✨ Check known required permissions for install before installing with the helm applier #1858

bentito · 2025-03-10T18:13:52Z

Description

This is a successor PR to #1716 and is primarily the contributions of @trgeiger and @joelanford .

Goal and title, remain the same. Approach is a bit modified:

Pulls in RBAC authorization code from k8s.is/kubernetes, uses that code to check GET and other verb permissions as prelude to and as response from a Helm dry-run

To pull in the RBAC auth code concisely, repeatably and with warnings if the used code changes, we add a maintenance utility that adds the needed replace directives for all related staging modules (e.g., k8s.io/api, k8s.io/apimachinery, etc.) and they are automatically pinned to the corresponding published version.

All this code is initially called at

missingRules, err := h.PreAuthorizer.PreAuthorize(ctx, &ceServiceAccount, strings.NewReader(tmplRel.Manifest))

in internal/operator-controller/applier/helm.go

Reviewer Checklist

API Go Documentation
Tests: Unit Tests (and E2E Tests, if appropriate)
Comprehensive Commit Messages
Links to related GitHub Issue(s)

netlify · 2025-03-10T18:14:28Z

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	`9a80b06`
🔍 Latest deploy log	https://app.netlify.com/sites/olmv1/deploys/67dc4805469c3500095563b8
😎 Deploy Preview	https://deploy-preview-1858--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

go.mod

codecov · 2025-03-11T15:30:29Z

Codecov Report

Attention: Patch coverage is 32.27273% with 447 lines in your changes missing coverage. Please review.

Project coverage is 64.76%. Comparing base (44ba340) to head (9a80b06).
Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
hack/tools/k8smaintainer/main.go	0.00%	245 Missing ⚠️
internal/operator-controller/authorization/rbac.go	59.33%	116 Missing and 19 partials ⚠️
internal/operator-controller/applier/helm.go	6.94%	66 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1858      +/-   ##
==========================================
- Coverage   68.94%   64.76%   -4.19%     
==========================================
  Files          66       68       +2     
  Lines        5236     5883     +647     
==========================================
+ Hits         3610     3810     +200     
- Misses       1394     1821     +427     
- Partials      232      252      +20

Flag	Coverage Δ
e2e	`46.15% <6.74%> (-4.28%)`	⬇️
unit	`53.85% <30.60%> (-2.95%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

azych

looks good, will you be adding testing in the authorization package?

azych · 2025-03-13T12:31:52Z

internal/operator-controller/authorization/rbac.go

+	}
+}
+
+func (a *rbacPreAuthorizer) PreAuthorize(ctx context.Context, manifestManager user.Info, manifestReader io.Reader) (map[string][]rbacv1.PolicyRule, error) {


a short doc comment would be nice, especially about the return value

agreed, adding in next commit

internal/operator-controller/authorization/rbac.go

azych · 2025-03-13T12:35:41Z

internal/operator-controller/authorization/rbac.go

+		gvk := uObj.GroupVersionKind()
+		restMapping, err := a.restMapper.RESTMapping(gvk.GroupKind(), gvk.Version)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("could not get REST mapping for object %d in manifest with GVK %s: %w", i, gvk, err))


would it make sense to also try and add name of the object if possible via uObj.GetName?

Agreed, adding the object’s name should make debugging easier. Adding next commit.

azych · 2025-03-13T12:40:20Z

internal/operator-controller/authorization/rbac.go

+}
+
+func (a *rbacPreAuthorizer) attributesAllowed(ctx context.Context, attributesRecord authorizer.AttributesRecord) (bool, error) {
+	decision, _, err := a.authorizer.Authorize(ctx, attributesRecord)


second returned value is a 'reason' string. Would that be included in error? If not, maybe it would make sense to either return it or wrap the returned error with it for better context?

yep we should return it, done in next commit

azych · 2025-03-13T12:43:08Z

internal/operator-controller/authorization/rbac.go

+	}
+
+	for ns, nsMissingRules := range missingRules {
+		if compactMissingRules, err := validation.CompactRules(nsMissingRules); err == nil {


I can see that CompactRules cannot return a non nil error right now, but a comment about why we're not handling error might be a good idea for the future

Adding in next commit

Is there any reason why we shouldn't just go ahead and account for that possibility for future-proofing reasons?

Oh, I guess the way this works is that if there is an error, then we just stick with the original non-compacted set of missing rules, which seems like a reasonable fallback. I think that is actually the important detail to call out in the comment.

azych · 2025-03-13T12:48:12Z

internal/operator-controller/authorization/rbac.go

+}
+
+func hasAggregationRule(clusterRole *rbacv1.ClusterRole) bool {
+	return clusterRole.AggregationRule != nil && len(clusterRole.AggregationRule.ClusterRoleSelectors) > 0


if len(clusterRole.AggregationRule.ClusterRoleSelectors) is 0 would it not mean "match all" in this case?

I added a comment to try to clarify, does this help? see next commit for comment

This is all mostly copied code from kubernetes (e.g. https://github.com/kubernetes/kubernetes/blob/fd0a3484176f8f29f038b4b28132dd3c7583eb00/pkg/registry/rbac/clusterrole/policybased/storage.go#L124-L126)

Looking at this again, I almost wonder if we could have the escalationChecker simply call this code with a fake storage backend. That way we'd pick up any changes that are made here and avoid maintaining our own copy of it.

azych · 2025-03-13T12:54:15Z

internal/operator-controller/applier/helm.go

+		missingRules, err := h.PreAuthorizer.PreAuthorize(ctx, &ceServiceAccount, strings.NewReader(tmplRel.Manifest))
+
+		var preAuthErrors []error
+		if len(missingRules) > 0 {


nit: missingRules iteration below would not fire if it has no items, so we should be ok with skipping this if

azych · 2025-03-13T12:55:40Z

internal/operator-controller/applier/helm.go

+					missingRuleDescriptions = append(missingRuleDescriptions, ruleDescription(ns, rule))
+				}
+			}
+			slices.Sort(missingRuleDescriptions)


azych · 2025-03-13T12:57:57Z

internal/operator-controller/applier/helm.go

+		if len(preAuthErrors) > 0 {
+			return nil, "", fmt.Errorf("pre-authorization failed: %v", preAuthErrors)
+		}
+	}


since this is a fairly self-contained logic, how about extracting a helper function to enclose it and make Apply easier to follow?
Something like:

if features.OperatorControllerFeatureGate.Enabled(features.PreflightPermissions) { if _, err := preAuthPreflight(...); err != nil {...} }

azych · 2025-03-13T13:04:04Z

internal/operator-controller/applier/helm.go

@@ -164,6 +197,34 @@ func (h *Helm) buildHelmChart(bundleFS fs.FS, ext *ocv1.ClusterExtension) (*char
 	return h.BundleToHelmChartFn(bundleFS, ext.Spec.Namespace, watchNamespace)
 }

+func (h *Helm) template(ctx context.Context, ext *ocv1.ClusterExtension, chrt *chart.Chart, values chartutil.Values, post postrender.PostRenderer) (*release.Release, error) {


would it make sense to merge it with getReleaseState somehow? I guess the main thing is i.ClientOnly and the fact that we need to instantiate a separate client for that.
If it doesn't and ends up clumsy, I'd still probably adjust the name to be closer togetReleaseState, since logically it's almost the same

azych · 2025-03-13T14:41:56Z

internal/operator-controller/authorization/rbac.go

+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+type PreAuthorizer interface {


we could declare this interface on the applier/helm side to decouple it completely from this package as a dependency, but I saw that we're usually declaring interfaces on the producer side, probably because those are then reused, so seems fine as is now too

We're going to add unit tests based on your general comment I think. If so it might one more reason to change where the interface is made, could help with testing...

trgeiger · 2025-03-15T19:26:30Z

I added some tests but they still need to be tweaked/finalized. I noticed while writing them up that due to the order of the logic where missing rules are checked before escalation, if bind/escalate are in play but we're missing the explicit permissions that bind/escalate would give us we end up with a result where there's no error but we do have missing rules. @joelanford is that what we would want? I would think if we can bind or escalate that we would not return that we're missing those rules since the SA can grant them.

joelanford · 2025-03-17T14:21:23Z

hack/tools/k8sMaintainer.go

Nit: move to hack/tools/k8smaintainer/main.go (and move the doc to hack/tools/k8smaintainer/README.md)?

Also, make it a separate go module to avoid the golang.org/x/mod dependencies being added to our main module?

I think the move and naming makes sense, but we already have an indirect usage of x/mod in our go.mod on main: golang.org/x/mod v0.24.0 // indirect and we have that after go mod tidy even with the creation of a separate module:

from a run on main:

operator-controller main $ go mod why -m -vendor golang.org/x/mod # golang.org/x/mod github.com/operator-framework/operator-controller/hack/ci/custom-linters/analyzers github.com/operator-framework/operator-controller/hack/ci/custom-linters/analyzers.test golang.org/x/tools/go/analysis/analysistest golang.org/x/tools/internal/testenv golang.org/x/mod/modfile

without a new go module, the changes are made in 7a6a943

internal/operator-controller/applier/helm.go

joelanford · 2025-03-17T14:32:40Z

internal/operator-controller/authorization/rbac.go

+//   - nil: indicates that the authorization check passed and the operation is permitted.
+//   - non-nil error: indicates that the authorization failed (either due to insufficient permissions
+//     or an error encountered during the check), the error provides a slice of several failures at once.
+func (a *rbacPreAuthorizer) PreAuthorize(ctx context.Context, manifestManager user.Info, manifestReader io.Reader) (map[string][]rbacv1.PolicyRule, error) {


I'd recommend avoiding returning a map because of the issues it causes with random iteration order.

WDYT about defining type ScopedPolicyRules struct that includes the namespace and list of policy rules, and then returning []ScopedPolicyRules instead?

joelanford · 2025-03-17T14:37:54Z

internal/operator-controller/authorization/rbac.go

+//   - non-nil error: indicates that the authorization failed (either due to insufficient permissions
+//     or an error encountered during the check), the error provides a slice of several failures at once.


Non-nil errors are just when there were issues evaluating the permissions, right? If we successfully evaluate permissions and determine that some rules are missing, then we'll return a nil error with some missing rules.

I would also say that the returned error may include multiple failures encountered during rule evaluation (but it also may not, for example if there was a failure decoding the manifest).

Signed-off-by: Joe Lanford <[email protected]>

This is the manual version. Needed to change rbac.go a bit to allow for v1.32.2 code changes, but basically as-was Signed-off-by: Brett Tofel <[email protected]>

go.mod made in the current form the tool generates Signed-off-by: Brett Tofel <[email protected]>

Signed-off-by: Brett Tofel <[email protected]>

rbac_test.go likely coming soon Signed-off-by: Brett Tofel <[email protected]>

Signed-off-by: Tayler Geiger <[email protected]>

Signed-off-by: Brett Tofel <[email protected]>

Signed-off-by: Tayler Geiger <[email protected]>

Signed-off-by: Brett Tofel <[email protected]>

Use []ScopedPolicyRules struct for first return value in PreAuthorize() to avoid issues with random iteration order in previous map return value. Signed-off-by: Tayler Geiger <[email protected]>

Signed-off-by: Brett Tofel <[email protected]>

trgeiger · 2025-03-19T21:05:10Z

internal/operator-controller/authorization/rbac_test.go

+			Name: fmt.Sprintf("system:serviceaccount:%s:%s", ns, saName),
+		}
+		// Ensure the manifest contains only allowed rules so that the escalation check succeeds with no missing rules
+		modifiedManifest := strings.Replace(testManifest, `- apiGroups: ["*"]


Why is this necessary? The escalation check should pass with the create certificates bit included, that's the verb that we're testing we can escalate for, no?

So this is meant to be a happy path test, right? It seems like the dry-run w/ fake storage we're now using is correctly catching that the manifest includes a certificates rule that the service account w/ escalatingClusterRole doesn’t have permission to escalate to create the certificate. I think we were missing what should have been an escalation error before?

This version of the test: uses privilegedClusterRole, new test name, passes:

func TestPreAuthorize_SuccessWithFullPermissions(t *testing.T) { t.Run("preauthorize succeeds with full permissions using unchanged manifest", func(t *testing.T) { featuregatetesting.SetFeatureGateDuringTest(t, features.OperatorControllerFeatureGate, features.PreflightPermissions, true) // Use a client configured with a privileged cluster role that grants all permissions, // including certificate creation. fakeClient := setupFakeClient(privilegedClusterRole) preAuth := NewRBACPreAuthorizer(fakeClient) testServiceAccount := user.DefaultInfo{ Name: fmt.Sprintf("system:serviceaccount:%s:%s", ns, saName), } // Use the unchanged testManifest which includes the certificates rule. missingRules, err := preAuth.PreAuthorize(context.TODO(), &testServiceAccount, strings.NewReader(testManifest)) require.NoError(t, err) require.Equal(t, []ScopedPolicyRules{}, missingRules) }) }

I must still be misunderstanding how the escalation works or something because I wrote the test the way it was originally, where the SA does not have the "create" on "certificates" explicitly granted, so we can test if the permissions checking logic results in no missing rules and passes, because as I understood it, if the SA has all the verbs on RBAC objects and is also given bind/escalate, then additional rules like "create" on "certificates" that it doesn't explicitly start with should not cause a failure of the permissions check because it can bind or escalate those. When I ran this test locally in its original form where the SA has bind/escalate but not "create certificates," it passes with no missing rules as I expected.

trgeiger · 2025-03-19T21:07:31Z

internal/operator-controller/authorization/rbac_test.go

+`
+		missingRules, err := preAuth.PreAuthorize(context.TODO(), &testServiceAccount, strings.NewReader(manifest))
+		require.Error(t, err)
+		// Instead of calling it opaque, we check that the error contains "forbidden:" to indicate it's from storage-layer checks


Is this not just a failed escalation check? How is that the storage layer?

We should probably redo the comments, I just made them quickly to keep it straight in my head where the logic that created the error came from, but that is from the Create with fakestorage, coming from this code, for instance:

https://github.com/kubernetes/kubernetes/blob/master/pkg/registry/rbac/clusterrolebinding/policybased/storage.go#L123

joelanford · 2025-03-20T00:58:14Z

internal/operator-controller/authorization/rbac.go

@@ -255,16 +257,20 @@ type decodedManifest struct {
 func (dm *decodedManifest) rbacObjects() []client.Object {
 	objects := make([]client.Object, 0, len(dm.clusterRoles)+len(dm.roles)+len(dm.clusterRoleBindings)+len(dm.roleBindings))
 	for obj := range maps.Values(dm.clusterRoles) {
-		objects = append(objects, &obj)
+		o := obj // avoid aliasing


This is no longer a problem in 1.22+

joelanford · 2025-03-20T01:02:53Z

internal/operator-controller/authorization/rbac.go

+		// If there are errors here, you might choose to log them or collect them.
+		// We'll still try to run the upstream escalation check.


We still need to collect and return these errors. This is the equivalent of the SelfSubjectAccessReview. That the check itself fails to even tell us whether we had missing rules, we need to tell the user what happened.

joelanford · 2025-03-20T01:09:28Z

internal/operator-controller/authorization/rbac.go

 	for _, obj := range dm.rbacObjects() {
 		if err := ec.checkEscalation(ctx, manifestManager, obj); err != nil {
-			// In Kubernetes 1.32.2 the specialized PrivilegeEscalationError is gone.


This is the error type that I added in my copied code so that we could extract the missing rules and separate out the rule evaluation errors.

When we get to phase 2 of this work, we're going to have to do something like that regardless.

joelanford · 2025-03-20T01:16:27Z

internal/operator-controller/authorization/rbac.go

+	// If escalation check fails, return the detailed missing rules along with the error.
+	if len(escalationErrors) > 0 {


The missingRules are separate from the escalation check. If there are missingRules, but there are no escalation errors, we still need to report the missing rules.

For example, consider a manifest where the only contents are a secret and configmap. There will never be an escalation there because only RBAC objects can fail escalation checks. If a user lacks permissions on either secrets or configmaps, we need to fail return those and fail the preflight check.

joelanford · 2025-03-20T01:19:26Z

internal/operator-controller/authorization/rbac.go

-		return allMissingPolicyRules, fmt.Errorf("authorization evaluation errors: %w", errors.Join(preAuthEvaluationErrors...))
-	}
-	return allMissingPolicyRules, nil
+	// If the escalation check passed, override any computed missing rules (since the final decision is allowed).


See my other comment. This is incorrect. The missing rules from authorizeAttributesRecords need to be unioned with the missing rules from the escalation checks.

The fact that all we're getting now is the opaque string-based errors from the escalation check is problematic even now because we can't compute this union, which means we are very likely going to repeat missing rules and make the condition messages longer and more confusing.

joelanford · 2025-03-20T01:31:40Z

internal/operator-controller/authorization/rbac.go

+		// Merge extra Role rules if present.
+		key := types.NamespacedName{Namespace: v.Namespace, Name: v.Name}
+		if extra, ok := ec.extraRoles[key]; ok {
+			v.Rules = append(v.Rules, extra.Rules...)
+		}


This is not the right place to merge extra rules. The extraRoles and extraClusterRoles need to be used to augment rules returned by the rules resolver when evaluating a role binding or cluster role binding.

The rules resolver only knows about roles and cluster roles that exist in our cache (via KAS and etcd). However, we may have role bindings and cluster role bindings in our manifest that reference other roles and cluster roles in our manifest.

So when ConfirmNoEscalation eventually executes, the rules passed to it need to include the rules that would be bound if the referenced roles or cluster roles did exist.

trgeiger · 2025-03-20T14:10:07Z

internal/operator-controller/authorization/rbac_test.go

+		featuregatetesting.SetFeatureGateDuringTest(t, features.OperatorControllerFeatureGate, features.PreflightPermissions, true)
+		fakeClient := setupFakeClient(privilegedClusterRole)
+		preAuth := NewRBACPreAuthorizer(fakeClient)
+		testServiceAccount := user.DefaultInfo{Name: fmt.Sprintf("system:serviceaccount:%s:%s", ns, saName)}


we can DRY up these testServiceAccount initializations by making it a global since I think we use the exact same value every time

This reverts commit 2681194.

trgeiger · 2025-03-21T15:13:10Z

Opened kubernetes/kubernetes#130955 to hopefully get the PrivilegedEscalationError upstreamed in k8s

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 10, 2025

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 10, 2025

bentito force-pushed the rbac-auth-k8s-replacer branch from 2991d5d to 65ef8a2 Compare March 10, 2025 20:03

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 10, 2025

bentito marked this pull request as ready for review March 10, 2025 20:04

bentito requested a review from a team as a code owner March 10, 2025 20:04

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 10, 2025

camilamacedo86 reviewed Mar 10, 2025

View reviewed changes

go.mod Show resolved Hide resolved

azych reviewed Mar 13, 2025

View reviewed changes

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 14, 2025

joelanford reviewed Mar 17, 2025

View reviewed changes

internal/operator-controller/applier/helm.go Outdated Show resolved Hide resolved

joelanford reviewed Mar 17, 2025

View reviewed changes

joelanford and others added 12 commits March 18, 2025 09:10

permissions preflight: copy necessary kubernetes libs

bd8b0f8

Signed-off-by: Joe Lanford <[email protected]>

permissions preflight: kubernetes rbac code modifications

742c427

Signed-off-by: Joe Lanford <[email protected]>

permissions preflight: add preauth implementation

bf346a7

Signed-off-by: Joe Lanford <[email protected]>

permissions preflight: enable implementation behind feature gate

cae4c7e

Signed-off-by: Joe Lanford <[email protected]>

Rm k8s.io/kubernetes copypasta & import/replace

eb2cdd7

This is the manual version. Needed to change rbac.go a bit to allow for v1.32.2 code changes, but basically as-was Signed-off-by: Brett Tofel <[email protected]>

Adds k8s.io/ lib maintainer tool

00ed020

go.mod made in the current form the tool generates Signed-off-by: Brett Tofel <[email protected]>

Make debug a flag

0fa822e

Signed-off-by: Brett Tofel <[email protected]>

Small fix, fixes err on kubernetes replace itself

b082fa9

Signed-off-by: Brett Tofel <[email protected]>

Changes to allow calling as make target

65a8397

Signed-off-by: Brett Tofel <[email protected]>

Run go mod tidy post rebase

aeed741

Signed-off-by: Brett Tofel <[email protected]>

From rebase - add PreAuthorizer to Helm struct

08f70c9

Signed-off-by: Brett Tofel <[email protected]>

Fixes to pass linter

5443476

Signed-off-by: Brett Tofel <[email protected]>

bentito added 2 commits March 18, 2025 09:25

Add needed setups to preflightPerm unit tests

a2ed7bb

Signed-off-by: Brett Tofel <[email protected]>

Address review comments on rbac.go

d63fc8c

rbac_test.go likely coming soon Signed-off-by: Brett Tofel <[email protected]>

bentito force-pushed the rbac-auth-k8s-replacer branch from 7a6a943 to e974006 Compare March 18, 2025 13:44

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 18, 2025

trgeiger and others added 4 commits March 18, 2025 09:28

Add tests for authorization/rbac.go

c6c1b00

Signed-off-by: Tayler Geiger <[email protected]>

Move k8sMaintainer code to its own dir

e2ed341

Signed-off-by: Brett Tofel <[email protected]>

Run k8smaintainer code post rebase

c0f9b4d

Signed-off-by: Brett Tofel <[email protected]>

Lint acceptable format for rbac_test.go

8f76fa8

Signed-off-by: Brett Tofel <[email protected]>

trgeiger force-pushed the rbac-auth-k8s-replacer branch from e974006 to 8f76fa8 Compare March 18, 2025 14:29

trgeiger and others added 5 commits March 18, 2025 10:48

Add tests for authorization/rbac.go

adb7f9a

Signed-off-by: Tayler Geiger <[email protected]>

Refactor inline feature gate check

dc30c5a

Signed-off-by: Brett Tofel <[email protected]>

Change PreAuthorize() return value to []ScopedPolicyRules

3cd7907

Use []ScopedPolicyRules struct for first return value in PreAuthorize() to avoid issues with random iteration order in previous map return value. Signed-off-by: Tayler Geiger <[email protected]>

Lint acceptable format for rbac_test.go (take 2)

3e3187a

Signed-off-by: Brett Tofel <[email protected]>

Add fakeStorage dry run for escalationCheck

2681194

Signed-off-by: Brett Tofel <[email protected]>

trgeiger reviewed Mar 19, 2025

View reviewed changes

joelanford reviewed Mar 20, 2025

View reviewed changes

trgeiger reviewed Mar 20, 2025

View reviewed changes

Revert "Add fakeStorage dry run for escalationCheck"

9a80b06

This reverts commit 2681194.

		// - non-nil error: indicates that the authorization failed (either due to insufficient permissions
		// or an error encountered during the check), the error provides a slice of several failures at once.

		// If there are errors here, you might choose to log them or collect them.
		// We'll still try to run the upstream escalation check.

		// If escalation check fails, return the detailed missing rules along with the error.
		if len(escalationErrors) > 0 {

✨ Check known required permissions for install before installing with the helm applier #1858

Are you sure you want to change the base?

✨ Check known required permissions for install before installing with the helm applier #1858

Conversation

bentito commented Mar 10, 2025 • edited Loading

Description

Reviewer Checklist

netlify bot commented Mar 10, 2025 • edited Loading

✅ Deploy Preview for olmv1 ready!

codecov bot commented Mar 11, 2025 • edited Loading

Codecov Report

azych left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joelanford Mar 17, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

azych Mar 13, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

trgeiger commented Mar 15, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

trgeiger commented Mar 21, 2025

bentito commented Mar 10, 2025 •

edited

Loading

netlify bot commented Mar 10, 2025 •

edited

Loading

codecov bot commented Mar 11, 2025 •

edited

Loading

joelanford Mar 17, 2025 •

edited

Loading

azych Mar 13, 2025 •

edited

Loading