carverauto/serviceradar
1
1
Fork 0
Code Issues 190 Pull requests 16 Projects Releases 173 Packages Wiki Activity Actions

helm updates for flowgger and netflow #2822

Merged
mfreeman451 merged 1 commit from refs/pull/2822/head into staging 2026-02-01 04:52:17 +00:00
Conversation 3 Commits 1 Files changed 6 +18 -4
mfreeman451 commented 2026-02-01 04:51:26 +00:00 (Migrated from github.com)
Owner
Copy link

Imported from GitHub pull request.

Original GitHub pull request: #2652
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/2652
Original created: 2026-02-01T04:51:26Z
Original updated: 2026-02-01T05:23:45Z
Original head: carverauto/serviceradar:chore/k8s-updates
Original base: staging
Original merged: 2026-02-01T04:52:17Z by @mfreeman451

User description

IMPORTANT: Please sign the Developer Certificate of Origin

Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include
a DCO sign-off statement indicating the DCO acceptance in one commit message. Here
is an example DCO Signed-off-by line in a commit message:

Signed-off-by: J. Doe <j.doe@domain.com>

Describe your changes

Issue ticket number and link

Code checklist before requesting a review

  • I have signed the DCO?
  • The build completes without errors?
  • All tests are passing when running make test?

PR Type

Enhancement

Description

  • Add externalTrafficPolicy configuration to Kubernetes services

    • Enables local traffic policy for Calico BGP compatibility

  • Update MetalLB pool references from k3s-lan-pool to k3s-pool

  • Update demo LoadBalancer IP addresses for flowgger and netflow services

  • Add configuration documentation for external traffic policy settings

Diagram Walkthrough

flowchart LR
  A["Helm Templates"] -->|Add externalTrafficPolicy| B["flowgger.yaml"]
  A -->|Add externalTrafficPolicy| C["netflow-collector.yaml"]
  D["Values Files"] -->|Update pool names| E["values-demo.yaml"]
  D -->|Add policy defaults| F["values.yaml"]
  G["K8s Manifests"] -->|Set Local policy| H["Demo Services"]

File Walkthrough
Relevant files
Enhancement
flowgger.yaml
Add externalTrafficPolicy to flowgger service                       

helm/serviceradar/templates/flowgger.yaml

  • Add conditional externalTrafficPolicy field to external service spec
  • Allows configuration of traffic policy via values
 +3/-0     
netflow-collector.yaml
Add externalTrafficPolicy to netflow service                         

helm/serviceradar/templates/netflow-collector.yaml

  • Add conditional externalTrafficPolicy field to service spec
  • Enables traffic policy configuration through Helm values
 +3/-0     
serviceradar-netflow-collector.yaml
Add Local traffic policy to netflow service                           

k8s/demo/base/serviceradar-netflow-collector.yaml

  • Add externalTrafficPolicy: Local to netflow collector service spec
  • Enables local endpoint traffic routing
 +1/-0     
serviceradar-flowgger-external.yaml
Add Local traffic policy to flowgger service                         

k8s/demo/prod/serviceradar-flowgger-external.yaml

  • Add externalTrafficPolicy: Local to flowgger external service spec
  • Configures local traffic routing for production environment
 +1/-0     
Configuration changes
values-demo.yaml
Update demo values with new pool and traffic policy           

helm/serviceradar/values-demo.yaml

  • Update flowgger MetalLB pool from k3s-lan-pool to k3s-pool
  • Update flowgger LoadBalancerIP to 23.138.124.24
  • Add externalTrafficPolicy: Local to flowgger configuration
  • Update netflow MetalLB pool and LoadBalancerIP, add Local traffic
    policy
 +6/-4     
Documentation
values.yaml
Add externalTrafficPolicy defaults and documentation         

helm/serviceradar/values.yaml

  • Add externalTrafficPolicy: Cluster default to flowgger external
    service
  • Add documentation comment explaining Calico BGP requirement
  • Add externalTrafficPolicy: Cluster default to netflow collector
    service
  • Include explanatory comment for traffic policy configuration
 +4/-0     
Imported from GitHub pull request. Original GitHub pull request: #2652 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/pull/2652 Original created: 2026-02-01T04:51:26Z Original updated: 2026-02-01T05:23:45Z Original head: carverauto/serviceradar:chore/k8s-updates Original base: staging Original merged: 2026-02-01T04:52:17Z by @mfreeman451 --- ### **User description** ## IMPORTANT: Please sign the Developer Certificate of Origin Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include a [DCO sign-off statement]( https://developercertificate.org/) indicating the DCO acceptance in one commit message. Here is an example DCO Signed-off-by line in a commit message: ``` Signed-off-by: J. Doe <j.doe@domain.com> ``` ## Describe your changes ## Issue ticket number and link ## Code checklist before requesting a review - [ ] I have signed the DCO? - [ ] The build completes without errors? - [ ] All tests are passing when running make test? ___ ### **PR Type** Enhancement ___ ### **Description** - Add `externalTrafficPolicy` configuration to Kubernetes services - Enables local traffic policy for Calico BGP compatibility - Update MetalLB pool references from `k3s-lan-pool` to `k3s-pool` - Update demo LoadBalancer IP addresses for flowgger and netflow services - Add configuration documentation for external traffic policy settings ___ ### Diagram Walkthrough ```mermaid flowchart LR A["Helm Templates"] -->|Add externalTrafficPolicy| B["flowgger.yaml"] A -->|Add externalTrafficPolicy| C["netflow-collector.yaml"] D["Values Files"] -->|Update pool names| E["values-demo.yaml"] D -->|Add policy defaults| F["values.yaml"] G["K8s Manifests"] -->|Set Local policy| H["Demo Services"] ``` <details><summary><h3>File Walkthrough</h3></summary> <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><table> <tr> <td> <details> <summary><strong>flowgger.yaml</strong><dd><code>Add externalTrafficPolicy to flowgger service</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> helm/serviceradar/templates/flowgger.yaml <ul><li>Add conditional <code>externalTrafficPolicy</code> field to external service spec<br> <li> Allows configuration of traffic policy via values</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/2652/files#diff-511cfbfe42e0c41cd2fddf67a04911b48724ca9ea9f6d1ddc1f4bb7bf07086ab">+3/-0</a>&nbsp; &nbsp; &nbsp; </td> </tr> <tr> <td> <details> <summary><strong>netflow-collector.yaml</strong><dd><code>Add externalTrafficPolicy to netflow service</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> helm/serviceradar/templates/netflow-collector.yaml <ul><li>Add conditional <code>externalTrafficPolicy</code> field to service spec<br> <li> Enables traffic policy configuration through Helm values</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/2652/files#diff-2caca5e6b4a9d567d04bd326125e554b1f571be0f7746fb6f9144e0a33f65b07">+3/-0</a>&nbsp; &nbsp; &nbsp; </td> </tr> <tr> <td> <details> <summary><strong>serviceradar-netflow-collector.yaml</strong><dd><code>Add Local traffic policy to netflow service</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> k8s/demo/base/serviceradar-netflow-collector.yaml <ul><li>Add <code>externalTrafficPolicy: Local</code> to netflow collector service spec<br> <li> Enables local endpoint traffic routing</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/2652/files#diff-c29757a23e5f4021c9cd4d6d35a261edf9b56c706188bb24855fafa84454b797">+1/-0</a>&nbsp; &nbsp; &nbsp; </td> </tr> <tr> <td> <details> <summary><strong>serviceradar-flowgger-external.yaml</strong><dd><code>Add Local traffic policy to flowgger service</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> k8s/demo/prod/serviceradar-flowgger-external.yaml <ul><li>Add <code>externalTrafficPolicy: Local</code> to flowgger external service spec<br> <li> Configures local traffic routing for production environment</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/2652/files#diff-0e3d242dcaf4f3a83adc9de3f7183db6299c50bca47b9cd544ee02dfec263dcf">+1/-0</a>&nbsp; &nbsp; &nbsp; </td> </tr> </table></td></tr><tr><td><strong>Configuration changes</strong></td><td><table> <tr> <td> <details> <summary><strong>values-demo.yaml</strong><dd><code>Update demo values with new pool and traffic policy</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> helm/serviceradar/values-demo.yaml <ul><li>Update flowgger MetalLB pool from <code>k3s-lan-pool</code> to <code>k3s-pool</code><br> <li> Update flowgger LoadBalancerIP to <code>23.138.124.24</code><br> <li> Add <code>externalTrafficPolicy: Local</code> to flowgger configuration<br> <li> Update netflow MetalLB pool and LoadBalancerIP, add Local traffic <br>policy</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/2652/files#diff-3a2c6c76ca4d5e8a336cd917d39b1704c03ea94a5cba4da1eb20629c63a5b914">+6/-4</a>&nbsp; &nbsp; &nbsp; </td> </tr> </table></td></tr><tr><td><strong>Documentation</strong></td><td><table> <tr> <td> <details> <summary><strong>values.yaml</strong><dd><code>Add externalTrafficPolicy defaults and documentation</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> helm/serviceradar/values.yaml <ul><li>Add <code>externalTrafficPolicy: Cluster</code> default to flowgger external <br>service<br> <li> Add documentation comment explaining Calico BGP requirement<br> <li> Add <code>externalTrafficPolicy: Cluster</code> default to netflow collector <br>service<br> <li> Include explanatory comment for traffic policy configuration</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/2652/files#diff-d4449c7cb70362554b274f81eae5a4b81a8e81df494282e383d1b7ea3871c452">+4/-0</a>&nbsp; &nbsp; &nbsp; </td> </tr> </table></td></tr></tbody></table> </details> ___
qodo-code-review[bot] commented 2026-02-01 04:52:05 +00:00 (Migrated from github.com)
Author
Owner
Copy link

Imported GitHub PR comment.

Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2652#issuecomment-3830373256
Original created: 2026-02-01T04:52:05Z

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
⚪
Unintended public exposure

Description: The demo configuration sets type: LoadBalancer with specific loadBalancerIP values (e.g.,
23.138.124.24/23.138.124.25) which may unintentionally expose syslog/NetFlow ingestion
services publicly if applied in an environment where these IPs are routable; confirm these
IPs are intended, restricted by firewall/ACLs, and not usable outside a controlled demo
network.
values-demo.yaml [90-107]

Referred Code 
flowgger:
  externalService:
    enabled: true
    annotations:
      metallb.universe.tf/address-pool: k3s-pool
    loadBalancerIP: "23.138.124.24"
    externalTrafficPolicy: Local

netflowCollector:
  enabled: true
  config:
    stream_max_bytes: 1073741824
  service:
    type: LoadBalancer
    annotations:
      metallb.universe.tf/address-pool: k3s-pool
    loadBalancerIP: "23.138.124.25"
    externalTrafficPolicy: Local
Ticket Compliance
⚪
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
⚪
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

🔴
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status:
Misleading config comment: The comment says the setting will "only advertise from nodes with local
endpoints" (i.e., externalTrafficPolicy: Local) but the default value is set to
Cluster, making the configuration self-documentation misleading.

Referred Code 
# Only advertise from nodes with local endpoints (required for Calico BGP)
externalTrafficPolicy: Cluster

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Missing edge-case guard: externalTrafficPolicy is rendered whenever a value is provided, even if the Service type
is ClusterIP, which can produce an invalid Kubernetes Service manifest instead of handling
the edge case safely.

Referred Code 
type: {{ .Values.netflowCollector.service.type | default "ClusterIP" }}
{{- with .Values.netflowCollector.service.externalTrafficPolicy }}
externalTrafficPolicy: {{ . }}
{{- end }}

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
No value validation: The template inserts .Values.flowgger.externalService.externalTrafficPolicy directly into
the manifest without validating it against allowed values (Local/Cluster) or gating it by
Service type, allowing invalid external inputs to generate unsafe/invalid resources.

Referred Code 
type: {{ .Values.flowgger.externalService.type | default "LoadBalancer" }}
{{- with .Values.flowgger.externalService.externalTrafficPolicy }}
externalTrafficPolicy: {{ . }}
{{- end }}

Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label
Imported GitHub PR comment. Original author: @qodo-code-review[bot] Original URL: https://github.com/carverauto/serviceradar/pull/2652#issuecomment-3830373256 Original created: 2026-02-01T04:52:05Z --- ## PR Compliance Guide 🔍 <!-- https://github.com/carverauto/serviceradar/commit/b10222c36e9be0c0cf97835da786e6639be7f92c --> Below is a summary of compliance checks for this PR:<br> <table><tbody><tr><td colspan='2'><strong>Security Compliance</strong></td></tr> <tr><td rowspan=1>⚪</td> <td><details><summary><strong>Unintended public exposure </strong></summary><br> <b>Description:</b> The demo configuration sets <code>type: LoadBalancer</code> with specific <code>loadBalancerIP</code> values (e.g., <br><code>23.138.124.24</code>/<code>23.138.124.25</code>) which may unintentionally expose syslog/NetFlow ingestion <br>services publicly if applied in an environment where these IPs are routable; confirm these <br>IPs are intended, restricted by firewall/ACLs, and not usable outside a controlled demo <br>network.<br> <strong><a href='https://github.com/carverauto/serviceradar/pull/2652/files#diff-3a2c6c76ca4d5e8a336cd917d39b1704c03ea94a5cba4da1eb20629c63a5b914R90-R107'>values-demo.yaml [90-107]</a></strong><br> <details open><summary>Referred Code</summary> ```yaml flowgger: externalService: enabled: true annotations: metallb.universe.tf/address-pool: k3s-pool loadBalancerIP: "23.138.124.24" externalTrafficPolicy: Local netflowCollector: enabled: true config: stream_max_bytes: 1073741824 service: type: LoadBalancer annotations: metallb.universe.tf/address-pool: k3s-pool loadBalancerIP: "23.138.124.25" externalTrafficPolicy: Local ``` </details></details></td></tr> <tr><td colspan='2'><strong>Ticket Compliance</strong></td></tr> <tr><td>⚪</td><td><details><summary>🎫 <strong>No ticket provided </strong></summary> - [ ] Create ticket/issue <!-- /create_ticket --create_ticket=true --> </details></td></tr> <tr><td colspan='2'><strong>Codebase Duplication Compliance</strong></td></tr> <tr><td>⚪</td><td><details><summary><strong>Codebase context is not defined </strong></summary> Follow the <a href='https://qodo-merge-docs.qodo.ai/core-abilities/rag_context_enrichment/'>guide</a> to enable codebase context checks. </details></td></tr> <tr><td colspan='2'><strong>Custom Compliance</strong></td></tr> <tr><td rowspan=3>🟢</td><td> <details><summary><strong>Generic: Comprehensive Audit Trails</strong></summary><br> **Objective:** To create a detailed and reliable record of critical system actions for security analysis <br>and compliance.<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Secure Error Handling</strong></summary><br> **Objective:** To prevent the leakage of sensitive system information through error messages while <br>providing sufficient detail for internal debugging.<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Secure Logging Practices</strong></summary><br> **Objective:** To ensure logs are useful for debugging and auditing without exposing sensitive <br>information like PII, PHI, or cardholder data.<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td rowspan=3>🔴</td> <td><details> <summary><strong>Generic: Meaningful Naming and Self-Documenting Code</strong></summary><br> **Objective:** Ensure all identifiers clearly express their purpose and intent, making code <br>self-documenting<br> **Status:** <br><a href='https://github.com/carverauto/serviceradar/pull/2652/files#diff-d4449c7cb70362554b274f81eae5a4b81a8e81df494282e383d1b7ea3871c452R255-R256'><strong>Misleading config comment</strong></a>: The comment says the setting will &quot;only advertise from nodes with local <br>endpoints&quot; (i.e., <code>externalTrafficPolicy: Local</code>) but the default value is set to <br><code>Cluster</code>, making the configuration self-documentation misleading.<br> <details open><summary>Referred Code</summary> ```yaml # Only advertise from nodes with local endpoints (required for Calico BGP) externalTrafficPolicy: Cluster ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td><details> <summary><strong>Generic: Robust Error Handling and Edge Case Management</strong></summary><br> **Objective:** Ensure comprehensive error handling that provides meaningful context and graceful <br>degradation<br> **Status:** <br><a href='https://github.com/carverauto/serviceradar/pull/2652/files#diff-2caca5e6b4a9d567d04bd326125e554b1f571be0f7746fb6f9144e0a33f65b07R146-R149'><strong>Missing edge-case guard</strong></a>: <code>externalTrafficPolicy</code> is rendered whenever a value is provided, even if the Service <code>type</code> <br>is <code>ClusterIP</code>, which can produce an invalid Kubernetes Service manifest instead of handling <br>the edge case safely.<br> <details open><summary>Referred Code</summary> ```yaml type: {{ .Values.netflowCollector.service.type | default "ClusterIP" }} {{- with .Values.netflowCollector.service.externalTrafficPolicy }} externalTrafficPolicy: {{ . }} {{- end }} ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td><details> <summary><strong>Generic: Security-First Input Validation and Data Handling</strong></summary><br> **Objective:** Ensure all data inputs are validated, sanitized, and handled securely to prevent <br>vulnerabilities<br> **Status:** <br><a href='https://github.com/carverauto/serviceradar/pull/2652/files#diff-511cfbfe42e0c41cd2fddf67a04911b48724ca9ea9f6d1ddc1f4bb7bf07086abR192-R195'><strong>No value validation</strong></a>: The template inserts <code>.Values.flowgger.externalService.externalTrafficPolicy</code> directly into <br>the manifest without validating it against allowed values (<code>Local</code>/<code>Cluster</code>) or gating it by <br>Service type, allowing invalid external inputs to generate unsafe/invalid resources.<br> <details open><summary>Referred Code</summary> ```yaml type: {{ .Values.flowgger.externalService.type | default "LoadBalancer" }} {{- with .Values.flowgger.externalService.externalTrafficPolicy }} externalTrafficPolicy: {{ . }} {{- end }} ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td align="center" colspan="2"> <!-- placeholder --> <!-- /compliance --update_compliance=true --> </td></tr></tbody></table> <details><summary>Compliance status legend</summary> 🟢 - Fully Compliant<br> 🟡 - Partial Compliant<br> 🔴 - Not Compliant<br> ⚪ - Requires Further Human Verification<br> 🏷️ - Compliance label<br> </details>
qodo-code-review[bot] commented 2026-02-01 04:52:23 +00:00 (Migrated from github.com)
Author
Owner
Copy link

Imported GitHub PR comment.

Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2652#issuecomment-3830373522
Original created: 2026-02-01T04:52:23Z

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: build

Failed stage: Configure SRQL fixture database for tests [❌]

Failed test name: ""

Failure summary:

The action failed during environment/fixture setup because the required secret
SRQL_TEST_DATABASE_CA_CERT was not configured.
- The log explicitly reports:
SRQL_TEST_DATABASE_CA_CERT secret must be configured to verify SRQL fixture TLS. (around lines
676-678).
- The SRQL_TEST_DATABASE_CA_CERT environment variable is empty in the job environment
(lines 361, 517, 580), causing the setup script to exit with code 1.

Relevant error logs: 
1:  Runner name: 'arc-runner-set-hk6mk-runner-hpmb6'
2:  Runner group name: 'Default'
...

139:  ^[[36;1mif command -v apt-get >/dev/null 2>&1; then^[[0m
140:  ^[[36;1m  sudo apt-get update^[[0m
141:  ^[[36;1m  sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler cmake flex bison^[[0m
142:  ^[[36;1melif command -v dnf >/dev/null 2>&1; then^[[0m
143:  ^[[36;1m  sudo dnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison^[[0m
144:  ^[[36;1melif command -v yum >/dev/null 2>&1; then^[[0m
145:  ^[[36;1m  sudo yum install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison^[[0m
146:  ^[[36;1melif command -v microdnf >/dev/null 2>&1; then^[[0m
147:  ^[[36;1m  sudo microdnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison^[[0m
148:  ^[[36;1melse^[[0m
149:  ^[[36;1m  echo "Unsupported package manager; please install gcc, g++ (or clang), make, OpenSSL headers, pkg-config, and protoc manually." >&2^[[0m
150:  ^[[36;1m  exit 1^[[0m
151:  ^[[36;1mfi^[[0m
152:  ^[[36;1m^[[0m
153:  ^[[36;1mensure_pkg_config^[[0m
154:  ^[[36;1mprotoc --version || (echo "protoc installation failed" && exit 1)^[[0m
155:  shell: /usr/bin/bash -e {0}
...

356:  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
357:  env:
358:  BUILDBUDDY_ORG_API_KEY: ***
359:  SRQL_TEST_DATABASE_URL: ***
360:  SRQL_TEST_ADMIN_URL: ***
361:  SRQL_TEST_DATABASE_CA_CERT: 
362:  DOCKERHUB_USERNAME: ***
363:  DOCKERHUB_TOKEN: ***
364:  TEST_CNPG_DATABASE: serviceradar_web_ng_test
365:  INSTALL_DIR_FOR_OTP: /home/runner/_work/_temp/.setup-beam/otp
366:  INSTALL_DIR_FOR_ELIXIR: /home/runner/_work/_temp/.setup-beam/elixir
367:  ##[endgroup]
368:  ##[group]Run : install rustup if needed
369:  ^[[36;1m: install rustup if needed^[[0m
370:  ^[[36;1mif ! command -v rustup &>/dev/null; then^[[0m
371:  ^[[36;1m  curl --proto '=https' --tlsv1.2 --retry 10 --retry-connrefused --location --silent --show-error --fail https://sh.rustup.rs | sh -s -- --default-toolchain none -y^[[0m
372:  ^[[36;1m  echo "$CARGO_HOME/bin" >> $GITHUB_PATH^[[0m
...

512:  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
513:  env:
514:  BUILDBUDDY_ORG_API_KEY: ***
515:  SRQL_TEST_DATABASE_URL: ***
516:  SRQL_TEST_ADMIN_URL: ***
517:  SRQL_TEST_DATABASE_CA_CERT: 
518:  DOCKERHUB_USERNAME: ***
519:  DOCKERHUB_TOKEN: ***
520:  TEST_CNPG_DATABASE: serviceradar_web_ng_test
521:  INSTALL_DIR_FOR_OTP: /home/runner/_work/_temp/.setup-beam/otp
522:  INSTALL_DIR_FOR_ELIXIR: /home/runner/_work/_temp/.setup-beam/elixir
523:  CARGO_HOME: /home/runner/.cargo
524:  CARGO_INCREMENTAL: 0
525:  CARGO_TERM_COLOR: always
526:  ##[endgroup]
527:  ##[group]Run : work around spurious network errors in curl 8.0
528:  ^[[36;1m: work around spurious network errors in curl 8.0^[[0m
529:  ^[[36;1m# https://rust-lang.zulipchat.com/#narrow/stream/246057-t-cargo/topic/timeout.20investigation^[[0m
...

580:  SRQL_TEST_DATABASE_CA_CERT: 
581:  DOCKERHUB_USERNAME: ***
582:  DOCKERHUB_TOKEN: ***
583:  TEST_CNPG_DATABASE: serviceradar_web_ng_test
584:  INSTALL_DIR_FOR_OTP: /home/runner/_work/_temp/.setup-beam/otp
585:  INSTALL_DIR_FOR_ELIXIR: /home/runner/_work/_temp/.setup-beam/elixir
586:  CARGO_HOME: /home/runner/.cargo
587:  CARGO_INCREMENTAL: 0
588:  CARGO_TERM_COLOR: always
589:  ##[endgroup]
590:  Attempting to download 1.x...
591:  Acquiring v1.28.1 from https://github.com/bazelbuild/bazelisk/releases/download/v1.28.1/bazelisk-linux-amd64
592:  Adding to the cache ...
593:  Successfully cached bazelisk to /home/runner/_work/_tool/bazelisk/1.28.1/x64
594:  Added bazelisk to the path
595:  ##[warning]Failed to restore: Cache service responded with 400
596:  Restored bazelisk cache dir @ /home/runner/.cache/bazelisk
...

662:  env:
663:  BUILDBUDDY_ORG_API_KEY: ***
664:  SRQL_TEST_DATABASE_URL: ***
665:  SRQL_TEST_ADMIN_URL: ***
666:  SRQL_TEST_DATABASE_CA_CERT: 
667:  DOCKERHUB_USERNAME: ***
668:  DOCKERHUB_TOKEN: ***
669:  TEST_CNPG_DATABASE: serviceradar_web_ng_test
670:  INSTALL_DIR_FOR_OTP: /home/runner/_work/_temp/.setup-beam/otp
671:  INSTALL_DIR_FOR_ELIXIR: /home/runner/_work/_temp/.setup-beam/elixir
672:  CARGO_HOME: /home/runner/.cargo
673:  CARGO_INCREMENTAL: 0
674:  CARGO_TERM_COLOR: always
675:  ##[endgroup]
676:  SRQL_TEST_DATABASE_CA_CERT secret must be configured to verify SRQL fixture TLS.
677:  ##[error]Process completed with exit code 1.
678:  Post job cleanup.
Imported GitHub PR comment. Original author: @qodo-code-review[bot] Original URL: https://github.com/carverauto/serviceradar/pull/2652#issuecomment-3830373522 Original created: 2026-02-01T04:52:23Z --- ## CI Feedback 🧐 A test triggered by this PR failed. Here is an AI-generated analysis of the failure: <table><tr><td> **Action:** build</td></tr> <tr><td> **Failed stage:** [Configure SRQL fixture database for tests](https://github.com/carverauto/serviceradar/actions/runs/21556906013/job/62114829831) [❌] </td></tr> <tr><td> **Failed test name:** "" </td></tr> <tr><td> **Failure summary:** The action failed during environment/fixture setup because the required secret <br><code>SRQL_TEST_DATABASE_CA_CERT</code> was not configured.<br> - The log explicitly reports: <br><code>SRQL_TEST_DATABASE_CA_CERT secret must be configured to verify SRQL fixture TLS.</code> (around lines <br>676-678).<br> - The <code>SRQL_TEST_DATABASE_CA_CERT</code> environment variable is empty in the job environment <br>(lines 361, 517, 580), causing the setup script to exit with code 1.<br> </td></tr> <tr><td> <details><summary>Relevant error logs:</summary> ```yaml 1: Runner name: 'arc-runner-set-hk6mk-runner-hpmb6' 2: Runner group name: 'Default' ... 139: ^[[36;1mif command -v apt-get >/dev/null 2>&1; then^[[0m 140: ^[[36;1m sudo apt-get update^[[0m 141: ^[[36;1m sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler cmake flex bison^[[0m 142: ^[[36;1melif command -v dnf >/dev/null 2>&1; then^[[0m 143: ^[[36;1m sudo dnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison^[[0m 144: ^[[36;1melif command -v yum >/dev/null 2>&1; then^[[0m 145: ^[[36;1m sudo yum install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison^[[0m 146: ^[[36;1melif command -v microdnf >/dev/null 2>&1; then^[[0m 147: ^[[36;1m sudo microdnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison^[[0m 148: ^[[36;1melse^[[0m 149: ^[[36;1m echo "Unsupported package manager; please install gcc, g++ (or clang), make, OpenSSL headers, pkg-config, and protoc manually." >&2^[[0m 150: ^[[36;1m exit 1^[[0m 151: ^[[36;1mfi^[[0m 152: ^[[36;1m^[[0m 153: ^[[36;1mensure_pkg_config^[[0m 154: ^[[36;1mprotoc --version || (echo "protoc installation failed" && exit 1)^[[0m 155: shell: /usr/bin/bash -e {0} ... 356: shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0} 357: env: 358: BUILDBUDDY_ORG_API_KEY: *** 359: SRQL_TEST_DATABASE_URL: *** 360: SRQL_TEST_ADMIN_URL: *** 361: SRQL_TEST_DATABASE_CA_CERT: 362: DOCKERHUB_USERNAME: *** 363: DOCKERHUB_TOKEN: *** 364: TEST_CNPG_DATABASE: serviceradar_web_ng_test 365: INSTALL_DIR_FOR_OTP: /home/runner/_work/_temp/.setup-beam/otp 366: INSTALL_DIR_FOR_ELIXIR: /home/runner/_work/_temp/.setup-beam/elixir 367: ##[endgroup] 368: ##[group]Run : install rustup if needed 369: ^[[36;1m: install rustup if needed^[[0m 370: ^[[36;1mif ! command -v rustup &>/dev/null; then^[[0m 371: ^[[36;1m curl --proto '=https' --tlsv1.2 --retry 10 --retry-connrefused --location --silent --show-error --fail https://sh.rustup.rs | sh -s -- --default-toolchain none -y^[[0m 372: ^[[36;1m echo "$CARGO_HOME/bin" >> $GITHUB_PATH^[[0m ... 512: shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0} 513: env: 514: BUILDBUDDY_ORG_API_KEY: *** 515: SRQL_TEST_DATABASE_URL: *** 516: SRQL_TEST_ADMIN_URL: *** 517: SRQL_TEST_DATABASE_CA_CERT: 518: DOCKERHUB_USERNAME: *** 519: DOCKERHUB_TOKEN: *** 520: TEST_CNPG_DATABASE: serviceradar_web_ng_test 521: INSTALL_DIR_FOR_OTP: /home/runner/_work/_temp/.setup-beam/otp 522: INSTALL_DIR_FOR_ELIXIR: /home/runner/_work/_temp/.setup-beam/elixir 523: CARGO_HOME: /home/runner/.cargo 524: CARGO_INCREMENTAL: 0 525: CARGO_TERM_COLOR: always 526: ##[endgroup] 527: ##[group]Run : work around spurious network errors in curl 8.0 528: ^[[36;1m: work around spurious network errors in curl 8.0^[[0m 529: ^[[36;1m# https://rust-lang.zulipchat.com/#narrow/stream/246057-t-cargo/topic/timeout.20investigation^[[0m ... 580: SRQL_TEST_DATABASE_CA_CERT: 581: DOCKERHUB_USERNAME: *** 582: DOCKERHUB_TOKEN: *** 583: TEST_CNPG_DATABASE: serviceradar_web_ng_test 584: INSTALL_DIR_FOR_OTP: /home/runner/_work/_temp/.setup-beam/otp 585: INSTALL_DIR_FOR_ELIXIR: /home/runner/_work/_temp/.setup-beam/elixir 586: CARGO_HOME: /home/runner/.cargo 587: CARGO_INCREMENTAL: 0 588: CARGO_TERM_COLOR: always 589: ##[endgroup] 590: Attempting to download 1.x... 591: Acquiring v1.28.1 from https://github.com/bazelbuild/bazelisk/releases/download/v1.28.1/bazelisk-linux-amd64 592: Adding to the cache ... 593: Successfully cached bazelisk to /home/runner/_work/_tool/bazelisk/1.28.1/x64 594: Added bazelisk to the path 595: ##[warning]Failed to restore: Cache service responded with 400 596: Restored bazelisk cache dir @ /home/runner/.cache/bazelisk ... 662: env: 663: BUILDBUDDY_ORG_API_KEY: *** 664: SRQL_TEST_DATABASE_URL: *** 665: SRQL_TEST_ADMIN_URL: *** 666: SRQL_TEST_DATABASE_CA_CERT: 667: DOCKERHUB_USERNAME: *** 668: DOCKERHUB_TOKEN: *** 669: TEST_CNPG_DATABASE: serviceradar_web_ng_test 670: INSTALL_DIR_FOR_OTP: /home/runner/_work/_temp/.setup-beam/otp 671: INSTALL_DIR_FOR_ELIXIR: /home/runner/_work/_temp/.setup-beam/elixir 672: CARGO_HOME: /home/runner/.cargo 673: CARGO_INCREMENTAL: 0 674: CARGO_TERM_COLOR: always 675: ##[endgroup] 676: SRQL_TEST_DATABASE_CA_CERT secret must be configured to verify SRQL fixture TLS. 677: ##[error]Process completed with exit code 1. 678: Post job cleanup. ``` </details></td></tr></table>
qodo-code-review[bot] commented 2026-02-01 04:52:54 +00:00 (Migrated from github.com)
Author
Owner
Copy link

Imported GitHub PR comment.

Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2652#issuecomment-3830373935
Original created: 2026-02-01T04:52:54Z

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
High-level
Consolidate Kubernetes manifests into a single tool

The PR edits both Helm charts and static Kubernetes manifests in k8s/demo/. To
improve maintainability and create a single source of truth, consider managing
all Kubernetes resources exclusively through the Helm chart.

Examples:

k8s/demo/base/serviceradar-netflow-collector.yaml [157] 
  externalTrafficPolicy: Local
helm/serviceradar/values-demo.yaml [96-107] 
    externalTrafficPolicy: Local

netflowCollector:
  enabled: true
  config:
    stream_max_bytes: 1073741824
  service:
    type: LoadBalancer
    annotations:
      metallb.universe.tf/address-pool: k3s-pool

 ... (clipped 2 lines)

Solution Walkthrough:

Before:

# helm/serviceradar/values-demo.yaml
flowgger:
  externalService:
    externalTrafficPolicy: Local
netflowCollector:
  service:
    externalTrafficPolicy: Local

# k8s/demo/base/serviceradar-netflow-collector.yaml
apiVersion: v1
kind: Service
spec:
  externalTrafficPolicy: Local
  ...

# k8s/demo/prod/serviceradar-flowgger-external.yaml
apiVersion: v1
kind: Service
spec:
  externalTrafficPolicy: Local
  ...

After:

# helm/serviceradar/values-demo.yaml
flowgger:
  externalService:
    externalTrafficPolicy: Local
netflowCollector:
  service:
    externalTrafficPolicy: Local

# The k8s/demo/ directory is removed.
# All manifests are now generated by Helm, for example:
# helm template . -f values-demo.yaml > demo-manifests.yaml
# helm template . -f values-prod.yaml > prod-manifests.yaml
Suggestion importance[1-10]: 9

__

Why: This is a significant architectural suggestion that correctly identifies a major maintainability issue, as the PR modifies both Helm charts and static manifests for the same purpose, increasing complexity and risk of drift.

High
Possible issue
Only add traffic policy for non-ClusterIP

In the Helm template, add a condition to only set externalTrafficPolicy if the
service type is not ClusterIP, as this field is not supported for ClusterIP
services.

helm/serviceradar/templates/flowgger.yaml [193-195]

-{{- with .Values.flowgger.externalService.externalTrafficPolicy }}
-externalTrafficPolicy: {{ . }}
+{{- if and .Values.flowgger.externalService.externalTrafficPolicy (ne .Values.flowgger.externalService.type "ClusterIP") }}
+  externalTrafficPolicy: {{ .Values.flowgger.externalService.externalTrafficPolicy }}
 {{- end }}
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly points out that externalTrafficPolicy is invalid for ClusterIP services and provides a valid guard to prevent rendering invalid Kubernetes manifests.

Medium
Skip policy on ClusterIP services

In the Helm template, add a condition to only set externalTrafficPolicy if the
service type is not ClusterIP, as this field is not supported for ClusterIP
services.

helm/serviceradar/templates/netflow-collector.yaml [147-149]

-{{- with .Values.netflowCollector.service.externalTrafficPolicy }}
-externalTrafficPolicy: {{ . }}
+{{- if and .Values.netflowCollector.service.externalTrafficPolicy (ne .Values.netflowCollector.service.type "ClusterIP") }}
+  externalTrafficPolicy: {{ .Values.netflowCollector.service.externalTrafficPolicy }}
 {{- end }}
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly points out that externalTrafficPolicy is invalid for ClusterIP services and provides a valid guard to prevent rendering invalid Kubernetes manifests.

Medium
Correct default traffic policy value

Change the default externalTrafficPolicy from Cluster to Local in values.yaml to
align the value with its descriptive comment.

helm/serviceradar/values.yaml [249-260]

     # External service configuration for syslog/NetFlow ingestion from outside the cluster.
     # When enabled, creates a LoadBalancer service separate from the internal ClusterIP.
     externalService:
       enabled: false
       # Service type: LoadBalancer, NodePort, or ClusterIP
       type: LoadBalancer
       # Only advertise from nodes with local endpoints (required for Calico BGP)
-      externalTrafficPolicy: Cluster
+      externalTrafficPolicy: Local
       # Annotations for load balancer configuration (MetalLB, cloud providers, etc.)
       # Example for MetalLB: metallb.universe.tf/address-pool: k3s-pool
       # Example for AWS NLB: service.beta.kubernetes.io/aws-load-balancer-type: nlb
       annotations: {}

[To ensure code accuracy, apply this suggestion manually]

Suggestion importance[1-10]: 6

__

Why: The suggestion correctly identifies a contradiction between the comment and the default value for externalTrafficPolicy, which could lead to user confusion and misconfiguration.

Low
  • More
Imported GitHub PR comment. Original author: @qodo-code-review[bot] Original URL: https://github.com/carverauto/serviceradar/pull/2652#issuecomment-3830373935 Original created: 2026-02-01T04:52:54Z --- ## PR Code Suggestions ✨ <!-- b10222c --> Explore these optional code suggestions: <table><thead><tr><td><strong>Category</strong></td><td align=left><strong>Suggestion&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </strong></td><td align=center><strong>Impact</strong></td></tr><tbody><tr><td rowspan=1>High-level</td> <td> <details><summary>Consolidate Kubernetes manifests into a single tool</summary> ___ **The PR edits both Helm charts and static Kubernetes manifests in <code>k8s/demo/</code>. To <br>improve maintainability and create a single source of truth, consider managing <br>all Kubernetes resources exclusively through the Helm chart.** ### Examples: <details> <summary> <a href="https://github.com/carverauto/serviceradar/pull/2652/files#diff-c29757a23e5f4021c9cd4d6d35a261edf9b56c706188bb24855fafa84454b797R157-R157">k8s/demo/base/serviceradar-netflow-collector.yaml [157]</a> </summary> ```yaml externalTrafficPolicy: Local ``` </details> <details> <summary> <a href="https://github.com/carverauto/serviceradar/pull/2652/files#diff-3a2c6c76ca4d5e8a336cd917d39b1704c03ea94a5cba4da1eb20629c63a5b914R96-R107">helm/serviceradar/values-demo.yaml [96-107]</a> </summary> ```yaml externalTrafficPolicy: Local netflowCollector: enabled: true config: stream_max_bytes: 1073741824 service: type: LoadBalancer annotations: metallb.universe.tf/address-pool: k3s-pool ... (clipped 2 lines) ``` </details> ### Solution Walkthrough: #### Before: ```yaml # helm/serviceradar/values-demo.yaml flowgger: externalService: externalTrafficPolicy: Local netflowCollector: service: externalTrafficPolicy: Local # k8s/demo/base/serviceradar-netflow-collector.yaml apiVersion: v1 kind: Service spec: externalTrafficPolicy: Local ... # k8s/demo/prod/serviceradar-flowgger-external.yaml apiVersion: v1 kind: Service spec: externalTrafficPolicy: Local ... ``` #### After: ```yaml # helm/serviceradar/values-demo.yaml flowgger: externalService: externalTrafficPolicy: Local netflowCollector: service: externalTrafficPolicy: Local # The k8s/demo/ directory is removed. # All manifests are now generated by Helm, for example: # helm template . -f values-demo.yaml > demo-manifests.yaml # helm template . -f values-prod.yaml > prod-manifests.yaml ``` <details><summary>Suggestion importance[1-10]: 9</summary> __ Why: This is a significant architectural suggestion that correctly identifies a major maintainability issue, as the PR modifies both Helm charts and static manifests for the same purpose, increasing complexity and risk of drift. </details></details></td><td align=center>High </td></tr><tr><td rowspan=3>Possible issue</td> <td> <details><summary>Only add traffic policy for non-ClusterIP</summary> ___ **In the Helm template, add a condition to only set <code>externalTrafficPolicy</code> if the <br>service type is not <code>ClusterIP</code>, as this field is not supported for <code>ClusterIP</code> <br>services.** [helm/serviceradar/templates/flowgger.yaml [193-195]](https://github.com/carverauto/serviceradar/pull/2652/files#diff-511cfbfe42e0c41cd2fddf67a04911b48724ca9ea9f6d1ddc1f4bb7bf07086abR193-R195) ```diff -{{- with .Values.flowgger.externalService.externalTrafficPolicy }} -externalTrafficPolicy: {{ . }} +{{- if and .Values.flowgger.externalService.externalTrafficPolicy (ne .Values.flowgger.externalService.type "ClusterIP") }} + externalTrafficPolicy: {{ .Values.flowgger.externalService.externalTrafficPolicy }} {{- end }} ``` - [ ] **Apply / Chat** <!-- /improve --apply_suggestion=1 --> <details><summary>Suggestion importance[1-10]: 7</summary> __ Why: The suggestion correctly points out that `externalTrafficPolicy` is invalid for `ClusterIP` services and provides a valid guard to prevent rendering invalid Kubernetes manifests. </details></details></td><td align=center>Medium </td></tr><tr><td> <details><summary>Skip policy on ClusterIP services</summary> ___ **In the Helm template, add a condition to only set <code>externalTrafficPolicy</code> if the <br>service type is not <code>ClusterIP</code>, as this field is not supported for <code>ClusterIP</code> <br>services.** [helm/serviceradar/templates/netflow-collector.yaml [147-149]](https://github.com/carverauto/serviceradar/pull/2652/files#diff-2caca5e6b4a9d567d04bd326125e554b1f571be0f7746fb6f9144e0a33f65b07R147-R149) ```diff -{{- with .Values.netflowCollector.service.externalTrafficPolicy }} -externalTrafficPolicy: {{ . }} +{{- if and .Values.netflowCollector.service.externalTrafficPolicy (ne .Values.netflowCollector.service.type "ClusterIP") }} + externalTrafficPolicy: {{ .Values.netflowCollector.service.externalTrafficPolicy }} {{- end }} ``` - [ ] **Apply / Chat** <!-- /improve --apply_suggestion=2 --> <details><summary>Suggestion importance[1-10]: 7</summary> __ Why: The suggestion correctly points out that `externalTrafficPolicy` is invalid for `ClusterIP` services and provides a valid guard to prevent rendering invalid Kubernetes manifests. </details></details></td><td align=center>Medium </td></tr><tr><td> <details><summary>Correct default traffic policy value</summary> ___ **Change the default <code>externalTrafficPolicy</code> from <code>Cluster</code> to <code>Local</code> in <code>values.yaml</code> to <br>align the value with its descriptive comment.** [helm/serviceradar/values.yaml [249-260]](https://github.com/carverauto/serviceradar/pull/2652/files#diff-d4449c7cb70362554b274f81eae5a4b81a8e81df494282e383d1b7ea3871c452R249-R260) ```diff # External service configuration for syslog/NetFlow ingestion from outside the cluster. # When enabled, creates a LoadBalancer service separate from the internal ClusterIP. externalService: enabled: false # Service type: LoadBalancer, NodePort, or ClusterIP type: LoadBalancer # Only advertise from nodes with local endpoints (required for Calico BGP) - externalTrafficPolicy: Cluster + externalTrafficPolicy: Local # Annotations for load balancer configuration (MetalLB, cloud providers, etc.) # Example for MetalLB: metallb.universe.tf/address-pool: k3s-pool # Example for AWS NLB: service.beta.kubernetes.io/aws-load-balancer-type: nlb annotations: {} ``` `[To ensure code accuracy, apply this suggestion manually]` <details><summary>Suggestion importance[1-10]: 6</summary> __ Why: The suggestion correctly identifies a contradiction between the comment and the default value for `externalTrafficPolicy`, which could lead to user confusion and misconfiguration. </details></details></td><td align=center>Low </td></tr> <tr><td align="center" colspan="2"> - [ ] More <!-- /improve --more_suggestions=true --> </td><td></td></tr></tbody></table>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
1week

   
2weeks

   
Failed compliance check

   
IP cameras

   
NATS

NATS JetStream

  
Possible security concern

   
Review effort 1/5

   
Review effort 2/5

   
Review effort 3/5

   
Review effort 4/5

   
Review effort 5/5

   
UI

   
aardvark

   
accessibility

   
amd64

   
api

   
arm64

   
auth

   
back-end

   
bgp

   
blog

   
bug

Something isn't working

  
build

   
checkers

   
ci-cd

continuous integration-continuous deployments

  
cleanup

   
cnpg

cloud-native postgres

  
codex

   
core

core service

  
dependencies

Pull requests that update a dependency file

  
device-management

   
documentation

Improvements or additions to documentation

  
duplicate

This issue or pull request already exists

  
dusk

   
ebpf

   
enhancement

New feature or request

  
eta 1d

   
eta 1hr

   
eta 3d

   
eta 3hr

   
feature

   
fieldsurvey

   
github_actions

Pull requests that update GitHub Actions code

  
go

Pull requests that update Go code

  
good first issue

Good for newcomers

  
help wanted

Extra attention is needed

  
invalid

This doesn't seem right

  
javascript

Pull requests that update Javascript code

  
k8s

   
log-collector

   
mapper

   
mtr

multi traceroute

  
needs-triage

   
netflow

   
network-sweep

   
observability

   
oracle

Oracle Linux related issues

  
otel

opentelemetry logs, traces, metrics

  
plug-in

   
proton

timeplus proton streaming database

  
python

   
question

Further information is requested

  
reddit

   
redhat

   
research

   
rperf

   
rperf-checker

   
rust

Pull requests that update rust code

  
sdk

   
security

   
serviceradar-agent

   
serviceradar-agent-gateway

   
serviceradar-web

   
serviceradar-web-ng

   
siem

   
snmp

   
sysmon

   
topology

   
ubiquiti

   
wasm

   
wontfix

This will not be worked on

  
zen-engine
No labels
1week
2weeks
Failed compliance check
IP cameras
NATS
Possible security concern
Review effort 1/5
Review effort 2/5
Review effort 3/5
Review effort 4/5
Review effort 5/5
UI
aardvark
accessibility
amd64
api
arm64
auth
back-end
bgp
blog
bug
build
checkers
ci-cd
cleanup
cnpg
codex
core
dependencies
device-management
documentation
duplicate
dusk
ebpf
enhancement
eta 1d
eta 1hr
eta 3d
eta 3hr
feature
fieldsurvey
github_actions
go
good first issue
help wanted
invalid
javascript
k8s
log-collector
mapper
mtr
needs-triage
netflow
network-sweep
observability
oracle
otel
plug-in
proton
python
question
reddit
redhat
research
rperf
rperf-checker
rust
sdk
security
serviceradar-agent
serviceradar-agent-gateway
serviceradar-web
serviceradar-web-ng
siem
snmp
sysmon
topology
ubiquiti
wasm
wontfix
zen-engine
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
carverauto/serviceradar!2822
No description provided.