mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-11 02:55:51 +00:00
rcourtman
e327e09945
KubernetesCluster RBAC slices were not deep-cloned cloneKubernetesCluster cloned Nodes, Namespaces, Pods, Deployments, and 20+ other slices via dedicated helpers but left Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings aliased to the source slice through the dest := src shallow copy. The final dest.NormalizeCollections() call then iterates over those four slices and writes c.Roles[i] = c.Roles[i].NormalizeCollections() via index assignment, which races with any concurrent clone (or read of the same source). The race detector caught it once the k8s cluster count was bumped from 1 to 3 in7938f28de, which made the contention window wide enough to hit under -race. Fix by deep-cloning the four RBAC slices with append([]T(nil), src...) following the same pattern as the inline slice copies elsewhere in cloneKubernetesCluster. SECURITY.md sensor-wrapper alignment The SMART/SSH feature shipped in8769f07eeupdated the shipped public security doc at frontend-modern/public/docs/SECURITY.md to document the new Pulse-owned /usr/local/sbin/pulse-sensors wrapper forced-command shape for the legacy SSH temperature collection flow, but the source SECURITY.md at the repo root still described the prior command="sensors -j" forced command. The docsLinks test (which compares the two for byte equality) flagged the drift. Align root SECURITY.md and re-sync the shipped copy so both describe the wrapper contract that the setup-script and runtime collector now own.