Repository navigation
docs: say what the AWS tenant may own and how a new kind is enabled - #62
Conversation
The eks-ci comments still described a CI Role "to be added here as a follow-up", but that Role is owned by the platform on purpose. And nothing told a contributor that a manifest for a new AWS resource kind needs the platform to activate the kind and grant this tenant permission first; without that, the release is refused and the whole tenant stops reconciling. Fixes #51 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@coderabbitai review |
✅ Action performed
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly summarizes the main documentation change: it defines what the AWS tenant may own and explains how contributors enable a new resource kind. |
| Description check | |
The description directly explains the documentation gap, the required platform-first process, the comment updates, and the absence of behavior changes. |
| Linked Issues check | |
The changes satisfy #51. AGENTS.md and CONTRIBUTING.md state that this tenant may own only OpenIDConnectProvider. They require platform activation and tenant permission before a new-kind manifes… |
| Out of Scope Changes check | |
The supplied change summary limits the changes to AGENTS.md, CONTRIBUTING.md, and comments in the eks-ci manifests. These changes directly document the ownership and platform-activation requirem… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
Full details: Linked Issues check
-
Explanation
The changes satisfy
#51.AGENTS.mdandCONTRIBUTING.mdstate that this tenant may own onlyOpenIDConnectProvider. They require platform activation and tenant permission before a new-kind manifest lands here. Theeks-cicomments identify the repository-owned OIDC provider and the platform-owned CIRoleand permissions boundary, with the ownership reason. The reviewed text describes the current design and uses current repository links. No behavior change is introduced.
Full details: Out of Scope Changes check
-
Explanation
The supplied change summary limits the changes to
AGENTS.md,CONTRIBUTING.md, and comments in theeks-cimanifests. These changes directly document the ownership and platform-activation requirements in#51. The Kustomization resources remain unchanged, and no unrelated behavior or implementation change is identified.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
🔧 Checkov (3.3.25)
-
deploy/eks-ci/kustomization.yaml
-
Process SyncManager-7:1:
Traceback (most recent call last):
File "/usr/lib64/python3.11/multiprocessing/process.py", line 314, in _bootstrap
self.run()
File "/usr/lib64/python3.11/multiprocessing/process.py", line 108, in run
self._target(*self._args, **self._kwargs)
File "/usr/lib64/python3.11/multiprocessing/managers.py", line 592, in _run_server
server = cls._Server(registry, address, authkey, serializer)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.11/multiprocessing/managers.py", line 156, in init
self.listener = Listener(address=address, backlog=128)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.11/multiprocessing/connection.py", line 468, in init
self._listener = SocketListener(address, family, backlog)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.11/multiprocessing/connection.py", line 605, in init
self._soc... [truncated 2057 characters] ...
xception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/site-packages/checkov/main.py", line 655, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/site-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/site-packages/checkov/common/parallelizer/parallel_runner.py", line 133, in _run_function_multiprocess_fork
yield from self._drain_interleaved(processes)
File "/usr/local/lib/python3.11/site-packages/checkov/common/parallelizer/parallel_runner.py", line 185, in _drain_interleaved
raise value.internal_exception.with_traceback(value.internal_exception.traceback)
EOFError
-
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Readiness at
|
Why
The docs invited contributors to add AWS resources here without saying that a new kind of resource must first be enabled on the platform. A change like that passes this repository's checks and releases, then stops the whole AWS tenant from updating. One comment also still described a plan that was replaced.
What
The contributor and agent guides now say what this tenant may own today and the order a new kind of resource needs: the platform change first, then the manifest here. The comments describe the current ownership and why the CI role stays on the platform. No behaviour changes.
Fixes #51
🤖 Generated with Claude Code