Release v1.4.5: promote develop → main

[saadqbal]

Release v1.4.5 — promote develop → main

Cuts the v1.4.5 release line. Merging this is not fleet-impacting — the fleet only auto-upgrades once a v1.4.5 GitHub Release is published (triggers release-helm-chart → Pages). So this PR is the staging step; the release publish remains a separate, explicit go.

Headline fix

• fix(#196): allow training-pod egress to the requests-proxy (8888) #197 / training-egress NetworkPolicy blocks training pods from the requests-proxy (8888) #196 — training-egress NetworkPolicy now allows training pods → requests-proxy:8888. Without it, training pods can't report epoch results (Connection refused → CrashLoopBackOff) and all experiments fail. Found live on a fresh client; interim-patched + auto-upgrade suspended on that cluster pending this release.

Also in this release (12 commits ahead of main)

• chore: bump chart 1.4.4 → 1.4.5 (ships #197 training-egress proxy fix) #198 chart bump → 1.4.5
• Installer UX: drop PriorityClass, fix namespace, one-per-machine guard, surface version #192 Installer UX (drop PriorityClass, namespace fix, one-per-machine guard, surface version)
• test(requests-proxy): add helm-unittest coverage for requests-proxy Deployment #194 requests-proxy helm-unittest coverage
• fix(#190): fail image-refresh loudly when the ingestor (ghcr) digest can't resolve #191 image-refresh fails loudly when the ingestor ghcr digest can't resolve
• ci(helm): guard that the pinned ingestor digest is multi-arch (closes #186) #187 guard pinned ingestor digest is multi-arch
• RBAC fixes (resource-monitor always-cluster-scoped ClusterRole; jobs-manager get on configmaps/secrets) + sync merges

Post-merge release steps (release owner)

1. Tag v1.4.5 on main and publish the GitHub Release → release-helm-chart publishes the chart (⚠️ fleet-wide: every client auto-upgrades at :23).
2. Re-enable the interim-patched cluster's auto-upgrade CronJob so it converges onto the chart-managed NetworkPolicy rule:
   kubectl -n tracebloc-amazon patch cronjob tracebloc-amazon-auto-upgrade -p '{"spec":{"suspend":false}}'

🤖 Generated with Claude Code

---

Note

High Risk
Training NetworkPolicy and RBAC changes affect every experiment and node telemetry on upgrade; publishing the v1.4.5 release triggers fleet-wide auto-upgrade, so the requests-proxy egress fix is broadly impactful but misconfiguration could still break training or monitoring.

Overview
Release v1.4.5 bumps the client Helm chart and bundles several fleet- and install-facing fixes.

The headline change adds an explicit training NetworkPolicy egress rule for in-namespace requests-proxy on TCP 8888, so epoch reporting is not blocked by the “external HTTPS only” rule that was denying ClusterIP traffic to the proxy (#196).

Image / ingestor: Pinned ingestor digest is documented as multi-arch and CI adds an ingestor-multiarch job that fails if the pin lacks linux/amd64 + linux/arm64. Image-refresh now counts consecutive ghcr ingestor resolve failures, annotates the jobs-manager deployment, and fails the CronJob after configurable threshold (default 3) instead of skipping silently forever.

RBAC / defaults: Jobs-manager ConfigMap/Secret rules gain get (409 verify/replay paths). Resource-monitor always uses a ClusterRole (removed the clusterScope: false namespaced Role path). PriorityClass is off by default (create: false, empty name) so mysql no longer references it unless opted in.

Installers: Default namespace is fixed to tracebloc (no workspace prompt); TB_NAMESPACE override documented. One-client-per-machine guard blocks install when a different clientId is already deployed cluster-wide. Success/diagnose flows surface chart version via helm list.

Tests/schema updated for image-refresh threshold, priority class defaults, resource-monitor RBAC, mysql priority, and new requests-proxy deployment unittest coverage.

^{Reviewed by Cursor Bugbot for commit ddb233a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 15 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#102 — chore(kanban): declare staging as prod-truth branch via .kanban.yml · author: @LukasWodka · no reviewer assigned
• averaging-service#98 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• cli#49 — Sync develop → main (prepare next release) · author: @aptracebloc · no reviewer assigned
• client-runtime#79 — docs(chore: real merge commit to unblock PR #57 #59): feasibility — delete pod_tokens (and the reconciler)? · author: @saadqbal · no reviewer assigned
• data-ingestors#146 — test(schema): lock category enum to the engine's TaskCategory (anti-drift) · author: @LukasWodka · reviewer: @saadqbal
• data-ingestors#148 — Develop to prod · author: @divyasinghds · reviewer: @saadqbal
• design-system#19 — fix: un-track coverage/ and node_modules/ from git · author: @LukasWodka · no reviewer assigned
• design-system#22 — ci: add Vitest test workflow · author: @LukasWodka · reviewer: @aptracebloc
• design-system#23 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• docs#47 — docs(environment-setup): Installer UX: drop PriorityClass, fix namespace, one-per-machine guard, surface version #192 namespace/workspace flow (hold for client#192) · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ddb233a. Configure here.}