modified k8s manifests for minikube compatibility and project needs#9
modified k8s manifests for minikube compatibility and project needs#9abhay41 wants to merge 1 commit intoiemafzalhassan:mainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
WalkthroughThis change restructures the Kubernetes deployment for a chat application. It removes several old YAML manifests, replacing them with updated deployment, service, ingress, persistent volume, and secret definitions. The new configuration standardizes naming, updates images, modifies service exposure (removing NodePort), introduces an Ingress resource, and revises persistent storage for MongoDB. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Ingress
participant Frontend Service
participant Backend Service
participant MongoDB Service
User->>Ingress: HTTP request /
Ingress->>Frontend Service: Forward to frontend (port 80)
Frontend Service->>Frontend Pod: Serve static content
User->>Ingress: HTTP request /api
Ingress->>Backend Service: Forward to backend (port 5001)
Backend Service->>Backend Pod: Handle API logic
Backend Pod->>MongoDB Service: Query database
MongoDB Service->>MongoDB Pod: Access data
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~15–20 minutes Poem
Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🔭 Outside diff range comments (1)
k8s/secrets.yml (1)
1-9: Do not commit real secrets & remove trailing whitespace
- The base-64 value appears to be an actual JWT secret. Storing secrets in the repo is a security risk – switch to:
kubectl create secret … --from-literal,- a
SealedSecret, or- an External Secrets operator.
- YAMLlint flagged the trailing space at Line 8.
- jwt: N2MxZjBkYmIyOGMxOGE5MmI4ODdiNGU0MTI3MGY1NmY= + jwt: <base64-encoded-placeholder>At minimum replace the value with a placeholder before merging.
🧹 Nitpick comments (9)
k8s/namespace.yml (1)
4-4: Nit: align indentation for consistencyLine 4 uses a single leading space while the file (and all other manifests) use two. YAML tolerates this, but it stands out when grepping manifests.
- name: chat-app + name: chat-appk8s/mongodb-service.yml (1)
12-12: Add a final newline to satisfy lintersYAMLlint warns about the missing newline at EOF.
- targetPort: 27017 + targetPort: 27017 +k8s/frontend-service.yml (1)
3-11: Clean up trailing spaces & double-check Service exposure strategy
- Lines 3, 10 & 11 have trailing whitespace – YAMLlint errors.
- Service switched from
NodePortto implicitClusterIP. That’s fine as long as the new Ingress is enabled in Minikube (minikube addons enable ingress).-metadata: +metadata: ... - - port: 80 - targetPort: 80 + - port: 80 + targetPort: 80k8s/backend-service.yml (2)
3-3: Trailing whitespace breaks some linters/CI pipelinesRemove the two trailing spaces after
metadata:.-metadata: +metadata:
6-13: Be explicit about the Service type for future maintainabilityThe manifest relies on the implicit default (
ClusterIP).
Being explicit avoids confusion when port-exposure requirements change:spec: + type: ClusterIP # explicit – ingress handles external traffic selector: app: backend ports: - protocol: TCP port: 5001 # Port exposed inside the cluster targetPort: 5001 # Matches container portk8s/frontend-deployment.yml (1)
16-21: Add basic pod security contextSame as the MongoDB deployment, restrict privilege escalation:
spec: + securityContext: + runAsNonRoot: true + runAsUser: 1001 containers:k8s/backend-deployment.yml (3)
19-19: Avoidlatest– pin the backend image to an explicit version tag.
latestbreaks reproducibility and can silently pull incompatible images in CI / prod. Publish a semver tag (e.g.1.3.0) and reference that instead.- image: abhay41/chatapp-backend:latest + image: abhay41/chatapp-backend:1.3.0 # ← example pin
17-21: Add liveness & readiness probes and resource requests/limits for production resilience.
Without probes Kubernetes cannot detect hung processes, and missing resources hinder scheduling & autoscaling.Example snippet to append under the container:
resources: requests: cpu: "100m" memory: "128Mi" limits: cpu: "500m" memory: "256Mi" readinessProbe: httpGet: path: /api/health port: 5001 initialDelaySeconds: 5 periodSeconds: 10 livenessProbe: httpGet: path: /api/health port: 5001 initialDelaySeconds: 15 periodSeconds: 20
33-33: Terminate file with a trailing newline.
yaml-lintfails (new-line-at-end-of-file). Add a\nafter the last line to keep tooling happy.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (18)
k8s/README.md(0 hunks)k8s/backend-deployment.yaml(0 hunks)k8s/backend-deployment.yml(1 hunks)k8s/backend-secrets.yaml(0 hunks)k8s/backend-service.yml(1 hunks)k8s/frontend-configmap.yaml(0 hunks)k8s/frontend-deployment.yaml(0 hunks)k8s/frontend-deployment.yml(1 hunks)k8s/frontend-service.yml(1 hunks)k8s/ingress.yml(1 hunks)k8s/kind-config.yaml(0 hunks)k8s/mongodb-deployment.yaml(0 hunks)k8s/mongodb-deployment.yml(1 hunks)k8s/mongodb-pv.yml(1 hunks)k8s/mongodb-pvc.yml(1 hunks)k8s/mongodb-service.yml(1 hunks)k8s/namespace.yml(1 hunks)k8s/secrets.yml(1 hunks)
💤 Files with no reviewable changes (7)
- k8s/kind-config.yaml
- k8s/backend-deployment.yaml
- k8s/backend-secrets.yaml
- k8s/mongodb-deployment.yaml
- k8s/frontend-configmap.yaml
- k8s/README.md
- k8s/frontend-deployment.yaml
🧰 Additional context used
🪛 YAMLlint (1.37.1)
k8s/frontend-service.yml
[error] 3-3: trailing spaces
(trailing-spaces)
[error] 10-10: trailing spaces
(trailing-spaces)
[error] 11-11: trailing spaces
(trailing-spaces)
k8s/backend-service.yml
[error] 3-3: trailing spaces
(trailing-spaces)
k8s/mongodb-service.yml
[error] 12-12: no new line character at the end of file
(new-line-at-end-of-file)
k8s/secrets.yml
[error] 8-8: trailing spaces
(trailing-spaces)
k8s/backend-deployment.yml
[error] 33-33: no new line character at the end of file
(new-line-at-end-of-file)
🪛 Checkov (3.2.334)
k8s/mongodb-deployment.yml
[MEDIUM] 1-33: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[MEDIUM] 1-33: Minimize the admission of root containers
(CKV_K8S_23)
k8s/backend-deployment.yml
[MEDIUM] 1-33: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[MEDIUM] 1-33: Minimize the admission of root containers
(CKV_K8S_23)
[MEDIUM] 26-27: Basic Auth Credentials
(CKV_SECRET_4)
k8s/frontend-deployment.yml
[MEDIUM] 1-21: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[MEDIUM] 1-21: Minimize the admission of root containers
(CKV_K8S_23)
| containers: | ||
| - name: chat-backend | ||
| image: abhay41/chatapp-backend:latest | ||
| ports: | ||
| - containerPort: 5001 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add a securityContext to drop root privileges and disallow privilege escalation.
Static analysis (CKV_K8S_20 / 23) flags the container as running as root. Harden it:
containers:
- name: chat-backend
image: abhay41/chatapp-backend:latest
+ securityContext:
+ runAsUser: 1000
+ runAsNonRoot: true
+ allowPrivilegeEscalation: false
ports:
- containerPort: 5001📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| containers: | |
| - name: chat-backend | |
| image: abhay41/chatapp-backend:latest | |
| ports: | |
| - containerPort: 5001 | |
| containers: | |
| - name: chat-backend | |
| image: abhay41/chatapp-backend:latest | |
| securityContext: | |
| runAsUser: 1000 | |
| runAsNonRoot: true | |
| allowPrivilegeEscalation: false | |
| ports: | |
| - containerPort: 5001 |
🤖 Prompt for AI Agents
In k8s/backend-deployment.yml around lines 17 to 21, the container definition
lacks a securityContext to prevent running as root and disallow privilege
escalation. Add a securityContext section under the container spec with
runAsNonRoot set to true, runAsUser set to a non-root user ID (e.g., 1000), and
allowPrivilegeEscalation set to false to harden the container's security
posture.
| - name: MONGODB_URI | ||
| value: "mongodb://root:admin@mongodb-service:27017/chatApp?authSource=admin&retryWrites=true&w=majority" |
There was a problem hiding this comment.
Hard-coded DB credentials leak secrets – move the entire URI to a Secret.
Shipping root:admin in plain text violates basic 12-factor & K8s security guidelines and is caught by CKV_SECRET_4. Mount the connection string via valueFrom.secretKeyRef (or split user/pass into two keys) and delete the literal.
- - name: MONGODB_URI
- value: "mongodb://root:admin@mongodb-service:27017/chatApp?authSource=admin&retryWrites=true&w=majority"
+ - name: MONGODB_URI
+ valueFrom:
+ secretKeyRef:
+ name: chatapp-secrets
+ key: mongodb-uri📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: MONGODB_URI | |
| value: "mongodb://root:admin@mongodb-service:27017/chatApp?authSource=admin&retryWrites=true&w=majority" | |
| - name: MONGODB_URI | |
| valueFrom: | |
| secretKeyRef: | |
| name: chatapp-secrets | |
| key: mongodb-uri |
🤖 Prompt for AI Agents
In k8s/backend-deployment.yml at lines 25 to 26, the MongoDB URI with hard-coded
credentials is exposed as plain text. To fix this, remove the literal URI from
the value field and instead reference it securely using valueFrom.secretKeyRef,
pointing to a Kubernetes Secret that stores the connection string. Create or
update the Secret to hold the URI or separate user and password keys, then mount
these securely in the deployment manifest.
| image: abhay41/chatapp-frontend:latest | ||
| ports: | ||
| - containerPort: 80 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Unpinned image and missing health probes
- Pin the image tag (
chatapp-frontend:v1.0.0) to ensure reproducible deploys. - Add readiness & liveness probes so the ingress doesn’t route to an unhealthy pod.
- image: abhay41/chatapp-frontend:latest
+ image: abhay41/chatapp-frontend:v1.0.0
+ readinessProbe:
+ httpGet:
+ path: /
+ port: 80
+ initialDelaySeconds: 5
+ periodSeconds: 10
+ livenessProbe:
+ httpGet:
+ path: /
+ port: 80
+ initialDelaySeconds: 15
+ periodSeconds: 20📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| image: abhay41/chatapp-frontend:latest | |
| ports: | |
| - containerPort: 80 | |
| image: abhay41/chatapp-frontend:v1.0.0 | |
| readinessProbe: | |
| httpGet: | |
| path: / | |
| port: 80 | |
| initialDelaySeconds: 5 | |
| periodSeconds: 10 | |
| livenessProbe: | |
| httpGet: | |
| path: / | |
| port: 80 | |
| initialDelaySeconds: 15 | |
| periodSeconds: 20 | |
| ports: | |
| - containerPort: 80 |
🧰 Tools
🪛 Checkov (3.2.334)
[MEDIUM] 1-21: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[MEDIUM] 1-21: Minimize the admission of root containers
(CKV_K8S_23)
🤖 Prompt for AI Agents
In k8s/frontend-deployment.yml around lines 19 to 21, the container image tag is
unpinned and health probes are missing. Update the image tag from "latest" to a
fixed version like "v1.0.0" to ensure consistent deployments. Add both
readinessProbe and livenessProbe configurations under the container spec to
enable Kubernetes to check pod health and prevent routing traffic to unhealthy
pods.
| annotations: | ||
| nginx.ingress.kubernetes.io/rewrite-target: / |
There was a problem hiding this comment.
rewrite-target: / masks path information – likely breaks /api routing
With the global rewrite every request ends up at /, so
/api/auth/login → backend request / (path stripped).
If the backend expects the /api prefix, remove the annotation or use regex-based rewrites:
metadata:
name: chatapp-ingress
namespace: chat-app
annotations:
- nginx.ingress.kubernetes.io/rewrite-target: /
+ nginx.ingress.kubernetes.io/use-regex: "true"
+ nginx.ingress.kubernetes.io/rewrite-target: /$2and change the path rules:
- - path: /api
+ - path: /api(/|$)(.*)Additionally, set the ingress class for Minikube NGINX:
annotations:
ingressClassName: nginx🤖 Prompt for AI Agents
In k8s/ingress.yml around lines 6 to 7, the annotation
'nginx.ingress.kubernetes.io/rewrite-target: /' causes all paths to be rewritten
to '/', stripping path information and breaking routes like '/api/auth/login'.
To fix this, remove this annotation or replace it with a regex-based rewrite
that preserves the path prefix as needed. Also, update the path rules to match
the regex accordingly. Additionally, add the annotation 'ingressClassName:
nginx' to specify the ingress class for Minikube NGINX.
| containers: | ||
| - name: chatapp-mongodb | ||
| image: mongo:latest | ||
| ports: | ||
| - containerPort: 27017 | ||
| env: | ||
| - name: MONGO_INITDB_ROOT_USERNAME | ||
| value: root | ||
| - name: MONGO_INITDB_ROOT_PASSWORD | ||
| value: admin | ||
| volumeMounts: | ||
| - name: mongodb-storage | ||
| mountPath: /data/db | ||
| volumes: |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Harden the pod – disallow privilege escalation & run as non-root
Add a simple securityContext block:
spec:
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 999
+ fsGroup: 999
containers:This addresses CKV_K8S_20 / 23 and improves baseline security.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| containers: | |
| - name: chatapp-mongodb | |
| image: mongo:latest | |
| ports: | |
| - containerPort: 27017 | |
| env: | |
| - name: MONGO_INITDB_ROOT_USERNAME | |
| value: root | |
| - name: MONGO_INITDB_ROOT_PASSWORD | |
| value: admin | |
| volumeMounts: | |
| - name: mongodb-storage | |
| mountPath: /data/db | |
| volumes: | |
| spec: | |
| securityContext: | |
| runAsNonRoot: true | |
| runAsUser: 999 | |
| fsGroup: 999 | |
| containers: | |
| - name: chatapp-mongodb | |
| image: mongo:latest | |
| ports: | |
| - containerPort: 27017 | |
| env: | |
| - name: MONGO_INITDB_ROOT_USERNAME | |
| value: root | |
| - name: MONGO_INITDB_ROOT_PASSWORD | |
| value: admin | |
| volumeMounts: | |
| - name: mongodb-storage | |
| mountPath: /data/db | |
| volumes: |
🤖 Prompt for AI Agents
In k8s/mongodb-deployment.yml around lines 17 to 30, the container lacks a
securityContext to prevent privilege escalation and to run as a non-root user.
Add a securityContext block under the container definition with runAsNonRoot set
to true and allowPrivilegeEscalation set to false to harden the pod and improve
security compliance.
| - name: chatapp-mongodb | ||
| image: mongo:latest | ||
| ports: | ||
| - containerPort: 27017 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the MongoDB image tag to avoid accidental major upgrades
mongo:latest can introduce breaking changes without notice. Pin to a known-good version (e.g. 6.0.11) and enable predictable roll-outs.
- image: mongo:latest
+ image: mongo:6.0.11📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: chatapp-mongodb | |
| image: mongo:latest | |
| ports: | |
| - containerPort: 27017 | |
| - name: chatapp-mongodb | |
| image: mongo:6.0.11 | |
| ports: | |
| - containerPort: 27017 |
🤖 Prompt for AI Agents
In k8s/mongodb-deployment.yml around lines 18 to 21, the MongoDB image tag is
set to 'latest', which risks unintentional major upgrades. Change the image tag
from 'mongo:latest' to a specific version like 'mongo:6.0.11' to ensure stable
and predictable deployments.
| env: | ||
| - name: MONGO_INITDB_ROOT_USERNAME | ||
| value: root | ||
| - name: MONGO_INITDB_ROOT_PASSWORD | ||
| value: admin |
There was a problem hiding this comment.
Root credentials are hard-coded in plain text – move them to a Secret
Exposing DB passwords in the manifest risks leaking in VCS/history.
Create a Secret and reference it via valueFrom.secretKeyRef:
- env:
- - name: MONGO_INITDB_ROOT_USERNAME
- value: root
- - name: MONGO_INITDB_ROOT_PASSWORD
- value: admin
+ env:
+ - name: MONGO_INITDB_ROOT_USERNAME
+ valueFrom:
+ secretKeyRef:
+ name: mongodb-auth
+ key: username
+ - name: MONGO_INITDB_ROOT_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: mongodb-auth
+ key: password📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| env: | |
| - name: MONGO_INITDB_ROOT_USERNAME | |
| value: root | |
| - name: MONGO_INITDB_ROOT_PASSWORD | |
| value: admin | |
| env: | |
| - name: MONGO_INITDB_ROOT_USERNAME | |
| valueFrom: | |
| secretKeyRef: | |
| name: mongodb-auth | |
| key: username | |
| - name: MONGO_INITDB_ROOT_PASSWORD | |
| valueFrom: | |
| secretKeyRef: | |
| name: mongodb-auth | |
| key: password |
🤖 Prompt for AI Agents
In k8s/mongodb-deployment.yml around lines 22 to 26, the MongoDB root username
and password are hard-coded as plain text environment variables, which is
insecure. Create a Kubernetes Secret resource to store these credentials
securely, then update the deployment manifest to reference the Secret using
valueFrom.secretKeyRef for both MONGO_INITDB_ROOT_USERNAME and
MONGO_INITDB_ROOT_PASSWORD environment variables.
| spec: | ||
| capacity: | ||
| storage: 5Gi | ||
| accessModes: | ||
| - ReadWriteOnce | ||
| hostPath: | ||
| path: /data |
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
Add storageClassName & reclaim policy to make the PV bindable and durable
With a hostPath PV Minikube will happily mount /data, but the PV currently:
- Has no
storageClassName– if the PVC specifies anything (even the defaultstandard) this PV will never bind. - Falls back to the default
Deletereclaim policy – data will be wiped on PVC deletion, which is rarely what you want for a database.
A minimal hard-coded class plus Retain is usually safer for local dev:
spec:
+ storageClassName: manual # PVC must use the same value (or leave it empty)
+ persistentVolumeReclaimPolicy: Retain
capacity:
storage: 5Gi
accessModes:
- ReadWriteOnce
hostPath:
path: /dataAdd storageClassName & persistentVolumeReclaimPolicy for reliable binding and data retention
The PV defined in k8s/mongodb-pv.yml currently:
- Lacks a
storageClassName– it will only bind to a PVC that omits any class (defaults to an empty string), so most PVCs (e.g. using the “standard” class) won’t ever bind. - Defaults to a
Deletereclaim policy – data is discarded when the PVC is removed.
To ensure local-dev durability and explicit binding, update lines 5–11 as follows:
spec:
+ storageClassName: manual # PVC must use the same class (or leave it unset)
+ persistentVolumeReclaimPolicy: Retain # retain data on PVC deletion
capacity:
storage: 5Gi
accessModes:
- ReadWriteOnce
hostPath:
path: /dataTagging this as a required change to prevent binding failures and accidental data loss.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| spec: | |
| capacity: | |
| storage: 5Gi | |
| accessModes: | |
| - ReadWriteOnce | |
| hostPath: | |
| path: /data | |
| spec: | |
| storageClassName: manual # PVC must use the same class (or leave it unset) | |
| persistentVolumeReclaimPolicy: Retain # retain data on PVC deletion | |
| capacity: | |
| storage: 5Gi | |
| accessModes: | |
| - ReadWriteOnce | |
| hostPath: | |
| path: /data |
🤖 Prompt for AI Agents
In k8s/mongodb-pv.yml around lines 5 to 11, add the field storageClassName with
a specific value to ensure the PV binds correctly to PVCs using that class, and
set persistentVolumeReclaimPolicy to Retain to prevent data loss when the PVC is
deleted. Update the spec section to include these two fields explicitly for
reliable binding and data retention.
| name: mongodb-pvc | ||
| namespace: chat-app |
There was a problem hiding this comment.
PVC may fail to bind to the static PV – storageClassName must be set/empty-stringed
Because a default StorageClass usually exists on Minikube, omitting storageClassName on the PVC will trigger dynamic provisioning instead of binding to your static mongodb-pv.
Either add the same storageClass used on the PV or explicitly bind to the “no-class” PV by setting an empty string:
spec:
+ storageClassName: "" # ensures the claim binds to mongodb-pv (no SC)
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5GiAlso applies to: 11-11
🤖 Prompt for AI Agents
In k8s/mongodb-pvc.yml around lines 4 to 5 and 11 to 11, the
PersistentVolumeClaim lacks the storageClassName field, which can cause it to
dynamically provision storage instead of binding to the intended static
PersistentVolume. To fix this, explicitly set the storageClassName in the PVC to
match the storageClassName of the static PV or set it to an empty string ("") to
bind to a PV without a storage class.
1 participant
Summary
Replaced the original Kubernetes manifests designed for Kind with updated versions compatible with Minikube and tailored to my project setup.
Changes Made
chat-appWhy This Change?
The previous manifests were well-structured but tailored for the Kind cluster setup. I adapted the configuration to run smoothly on Minikube, ensuring compatibility with my development environment and project architecture.
Notes
ingress-nginxcontroller is installed in Minikube before applyingingress.yaml.Summary by CodeRabbit