Bug: jobs-manager re-emits NO_PROXY unmerged (proxy customers)
Found by Cursor Bugbot on the v1.6.0 release PR #235 (release ticket #234), verified by render.
tracebloc.proxyEnv injects a merged, cluster-safe NO_PROXY (user value + cluster-internal entries: .svc, 10.0.0.0/8, 127.0.0.1, …). But jobs-manager's api and pods-monitor containers ALSO run a generic range .Values.env passthrough after proxyEnv, which re-emits a user-set NO_PROXY unmerged. Kubernetes keeps the last duplicate env, so the unmerged copy wins.
Impact
A proxy customer who sets a custom NO_PROXY loses the cluster-internal exemptions → jobs-manager routes in-cluster traffic (mysql-client, requests-proxy, API) through the corporate proxy → client breaks. Medium severity; hits the proxy/hospital archetype #229 targets. Not caught by dev/prod validation (no proxy there) nor existing proxy_env_test (no test set a custom NO_PROXY). Only jobs-manager-deployment.yaml is affected.
Fix
Exclude proxy-owned keys from both passthrough loops via a shared $proxyKeys list so proxyEnv is the sole source; add a proxy_env_test regression (custom NO_PROXY + proxy → single merged NO_PROXY) for both containers.
Validation
helm unittest 195 pass (+1 regression); render-verified single merged NO_PROXY per container; non-proxy passthrough intact; lint + 4-platform render clean.
Bug: jobs-manager re-emits NO_PROXY unmerged (proxy customers)
Found by Cursor Bugbot on the v1.6.0 release PR #235 (release ticket #234), verified by render.
tracebloc.proxyEnvinjects a merged, cluster-safeNO_PROXY(user value + cluster-internal entries:.svc,10.0.0.0/8,127.0.0.1, …). But jobs-manager'sapiandpods-monitorcontainers ALSO run a genericrange .Values.envpassthrough after proxyEnv, which re-emits a user-setNO_PROXYunmerged. Kubernetes keeps the last duplicate env, so the unmerged copy wins.Impact
A proxy customer who sets a custom
NO_PROXYloses the cluster-internal exemptions → jobs-manager routes in-cluster traffic (mysql-client, requests-proxy, API) through the corporate proxy → client breaks. Medium severity; hits the proxy/hospital archetype #229 targets. Not caught by dev/prod validation (no proxy there) nor existingproxy_env_test(no test set a custom NO_PROXY). Onlyjobs-manager-deployment.yamlis affected.Fix
Exclude proxy-owned keys from both passthrough loops via a shared
$proxyKeyslist soproxyEnvis the sole source; add aproxy_env_testregression (custom NO_PROXY + proxy → single merged NO_PROXY) for both containers.Validation
helm unittest 195 pass (+1 regression); render-verified single merged NO_PROXY per container; non-proxy passthrough intact; lint + 4-platform render clean.