CP-46005: v1.2.14 release notes - #946
Conversation
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Cp5HSjxdMed1oiCx9rymw
Greptile SummaryThe PR adds concise release notes for CloudZero Agent v1.2.14.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains. Important Files Changed
Reviews (5): Last reviewed commit: "Merge branch 'develop' into CP-46005-rel..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Greptile flagged that the Build and Infrastructure section enumerated Go module versions (Prometheus, Kubernetes, Gateway API, chi, sqlite3, x/sync) newer than those pinned in go.mod on this branch. Match Evan's release-notes house style (e.g. 1.2.13) by summarizing dependency updates at a high level instead of pinning exact versions; the CVE-relevant pins stay in the Security section, where they match go.mod. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Cp5HSjxdMed1oiCx9rymw
Per Evan's review, reframe the notes as the routine maintenance release they are rather than an incident response: - Drop the dedicated Security section and CVE links; fold the x/net and x/text updates into Build & Infrastructure as routine dependency updates flagged by vulnerability scanners (no known reachability or severity claimed). - Scope the config-loader bug fix to the optional, non-default webhook-disable path; note default installs were unaffected. - Remove the "upgrade promptly" urgency language, matching 1.2.11. - Add two of Evan's webhook fixes: CloudZeroWebhookNoEvents alert false-alarms (#906) and anaximander RBAC-vs-absent-VWC diagnostics (#908). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Cp5HSjxdMed1oiCx9rymw
|
|
||
| ### Bug Fixes | ||
|
|
||
| - **Install with the webhook server disabled**: The optional `components.webhookServer.enabled: false` setting (introduced in 1.2.12, and not recommended for general use) could fail to install because the config-loader job was handed an empty `--config-webhook` path. The job now tolerates an empty webhook config path. Default installs run the webhook server and were unaffected. |
There was a problem hiding this comment.
I would replace "introduced in 1.2.12, and not recommended for general use" with "an experimental feature introduced in 1.2.12".
There was a problem hiding this comment.
Done in 637b72b — reworded to "an experimental feature introduced in 1.2.12".
|
|
||
| - **Install with the webhook server disabled**: The optional `components.webhookServer.enabled: false` setting (introduced in 1.2.12, and not recommended for general use) could fail to install because the config-loader job was handed an empty `--config-webhook` path. The job now tolerates an empty webhook config path. Default installs run the webhook server and were unaffected. | ||
|
|
||
| - **`CloudZeroWebhookNoEvents` false alarms**: With the optional Prometheus Operator monitoring integration enabled, this alert evaluated its rate one metric series at a time, so it could fire while the webhook server was healthy and busy — a single rarely-used resource or one quiet replica was enough — yet never fire for a webhook that was up but receiving no events at all. The alert now aggregates across all series and replicas and treats an absent metric as zero, so it fires only when no replica is seeing any admission events. Installs without the monitoring integration are unaffected. |
There was a problem hiding this comment.
This can be simplified a lot. Something like
CloudZeroWebhookNoEventsfalse alarms: part of the optional monitoring infrastructure, this alert now applies to the aggregate of all webhook servers instead of each instance individually, in order to eliminate false positives.
There was a problem hiding this comment.
Done in 637b72b — used your version, with one light tightening: dropped "individually" (redundant with "each instance") and "in order to eliminate" → "eliminating". Same meaning.
|
|
||
| - **`CloudZeroWebhookNoEvents` false alarms**: With the optional Prometheus Operator monitoring integration enabled, this alert evaluated its rate one metric series at a time, so it could fire while the webhook server was healthy and busy — a single rarely-used resource or one quiet replica was enough — yet never fire for a webhook that was up but receiving no events at all. The alert now aggregates across all series and replicas and treats an absent metric as zero, so it fires only when no replica is seeing any admission events. Installs without the monitoring integration are unaffected. | ||
|
|
||
| - **Webhook diagnostics false negative**: The `anaximander` support script could report that no `ValidatingWebhookConfiguration` was found — and conclude the API server was not sending admission requests — when the user collecting the bundle simply lacked permission to list them. It now distinguishes a permission or API failure from a genuine absence, and matches the agent's webhook configuration by its chart label. This affects only the diagnostic bundle, not the agent's runtime behavior. |
There was a problem hiding this comment.
- Webhook diagnostics accuracy: The
anaximanderdebugging script now includes information to distinguish between a missingValidatingWebhookConfigurationand a permission error preventing the script from retrieving theValidatingWebhookConfiguration
There was a problem hiding this comment.
Done in 637b72b — adopted your rewrite and the "Webhook diagnostics accuracy" title. Tightened slightly: "includes information to distinguish between … and …" → "distinguishes … from …", and used "it" for the repeated ValidatingWebhookConfiguration.
| - Embedded Alloy binary updated to v1.18.1 | ||
| - Updated `golang.org/x/net` and `golang.org/x/text`, resolving advisories reported by our dependency vulnerability scanners | ||
| - Numerous dependency updates across Go modules, GitHub Actions, and tooling | ||
| - Base image refreshed to the latest `distroless/static-debian12` digest |
There was a problem hiding this comment.
I would just get rid of this section, and say something like "This release also incorporates dependency updates to promote security and reliability."
There was a problem hiding this comment.
Done in 637b72b — dropped the Build and Infrastructure section and folded the dependency note into the intro: "It also updates dependencies for security and reliability." Happy to make it a standalone line where the section was if you would prefer.
- Reword the config-loader fix to describe the webhook-disable setting as "an experimental feature introduced in 1.2.12" (per review). - Simplify the CloudZeroWebhookNoEvents and anaximander bullets. - Drop the Build and Infrastructure section; fold the dependency note into the intro. - Apply a Zinsser prose-polish pass: active verbs, less clutter. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Cp5HSjxdMed1oiCx9rymw
2 participants
Release notes for v1.2.14 (CP-46005) — a maintenance/security release headlined by the config-loader fix (an empty
--config-webhookpath no longer blocks install, e.g. on GCP), plus security patches (x/net GO-2026-5942 / CVE-2026-46600, x/text GO-2026-5970, Alloy v1.18.1, Go 1.26.5) and the Dependabot dependency backlog.Closes CP-46005.
🤖 Generated with Claude Code
https://claude.ai/code/session_018Cp5HSjxdMed1oiCx9rymw