Issues

• KCC 1.159.0 IAMServiceAccount CRD has no spec.projectRef; krops manifests set it - kcc-identity red 13/13, workload resources blocked

  area:bootstrapbug
  polarsquad/krops#643 · Filter by author shrinedogg opened on Oct 19, 2026

• GCP bootstrap blocked: CAPG v1.13.1 generateToken fails with the keyless WIF credential (empty account ID) - cluster kubeconfig secrets never created

  area:bootstrapbug
  polarsquad/krops#642 · Filter by author shrinedogg opened on Oct 19, 2026

• GKE acceptance run blocked: CAPG v1.13.1 GCPManagedMachinePool reconciles zonal pools via the regional path (NodePoolLocation drops the zone)

  area:bootstrapbug
  polarsquad/krops#641 · Filter by author shrinedogg opened on Oct 19, 2026

• bootstrap runs are not host-multiplexable: fixed kind cluster name 'mgmt' + shared ~/.kube/config make concurrent profile runs mutually destructive

  area:bootstrapbug
  polarsquad/krops#640 · Filter by author shrinedogg opened on Oct 19, 2026

• fix(toolbox): default toolbox path broken - GHCR :latest stale (mise 2026.10.3) vs main's self-pin (2026.10.8); first mise-shim tool call fails

  area:bootstrapbug
  polarsquad/krops#639 · Filter by author shrinedogg opened on Oct 19, 2026

• fix(toolbox): bare aws in the toolbox container does not resolve (mise shim without env layer); EIP quota preflight fails

  area:bootstrapbug
  polarsquad/krops#635 · Filter by author shrinedogg opened on Oct 19, 2026

• fix(airgap): flux-operator chart pin stale at 0.58.0 in airgap generator + zarf.yaml; nightly air-gapped run red

  area:airgapbug
  polarsquad/krops#633 · Filter by author shrinedogg opened on Oct 19, 2026

• ci: aws-orphan-report fails on every scheduled run: pinned mise 2026.9.12 is below min_version 2026.10.8

  area:ciarea:operationsbugpriority:medium
  polarsquad/krops#631 · Filter by author shrinedogg opened on Oct 19, 2026 · 6-operations-and-recovery

• air-gapped: scheduled workflow is failing

  area:airgaparea:cibugpriority:high
  polarsquad/krops#612 · Filter by author github-actions opened on Oct 19, 2026 · 4-hardening
  3

• airgap: failure-mode test: storage pressure during staging and cutover

  area:airgapenhancement
  polarsquad/krops#610 · Filter by author lmilbaum opened on Oct 16, 2026 · 4-hardening
  

• airgap: failure-mode test: certificate rotation mid-lifecycle

  area:airgapenhancement
  polarsquad/krops#609 · Filter by author lmilbaum opened on Oct 16, 2026 · 4-hardening
  

• airgap: failure-mode test: unavailable external DNS

  area:airgapenhancement
  polarsquad/krops#608 · Filter by author lmilbaum opened on Oct 16, 2026 · 4-hardening
  

• airgap: failure-mode test: stale system clock

  area:airgapenhancement
  polarsquad/krops#607 · Filter by author lmilbaum opened on Oct 16, 2026 · 4-hardening
  

• airgap: record exact dependency graph per build as a retained artifact

  area:airgapenhancement
  polarsquad/krops#606 · Filter by author lmilbaum opened on Oct 16, 2026 · 4-hardening
  

• fix(toolbox): lifecycle mise run calls auto-install go and zarf at runtime

  area:bootstrapbug
  polarsquad/krops#601 · Filter by author lmilbaum opened on Oct 12, 2026 · 8-bootstrap-correctness

• ci: konflate 'Rendered Flux diff' fails on GCP tree: CRS-delivered cluster-vars ConfigMap not visible to the dependency resolver

  area:cibugstatus:blocked
  polarsquad/krops#554 · Filter by author shrinedogg opened on Oct 8, 2026 · 5-validation-and-tooling

• security: pin KCC operator OCIRepository by digest (tamper-evident), not just tag

  area:renovateenhancementstatus:design
  polarsquad/krops#550 · Filter by author shrinedogg opened on Oct 8, 2026 · 4-hardening

• ci: add workflow_dispatch retry path to toolbox-release.yml

  area:cienhancementpriority:medium
  polarsquad/krops#545 · Filter by author shrinedogg opened on Oct 7, 2026 · 5-validation-and-tooling

• fix(azure): azure-identity substitutes from azure-vars but also applies it, so it never builds on a fresh cluster

  area:environmentsbug
  polarsquad/krops#507 · Filter by author masimalmi-ps opened on Oct 1, 2026 · 3-environments
  1

• fix(azure): arc-federate returns before the restarted apiserver is up, so the Flux install hits connection refused

  area:bootstrapbug
  polarsquad/krops#506 · Filter by author masimalmi-ps opened on Oct 1, 2026 · 8-bootstrap-correctness

• fix(aws): run-tag fallbacks never apply when the krops-run ConfigMap is absent

  area:operationsbugpriority:low
  polarsquad/krops#505 · Filter by author shrinedogg opened on Oct 1, 2026 · 3-environments

• fix(toolbox): lifecycle aws calls fail with No version is set for shim when MISE_ENV is unset

  area:bootstrapbugpriority:medium
  polarsquad/krops#504 · Filter by author shrinedogg opened on Oct 1, 2026 · 8-bootstrap-correctness

• feat(bootstrap): decide whether to deliver the sops-age key to workload clusters

  area:bootstrapenhancementpriority:lowstatus:design
  polarsquad/krops#498 · Filter by author shrinedogg opened on Oct 1, 2026 · 8-bootstrap-correctness
  1

• fix(teardown): toolbox teardown can't reach the post-pivot local-host management cluster (regression since v0.2.2)

  area:bootstrapbugpriority:medium
  polarsquad/krops#486 · Filter by author masimalmi-ps opened on Sep 29, 2026 · 8-bootstrap-correctness

• fix(toolbox): oci-push fails with "not inside a Git repository" on native Linux Docker (git dubious ownership)

  area:bootstrapbugpriority:medium
  polarsquad/krops#485 · Filter by author masimalmi-ps opened on Sep 29, 2026 · 8-bootstrap-correctness