$ the-wire · showcase
kops compares GCE firewall rules as sets, PSA drops its webhook
By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology
![kubernetes-prow[bot]](https://avatars.githubusercontent.com/in/992787?v=4)
kops removes spurious GCE firewall diffs by comparing rule collections as sets, and pod-security-admission deletes its webhook while the go-restful v3.14.0 bump propagates through four staging repos.
fix(gce): compare firewall rule collections as sets kubernetes/kops
Allowed, SourceRanges, SourceTags and TargetTags are now compared as sets, so API ordering no longer triggers spurious firewall updates; absent selectors are preserved and values render sorted in API requests, Terraform output and dry-run reports. Nil and empty maps are now treated as equal during reconciliation, and the dependency walker can traverse set-valued fields safely.
Merge pull request #138469 from borg-land/delete-psa-webhook kubernetes/pod-security-admission
The pod security admission webhook is gone from the staging repo. If you have a validating webhook configuration or an admission chain entry pointing at the PSA webhook, that is now dead configuration; enforcement follows the built-in admission plugin.
OpenStack: Override default images for v1.37 kubernetes/kops
kops overrides the default OpenStack images for v1.37 because, per the PR, the v1.37.0 release of cloud-provider-openstack is broken. Clusters on that track get working defaults without an explicit image pin.
Merge pull request #142849 from mauriciopoppe/pr-bump-go-restful-v3.14.0 kubernetes/kube-controller-manager
github.com/emicklei/go-restful/v3 moves to v3.14.0 across dynamic-resource-allocation, pod-security-admission, kube-controller-manager and cloud-provider in one publishing-bot sweep; a routine bump, nothing to act on unless you vendor those components.
gce: use set type where order does not matter kubernetes/kops
justinsb's set-type work starts small, on FirewallRule Allowed and SourceRanges, to avoid handling order-sensitive values explicitly; the merge commit landed the same day.
Action items
- → Remove references to the deleted pod security admission webhook from admission chains before the next pod-security-ad... kubernetes/pod-security-admission [plan]
- → Run kops cluster updates against GCE to confirm no firewall diff appears kubernetes/kops [plan]
