Loading today’s stories
Build1 distinct publisher2 min readUpdated
A dev.to walkthrough gates cluster-proxy agent images through Placement decision groups. The hub-side proxy-server image ships the moment helm upgrade returns.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
What does the gating here is a hash comparison. A change to `proxyAgent.image` moves the spec hash of the proxyAgent config, and the OCM add-on manager watches that hash [8]. It sets `Configured=True` on the ManagedClusterAddOn in the current decision group only, after which the cluster-proxy manager renders the agent chart and writes a ManifestWork [10]. The spoke work-agent applies it, updates the proxy-agent Deployment, and reports Applied and Available back to the ManifestWork, which in turn tells the rollout that the hash matches and the agent is Ready [11]. Success plus a `minSuccessTime` of 5m is what releases the next group [5][9]. The loop closes on spoke status, so a cluster that goes quiet does not fail its group, it parks it.
Anything Helm writes on the hub skips all of that. The same upgrade that changes the tag to vX.Y.Z rewrites the cluster-proxy-addon-manager Deployment and the ManagedProxyConfiguration spec directly [7], and `proxyServer.image`, which lives in that spec and drives the hub proxy-server Deployment, is marked in the author's own diagram as not part of the rollout [8]. One tag bump is therefore half staged. On the example values, a clean run holds at least 10 minutes after dev before prod's ManifestWork is written, and 15 minutes of enforced wait in total [14]. For that window the hub runs the new proxy-server against the previous proxy-agent on every cluster the rollout has not reached [17]. Hub-to-agent skew is the failure a dev group exists to find, and it is the one combination this sequencing cannot rehearse.
Order is positional. The Placement controller assigns index 0 to dev, 1 to stg and 2 to prod because that is the sequence the `decisionGroups` entries appear in, and ProgressivePerGroup follows the index [4]. The names carry no meaning to the controller, so any tooling that normalises or sorts that list rewrites the plan: sorted alphabetically the three come out dev, prod, stg, which promotes prod to second [16]. Group membership is label-driven as well [3], so a cluster carrying `environment: dev` [2] joins the first group regardless of what it actually is.
The published text stops mid-word at the ManagedProxyConfiguration update [13], which is the step that would show which fields of that object feed the hash. The diagram names two, one staged and one not [8]. For every other field in that spec, and for any other add-on, how much of a change can be gated is an empirical question about where each value is consumed on the way to a spoke, not a property of ProgressivePerGroup.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
The dev.to post combines ProgressivePerGroup with Placement decision groups to roll out add-on configuration changes in the order dev, stg, prod, using cluster-proxy as the worked example.
ManagedCluster resources dev-cluster, stg-cluster and prod-cluster each carry the labels cluster-proxy: enabled and environment set to dev, stg or prod, with hubAcceptsClient true and leaseDurationSeconds 60.
The Placement selects clusters labelled cluster-proxy: enabled whose environment is in dev, stg or prod, sets decisionStrategy.groupStrategy.clustersPerDecisionGroup to 100%, and defines three decisionGroups named dev, stg and prod, each selected by the environment label.
Rollout order is determined by the order of entries under decisionGroups; the Placement controller assigns group index 0 to dev, 1 to stg and 2 to prod, and ProgressivePerGroup distributes the configuration in that order.
The cluster-proxy ClusterManagementAddOn sets rolloutStrategy type ProgressivePerGroup with minSuccessTime 5m, progressDeadline 15m and maxFailures 0.
The same ClusterManagementAddOn carries the annotation addon.open-cluster-management.io/lifecycle: addon-manager, lists defaultConfigs pointing at the managedproxyconfigurations resource named cluster-proxy in group proxy.open-cluster-management.io, and uses installStrategy type Placements referencing cluster-proxy-placement in the open-cluster-management namespace.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Verbatim config, one unverified tutorial
Strong specificity: complete ManagedCluster, Placement, ClusterManagementAddOn and ManagedProxyConfiguration manifests, exact rollout parameters (minSuccessTime 5m, progressDeadline 15m, maxFailures 0), a control-flow diagram, and kubectl commands to verify group indexes. Weak corroboration: a single dev.to post with no upstream documentation, release note, logs or command output, and the supplied text is truncated mid-word before the verification wrap-up, so the described sequence is asserted rather than demonstrated.
No adoption signal in sources
The supplied material is a configuration walkthrough. It reports no release, deployment, usage disclosure, benchmark, pricing or licence event — no cluster counts, no organisations running the pattern, not even confirmation that the author executed the rollout in a real fleet. Nothing in the sources supports an adoption measurement.
Mechanics honest, staging scope narrower than it reads
Slightly overstated rather than inflated. The article self-discloses the main limitation — its own diagram labels proxyServer.image "not part of rollout" — so the framing is not deceptive, but the headline promise of ordered dev → stg → prod delivery covers only the fields the config spec hash touches, while the hub-side addon-manager and proxy-server images ship the instant helm upgrade returns. Add that no rollout is shown actually progressing and the truncated text omits verification, and the claimed safety of the pattern runs modestly ahead of what is demonstrated.
Unsponsored community how-to
Low distortion pressure visible in the source: an individual-author dev.to walkthrough about an open-source project's own APIs, with no product being sold, no vendor named as sponsor, no pricing or licensing pitch, and container images referenced from the project's public registry. The residual incentive is ordinary developer-blog reputational and engagement benefit, which favours presenting the pattern as working — consistent with the absence of failure-mode and rollback coverage.
Config claims solid, outcomes unproven
High confidence in the configuration-level facts, which are quoted verbatim and internally consistent across YAML, prose and diagram, and in the derived timing and skew arithmetic that follows directly from them. Confidence is held down by the single-publisher cluster, the absence of any adoption or runtime evidence, the truncated source text, and the unresolved discrepancy over where the supplied text is cut off.
build
A NetworkPolicy in another repo broke invoicing while every dashboard reported success1 distinct publisher
build
Thirteen tasks green, then "give up (Recommended)" on the one that needed understanding1 distinct publisher
build
One alert, two causes, four green dashboards: the day the stack agreed and was wrong1 distinct publisher
build
A 30-to-45-second timeout change, four approvals, no merge: the cost of a two-person gate1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 24, 2026