Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/ksail/issues.md or /mcp/ksail/issues.json, or Pod over MCP.

Reported issues for KSail

Pod holds 22 of 45 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to KSail.

Most discussed

Move kubeadm Hetzner signing PKI out of provider user-data

🤖 Generated by the Agentic Engineer

Evidence and impact

The supported kubeadm Hetzner bootstrap still places cluster-signing private material in provider-readable initialization data. The HA hotfix removes extra copies, but the initial control plane keeps this exposure so existing single-control-plane users remain affected.

Hypothesis

Generating or transferring the private material through a channel outside provider user-data will preserve the current one-command workflow while removin

Read the thread · 2026-08-01 · open · outside contributor · 4 comments

feat(mirror): Phase-1 local delivery — replay captured traffic to the local process

🤖 Generated by the Daily AI Assistant

Part of #4521 (Phase 1 — mirror-only). Next increment after #5702/#5703 (capture spec) and the capture session + workload mirror command landing.

Problem

ksail workload mirror <deployment> today resolves the target, injects the NET_RAW tap, streams the pcap over the exec channel, writes it to a file, and summarizes it. But mirror-only mode's headline promise — the locally-running service receives the mirrored traffic — is still unfulfilled: not

Read the thread · 2026-07-04 · closed · outside contributor · 3 comments

[aw] Daily Workflow Maintenance failed

Workflow Failure

Workflow: Daily Workflow Maintenance
Branch: main
Run: https://github.com/devantler-tech/ksail/actions/runs/26038123782

🔒 Lock File Out of Sync: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's .md file was edited but gh aw compile was not run afterwards to regenerate the corresponding .lock.yml file. The agent is prevented from running against a stale configuration

Read the thread · 2026-05-18 · closed · outside contributor · 4 comments

[bug]: kubelet-serving CSRs stay Pending on Hetzner clusters — no approver installed despite rotate-server-certificates=true

Expected Behavior

On a Hetzner cluster with rotate-server-certificates: true in the Talos machine config (set by ksail since v7.4.0), kubectl logs, kubectl exec, and metrics-server should work immediately after bootstrap, because the kubelet-serving CSRs are approved.

Actual Behavior

All kubelet-serving CSRs (kubernetes.io/kubelet-serving signer) stay Pending indefinitely. This blocks:

Read the thread · 2026-04-24 · closed · outside contributor · 1 comment

CI Doctor - CI Failure Investigation - Run #3145 — TODOs workflow fails: APP_PRIVATE_KEY secret missing

Summary

The TODOs workflow (run #3145) failed because the APP_PRIVATE_KEY repository secret is missing or empty. The create-issues-from-todos action authenticates as a GitHub App and requires this private key to function.

Failure Details

Read the thread · 2026-04-20 · closed · outside contributor · 7 comments

CI Doctor - CI Failure Investigation - Daily Docs Run #1425 - Recurring add_comment in push context

Summary

The Daily Docs workflow (run #1425) failed in the safe_outputs job — identical root cause to the previously-closed issue #3501. The agent called add_comment with target "triggering" during a push event, which has no associated PR or issue to comment on.

Failure Details

Read the thread · 2026-04-02 · closed · outside contributor · 2 comments

[chore]: add mirrord companion guide to KSail docs

User Story

As a KSail user debugging microservices in a local cluster, I want a companion guide showing how to use KSail with mirrord, So that I can intercept live traffic from my local process into a KSail-provisioned cluster for rapid inner-loop debugging.

Context

Weekly Roadmap — March 23, 2026 #3294 identifies this as a Next priority.

mirrord crossed 5,000 ⭐ this week (March 25, 2026), with strong VSCode ex

Read the thread · 2026-03-25 · closed · outside contributor · 1 comment

[feature]: add real-time cluster status view to VSCode extension sidebar

User Story

As a developer using the KSail VSCode extension, I want real-time cluster health indicators in the VSCode sidebar showing pod status and GitOps reconciliation state, So that I can monitor my cluster without leaving the editor and react to failures instantly.

Context

The Weekly Research Roadmap — March 4, 2026 identifies VSCode extension: live cluster status as a "Next" priority. KSail already ship

Read the thread · 2026-03-06 · closed · outside contributor · 1 comment

Most recent

Add privacy-preserving product telemetry and decision feedback loop

🤖 Generated by the Agentic Engineer

Summary

Add privacy-preserving product telemetry across every KSail user surface: CLI, terminal UI (TUI), VS Code extension/plugin, MCP, desktop app, and web UI. The completed capability is enabled by default, has a prominent and reliable opt-out, sends a small versioned event set to a platform-hosted ingestion path, and gives the Agentic Engineer read-only aggregate evidence for future product decisions.

Motivation

KSail decisions currently rely h

Read the thread · 2026-08-08 · open · outside contributor · 0 comments

fix(clusterapi): carry the ownership record's AWS credential mapping through to the EKS provisioner

🤖 Generated by the Agentic Engineer

Evidence

Raised by Codex against #6385 and confirmed structurally at ac74b807:

Read the thread · 2026-08-01 · closed · outside contributor · 1 comment

Rate Limit Gate reports rate-limit exhaustion when the GitHub API is merely unreachable

🤖 Generated by the Daily AI Engineer

Evidence

During a GitHub API incident on 2026-07-20, ⏳ Rate Limit Gate failed on PR #6285 and took CI - Required Checks down with it. The reported reason was rate-limit exhaustion. That was not the actual cause.

.github/actions/rate-limit-gate does:

remaining=$(gh api /rate_limit --jq '.resources.core.remaining')
if [ "$remaining" -ge "$MIN_REMAINING" ]; then

The job log shows what actually happened:

gh: No server is currently a

[Read the thread](https://github.com/devantler-tech/ksail/issues/6291) · 2026-07-20 · open · outside contributor · 0 comments

### fix(workload): expose Kubernetes config flags on workload wait

> 🤖 Generated by the Daily AI Engineer

## Reproduction and evidence

`pkg/client/kubectl/commands.go` creates `genericclioptions.NewConfigFlags(true)` in `CreateWaitCommand` and passes it to upstream `wait.NewCmdWait`, but never registers those flags on the Cobra command. This differs from the other kubectl-backed commands, whose shared `customizeCommand` calls `configFlags.AddFlags(cmd.Flags())`.

On current `main` (`deeaf6ddabd3dc895ee12f72d6871e969f53f6bf`):

```text
$ go run . workload wait

[Read the thread](https://github.com/devantler-tech/ksail/issues/6144) · 2026-07-15 · open · outside contributor · 1 comment

### feat(project): surface the environment reconcile as an experimental env reconcile command

> 🤖 Generated by the Daily AI Engineer

**Part of #5441** (item 3b — declarative environments reconcile; increment 3, follows the generation step #6072/#6073).

**Problem.** The reconcile lane is complete as a library — `environment.DerivePlan` (#6054) reports Missing/Present/Orphaned overlays and `environment.GenerateMissingOverlays` (#6073) scaffolds the missing ones — but no CLI surface consumes it: an operator who declares a new `ksail.<env>.yaml` still has nothing to run that reconciles the

[Read the thread](https://github.com/devantler-tech/ksail/issues/6085) · 2026-07-13 · closed · outside contributor · 1 comment

### [intercept] steer-agent stdout noise corrupts the tunnel protocol, and the client masks the corruption as a clean exit 0

> 🤖 Generated by the Daily AI Engineer

Part of #4521; found by #5971's live-cluster validation pass (Kind/Docker, 2026-07-11).

## Problem
`ksail workload intercept` exits 0 within ~2s on a real cluster without ever running the steering agent — a silent no-op. Two stacked defects:

1. **Protocol corruption:** the ksail binary links `github.com/derailed/k9s/cmd`, whose package `init()` does `fmt.Printf("Fail to init k9s logs location …")` — **to stdout** — whenever the k9s state dir is not creat

[Read the thread](https://github.com/devantler-tech/ksail/issues/6038) · 2026-07-11 · closed · outside contributor · 1 comment

### workload mirror Ctrl-C skips the capture summary

## Description

`ksail workload mirror` tells users that Ctrl-C stops the capture and documents that a file capture is summarized on stop. The current root execution path does not install a signal-aware context for this command, so SIGINT terminates the process with status 130 before `finishCapture` and `summarizeMirrorFile` run.

This also prevents an end-to-end smoke test from treating the documented Ctrl-C path as a clean completion; the test must currently assert the flushed PCAP contents be

[Read the thread](https://github.com/devantler-tech/ksail/issues/6005) · 2026-07-10 · closed · outside contributor · 1 comment

### ci: add a secret-gated EKS smoke workflow

> 🤖 Generated by the Daily AI Engineer

Parent: #4328

## Problem

The EKS provider epic still lacks a CI smoke-test entry point. The full provider code is mostly present, but there is no workflow that can validate a real EKS create/info/delete path once AWS CI credentials are available. Adding an always-on scheduled lane before credentials and a spend envelope exist would create recurring red noise.

## Proposed direction

Add a manual `System Test - EKS` workflow that:

- skips cleanly when `A

[Read the thread](https://github.com/devantler-tech/ksail/issues/5996) · 2026-07-10 · closed · outside contributor · 0 comments

### bug(autoscaler): ignoreDaemonsetsUtilization & skipNodesWith* not wired into detector reverse-parse or cluster-update diff

> 🤖 Generated by the Daily AI Assistant

## Problem
Three recently-added `NodeAutoscalerConfig` pass-through fields are rendered at **install** but are missing from two downstream paths, unlike the older siblings (`expander`, `maxNodesTotal`, `scaleDownUnneededTime`, `capacityBuffers`) which are wired everywhere:

- `ignoreDaemonsetsUtilization`
- `skipNodesWithLocalStorage`
- `skipNodesWithSystemPods`

Neither is:
1. **reverse-parsed by the detector** — `pkg/svc/detector/component.go` `parseAut

[Read the thread](https://github.com/devantler-tech/ksail/issues/5867) · 2026-07-06 · closed · outside contributor · 1 comment

### feat(mirror): Phase 2 intercept — tunnel frame codec (multiplexing wire format)

> 🤖 Generated by the Daily AI Assistant

**Part of #4521** (local-remote service mirroring — Phase 2 *intercept*).

## Problem
Phase 1 (mirror-only) is complete: inbound traffic is captured read-only and replayed to the local process (`workload mirror`, last increment #5794's `--to` live replay). Phase 2 — *intercept* — must **return the local process's responses back into the cluster**, which the read-only mirror path deliberately cannot do (`pkg/svc/mirror/doc.go` Phase 2 note; `inject.go` "th

[Read the thread](https://github.com/devantler-tech/ksail/issues/5808) · 2026-07-05 · closed · outside contributor · 1 comment

### feat(workload): configure CEL rules via spec.workload.validation.rules

> 🤖 Generated by the Daily AI Assistant

### Problem
`ksail workload validate` can run CEL rules today, but only via the `--rules <file>` flag (shipped in #5773). Its sibling validation options — `spec.workload.validation.skipKinds` and `spec.workload.validation.schemaLocations` — are configurable declaratively in `ksail.yaml`, so `ksail workload validate` (no args) acts as a turnkey CI gate. CEL rules are the odd one out: a repo that wants rule validation must pass `--rules` on every invocation

[Read the thread](https://github.com/devantler-tech/ksail/issues/5781) · 2026-07-04 · closed · outside contributor · 0 comments

### Wire native CEL-rule validation into `workload validate` (--rules flag)

> 🤖 Generated by the Daily AI Assistant

## Problem

The CEL rule engine foundation (`pkg/svc/gitops/.../celrules`, merged via #5707) can load a YAML rules file, compile CEL expressions, and evaluate them against decoded documents with per-rule severity — but it is **not wired into the `workload validate` command**. Today `workload validate` only runs kubeconform + Helm render + Flux substitution; there is no way for a user to run their own CEL policy rules over the rendered GitOps layers.

This

[Read the thread](https://github.com/devantler-tech/ksail/issues/5772) · 2026-07-03 · closed · outside contributor · 0 comments

### feat: wire the Phase-1 mirror capture into a `workload mirror` command

> 🤖 Generated by the Daily AI Assistant

**Problem:** every Phase-1 mirror primitive from #4521 has merged (`ResolveTarget`, `SelectTapPoint`, `InjectTap`/`WaitForTap`, `CaptureCommand`, `RunCaptureSession`, `SummarizeCapture`) but none of it is reachable — there is no `ksail workload mirror` command, so the capability ships in the binary without a user-facing entry point.

**Proposal:** add `ksail workload mirror <deployment>` (dev-loop group) that chains the primitives end-to-end in mirror-onl

[Read the thread](https://github.com/devantler-tech/ksail/issues/5741) · 2026-07-03 · closed · outside contributor · 0 comments

### Move add-environment from the cluster group to the project group

> 🤖 Generated by the Daily AI Assistant

Part of #5626 (the `project` / `cluster` / `workload` command-taxonomy reorg).

## Problem

`add-environment` clones a GitOps environment on disk — it never touches a live cluster — so it belongs under the new `project` group (GitOps-project-files-only), not `cluster` (running-cluster lifecycle). It currently lives at `ksail cluster add-environment`. The empty `project` group was scaffolded in #5630 with the note that `add-environment` moves under it in a

[Read the thread](https://github.com/devantler-tech/ksail/issues/5633) · 2026-07-01 · closed · outside contributor · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/devantler-tech/ksail/issues).