feat: fix slack notifications, gitops PR engine, rbac, and update documentation#38
Conversation
… for installation, replacing the previous kind and make-based local development instructions.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly updates the 'Getting Started' documentation, transforming the local development environment setup. The primary goal is to simplify the onboarding process for new users by aligning the local setup with common production practices, utilizing modern tools like k3d, cert-manager, and Helm. This change enhances the user experience by providing a more robust and consistent installation and testing workflow. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request is a great initiative to modernize the getting started guide by adopting k3d, cert-manager, and Helm. The new guide is more streamlined and aligns better with current cloud-native practices. I've identified a few areas for improvement to enhance the user experience, including a critical fix for a command that would otherwise fail, removing some redundancy, re-introducing a cleanup section, and fixing a minor typo. Overall, these are excellent changes.
I am having trouble creating individual review comments. Click here to see my feedback.
docs/getting-started.md (32-36)
The helm install command for cert-manager is incorrect and will fail. The OCI repository path is outdated, the chart version v1.20.0 does not exist, and the crds.enabled=true flag is for older versions of the chart. I suggest updating to a recent version from the correct repository with the appropriate flag for CRD installation.
helm install cert-manager oci://quay.io/jetstack/cert-manager \
--version v1.14.5 \
--namespace cert-manager \
--create-namespace \
--set installCRDs=true
docs/getting-started.md (54-55)
The namespace zelyo-system is created here with kubectl, but the subsequent helm install command also uses the --create-namespace flag. This is redundant. It's common practice to let Helm manage the namespace creation. I suggest removing this kubectl command and relying on the Helm flag for a more streamlined experience.
docs/getting-started.md (148-159)
This "Clean Up" section was removed, but a getting-started guide should include instructions on how to remove the created resources to provide a complete user journey. Please consider adding an updated "Clean Up" section for the new k3d and helm based setup.
For example:
## Step 7: Clean Up
When you're finished, you can clean up the resources you created.
```bash
# Delete the test pod and policy
kubectl delete pod insecure-nginx -n default
kubectl delete -f test-security-policy.yaml
# Uninstall Zelyo Operator and cert-manager
helm uninstall zelyo-operator -n zelyo-system
helm uninstall cert-manager -n cert-manager
# Delete the k3d cluster
k3d cluster delete zelyodocs/getting-started.md (150)
There appears to be a typo or copy-paste artifact (xes |) at the end of the table. This line should be removed.
…ndicators, and enhanced clarity.
…expand the list of next steps guides.
…hance remediation engine configuration with new setters.
There was a problem hiding this comment.
Pull request overview
This PR updates the documentation experience around installation/getting-started (moving to k3d + cert-manager + Helm, adding an end-to-end guide and troubleshooting), and also introduces several operator/runtime behavior changes (LLM/GitOps engine injection, PAT auth support, and SecurityPolicy-driven notifications).
Changes:
- Revamps docs navigation and adds new docs pages (End-to-End Guide, Troubleshooting); removes Quickstart.
- Adds runtime injection points for the remediation engine (LLM client, GitOps engine, config/strategy).
- Adds GitHub PAT client support and wires GitOps engine initialization from a Secret; adds SecurityPolicy notification dispatch logic.
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 17 comments.
Show a summary per file
| File | Description |
|---|---|
| mkdocs.yml | Updates site nav to include new docs and remove quickstart. |
| docs/getting-started.md | Rewrites getting started to k3d/cert-manager/Helm flow and references new docs. |
| docs/end-to-end-guide.md | Adds a comprehensive end-to-end setup and usage guide. |
| docs/troubleshooting.md | Adds troubleshooting steps for webhooks, Slack, LLM, and GitOps PRs. |
| internal/remediation/engine.go | Adds setters to mutate remediation engine dependencies/config at runtime. |
| internal/controller/zelyoconfig_controller.go | Injects LLM client into remediation engine and sets remediation strategy from ZelyoConfig. |
| internal/github/client.go | Adds a PAT-based GitHub client option and token logic. |
| internal/controller/remediationpolicy_controller.go | Initializes GitOps engine from a Secret (PAT) and injects into remediation engine. |
| internal/controller/securitypolicy_controller.go | Adds notification dispatch based on findings via NotificationChannels. |
| config/rbac/role.yaml | Expands manager ClusterRole permissions (including new write permissions). |
| config/samples/zelyo-operator_v1alpha1_zelyoconfig.yaml | Updates sample config defaults (mode/model/temperature type). |
| cmd/main.go | Wires remediation engine instance into the ZelyoConfig reconciler. |
Comments suppressed due to low confidence (1)
docs/getting-started.md:172
- This page links to quickstart.md, but quickstart.md has been removed from the docs and is no longer in mkdocs nav. Update this link to the new End-to-End Guide (or another valid page) to avoid broken links in the published site.
| Guide | What You'll Learn |
|---|---|
| [Quick Start](quickstart.md) | Common recipes for security scanning |
| [CRD Reference](crd-reference.md) | Every field in every CRD explained |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
… mkdocs configuration.
Prathamesh07-stack
changed the title
|
@Prathamesh07-stack could you also review the copilot and gemini code review suggestions ^
|
… to `Zelyo`." This reverts commit 7ef8d87.
…nd refactor note syntax in troubleshooting guide.
Description
This PR addresses several critical issues that were hindering the core Observe -> Reason -> Act workflow in the Zelyo Operator. It specifically fixes Slack notification failures, enables Personal Access Token (PAT) support for GitOps PR generation, resolves RBAC permission errors, and provide a complete documentation overhaul for an improved onboarding experience.
Fixes and Enhancements
🛡️ Core & RBAC
patch, andupdatepermissions foreventsto thezelyo-operatorClusterRole. This resolves severalforbiddenerrors in the logs when the operator attempts to record security scans and remediation actions.📢 Slack Notifications
NotificationChannelsecrets. The controller now supports bothurlandwebhook-urlkeys for better compatibility.minSeveritylogic to ensure alerts are only dispatched when findings meet the user-defined threshold.🤖 GitOps & Remediation Engine
google/gemini-2.0-flash. This ensures much higher reliability and fewer 429 (Rate Limit) errors during AI reasoning compared to older models.📚 Documentation & UX
quickstart-guide.md(formerly end-to-end-guide.md) to follow a more logical flow: Build -> Deploy -> Observe -> Act.k3d, ensuring developers are always running their latest local fixes.Type of Change
How Has This Been Tested?
Verified on a local
k3dcluster:eventsare now correctly recorded without permission errors.