Record signed controller build and current RKE2 delivery blockers #54

Merged

gitchegumi merged 2 commits from kiyi/rke2-delivery-progress into main

2026-10-17 07:31:17 -05:00

kiyi commented

2026-10-16 22:07:25 -05:00

Member

Reconcile all four RKE2 status pages with verified private Platform results. Controller build 5004 published signed rke2-controller-bundle-v0.1.0-r7636; deploys 5005/5007 stopped at adoption/UDS delivery. Workflows #114 is now merged and released/promoted in v1.44.0, and private Platform #132 is merged. Record the exact channel binding separately from the owning source commit.

Fresh controller deploy 5012 exercised automatic signed release selection and passed scans, 77 required/14 forbidden permission probes, init 0.73.0 and ownership preflight. UDS archive deployment failed with kubernetes_authorization; session revocation passed. The denied operation, partial deployment and controller acceptance remain unverified. Workflows #115 prepares safe permission summaries; review/release/promotion and a separately approved retry remain pending.

Plan build 5006 separately failed on 28 blocking findings in the Rancher upgrade image and published no Plan bundle. Preserve successful bootstrap/routine identity/temporary-role retirement evidence and the owner-selected upgrade order. Detailed procedures remain in owning repositories; public pages contain no private repository links or secret values.

Validation at head 7842245: npm run check, npm run build (default Turbopack), diff checks and the active Gitleaks 8.30.1 hook passed. Documentation only; no runtime configuration, manual Actions dispatch or deployment changes.

Reconcile all four RKE2 status pages with verified private Platform results. Controller build 5004 published signed `rke2-controller-bundle-v0.1.0-r7636`; deploys 5005/5007 stopped at adoption/UDS delivery. [Workflows #114](https://git.gitchegumi.com/Homelab/workflows/pulls/114) is now merged and released/promoted in `v1.44.0`, and private Platform #132 is merged. Record the exact channel binding separately from the owning source commit. Fresh controller deploy 5012 exercised automatic signed release selection and passed scans, 77 required/14 forbidden permission probes, init 0.73.0 and ownership preflight. UDS archive deployment failed with `kubernetes_authorization`; session revocation passed. The denied operation, partial deployment and controller acceptance remain unverified. [Workflows #115](https://git.gitchegumi.com/Homelab/workflows/pulls/115) prepares safe permission summaries; review/release/promotion and a separately approved retry remain pending. Plan build 5006 separately failed on 28 blocking findings in the Rancher upgrade image and published no Plan bundle. Preserve successful bootstrap/routine identity/temporary-role retirement evidence and the owner-selected upgrade order. Detailed procedures remain in owning repositories; public pages contain no private repository links or secret values. Validation at head 7842245: `npm run check`, `npm run build` (default Turbopack), diff checks and the active Gitleaks 8.30.1 hook passed. Documentation only; no runtime configuration, manual Actions dispatch or deployment changes.

kiyi added 1 commit

2026-10-16 22:07:25 -05:00

Record signed controller build and current RKE2 delivery blockers

Source security / security (pull_request) Successful in 2m10s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

Documentation site checks / validate (pull_request) Successful in 2m40s

Details

2e1a65746e

kiyi added this to the Homelab Roadmap project

2026-10-16 22:08:06 -05:00

portegumi approved these changes

2026-10-16 22:08:29 -05:00

Dismissed

portegumi left a comment

Reviewed the four changed documentation pages at exact head 2e1a65746e. The controller signed-build record distinguishes publication from failed UDS archive deployment, leaves root cause/partial state/acceptance unverified, and keeps the Rancher Plan-image vulnerability gate separate from the controller/helper image scans. Proposed release selection is labeled pending; installed init/Core baselines and the owner-selected upgrade order remain consistent across pages. Documentation only: no deployment resources, routing, admission policy, or scan gates change. Forgejo did not supply file patch hunks, so this verdict rests on authenticated exact-head full-file source inspection rather than reconstructed base-to-head diffs. Source review approved; pending source-security and site checks remain independent merge gates, and private deployment-run facts were not independently revalidated here.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the four changed documentation pages at exact head 2e1a65746ee7c643ca4ff536d931165283260e64. The controller signed-build record distinguishes publication from failed UDS archive deployment, leaves root cause/partial state/acceptance unverified, and keeps the Rancher Plan-image vulnerability gate separate from the controller/helper image scans. Proposed release selection is labeled pending; installed init/Core baselines and the owner-selected upgrade order remain consistent across pages. Documentation only: no deployment resources, routing, admission policy, or scan gates change. Forgejo did not supply file patch hunks, so this verdict rests on authenticated exact-head full-file source inspection rather than reconstructed base-to-head diffs. Source review approved; pending source-security and site checks remain independent merge gates, and private deployment-run facts were not independently revalidated here. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi added 1 commit

2026-10-16 23:36:19 -05:00

Record v1.44.0 promotion and controller authorization blocker

Documentation site checks / validate (pull_request) Successful in 1m8s

Details

Source security / security (pull_request) Successful in 1m58s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

7842245dd4

portegumi approved these changes

2026-10-16 23:37:34 -05:00

portegumi left a comment

Reviewed the four changed documentation files at exact head 7842245dd4. The newly recorded workflows v1.44.0 channel binding and Platform #132 merge are distinguished from the owning controller deploy 5012: signed-release selection, scans, permissions, init and ownership preflight passed, but UDS archive delivery failed with kubernetes_authorization; denied operation, partial state and controller acceptance are explicitly unverified. Plan build 5006's separate Rancher upgrade-image blockers and absence of a published Plan bundle remain explicit. The bootstrap/routine-identity and temporary-role-retirement history and owner-selected upgrade order are preserved. Documentation only: no UDS resources, gateways/routes, admission policy or required scan gates are modified. Forgejo supplied no patch hunks, so this verdict uses authenticated full-file inspection at this head, not a reconstructed diff; the private deployment logs and reported local validation were not independently rerun. Source approved. Current source-security and site checks remain pending independent merge gates; this is not deployment or scan acceptance.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the four changed documentation files at exact head 7842245dd4013bda4657de8e4b13018e0d694e3d. The newly recorded workflows v1.44.0 channel binding and Platform #132 merge are distinguished from the owning controller deploy 5012: signed-release selection, scans, permissions, init and ownership preflight passed, but UDS archive delivery failed with kubernetes_authorization; denied operation, partial state and controller acceptance are explicitly unverified. Plan build 5006's separate Rancher upgrade-image blockers and absence of a published Plan bundle remain explicit. The bootstrap/routine-identity and temporary-role-retirement history and owner-selected upgrade order are preserved. Documentation only: no UDS resources, gateways/routes, admission policy or required scan gates are modified. Forgejo supplied no patch hunks, so this verdict uses authenticated full-file inspection at this head, not a reconstructed diff; the private deployment logs and reported local validation were not independently rerun. Source approved. Current source-security and site checks remain pending independent merge gates; this is not deployment or scan acceptance. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.