fix(ical-proxy): roll out main-926ead0 (2 MiB upstream body cap, REN-294) #1049

2026-09-27T20:45:52Z

Ghost commented

2026-09-27 20:45:52 +00:00

What changed

kubernetes/apps/ical-proxy/deployment.yaml: image main-73b5d97 → main-926ead0, plus the tag comment. One file, no other resources.

Why (REN-294, parent REN-230)

main-926ead0 is the ical-proxy main build that contains:

PR #7 (65ddc6d): the upstream response body is capped at 2 MiB (io.LimitReader); an oversized feed gets 413 instead of being buffered whole into a 256Mi pod. This closes the memory-exhaustion DoS.
PR #10 (926ead0): upstream fetch failures are logged with the host and answered with 502 instead of 500.

Known residual gap, out of scope here: 20 concurrent 2 MiB feeds can still exceed the 256Mi limit.

How verified

65ddc6d is an ancestor of Gitea konairius/ical-proxy main 926ead0.
Registry: GET /v2/konairius/ical-proxy/manifests/main-926ead0 → 200.
Baseline now: 2/2 ready on main-73b5d97, 0 restarts, /health 200.
After merge Atlas checks: rollout on main-926ead0, /health 200, a real feed through /proxy?url=... 200, no OOMKilled restarts.

Impact

Rolling update of a 2-replica Deployment; no Home Assistant, storage, network policy or Flux core change, so no HA window needed.

Revert

Revert this commit (tag back to main-73b5d97); Flux rolls it back.

🤖 Generated with Claude Code

## What changed `kubernetes/apps/ical-proxy/deployment.yaml`: image `main-73b5d97` → `main-926ead0`, plus the tag comment. One file, no other resources. ## Why (REN-294, parent REN-230) `main-926ead0` is the ical-proxy main build that contains: - PR #7 (65ddc6d): the upstream response body is capped at 2 MiB (`io.LimitReader`); an oversized feed gets 413 instead of being buffered whole into a 256Mi pod. This closes the memory-exhaustion DoS. - PR #10 (926ead0): upstream fetch failures are logged with the host and answered with 502 instead of 500. Known residual gap, out of scope here: 20 concurrent 2 MiB feeds can still exceed the 256Mi limit. ## How verified - `65ddc6d` is an ancestor of Gitea `konairius/ical-proxy` main `926ead0`. - Registry: `GET /v2/konairius/ical-proxy/manifests/main-926ead0` → 200. - Baseline now: 2/2 ready on `main-73b5d97`, 0 restarts, `/health` 200. - After merge Atlas checks: rollout on `main-926ead0`, `/health` 200, a real feed through `/proxy?url=...` 200, no OOMKilled restarts. ## Impact Rolling update of a 2-replica Deployment; no Home Assistant, storage, network policy or Flux core change, so no HA window needed. ## Revert Revert this commit (tag back to `main-73b5d97`); Flux rolls it back. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Ghost added 1 commit 2026-09-27 20:45:52 +00:00

fix(ical-proxy): roll out main-926ead0 (2 MiB upstream body cap)

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

1cd4b864ef

main-926ead0 includes ical-proxy PR #7 (REN-230): the upstream response
body is capped at 2 MiB, so an oversized feed gets 413 instead of being
buffered whole into a 256Mi pod. It also includes PR #10: upstream fetch
failures are logged with the host and answered with 502 instead of 500.

Refs: REN-294

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Ghost approved these changes

2026-09-27 20:47:07 +00:00

Ghost left a comment

Approved at 1cd4b864ef. Checked: diff is one file, tag + comment only; upstream konairius/ical-proxy main = 926ead0, contains 65ddc6d (2 MiB cap, server/main.go:38,383-390 -> 413) and PR #10 (502); Woodpecker success on 926ead0; registry manifest main-926ead0 -> 200.

Approved at 1cd4b864ef0946e952c09874550860f0fdf7ce78. Checked: diff is one file, tag + comment only; upstream konairius/ical-proxy main = 926ead0, contains 65ddc6d (2 MiB cap, server/main.go:38,383-390 -> 413) and PR #10 (502); Woodpecker success on 926ead0; registry manifest main-926ead0 -> 200.

Ghost merged commit 2b9e599573 into master

2026-09-27 20:47:08 +00:00

Ghost referenced this issue from a commit

2026-09-27 20:47:10 +00:00

Merge pull request 'fix(ical-proxy): roll out main-926ead0 (2 MiB upstream body cap, REN-294)' (#1049) from atlas/ren-294-ical-proxy-926ead0 into master

review-bot reviewed

2026-09-27 20:47:57 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: unknown), commit 1cd4b864ef0946e952c09874550860f0fdf7ce78.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Single-file change: bumps kubernetes/apps/ical-proxy/deployment.yaml's pinned image tag from main-73b5d97 to main-926ead0 and updates the adjacent explanatory comment to describe the new build's behavior (2 MiB response cap, 502-on-fetch-failure). No other resources touched. This is a low-risk, mechanical rollout of an already-reviewed upstream change, and the diff itself is correct and internally consistent.

🟡 Suggestions

The PR body's residual-gap note ("20 concurrent 2 MiB feeds can still exceed the 256Mi limit") is worth double-checking against resources.limits.memory: 256Mi at kubernetes/apps/ical-proxy/deployment.yaml:78. Nominally 20 × 2 MiB = 40 MiB, well under the limit, so the stated risk likely accounts for decompression/parsing overhead per request rather than raw buffer size — that's plausible but not derivable from this diff alone. Since the PR explicitly scopes this out as a known, accepted gap, it's not blocking here, just flagging for whoever picks up that follow-up.
The claim "65ddc6d is an ancestor of main-926ead0" (upstream konairius/ical-proxy repo) is not verifiable from this checkout since that repo isn't present here. Not a concern for this PR specifically, just noting the verification step relies on external state this review can't confirm.

Tests

No tests are expected or applicable for a pure image-tag/comment bump in a Kustomize manifest; the repo's own verification model for this class of change is the described rollout/health-check plan (baseline vs. post-merge Atlas checks), which is appropriate and matches the pattern used for prior bumps in this same file's comment history.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `CLI default` (complexity: unknown), commit `1cd4b864ef0946e952c09874550860f0fdf7ce78`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Single-file change: bumps `kubernetes/apps/ical-proxy/deployment.yaml`'s pinned image tag from `main-73b5d97` to `main-926ead0` and updates the adjacent explanatory comment to describe the new build's behavior (2 MiB response cap, 502-on-fetch-failure). No other resources touched. This is a low-risk, mechanical rollout of an already-reviewed upstream change, and the diff itself is correct and internally consistent. ## 🟡 Suggestions - The PR body's residual-gap note ("20 concurrent 2 MiB feeds can still exceed the 256Mi limit") is worth double-checking against `resources.limits.memory: 256Mi` at `kubernetes/apps/ical-proxy/deployment.yaml:78`. Nominally 20 × 2 MiB = 40 MiB, well under the limit, so the stated risk likely accounts for decompression/parsing overhead per request rather than raw buffer size — that's plausible but not derivable from this diff alone. Since the PR explicitly scopes this out as a known, accepted gap, it's not blocking here, just flagging for whoever picks up that follow-up. - The claim "`65ddc6d` is an ancestor of `main-926ead0`" (upstream `konairius/ical-proxy` repo) is not verifiable from this checkout since that repo isn't present here. Not a concern for this PR specifically, just noting the verification step relies on external state this review can't confirm. ## Tests No tests are expected or applicable for a pure image-tag/comment bump in a Kustomize manifest; the repo's own verification model for this class of change is the described rollout/health-check plan (baseline vs. post-merge Atlas checks), which is appropriate and matches the pattern used for prior bumps in this same file's comment history. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1049