# Reported issues for KSail

Pod holds 22 of 45 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [KSail](/mcp/ksail).

## Most discussed

### Move kubeadm Hetzner signing PKI out of provider user-data

> 🤖 Generated by the Agentic Engineer

## Evidence and impact
The supported kubeadm Hetzner bootstrap still places cluster-signing private material in provider-readable initialization data. The HA hotfix removes extra copies, but the initial control plane keeps this exposure so existing single-control-plane users remain affected.

## Hypothesis
Generating or transferring the private material through a channel outside provider user-data will preserve the current one-command workflow while removin

[Read the thread](https://github.com/devantler-tech/ksail/issues/6428) · 2026-08-01 · open · outside contributor · 4 comments

### feat(mirror): Phase-1 local delivery — replay captured traffic to the local process

> 🤖 Generated by the Daily AI Assistant

Part of #4521 (Phase 1 — mirror-only). Next increment after #5702/#5703 (capture spec) and the capture session + `workload mirror` command landing.

## Problem

`ksail workload mirror <deployment>` today resolves the target, injects the NET_RAW tap, streams the pcap over the exec channel, writes it to a file, and summarizes it. But mirror-only mode's headline promise — *the locally-running service receives the mirrored traffic* — is still unfulfilled: not

[Read the thread](https://github.com/devantler-tech/ksail/issues/5791) · 2026-07-04 · closed · outside contributor · 3 comments

### [aw] Daily Workflow Maintenance failed

### Workflow Failure

**Workflow:** [Daily Workflow Maintenance](#)  
**Branch:** main  
**Run:** https://github.com/devantler-tech/ksail/actions/runs/26038123782

**🔒 Lock File Out of Sync**: The workflow could not start because its compiled lock file no longer matches the source markdown.

This means the workflow's `.md` file was edited but `gh aw compile` was not run afterwards to regenerate the corresponding `.lock.yml` file. The agent is prevented from running against a stale configuration

[Read the thread](https://github.com/devantler-tech/ksail/issues/4779) · 2026-05-18 · closed · outside contributor · 4 comments

### [bug]: kubelet-serving CSRs stay Pending on Hetzner clusters — no approver installed despite rotate-server-certificates=true

### Expected Behavior

On a Hetzner cluster with `rotate-server-certificates: true` in the Talos machine config (set by ksail since v7.4.0), `kubectl logs`, `kubectl exec`, and metrics-server should work immediately after bootstrap, because the kubelet-serving CSRs are approved.

### Actual Behavior

All kubelet-serving CSRs (`kubernetes.io/kubelet-serving` signer) stay `Pending` indefinitely. This blocks:

- `kubectl logs <pod>` → `tls: internal error`
- `kubectl exec <pod>` → `tls: internal er

[Read the thread](https://github.com/devantler-tech/ksail/issues/4322) · 2026-04-24 · closed · outside contributor · 1 comment

### CI Doctor - CI Failure Investigation - Run #3145 — TODOs workflow fails: APP_PRIVATE_KEY secret missing

## Summary

The **TODOs** workflow (run [#3145](https://github.com/devantler-tech/ksail/actions/runs/24691190859)) failed because the `APP_PRIVATE_KEY` repository secret is missing or empty. The `create-issues-from-todos` action authenticates as a GitHub App and requires this private key to function.

## Failure Details

- **Run**: [24691190859](https://github.com/devantler-tech/ksail/actions/runs/24691190859)
- **Commit**: `4e1687b2536d005c596ae794115a76eea038958a`
- **Trigger**: `push` to `mai

[Read the thread](https://github.com/devantler-tech/ksail/issues/4225) · 2026-04-20 · closed · outside contributor · 7 comments

### CI Doctor - CI Failure Investigation - Daily Docs Run #1425 - Recurring add_comment in push context

## Summary

The **Daily Docs** workflow (run #1425) failed in the `safe_outputs` job — identical root cause to the previously-closed issue #3501. The agent called `add_comment` with target `"triggering"` during a `push` event, which has no associated PR or issue to comment on.

## Failure Details

- **Run**: [23913656320](https://github.com/devantler-tech/ksail/actions/runs/23913656320)
- **Commit**: `4e040c4467c1feb57f8070d9332cc9c1b4dc835d`
- **Trigger**: `push` to `main` via `github-merge-que

[Read the thread](https://github.com/devantler-tech/ksail/issues/3572) · 2026-04-02 · closed · outside contributor · 2 comments

### [chore]: add mirrord companion guide to KSail docs

## User Story

**As a** KSail user debugging microservices in a local cluster,
**I want** a companion guide showing how to use KSail with mirrord,
**So that** I can intercept live traffic from my local process into a KSail-provisioned cluster for rapid inner-loop debugging.

## Context

[Weekly Roadmap — March 23, 2026 #3294](https://github.com/devantler-tech/ksail/discussions/3294) identifies this as a **Next** priority.

mirrord crossed 5,000 ⭐ this week (March 25, 2026), with strong VSCode ex

[Read the thread](https://github.com/devantler-tech/ksail/issues/3379) · 2026-03-25 · closed · outside contributor · 1 comment

### [feature]: add real-time cluster status view to VSCode extension sidebar

## User Story

**As a** developer using the KSail VSCode extension,
**I want** real-time cluster health indicators in the VSCode sidebar showing pod status and GitOps reconciliation state,
**So that** I can monitor my cluster without leaving the editor and react to failures instantly.

## Context

The [Weekly Research Roadmap — March 4, 2026](https://github.com/devantler-tech/ksail/discussions/2793) identifies **VSCode extension: live cluster status** as a **"Next"** priority. KSail already ship

[Read the thread](https://github.com/devantler-tech/ksail/issues/2833) · 2026-03-06 · closed · outside contributor · 1 comment

## Most recent

### Add privacy-preserving product telemetry and decision feedback loop

> 🤖 Generated by the Agentic Engineer

## Summary

Add privacy-preserving product telemetry across every KSail user surface: CLI, terminal UI (TUI), VS Code extension/plugin, MCP, desktop app, and web UI. The completed capability is enabled by default, has a prominent and reliable opt-out, sends a small versioned event set to a platform-hosted ingestion path, and gives the Agentic Engineer read-only aggregate evidence for future product decisions.

## Motivation

KSail decisions currently rely h

[Read the thread](https://github.com/devantler-tech/ksail/issues/6523) · 2026-08-08 · open · outside contributor · 0 comments

### fix(clusterapi): carry the ownership record's AWS credential mapping through to the EKS provisioner

> 🤖 Generated by the Agentic Engineer

## Evidence

Raised by Codex against #6385 and confirmed structurally at `ac74b807`:

- `bindFromOwnershipRecord` (`pkg/cli/clusterapi/distconfig.go`) reads the ownership record and keeps
  `ownerships[0].Region` **only**.
- The `EKSConfig` it returns (`pkg/svc/provisioner/cluster/factory.go`) has fields for `Name`,
  `Region`, `ConfigPath` and `KubeconfigPath` — and **nowhere to put** `AWSOptions`.
- `AWSOptions` / `OptionsAWS` / `Provider.AWS` appear **no

[Read the thread](https://github.com/devantler-tech/ksail/issues/6427) · 2026-08-01 · closed · outside contributor · 1 comment

### Rate Limit Gate reports rate-limit exhaustion when the GitHub API is merely unreachable

> 🤖 Generated by the Daily AI Engineer

## Evidence

During a GitHub API incident on 2026-07-20, `⏳ Rate Limit Gate` failed on PR #6285 and took `CI - Required Checks` down with it. The reported reason was rate-limit exhaustion. That was not the actual cause.

`.github/actions/rate-limit-gate` does:

```sh
remaining=$(gh api /rate_limit --jq '.resources.core.remaining')
if [ "$remaining" -ge "$MIN_REMAINING" ]; then
```

The job log shows what actually happened:

```
gh: No server is currently a

[Read the thread](https://github.com/devantler-tech/ksail/issues/6291) · 2026-07-20 · open · outside contributor · 0 comments

### fix(workload): expose Kubernetes config flags on workload wait

> 🤖 Generated by the Daily AI Engineer

## Reproduction and evidence

`pkg/client/kubectl/commands.go` creates `genericclioptions.NewConfigFlags(true)` in `CreateWaitCommand` and passes it to upstream `wait.NewCmdWait`, but never registers those flags on the Cobra command. This differs from the other kubectl-backed commands, whose shared `customizeCommand` calls `configFlags.AddFlags(cmd.Flags())`.

On current `main` (`deeaf6ddabd3dc895ee12f72d6871e969f53f6bf`):

```text
$ go run . workload wait

[Read the thread](https://github.com/devantler-tech/ksail/issues/6144) · 2026-07-15 · open · outside contributor · 1 comment

### feat(project): surface the environment reconcile as an experimental env reconcile command

> 🤖 Generated by the Daily AI Engineer

**Part of #5441** (item 3b — declarative environments reconcile; increment 3, follows the generation step #6072/#6073).

**Problem.** The reconcile lane is complete as a library — `environment.DerivePlan` (#6054) reports Missing/Present/Orphaned overlays and `environment.GenerateMissingOverlays` (#6073) scaffolds the missing ones — but no CLI surface consumes it: an operator who declares a new `ksail.<env>.yaml` still has nothing to run that reconciles the

[Read the thread](https://github.com/devantler-tech/ksail/issues/6085) · 2026-07-13 · closed · outside contributor · 1 comment

### [intercept] steer-agent stdout noise corrupts the tunnel protocol, and the client masks the corruption as a clean exit 0

> 🤖 Generated by the Daily AI Engineer

Part of #4521; found by #5971's live-cluster validation pass (Kind/Docker, 2026-07-11).

## Problem
`ksail workload intercept` exits 0 within ~2s on a real cluster without ever running the steering agent — a silent no-op. Two stacked defects:

1. **Protocol corruption:** the ksail binary links `github.com/derailed/k9s/cmd`, whose package `init()` does `fmt.Printf("Fail to init k9s logs location …")` — **to stdout** — whenever the k9s state dir is not creat

[Read the thread](https://github.com/devantler-tech/ksail/issues/6038) · 2026-07-11 · closed · outside contributor · 1 comment

### workload mirror Ctrl-C skips the capture summary

## Description

`ksail workload mirror` tells users that Ctrl-C stops the capture and documents that a file capture is summarized on stop. The current root execution path does not install a signal-aware context for this command, so SIGINT terminates the process with status 130 before `finishCapture` and `summarizeMirrorFile` run.

This also prevents an end-to-end smoke test from treating the documented Ctrl-C path as a clean completion; the test must currently assert the flushed PCAP contents be

[Read the thread](https://github.com/devantler-tech/ksail/issues/6005) · 2026-07-10 · closed · outside contributor · 1 comment

### ci: add a secret-gated EKS smoke workflow

> 🤖 Generated by the Daily AI Engineer

Parent: #4328

## Problem

The EKS provider epic still lacks a CI smoke-test entry point. The full provider code is mostly present, but there is no workflow that can validate a real EKS create/info/delete path once AWS CI credentials are available. Adding an always-on scheduled lane before credentials and a spend envelope exist would create recurring red noise.

## Proposed direction

Add a manual `System Test - EKS` workflow that:

- skips cleanly when `A

[Read the thread](https://github.com/devantler-tech/ksail/issues/5996) · 2026-07-10 · closed · outside contributor · 0 comments

### bug(autoscaler): ignoreDaemonsetsUtilization & skipNodesWith* not wired into detector reverse-parse or cluster-update diff

> 🤖 Generated by the Daily AI Assistant

## Problem
Three recently-added `NodeAutoscalerConfig` pass-through fields are rendered at **install** but are missing from two downstream paths, unlike the older siblings (`expander`, `maxNodesTotal`, `scaleDownUnneededTime`, `capacityBuffers`) which are wired everywhere:

- `ignoreDaemonsetsUtilization`
- `skipNodesWithLocalStorage`
- `skipNodesWithSystemPods`

Neither is:
1. **reverse-parsed by the detector** — `pkg/svc/detector/component.go` `parseAut

[Read the thread](https://github.com/devantler-tech/ksail/issues/5867) · 2026-07-06 · closed · outside contributor · 1 comment

### feat(mirror): Phase 2 intercept — tunnel frame codec (multiplexing wire format)

> 🤖 Generated by the Daily AI Assistant

**Part of #4521** (local-remote service mirroring — Phase 2 *intercept*).

## Problem
Phase 1 (mirror-only) is complete: inbound traffic is captured read-only and replayed to the local process (`workload mirror`, last increment #5794's `--to` live replay). Phase 2 — *intercept* — must **return the local process's responses back into the cluster**, which the read-only mirror path deliberately cannot do (`pkg/svc/mirror/doc.go` Phase 2 note; `inject.go` "th

[Read the thread](https://github.com/devantler-tech/ksail/issues/5808) · 2026-07-05 · closed · outside contributor · 1 comment

### feat(workload): configure CEL rules via spec.workload.validation.rules

> 🤖 Generated by the Daily AI Assistant

### Problem
`ksail workload validate` can run CEL rules today, but only via the `--rules <file>` flag (shipped in #5773). Its sibling validation options — `spec.workload.validation.skipKinds` and `spec.workload.validation.schemaLocations` — are configurable declaratively in `ksail.yaml`, so `ksail workload validate` (no args) acts as a turnkey CI gate. CEL rules are the odd one out: a repo that wants rule validation must pass `--rules` on every invocation

[Read the thread](https://github.com/devantler-tech/ksail/issues/5781) · 2026-07-04 · closed · outside contributor · 0 comments

### Wire native CEL-rule validation into `workload validate` (--rules flag)

> 🤖 Generated by the Daily AI Assistant

## Problem

The CEL rule engine foundation (`pkg/svc/gitops/.../celrules`, merged via #5707) can load a YAML rules file, compile CEL expressions, and evaluate them against decoded documents with per-rule severity — but it is **not wired into the `workload validate` command**. Today `workload validate` only runs kubeconform + Helm render + Flux substitution; there is no way for a user to run their own CEL policy rules over the rendered GitOps layers.

This

[Read the thread](https://github.com/devantler-tech/ksail/issues/5772) · 2026-07-03 · closed · outside contributor · 0 comments

### feat: wire the Phase-1 mirror capture into a `workload mirror` command

> 🤖 Generated by the Daily AI Assistant

**Problem:** every Phase-1 mirror primitive from #4521 has merged (`ResolveTarget`, `SelectTapPoint`, `InjectTap`/`WaitForTap`, `CaptureCommand`, `RunCaptureSession`, `SummarizeCapture`) but none of it is reachable — there is no `ksail workload mirror` command, so the capability ships in the binary without a user-facing entry point.

**Proposal:** add `ksail workload mirror <deployment>` (dev-loop group) that chains the primitives end-to-end in mirror-onl

[Read the thread](https://github.com/devantler-tech/ksail/issues/5741) · 2026-07-03 · closed · outside contributor · 0 comments

### Move add-environment from the cluster group to the project group

> 🤖 Generated by the Daily AI Assistant

Part of #5626 (the `project` / `cluster` / `workload` command-taxonomy reorg).

## Problem

`add-environment` clones a GitOps environment on disk — it never touches a live cluster — so it belongs under the new `project` group (GitOps-project-files-only), not `cluster` (running-cluster lifecycle). It currently lives at `ksail cluster add-environment`. The empty `project` group was scaffolded in #5630 with the note that `add-environment` moves under it in a

[Read the thread](https://github.com/devantler-tech/ksail/issues/5633) · 2026-07-01 · closed · outside contributor · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/devantler-tech/ksail/issues).