- trigger: CronJob moved to deployNS (sless-fn-{userNS}), was tr.Namespace
Reason: with NetworkPolicy default-deny, pod in user-ns can't reach
Service in sless-fn-ns. Co-locating CronJob with Service guarantees
connectivity regardless of NetworkPolicy configuration.
handleTriggerDeletion updated consistently.
- trigger: pin curlimages/curl to 8.5.0 (was :latest)
Reason: reproducibility, no unexpected behavior changes from image updates.
- function: sort env vars in buildDeployment (was non-deterministic map range)
Reason: non-deterministic order caused k8s to detect container spec 'change'
on every reconcile → unnecessary pod restarts. Sorted order is stable.
- function: cleanup kaniko Job in handleDeletion
Reason: if Function deleted during Building phase, kaniko Job continued
running, wasting CPU/memory and pushing an unused image.
- invoke: filter hop-by-hop headers in proxy response (RFC 2616 §13.5.1)
Reason: Transfer-Encoding especially dangerous — forwarding it corrupts
response body framing for the client.
- config: SLESS_API_TOKEN no longer required
Reason: dead code — field loaded but never passed to any component.
Auth uses validateJWT() middleware, not static token.
Namespace lifecycle: user namespaces preserved on destroy (not changed).
E2E: apply 4 resources + destroy clean. Operator v0.1.22 deployed.
After trigger/function destroy the Service is deleted, DNS lookup fails with
'no such host'. Previously InvokeFunction returned 502 which kept the test
script retrying for 120s. Now returns 404 — endpoint removed, test passes.
Operator: naeel/sless-operator:v0.1.18
Naeel