubeVersion = "1.33.0" // MirrorDiscoveryConcurrency caps the number of components rendered in From 3bf7702b5dd0f4a46712037b1022681d5959012c Mon Sep 17 00:00:00 2001 From: Yuan Chen Date: Fri, 21 Aug 2026 15:14:30 -0700 Subject: [PATCH 2/2] docs(defaults): scope the kube-version invariant to the constant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review feedback: the invariant sentence read as though it bound the whole kube-version resolution path. It does not. KubeVersionFromConstraints returns the recipe's own value, and extractVersion(">= 1.25") yields "1.25", so a recipe carrying only base.yaml's floor renders with --kube-version 1.25 — below the stated invariant. Scope the sentence to this constant and note that the constraint path is unbounded below, so the comment cannot be read as a guarantee about rendering in general. Comment-only; no behavior change. Signed-off-by: Yuan Chen --- pkg/defaults/timeouts.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/pkg/defaults/timeouts.go b/pkg/defaults/timeouts.go index 9b31ffb0d..075be8cb7 100644 --- a/pkg/defaults/timeouts.go +++ b/pkg/defaults/timeouts.go @@ -1255,12 +1255,17 @@ const ( // default (currently v1.27.0 in Helm 3.x), which is too old for // charts that declare a kubeVersion constraint (e.g., >=1.32.0-0). // - // This is a render-safe fallback, not a support floor. It must stay at - // or above the strictest kubeVersion any bundled chart declares. Do NOT - // lower it to match the ">= 1.25" recipe floor in + // This is a render-safe fallback, not a support floor. This constant + // must stay at or above the strictest kubeVersion any bundled chart + // declares. Do NOT lower it to match the ">= 1.25" recipe floor in // recipes/overlays/base.yaml: that is the constraint recipes are // validated against, and a recipe that declares one never reaches this // default (see mirror.KubeVersionFromConstraints). + // + // The invariant binds this constant only. The constraint path is + // unbounded below: KubeVersionFromConstraints returns the recipe's own + // value, so a recipe carrying nothing but base.yaml's ">= 1.25" renders + // with --kube-version 1.25. MirrorDefaultKubeVersion = "1.33.0" // MirrorDiscoveryConcurrency caps the number of components rendered in