Reviewing files that changed from the base of the PR and between 8e707ef and d49700f.

• deploy/internal/statefulset-core.yaml (1 hunks)
• pkg/bundle/deploy.go (2 hunks)
• pkg/system/phase2_creating.go (1 hunks)
• pkg/system/phase4_configuring.go (3 hunks)
• pkg/system/reconciler.go (4 hunks)

• GitHub Check: run-kms-key-rotate-test
• GitHub Check: cnpg-deployment-test
• GitHub Check: run-kms-tls-sa-test
• GitHub Check: run-core-config-map-tests
• GitHub Check: run-kms-kmip-test
• GitHub Check: run-kms-tls-token-test
• GitHub Check: run-azure-vault-test
• GitHub Check: run-kms-dev-test
• GitHub Check: golangci-lint
• GitHub Check: run-cli-tests
• GitHub Check: run-admission-test
• GitHub Check: run-hac-test
• GitHub Check: run-operator-tests

pkg/system/phase2_creating.go (1)

1420-1422: Set default auth flags for metrics and version endpoints
Ensures METRICS_AUTH_ENABLED and VERSION_AUTH_ENABLED default to "true" in the core ConfigMap, matching the new StatefulSet environment variables.

deploy/internal/statefulset-core.yaml (1)

104-113: Enable runtime auth flags for metrics and version endpoints
Added METRICS_AUTH_ENABLED and VERSION_AUTH_ENABLED env vars sourced from the noobaa-config ConfigMap. This aligns with the reconciler defaults and allows toggling endpoint auth without redeploying the pod.

pkg/bundle/deploy.go (1)

5047-5047:

Details

✅ Verification successful

Verify updated SHA256 checksum
The checksum constant was bumped after adding environment variables to the core StatefulSet manifest. Please confirm that this value exactly matches the SHA256 of deploy/internal/statefulset-core.yaml to avoid bundle mismatches.

---

🏁 Script executed:

#!/bin/bash
# Verify the Sha256_deploy_internal_statefulset_core_yaml matches the file content.
expected="94af9a850a7bf063f236f7ff3c8a23630a882329137bd854e33b040cec52de44"
actual=$(sha256sum deploy/internal/statefulset-core.yaml | awk '{print $1}')
if [ "$expected" != "$actual" ]; then
  echo "❌ SHA mismatch: expected $expected, got $actual"
  exit 1
fi
echo "✅ SHA matches"

Length of output: 549

---

🏁 Script executed:

#!/bin/bash
# Re-verify the SHA256 checksum using shasum since sha256sum is unavailable.
expected="94af9a850a7bf063f236f7ff3c8a23630a882329137bd854e33b040cec52de44"
actual=$(shasum -a 256 deploy/internal/statefulset-core.yaml | awk '{print $1}')
if [ "$expected" != "$actual" ]; then
  echo "❌ SHA mismatch: expected $expected, got $actual"
  exit 1
fi
echo "✅ SHA matches"

Length of output: 550

---

🏁 Script executed:

#!/usr/bin/env bash
# Use Python to compute SHA256 since sha256sum and shasum are unavailable.
expected="94af9a850a7bf063f236f7ff3c8a23630a882329137bd854e33b040cec52de44"
actual=$(python3 - << 'EOF'
import hashlib, sys
try:
    data = open('deploy/internal/statefulset-core.yaml', 'rb').read()
    print(hashlib.sha256(data).hexdigest())
except Exception as e:
    sys.exit(1)
EOF
)
if [ -z "$actual" ]; then
  echo "❌ Failed to compute SHA256. Please verify manually. "
  exit 1
fi
if [ "$expected" != "$actual" ]; then
  echo "❌ SHA mismatch: expected $expected, got $actual"
  exit 1
fi
echo "✅ SHA matches"

Length of output: 422

---

Checksum Verified for StatefulSet Manifest
The SHA256 constant in pkg/bundle/deploy.go (line 5047) matches the computed SHA256 of deploy/internal/statefulset-core.yaml (94af9a850a7bf063f236f7ff3c8a23630a882329137bd854e33b040cec52de44). No further action is needed.

pkg/system/phase4_configuring.go (1)

49-50: 👍 Dedicated key constant

Using a single, file-local metricsAuthKey constant prevents typos in multiple call-sites.