Record RKE2 bootstrap, credential retirement and controller image blocker #53
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/Documentation!53
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/rke2-bootstrap-result"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Reconcile all four RKE2 status pages with verified 2026-10-16 results. Bootstrap deployment 4992 passed with signed rke2-bootstrap-bundle-v0.1.0-r7557, scoped adoption of five inspected matching objects and init 0.73.0 postflight. Routine credential checks 4993/4994 passed; Terraform plan/apply 86/87 retired only the temporary bootstrap JWT login/policy and converged.
Controller build 4995 stopped on 26 image vulnerabilities. Base-images PR #50 is now merged and controller r7589 / kubectl r7590 are published at e262e3732e3065296458ee2c76c279e1ac27e7bb. Release pages and receipt fields were inspected; local checks do not independently verify their signatures. Platform #131 prepares exact digest adoption and the controller build/deploy steps, dependent on workflows #111 being released/promoted to stable-v1 first.
Fresh hosted Platform checks, signed controller bundle publication, exact-release delivery and runtime acceptance remain pending. Bootstrap and Plan source inventories are unchanged; image adoption needs no repeat bootstrap or OpenBao setup. Controller/Plan delivery and node/Core/init upgrades have not occurred. Public pages retain plain references to private repositories without private Forgejo links or secret data.
Validation at
1584fc90d1: npm run check, npm run build -- --webpack, git diff --check and the active native Gitleaks 8.30.1 staged hook passed. Default npm run build was attempted but local Turbopack CSS worker startup failed, including with sandbox escalation; supported webpack mode passed without source/configuration changes. Fresh hosted default-build checks and review remain required.Reviewed the four changed documentation files at
5e1fa3bcc1. The status/decision, platform, delivery, and recovery records consistently distinguish the signed bootstrap build from deployment acceptance: the reported retained-resource ownership guard stopped before namespace creation, adoption, or bundle deployment; the object and field match remain unverified, and scoped adoption requires separate review/approval. The Core/init source transition is not described as a live upgrade. This PR changes documentation only and does not alter a UDS package, gateway/route, admission policy, or scan gate. I did not independently inspect the private platform runs 4988/4989, so this approval is of the documentation treatment, not certification of the cited operational evidence or permission to retry deployment. The PR's source-security and site checks were still pending at review time; they remain separate merge gates.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Record signed bootstrap build and retained-resource blockerto Record successful RKE2 bootstrap and reviewed scoped adoptionFollow-up to the review of
5e1fa3b: commit 536eea1 records the later retained-resource inspection and successful bootstrap run 4992. All four pages now distinguish the resolved ownership blocker and verified bootstrap from still-pending controller/Plan delivery and RKE2/Core upgrades. Work stopped after bootstrap completion as requested.Validation: npm run check, npm run build, git diff --check and the active native Gitleaks 8.30.1 staged hook passed. The commit’s author and committer are kiyi. Fresh hosted checks for this new head are separate; the earlier approval applied to
5e1fa3b. No inline review findings were pending.Reviewed all four changed documentation files at
536eea1351. They now distinguish the signed bootstrap build and the earlier 4989 read-only ownership stop from the subsequent read-only comparison of five matching retained objects plus 28 absent objects and the reported successful scoped-adoption deployment 4992. They retain the important limits: init 0.73.0, no RKE2/Core upgrade or controller/Plan delivery, and routine credential validation still pending. No package, manifests, gateway/route ownership, admission policy, or scan gate changes in this documentation PR; no UDS runtime fix is required here. I have not independently authenticated the private platform run 4992 or cluster state, so this is approval of the documentation treatment, not independent certification of deployment. The current-head source-security and site checks are pending and remain separate merge gates; approval is not merge authorization.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Record successful RKE2 bootstrap and reviewed scoped adoptionto Record RKE2 bootstrap, credential retirement and controller image blockerReviewed the current exact-head source of all four changed documentation pages at
ae2ef1e139, including the subsequent routine credential checks (4993/4994), scoped bootstrap-role retirement (plan/apply 86/87), and the blocked controller build (4995). The pages distinguish the successful signed bootstrap deployment 4992 from the controller/Plan delivery and RKE2/Core upgrades that have not occurred, and retain the image-security blocker (26 vulnerability occurrences, zero scanner errors) and the need for fresh hosted image acceptance, signed publication, and real digest adoption. No source, manifest, UDS package, gateway/route, admission policy, or scan gate changes are in this PR. I have not independently authenticated private platform runs or live cluster state; this approves the bounded documentation treatment, not those operational claims or any deployment. The PR body still says routine credential validation remains pending, while the pages now record 4993/4994 passing; please update that summary as a nonblocking documentation note. Current-head source-security and site checks were pending during review and remain separate merge gates. Approval is not merge authorization.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Follow-up to the prior source review: ae2ef1e reconciles all four current-status pages with verified controller/Plan credential checks 4993/4994 and Terraform retirement plan/apply 86/87. Apply 87 deleted only the temporary bootstrap JWT role/policy and converged. The pages now record controller build 4995’s 26 image blockers and the prepared fix in base-images PR #50, while preserving the initial bootstrap evidence and keeping actual image publication/controller/node/Core delivery separate.
Validation: npm run check, npm run build, git diff --check and active staged Gitleaks 8.30.1 passed. Author/committer and push identity verified as kiyi. The earlier approval applied to the prior head; fresh hosted checks/review are separate for
ae2ef1e.Updated in 1584fc9: all four pages now record the published controller/helper releases and the ordered dependencies on workflows #111 and Platform #131. The PR description is reconciled with the passing routine credential checks and retired temporary bootstrap login, addressing the prior summary note. Bootstrap/Plan source inventories remain unchanged; no repeat bootstrap or Terraform setup is needed for image adoption. No controller/Plan/node/Core deployment is claimed.
Validation: npm run check, supported npm run build -- --webpack, git diff --check and active native Gitleaks 8.30.1 passed. Default Turbopack build was attempted but its local CSS worker failed, including after sandbox escalation; no repository build configuration was changed. Hosted default-build checks and review of this new head remain required. No inline review findings were pending.
Reviewed all four changed documentation pages at
1584fc90d1and the live PR summary. The prior summary inconsistency is corrected. The pages separate the reported successful signed bootstrap deployment 4992 and routine credential/temporary-role retirement (4993/4994 and 86/87) from the blocked controller build 4995, later controller/helper image publication, and still-pending exact-digest adoption, signed controller delivery, and runtime acceptance. They retain init 0.73.0 as installed and do not claim controller/Plan or node/Core upgrades occurred. This is documentation only: no UDS package, gateway/route ownership, admission policy, or scan gate changes. The changed-files API omitted patch hunks, so I inspected the exact-head source of each changed page; I have not independently authenticated the private platform/base-images run artifacts or verified image signatures or live cluster state. Approval concerns the bounded documentation treatment, not certification of those operations or deployment authorization. Current-head source-security and site checks are pending; required CI remains a separate merge gate.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.