Record controller exemption denial and prepared RBAC recovery #55

Merged

gitchegumi merged 2 commits from kiyi/rke2-delivery-progress into main

2026-10-17 11:41:15 -05:00

kiyi commented

2026-10-17 07:37:58 -05:00

Member

Describe the prepared namespace-scoped exemption list/watch correction and its application through existing reviewed bootstrap delivery. Preserve named writes and Secret restrictions. Record temporary authorization, signed bootstrap delivery, routine validation, authorization retirement and controller retry as pending work. The existing controller runtime bundle remains reusable.

Validation: npm run check, npm run build, diff checks and the Gitleaks 8.30.1 hook passed. Documentation only; no deployment, apply or live Role change is performed.

Update the dated RKE2 status pages for the promoted diagnostic release and the identified exemption-readiness permission failure. Explain that uds.dev names a Kubernetes API group rather than a development environment. Keep failed delivery distinct from successful controller acceptance. Describe the prepared namespace-scoped exemption list/watch correction and its application through existing reviewed bootstrap delivery. Preserve named writes and Secret restrictions. Record temporary authorization, signed bootstrap delivery, routine validation, authorization retirement and controller retry as pending work. The existing controller runtime bundle remains reusable. Validation: npm run check, npm run build, diff checks and the Gitleaks 8.30.1 hook passed. Documentation only; no deployment, apply or live Role change is performed.

kiyi added 1 commit

2026-10-17 07:37:58 -05:00

Record controller exemption denial and prepared RBAC recovery

Source security / pipeline (pull_request) Has been cancelled

Details

Source security / security (pull_request) Has been cancelled

Details

Documentation site checks / validate (pull_request) Has been cancelled

Details

efa18ebb9c

kiyi added 1 commit

2026-10-17 07:38:56 -05:00

Merge branch 'main' of ssh://forgejo-kiyi/Homelab/Documentation into kiyi/rke2-delivery-progress

Documentation site checks / validate (pull_request) Successful in 59s

Details

Source security / security (pull_request) Successful in 1m45s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

c6e465a3ca

kiyi added this to the Homelab Roadmap project

2026-10-17 07:39:21 -05:00

portegumi approved these changes

2026-10-17 07:39:46 -05:00

portegumi left a comment

Reviewed the four changed documentation files at c6e465a3ca. The record identifies the 5015 denial as namespaced uds.dev/exemptions list access (not a dev-environment issue), distinguishes the failed controller delivery from acceptance, limits the proposed correction to namespace-scoped list/watch while preserving named writes and Secret restrictions, and retains reviewed Terraform authorization, signed bootstrap Role delivery, routine validation, retirement, and controller retry as pending. No deployment manifests or policy are changed by this PR. Source approval only: current source-security and site checks are pending; this does not approve deployment or merge. Forgejo did not expose patch hunks, and I did not independently validate the historical private run or live-cluster claims.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the four changed documentation files at c6e465a3ca7851ce5daec49dc89271535a2afd15. The record identifies the 5015 denial as namespaced `uds.dev/exemptions` list access (not a dev-environment issue), distinguishes the failed controller delivery from acceptance, limits the proposed correction to namespace-scoped list/watch while preserving named writes and Secret restrictions, and retains reviewed Terraform authorization, signed bootstrap Role delivery, routine validation, retirement, and controller retry as pending. No deployment manifests or policy are changed by this PR. Source approval only: current source-security and site checks are pending; this does not approve deployment or merge. Forgejo did not expose patch hunks, and I did not independently validate the historical private run or live-cluster claims. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.