Uh oh!
There was an error while loading. Please reload this page.
fix(installer): pin k3d + helm versions — drop api.github.com latest lookups (re-land #410 onto develop) - #446
Merged
Conversation
…lookups (#410) Ports the bash pins (#382) to the Windows installer: K3D_VERSION defaults to v5.9.0 and HELM_VERSION to v4.2.3 (lockstep with scripts/lib/common.sh until #435 single-sources them), env-overridable, validated against a release-tag shape before any URL is built (path-traversal gate mirroring the bootstrap and cli install.ps1). The unauthenticated releases/latest API allows 60 req/hour per IP — one shared corporate NAT exhausts it and fails installs (observed live on a customer install 2026-07-27). The literal value 'latest' still works but resolves API-free: the /releases/latest redirect Location for k3d, and get.helm.sh/helm-latest-version for helm — exactly like lib/setup-linux.sh. A Pester gate now fails the suite if any https://api.github.com fetch reappears in the installer. Closes#410 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…s (Bugbot #438) The new API-free 'latest' resolvers ran a single request — the old lookups and lib/setup-linux.sh retry 3x5s. Resolve-ToolVersion now drives the resolver through Invoke-WithRetry (resolvers throw on failure), so a one-off network blip on flaky corporate egress retries instead of aborting the install; a persistent failure still fails closed with the pin-a-tag remedy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ugbot #438) A host that accepts the TCP connect but never responds would hang the version resolvers indefinitely; the bash peers bound this with --connect-timeout 15 --max-time 30. Both resolver requests now carry -TimeoutSec 30; a timeout throws, so the retry ladder + fail-closed remedy from the previous commit take over. AST-based Pester gate keeps the timeouts in place. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
saadqbal
approved these changes
Jul 27, 2026
Uh oh!
There was an error while loading. Please reload this page.
LukasWodka added a commit
that referenced
this pull request
Jul 27, 2026
…447) * fix(installer): fail fast on k3d spawn failure; bound the create wait (#439) * fix(installer): fail fast on k3d spawn failure; bound the create wait (#412, #426 Windows half) Two fixes to New-K3dCluster's create path, both observed live: 1. Start-Process failure ('%1 is not a valid Win32 application' from a broken k3d.exe) is non-terminating by default, leaving $k3dProc null — and 'while (-not $null.HasExited)' is always true, so the installer spun 'Creating compute environment...' forever over a dead install. The spawn now runs under -ErrorAction Stop in a try/catch that cleans up the temp logs + proxy config and fails with the real exception, the log path, and a remedy. 2. k3d cluster create --wait has no timeout of its own, so a stalled image pull spun the spinner indefinitely. The wait is now bounded (15 min default, TB_CREATE_TIMEOUT_MIN override): on expiry the process is killed, the last stderr lines and the install-log path are printed, and the install fails loudly. Extracted as Wait-ProcessWithDeadline so the deadline/kill path is unit-tested. Closes#412. Windows half of #426 (the bash half — k3d create + helm timeouts in cluster.sh / install-client-helm.sh — follows separately). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(installer): remove the partial cluster when the create wait times out (Bugbot #439) Killing k3d mid --wait skips its own rollback, so the timeout path left a half-created cluster behind — and the next run's reuse path would see serversRunning > 0 and print 'Compute environment already running' over a broken environment. The timeout path now deletes the partial cluster (bounded at 2 min via Wait-ProcessWithDeadline) before failing, and tells the operator the exact manual command if the delete itself fails. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * fix(installer): Docker engine wait — 10 minutes, elapsed progress, named failure state (#440) * fix(installer): Docker engine wait — 10 minutes, elapsed progress, named failure state (#413) A first-ever Docker Desktop start on AV-heavy corporate machines routinely needs 5-10 minutes (WSL bootstrap, image unpack). The old 3-minute cap turned a normal cold start into a failed install plus a manual re-paste of the one-liner — observed as a recurring wait-then- re-run loop on hospital installs. - Wait bound: 3 min -> 10 min default, TB_DOCKER_WAIT_MIN override. - After the first minute the spinner shows elapsed minutes and the expected worst case, so the wait doesn't read as a hang. - On expiry the failure names the observed state: Docker Desktop process gone (start it / fix its error window) vs. running with the engine still down (tray-icon guidance) - instead of one generic line. Closes#413 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(installer): exited-Docker path drops the slow-start advice (Bugbot #440) When Docker Desktop's process has exited, 'a first start can be slow' and the TB_DOCKER_WAIT_MIN hint contradict the diagnosis and steer operators toward raising the wait instead of restarting/fixing the crash. The slow-start reassurance + override hint now print only on the engine-still-starting path; the exited path fails with its own start-and-fix remedy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
shujaatTracebloc
commented
Jul 30, 2026
ContributorAuthor
Backing-ref link: this PR landed the fix for #410 (pin k3d + helm, drop api.github.com latest lookups — re-land after the stacked-PR squash strand). Merged to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-lands the k3d/helm version pinning from #438, which was merged into its stacked base
fix/409-unc-job-cwdinstead ofdevelopand never reached the develop line (#437 had already squash-merged, orphaning that branch). This PR replays the exact #410 change directly ontodevelop.Ports #382's determinism to Windows:
install-k8s.ps1no longer resolves k3d/helm via the unauthenticatedapi.github.comreleases/latestendpoint (60 req/hour per IP — a single shared corporate NAT exhausts it; observed failing live on a customer install, 2026-07-27, right after an all-green preflight).Change
$K3dVersion(defaultv5.9.0) and$HelmVersion(defaultv4.2.3) — env-overridable, lockstep withscripts/lib/common.shuntil the shared facts spec (feat(installer): single-source installer facts (versions, hosts, timeouts, floors) + CI behavior-parity gate (RFC-CLIENT-0003 D3/D4) #435) single-sources them.Test-ReleaseTagShape— release-shape + path-traversal gate before any tag reaches a download URL (mirrors the bootstrap ref gate / clivalidate_version_tag).latestremains supported but API-free:/releases/latestredirect Location header for k3d,get.helm.sh/helm-latest-versionfor helm —lib/setup-linux.shparity, withInvoke-WithRetry(retry 3×5) and-TimeoutSec 30.https://api.github.comfetch reappears.manifest.sha256regenerated.Provenance
Identical to the reviewed & Bugbot-clean #438 (
install-k8s.ps1→c66c57c1…, matching the manifest byte-for-byte). Commits authored by @LukasWodka, cherry-picked ontodevelop(the redundant #409 commit, already merged via #437, dropped out cleanly). Both prior Bugbot findings (dropped retries, missing timeouts) are already fixed in these commits.Type
Bug fix
Test plan
gen-manifest.sh --checkclean on top of develop.develophere meansinstaller-tests.yaml(Pester ubuntu + windows) runs in CI on this PR.🤖 Generated with Claude Code
Note
Low Risk
Installer-only change to version resolution and download paths; defaults match existing Linux/bash pins with fail-closed tag validation and no new privileged behavior.
Overview
Windows
install-k8s.ps1no longer hitsapi.github.comto resolve k3d/helm versions, avoiding GitHub’s unauthenticated rate limit that breaks installs behind shared NAT.Default installs use pinned
K3D_VERSION/HELM_VERSION(v5.9.0/v4.2.3, env-overridable, aligned withscripts/lib/common.sh). New helpersTest-ReleaseTagShape,Get-LatestGitHubTag, andResolve-ToolVersionvalidate tags before download URLs are built; the literallateststill works via redirect/get.helm.sh, with 3×5 retries and 30s timeouts on lookups.Pester covers pins, tag validation, resolver behavior, timeouts, and a regression that fails if
https://api.github.comreappears.manifest.sha256is updated forinstall-k8s.ps1.Reviewed by Cursor Bugbot for commit 84de970. Bugbot is set up for automated code reviews on this repo. Configure here.