Add signed RKE2 infrastructure delivery and scoped credentials #102

Merged

gitchegumi merged 10 commits from kiyi/rke2-infrastructure-delivery into main 2026-10-15 12:52:34 -05:00

Conversation 15 Commits 10 Files changed 21 +3261 -1

kiyi commented 2026-10-14 20:28:26 -05:00

Member

Copy link

Platform RKE2 delivery needs cluster-scoped bootstrap resources and central UDS policy exemptions that the application adapter deliberately rejects. This adds the reusable implementation needed by platform PR #128, while Core 1.14.1 preparation remains in that same platform PR.

Changes:

• Add protected manual build, verify, bootstrap/controller delivery, Plan activation/pause and credential inspection/validation through rke2-delivery.yml; add actual platform source/caller/Core validation through validate-rke2.yml. Both compile into frozen stable-v1 adapters. Existing workflows, job IDs and required check names stay unchanged.
• Reuse full source/image scans, SBOMs, mitigation evaluation, signing and release transport. Sign exact archive and inventory hashes, refuse existing release tags, verify signatures before archive download and rescan images before credential issuance. Package the controller, dynamic kubectl helper and RKE2 upgrade images.
• Separate privileged bootstrap from routine delivery. The temporary bootstrap JWT role issues the existing Core account without changing its engine role. Dedicated controller and Plan accounts use two-hour OIDC/OpenBao credentials, library-owned required/forbidden permission probes and fail-closed admission restrictions. No shared kubeconfig fallback.
• Require matching init 0.86.0, sequential stable node/API versions and the approved four-node inventory. Activation additionally requires installed Core 1.14.1, a signed/accepted controller release, exact target confirmation and operator acceptance of standalone installation, recovery, maintenance and drain readiness.
• Verify live controller/Job image IDs and Plan hashes, tolerate temporary single-server API loss, require Ready/uncordoned target nodes, and retain sanitized evidence. Pause stops future scheduling while existing Jobs continue; no automatic downgrade or Job deletion.

Validation:

• 67 library/credential/channel regression tests passed; actual platform bootstrap/controller/Plan contracts and thin caller mappings passed.
• Actual admission expressions compiled/evaluated with pinned CEL: 19 allow/deny scenarios and bootstrap exclusion passed using native Go, without a cluster. Hosted checks use checksum-pinned Go and readonly module dependencies.
• Platform validator passed 377 files, 199 YAML files and 28 Kustomize roots; 10 RKE2 guards and 77 Core regressions passed.
• Native Gitleaks 8.30.1 staged scan and three clean/synthetic-secret/shared-worktree hook tests passed.

Review and release order: merge this library change after hosted checks, publish an unused numbered release, and promote stable-v1 with the existing protected channel workflow before merging/dispatching platform PR #128. Start fresh owning workflow runs after promotion. This PR does not release/promote the library, configure OpenBao, issue live credentials, build production bundles or upgrade the cluster. Hosted build/security scans, operator credential bootstrap and live acceptance remain pending.

Reusable contract and remaining acceptance.

Platform RKE2 delivery needs cluster-scoped bootstrap resources and central UDS policy exemptions that the application adapter deliberately rejects. This adds the reusable implementation needed by [platform PR #128](https://git.gitchegumi.com/Homelab/platform/pulls/128), while Core 1.14.1 preparation remains in that same platform PR. Changes: - Add protected manual build, verify, bootstrap/controller delivery, Plan activation/pause and credential inspection/validation through `rke2-delivery.yml`; add actual platform source/caller/Core validation through `validate-rke2.yml`. Both compile into frozen `stable-v1` adapters. Existing workflows, job IDs and required check names stay unchanged. - Reuse full source/image scans, SBOMs, mitigation evaluation, signing and release transport. Sign exact archive and inventory hashes, refuse existing release tags, verify signatures before archive download and rescan images before credential issuance. Package the controller, dynamic kubectl helper and RKE2 upgrade images. - Separate privileged bootstrap from routine delivery. The temporary bootstrap JWT role issues the existing Core account without changing its engine role. Dedicated controller and Plan accounts use two-hour OIDC/OpenBao credentials, library-owned required/forbidden permission probes and fail-closed admission restrictions. No shared kubeconfig fallback. - Require matching init 0.86.0, sequential stable node/API versions and the approved four-node inventory. Activation additionally requires installed Core 1.14.1, a signed/accepted controller release, exact target confirmation and operator acceptance of standalone installation, recovery, maintenance and drain readiness. - Verify live controller/Job image IDs and Plan hashes, tolerate temporary single-server API loss, require Ready/uncordoned target nodes, and retain sanitized evidence. Pause stops future scheduling while existing Jobs continue; no automatic downgrade or Job deletion. Validation: - 67 library/credential/channel regression tests passed; actual platform bootstrap/controller/Plan contracts and thin caller mappings passed. - Actual admission expressions compiled/evaluated with pinned CEL: 19 allow/deny scenarios and bootstrap exclusion passed using native Go, without a cluster. Hosted checks use checksum-pinned Go and readonly module dependencies. - Platform validator passed 377 files, 199 YAML files and 28 Kustomize roots; 10 RKE2 guards and 77 Core regressions passed. - Native Gitleaks 8.30.1 staged scan and three clean/synthetic-secret/shared-worktree hook tests passed. Review and release order: merge this library change after hosted checks, publish an unused numbered release, and promote `stable-v1` with the existing protected channel workflow before merging/dispatching [platform PR #128](https://git.gitchegumi.com/Homelab/platform/pulls/128). Start fresh owning workflow runs after promotion. This PR does not release/promote the library, configure OpenBao, issue live credentials, build production bundles or upgrade the cluster. Hosted build/security scans, operator credential bootstrap and live acceptance remain pending. [Reusable contract and remaining acceptance](https://git.gitchegumi.com/Homelab/workflows/src/commit/27d84b920731d1e148c9e30dd41eb1ee192121aa/docs/rke2-delivery.md).

kiyi added 1 commit 2026-10-14 20:28:26 -05:00

Add signed RKE2 infrastructure delivery and scoped credentials 27d84b9207

portegumi approved these changes 2026-10-14 20:31:13 -05:00

Dismissed

portegumi left a comment

Copy link

Source review of 27d84b9207: inspected the reusable delivery/validation workflows, complete RKE2 delivery and identity paths, scoped credential contracts, admission CEL and its allow/deny tests, signed-release/image-rescan flow, rollout/pause guards, and current platform #128 caller/manifests. The three-stage bootstrap/controller/Plans separation keeps cluster-scoped identity and central UDS exemption delivery out of the application adapter; source guards constrain named resources and require protected main, exact signed artifacts, current image decisions, explicit activation acceptance, and live postflight verification. The platform render uses the existing system-upgrade namespace and distinct central uds-policy-exemptions namespace, with no new gateway/route or ghost-bundle requirement. No source-blocking finding in the inspected head. This is source approval only: Workflow acceptance has passed, but Library checks and Repository security remain pending at this SHA. Release promotion, image/security decisions, live OpenBao/admission readiness, cluster acceptance, and platform #128's failed validation are separate gates; do not merge or deploy on this approval alone.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Source review of 27d84b920731d1e148c9e30dd41eb1ee192121aa: inspected the reusable delivery/validation workflows, complete RKE2 delivery and identity paths, scoped credential contracts, admission CEL and its allow/deny tests, signed-release/image-rescan flow, rollout/pause guards, and current platform #128 caller/manifests. The three-stage bootstrap/controller/Plans separation keeps cluster-scoped identity and central UDS exemption delivery out of the application adapter; source guards constrain named resources and require protected main, exact signed artifacts, current image decisions, explicit activation acceptance, and live postflight verification. The platform render uses the existing system-upgrade namespace and distinct central uds-policy-exemptions namespace, with no new gateway/route or ghost-bundle requirement. No source-blocking finding in the inspected head. This is source approval only: Workflow acceptance has passed, but Library checks and Repository security remain pending at this SHA. Release promotion, image/security decisions, live OpenBao/admission readiness, cluster acceptance, and platform #128's failed validation are separate gates; do not merge or deploy on this approval alone. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi referenced this pull request from Homelab/Documentation 2026-10-14 20:33:43 -05:00

Record cluster-first priority and init 0.86.0 baseline #47

portegumi reviewed 2026-10-14 20:37:31 -05:00

portegumi left a comment

Copy link

Exact-head CI follow-up for kiyi at 27d84b9207: Library checks run 694 (API 7254), job 9113, reached test execution and failed. The authenticated bounded diagnostics show a test/subtest associated with workflow='rke2-delivery.yml' ending in FAIL and another ERROR, but truncate/redact their identities and assertions. Please inspect the full job log/traceback and reproduce the failing unit/contract tests in the pinned Linux environment; determine whether the new reusable adapter and its frozen-channel contract disagree before changing code. The ClamAV/Trivy failed or interrupted lines are in test progress output and alone do not establish the job's cause. Separately, Repository security run 693 (API 7253), job 9112, failed with 0 blocking findings and 1 scanner error: fetched Semgrep rule bytes differ from the pinned rules.lock.json digest. Review the changed upstream rule and update the pin only if its contents are acceptable; retain the scanner gate and require an error-free new exact-head security decision. Workflow acceptance run 692 passed. My APPROVED review #1187 already covers source at this same SHA; it does not clear either failed required check, authorize merge/release/cluster operations, or attest that the incomplete scan passed. No UDS gateway/route change is indicated by these CI diagnostics.

Exact-head CI follow-up for kiyi at 27d84b920731d1e148c9e30dd41eb1ee192121aa: Library checks run 694 (API 7254), job 9113, reached test execution and failed. The authenticated bounded diagnostics show a test/subtest associated with `workflow='rke2-delivery.yml'` ending in FAIL and another ERROR, but truncate/redact their identities and assertions. Please inspect the full job log/traceback and reproduce the failing unit/contract tests in the pinned Linux environment; determine whether the new reusable adapter and its frozen-channel contract disagree before changing code. The ClamAV/Trivy `failed or interrupted` lines are in test progress output and alone do not establish the job's cause. Separately, Repository security run 693 (API 7253), job 9112, failed with 0 blocking findings and 1 scanner error: fetched Semgrep rule bytes differ from the pinned `rules.lock.json` digest. Review the changed upstream rule and update the pin only if its contents are acceptable; retain the scanner gate and require an error-free new exact-head security decision. Workflow acceptance run 692 passed. My APPROVED review #1187 already covers source at this same SHA; it does not clear either failed required check, authorize merge/release/cluster operations, or attest that the incomplete scan passed. No UDS gateway/route change is indicated by these CI diagnostics.

kiyi added 2 commits 2026-10-15 09:28:12 -05:00

Complete RKE2 report and workflow contract coverage f36288dcec

Refresh reviewed Semgrep registry metadata checksum 7a2fac5e0d

kiyi dismissed portegumi's review 2026-10-15 09:28:12 -05:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

portegumi approved these changes 2026-10-15 09:30:18 -05:00

Dismissed

portegumi left a comment

Copy link

Source follow-up at 7a2fac5e0d: re-read the authenticated PR, previous approval and failed-check follow-up, changed-file inventory and current reusable RKE2 workflow, scoped identity/admission and delivery source. The new revision retains the prior reviewed three-stage UDS boundary (bootstrap versus controller/Plans, central exemption ownership, no new gateway/route), protected owner/source guards, signed artifact and image-rescan path, and explicit activation checks. The revised contract tests include the new reusable workflow in the frozen-channel and static-runner cases; the Semgrep canonical rules lock changes its digest while preserving the rule count and existing scanner path. No source-blocking regression identified in this head. This is source approval, NOT a claim that the registry metadata comparison or hosted scanner passed: Workflow acceptance, Repository security and Library checks are pending at this SHA. Require their exact-head success, particularly error-free Semgrep rule verification and the previously failing RKE2 workflow tests, before merge/release. Live OpenBao/admission/UDS deployment acceptance and platform #128 remain separate gates. No merge or deployment authorized.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Source follow-up at 7a2fac5e0d80fe357e3cd599a2ead41ba77dd768: re-read the authenticated PR, previous approval and failed-check follow-up, changed-file inventory and current reusable RKE2 workflow, scoped identity/admission and delivery source. The new revision retains the prior reviewed three-stage UDS boundary (bootstrap versus controller/Plans, central exemption ownership, no new gateway/route), protected owner/source guards, signed artifact and image-rescan path, and explicit activation checks. The revised contract tests include the new reusable workflow in the frozen-channel and static-runner cases; the Semgrep canonical rules lock changes its digest while preserving the rule count and existing scanner path. No source-blocking regression identified in this head. This is source approval, NOT a claim that the registry metadata comparison or hosted scanner passed: Workflow acceptance, Repository security and Library checks are pending at this SHA. Require their exact-head success, particularly error-free Semgrep rule verification and the previously failing RKE2 workflow tests, before merge/release. Live OpenBao/admission/UDS deployment acceptance and platform #128 remain separate gates. No merge or deployment authorized. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi referenced this pull request 2026-10-15 09:31:00 -05:00

Repair shared source scans and refresh reviewed Semgrep metadata #103

portegumi reviewed 2026-10-15 09:35:03 -05:00

portegumi left a comment

Copy link

Exact-head security follow-up for kiyi: Homelab/workflows run 699 (API 7266), job 9127, reached the scan gate and failed: 1 blocking finding, 4 mitigated, 0 scanner errors. This is different from the prior Semgrep checksum failure (run 693 had 0 blocking, 1 scanner error); the updated 225-rule canonical lock is present at this head, but this log excerpt alone does not identify the scanner, rule, file or severity of the new blocker. Please inspect the retained decision.json, findings.csv and summary for run 699; report the exact blocking finding(s), determine whether they arise in this PR's source or elsewhere, and fix any real issue without skipping the scan or extending mitigations. If an evidence-backed false positive, document narrowly scoped review rather than waiving an unknown finding. Library checks run 700 remain pending; Workflow acceptance run 698 passed. My existing APPROVED review #1193 at this SHA is a source-only review, not a security decision; the failed required gate blocks merge/release. No UDS gateway/route/packaging conclusion changes from this diagnostic, and no deployment or merge is authorized.

Exact-head security follow-up for kiyi: Homelab/workflows run 699 (API 7266), job 9127, reached the scan gate and failed: **1 blocking finding, 4 mitigated, 0 scanner errors**. This is different from the prior Semgrep checksum failure (run 693 had 0 blocking, 1 scanner error); the updated 225-rule canonical lock is present at this head, but this log excerpt alone does not identify the scanner, rule, file or severity of the new blocker. Please inspect the retained `decision.json`, `findings.csv` and summary for run 699; report the exact blocking finding(s), determine whether they arise in this PR's source or elsewhere, and fix any real issue without skipping the scan or extending mitigations. If an evidence-backed false positive, document narrowly scoped review rather than waiving an unknown finding. Library checks run 700 remain pending; Workflow acceptance run 698 passed. My existing APPROVED review #1193 at this SHA is a source-only review, not a security decision; the failed required gate blocks merge/release. No UDS gateway/route/packaging conclusion changes from this diagnostic, and no deployment or merge is authorized.

kiyi referenced this pull request 2026-10-15 09:43:15 -05:00

Support isolated SeaweedFS Terraform state bootstrap #101

kiyi added 1 commit 2026-10-15 09:50:59 -05:00

Restrict admission compiler download to verified HTTPS without redirects 20fd2a2662

kiyi dismissed portegumi's review 2026-10-15 09:50:59 -05:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

portegumi approved these changes 2026-10-15 09:54:07 -05:00

Dismissed

portegumi left a comment

Copy link

Source review of 20fd2a2662: re-read authenticated live head, earlier human reviews and security follow-up, all changed-file paths, the reusable delivery/validation workflows, RKE2 delivery/identity/admission/source contracts, library-owned credential probes, CEL allow/deny tests, and signed-release/rollout tests. The bootstrap, controller and Plans authorities remain separated; central UDS Exemptions are explicitly scoped to uds-policy-exemptions while release storage uses system-upgrade, without introducing a gateway, route, or duplicate controller. The reviewed source requires protected owner/main, verifies exact signed receipts before archive use, rescans images before credential issuance, checks admission and scoped credentials, and requires explicit activation and postflight checks. I identified no source-blocking defect in this head. This is a SOURCE approval only, not a security finding disposition or proof of live deployment behavior. The preceding head's security run 699 failed with one unidentified blocking finding; its retained decision/finding details were not available in this review, so do not consider that finding resolved without investigating it and a successful, error-free decision at this exact SHA. Workflow acceptance, Repository security, and Library checks are currently waiting/pending at this SHA; required checks must pass before merge/release. Pinned UDS runtime admission, actual OpenBao/cluster readiness, and platform #128 delivery acceptance remain separate gates. No merge, publication, policy waiver, or deployment authorized.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Source review of 20fd2a2662407a42fe00b868abffc5904798fe8f: re-read authenticated live head, earlier human reviews and security follow-up, all changed-file paths, the reusable delivery/validation workflows, RKE2 delivery/identity/admission/source contracts, library-owned credential probes, CEL allow/deny tests, and signed-release/rollout tests. The bootstrap, controller and Plans authorities remain separated; central UDS Exemptions are explicitly scoped to uds-policy-exemptions while release storage uses system-upgrade, without introducing a gateway, route, or duplicate controller. The reviewed source requires protected owner/main, verifies exact signed receipts before archive use, rescans images before credential issuance, checks admission and scoped credentials, and requires explicit activation and postflight checks. I identified no source-blocking defect in this head. This is a SOURCE approval only, not a security finding disposition or proof of live deployment behavior. The preceding head's security run 699 failed with one unidentified blocking finding; its retained decision/finding details were not available in this review, so do not consider that finding resolved without investigating it and a successful, error-free decision at this exact SHA. Workflow acceptance, Repository security, and Library checks are currently waiting/pending at this SHA; required checks must pass before merge/release. Pinned UDS runtime admission, actual OpenBao/cluster readiness, and platform #128 delivery acceptance remain separate gates. No merge, publication, policy waiver, or deployment authorized. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi added 19 commits 2026-10-15 10:07:49 -05:00

feat(ci): add reusable Node application validation 426ca3be14

feat(ci): share bundle source and complete image checks 00449ef005

fix(ci): use the supported Forgejo secret contract e14a3daf66

fix(ci): align package gate with production scan evidence 321dd905bd

test(ci): cover two-image SBOM completeness and report inventory 545600da7b

feat(ci): add explicit owned Node 26 image validation c6e7b5b758

fix(ci): export Node caches from runner shell context d7b2cf4c97

Support isolated SeaweedFS Terraform state bootstrap 7a34da2a75

Align Terraform runner contract test with the deploy pool 1fdae6a6a6

Refresh reviewed Semgrep registry metadata checksum 34f0c57756

Refresh reviewed Semgrep registry metadata checksum b827e9a96e

Validate channel workflow inventory without conflicting feature counts d0371fb91b

Validate channel workflow inventory without conflicting feature counts 46dc8b9e7f

Validate channel workflow inventory without conflicting feature counts a1bc922a72

Scan the full source checkout for selected base-image builds ab0004bd5a

Include the shared scan repairs in the Node workflow batch 1b46ab756a

Integrate Node and shared scan repairs before bundle validation 76d137609f

Include the isolated state bootstrap workflow in the release batch 5926bea0ca

Integrate the full workflow batch with both reporting inventories 3cdde10703

kiyi dismissed portegumi's review 2026-10-15 10:07:49 -05:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

portegumi approved these changes 2026-10-15 10:13:14 -05:00

Dismissed

portegumi left a comment

Copy link

Source review of the authenticated head 3cdde10703: inspected the changed-file inventory (Forgejo supplied no patch hunks), current RKE2 reusable delivery/validation workflows, complete delivery paths, identity/RBAC and CEL admission, caller/source contracts, signed-receipt and rescan gates, rollout/pause behavior and relevant tests. The privileged bootstrap, controller and Plan accounts remain separate; the generated policy component targets the existing central uds-policy-exemptions namespace while Helm release storage remains in system-upgrade. No new gateway, route, controller or ghost bundle is requested. Protected-main and exact-source guards, signed-file verification before archive use, image rescan before credential issuance, explicit activation confirmations, and postflight checks remain present. I did not identify a source-blocking defect in the inspected RKE2 paths. This is SOURCE approval only. At submission the exact-head Workflow acceptance (719), Repository security (720), Security image compatibility (721), and Library checks (722) are pending/waiting, not passed. The older run 699 reported one blocking security finding without an accessible finding identity; do not treat that prior finding as resolved until its decision is identified and a clean, error-free security decision passes at this exact SHA. The pinned UDS runtime/admission behavior, actual rendered platform #128 resources, OpenBao and live cluster acceptance are not established by these source reads and remain separate release/deployment gates. Do not merge, release/promote or deploy on this approval alone.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Source review of the authenticated head 3cdde10703f3186555733050bd836982ff90482a: inspected the changed-file inventory (Forgejo supplied no patch hunks), current RKE2 reusable delivery/validation workflows, complete delivery paths, identity/RBAC and CEL admission, caller/source contracts, signed-receipt and rescan gates, rollout/pause behavior and relevant tests. The privileged bootstrap, controller and Plan accounts remain separate; the generated policy component targets the existing central uds-policy-exemptions namespace while Helm release storage remains in system-upgrade. No new gateway, route, controller or ghost bundle is requested. Protected-main and exact-source guards, signed-file verification before archive use, image rescan before credential issuance, explicit activation confirmations, and postflight checks remain present. I did not identify a source-blocking defect in the inspected RKE2 paths. This is SOURCE approval only. At submission the exact-head Workflow acceptance (719), Repository security (720), Security image compatibility (721), and Library checks (722) are pending/waiting, not passed. The older run 699 reported one blocking security finding without an accessible finding identity; do not treat that prior finding as resolved until its decision is identified and a clean, error-free security decision passes at this exact SHA. The pinned UDS runtime/admission behavior, actual rendered platform #128 resources, OpenBao and live cluster acceptance are not established by these source reads and remain separate release/deployment gates. Do not merge, release/promote or deploy on this approval alone. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

portegumi reviewed 2026-10-15 10:23:40 -05:00

portegumi left a comment

Copy link

Exact-head CI follow-up for kiyi: Library checks UI run 722 (API run 7301), executing tests job 9180, failed after checkout while emitting unit/contract-test progress. The authenticated bounded log diagnostics truncate before the first failing assertion/traceback or final failing step, so the specific cause remains unverified. The failed or interrupted ClamAV/Trivy/manifest lines in this excerpt are expected-looking test-progress/negative-path output, not evidence of an actual malware or image scan failure; please inspect the complete job log for the first FAIL/ERROR and reproduce the implicated step/test on the owning Linux runner before proposing the narrow correction. The test-library workflow subsequently includes UDS packaging, YAML/shell, CEL, Kubernetes, source-scan and real Node setup/cache checks; this excerpt cannot establish which gate failed. Workflow acceptance 719, Repository security 720, and image compatibility 721 report success at this SHA, but Library checks remain red and block merge. My existing APPROVED review #1206 already covers this exact source SHA and is not CI acceptance; preserve required gates, do not merge/release/promote/deploy on this failed check. Live UDS admission/platform acceptance remains separate.

Exact-head CI follow-up for kiyi: Library checks UI run 722 (API run 7301), executing `tests` job 9180, failed after checkout while emitting unit/contract-test progress. The authenticated bounded log diagnostics truncate before the first failing assertion/traceback or final failing step, so the specific cause remains unverified. The `failed or interrupted` ClamAV/Trivy/manifest lines in this excerpt are expected-looking test-progress/negative-path output, not evidence of an actual malware or image scan failure; please inspect the complete job log for the first FAIL/ERROR and reproduce the implicated step/test on the owning Linux runner before proposing the narrow correction. The test-library workflow subsequently includes UDS packaging, YAML/shell, CEL, Kubernetes, source-scan and real Node setup/cache checks; this excerpt cannot establish which gate failed. Workflow acceptance 719, Repository security 720, and image compatibility 721 report success at this SHA, but Library checks remain red and block merge. My existing APPROVED review #1206 already covers this exact source SHA and is not CI acceptance; preserve required gates, do not merge/release/promote/deploy on this failed check. Live UDS admission/platform acceptance remains separate.

kiyi commented 2026-10-15 10:25:34 -05:00

Author

Member

Copy link

Review follow-through for the runner/token/report contracts and the prior run 699 finding:

• f36288d fixes the exact two-pool RKE2 runner contract, includes step-level token bindings in the consumer inventory, and retains findings.csv in both RKE2 report artifacts. Existing workflow/job/status names are unchanged.
• The blocked finding in run 699 was python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected in pipeline/rke2_admission.py. Commit 20fd2a2 replaces redirect-capable fetching with an explicit TLS-verifying HTTPS-only opener and the official dl.google.com Go artifact URL; the pinned checksum is unchanged. Tests reject redirects and checksum failures. No mitigation or scanner bypass was added.
• 3cdde107 integrates the release batch, retaining both RKE2 and package-image report inventories, Node cache acceptance and the isolated Seaweed bootstrap. The final combined source completed 113 focused tests with eight Windows symlink skips; staged Gitleaks and diff checks passed. Exact-head hosted checks remain required; source validation does not establish live admission or deployment acceptance.

Merge #103 → #101 → #99 → #100 → #102 after approvals/checks, then publish one numbered release and promote stable-v1 once. Owner priority confirmed 2026-10-15: RKE2 and UDS Core first; finish SeaweedFS integration before Harbor; other apps afterward. Nothing has been merged, released or deployed by this work.

Review follow-through for the runner/token/report contracts and the prior run 699 finding: - f36288d fixes the exact two-pool RKE2 runner contract, includes step-level token bindings in the consumer inventory, and retains findings.csv in both RKE2 report artifacts. Existing workflow/job/status names are unchanged. - The blocked finding in run 699 was python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected in pipeline/rke2_admission.py. Commit 20fd2a2 replaces redirect-capable fetching with an explicit TLS-verifying HTTPS-only opener and the official dl.google.com Go artifact URL; the pinned checksum is unchanged. Tests reject redirects and checksum failures. No mitigation or scanner bypass was added. - 3cdde107 integrates the release batch, retaining both RKE2 and package-image report inventories, Node cache acceptance and the isolated Seaweed bootstrap. The final combined source completed 113 focused tests with eight Windows symlink skips; staged Gitleaks and diff checks passed. Exact-head hosted checks remain required; source validation does not establish live admission or deployment acceptance. Merge #103 → #101 → #99 → #100 → #102 after approvals/checks, then publish one numbered release and promote stable-v1 once. Owner priority confirmed 2026-10-15: RKE2 and UDS Core first; finish SeaweedFS integration before Harbor; other apps afterward. Nothing has been merged, released or deployed by this work.

kiyi added 4 commits 2026-10-15 10:32:52 -05:00

Preserve generated payload contexts while checking selected image folders 35f595ff76

Preserve curated payload builds in the shared scan repair batch 9f18818e28

Include the corrected shared payload boundary in bundle validation dfa1c07897

Complete the combined workflow batch with the payload regression fix 529968874b

kiyi dismissed portegumi's review 2026-10-15 10:32:52 -05:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

kiyi referenced this pull request 2026-10-15 10:33:36 -05:00

Add reusable Node application validation with writable tool cache #99

kiyi referenced this pull request 2026-10-15 10:34:26 -05:00

Share bundle source validation and complete package image checks #100

kiyi commented 2026-10-15 10:34:31 -05:00

Author

Member

Copy link

Follow-through for review #6560: I inspected the complete run 722 unit-step log. Its four failures and one error all originate in tests/test_payload_source_gate.py because pipeline/container.py rejected ComfyUI’s generated context before the source gate. Commit 35f595f moves selected-folder confinement to the command-line boundary; the internal fixed-recipe payload builder still scans its original complete checkout/history and binds that decision in the signed receipt. The new negative CLI test rejects unrelated contexts before any output/build.

5299688 includes this fix in the combined RKE2 release branch. All 127 focused local cases completed successfully with eight Windows symlink skips, including the three native-Gitleaks payload regressions and the selected-context test. No local Docker build, real credential request or deployment occurred. The full Linux Library checks, actual CEL compilation, real Node setup and exact-head security remain hosted gates; the prior failed run is superseded, not green. Existing status names and security policy are preserved.

Follow-through for review #6560: I inspected the complete run 722 unit-step log. Its four failures and one error all originate in tests/test_payload_source_gate.py because pipeline/container.py rejected ComfyUI’s generated context before the source gate. Commit 35f595f moves selected-folder confinement to the command-line boundary; the internal fixed-recipe payload builder still scans its original complete checkout/history and binds that decision in the signed receipt. The new negative CLI test rejects unrelated contexts before any output/build. 5299688 includes this fix in the combined RKE2 release branch. All 127 focused local cases completed successfully with eight Windows symlink skips, including the three native-Gitleaks payload regressions and the selected-context test. No local Docker build, real credential request or deployment occurred. The full Linux Library checks, actual CEL compilation, real Node setup and exact-head security remain hosted gates; the prior failed run is superseded, not green. Existing status names and security policy are preserved.

portegumi approved these changes 2026-10-15 10:36:10 -05:00

Dismissed

portegumi left a comment

Copy link

Source review of live head 529968874b: inspected authenticated changed-file inventory, earlier reviews and kiyi's follow-up, current RKE2 delivery/validation workflow and source/identity/admission contracts, signed receipt and image rescan, Node cache/validation and package-image scan gates, plus the new container build-context CLI boundary and its negative test. The CLI now rejects a context outside its scanned checkout before building; the builder still scans the complete selected checkout and binds the source decision in the image evidence. Scoped bootstrap/controller/Plan accounts, central uds-policy-exemptions resources and distinct system-upgrade workloads remain separated; no new gateway/route or duplicate controller is requested. I found no source-blocking regression in these inspected paths. This is source approval only: the preceding head's Library checks run 722 failed in payload-source-gate tests; kiyi attributes those failures to the corrected context boundary, but that correction is NOT established by hosted checks yet. At review the current-head Workflow acceptance (API 7321), Repository security (7322), image compatibility (7323) and Library checks (7324) are waiting/pending. Require exact-head successful checks and error-free security decisions before merge/release. Pinned UDS 1.14.1 live admission, rendered platform #128 resources, OpenBao credential issuance and cluster acceptance are not proven by these source reads and remain separate deployment gates. No merge, promotion, policy waiver or deployment authorized.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Source review of live head 529968874be7c2ae952d1ef87291cbd18be278d0: inspected authenticated changed-file inventory, earlier reviews and kiyi's follow-up, current RKE2 delivery/validation workflow and source/identity/admission contracts, signed receipt and image rescan, Node cache/validation and package-image scan gates, plus the new container build-context CLI boundary and its negative test. The CLI now rejects a context outside its scanned checkout before building; the builder still scans the complete selected checkout and binds the source decision in the image evidence. Scoped bootstrap/controller/Plan accounts, central uds-policy-exemptions resources and distinct system-upgrade workloads remain separated; no new gateway/route or duplicate controller is requested. I found no source-blocking regression in these inspected paths. This is source approval only: the preceding head's Library checks run 722 failed in payload-source-gate tests; kiyi attributes those failures to the corrected context boundary, but that correction is NOT established by hosted checks yet. At review the current-head Workflow acceptance (API 7321), Repository security (7322), image compatibility (7323) and Library checks (7324) are waiting/pending. Require exact-head successful checks and error-free security decisions before merge/release. Pinned UDS 1.14.1 live admission, rendered platform #128 resources, OpenBao credential issuance and cluster acceptance are not proven by these source reads and remain separate deployment gates. No merge, promotion, policy waiver or deployment authorized. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi added 4 commits 2026-10-15 10:59:55 -05:00

Retry temporary Semgrep downloads and integrate the reviewed scan fixes 868553c8aa

Include bounded Semgrep downloads in Node workflow preparation 4aafb8c368

Include bounded Semgrep downloads in bundle workflow preparation 0bacbfd83c

Keep the combined RKE2 workflow batch aligned with download recovery b955d25b59

kiyi dismissed portegumi's review 2026-10-15 10:59:55 -05:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

kiyi referenced this pull request 2026-10-15 11:01:50 -05:00

Support isolated SeaweedFS Terraform state bootstrap #101

portegumi approved these changes 2026-10-15 11:02:22 -05:00

Dismissed

portegumi left a comment

Copy link

Source review of live head b955d25b59: re-read authenticated changed-file inventory and current reusable RKE2 delivery/validation, scoped identity and admission CEL, signed-receipt verification, image rescan, rollout/pause guards and tests, plus the integrated Semgrep download recovery and Node/package-image gates. The new download path retries only bounded transient transport/HTTP failures, verifies the complete locked rules before execution, rejects certificate/content drift, and retains scanner errors as blocking decisions; regression tests cover resets, transient HTTP, exhausted retries and rejected rule changes. Protected-main checks, separate bootstrap/controller/Plans accounts, scoped central uds-policy-exemptions ownership and system-upgrade release storage remain in place. No new gateway/route or duplicate controller; no ghost bundle requested. I identified no source-blocking finding in the inspected head. This is SOURCE approval only: Workflow acceptance run 7335, Repository security 7336 and Library checks 7337 are pending/waiting at this SHA, NOT scan or test acceptance. Require exact-head success, including error-free security decision and actual Linux library/admission tests, before merge/release. Pinned UDS 1.14.1 live admission, actual platform #128 render/credentials and cluster acceptance remain separate deployment gates; no merge, promotion, policy waiver or deployment authorized.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Source review of live head b955d25b59b81441a2201b1303dde61c9618f0bf: re-read authenticated changed-file inventory and current reusable RKE2 delivery/validation, scoped identity and admission CEL, signed-receipt verification, image rescan, rollout/pause guards and tests, plus the integrated Semgrep download recovery and Node/package-image gates. The new download path retries only bounded transient transport/HTTP failures, verifies the complete locked rules before execution, rejects certificate/content drift, and retains scanner errors as blocking decisions; regression tests cover resets, transient HTTP, exhausted retries and rejected rule changes. Protected-main checks, separate bootstrap/controller/Plans accounts, scoped central uds-policy-exemptions ownership and system-upgrade release storage remain in place. No new gateway/route or duplicate controller; no ghost bundle requested. I identified no source-blocking finding in the inspected head. This is SOURCE approval only: Workflow acceptance run 7335, Repository security 7336 and Library checks 7337 are pending/waiting at this SHA, NOT scan or test acceptance. Require exact-head success, including error-free security decision and actual Linux library/admission tests, before merge/release. Pinned UDS 1.14.1 live admission, actual platform #128 render/credentials and cluster acceptance remain separate deployment gates; no merge, promotion, policy waiver or deployment authorized. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi referenced this pull request 2026-10-15 11:02:43 -05:00

Add reusable Node application validation with writable tool cache #99

kiyi referenced this pull request 2026-10-15 11:02:47 -05:00

Share bundle source validation and complete package image checks #100

kiyi commented 2026-10-15 11:02:50 -05:00

Author

Member

Copy link

Run 697 batch recovery is included in b955d25, the latest combined batch head. See the diagnosis and fix in #101: a passing clean source scan was followed by a reset Semgrep download. The shared downloader now uses at most three attempts with one/two-second backoff for temporary transport failures, while TLS, rule checksums and fail-closed scanner reports remain enforced.

Validation on b955d25 completed 177 local cases with eight Windows symlink skips, covering the new recovery/failure cases, native Gitleaks payload regressions, RKE2 admission transport guards, Terraform, Node, bundle, base-image and channel contracts. Staged Gitleaks and diff checks passed, and merge simulations remain clean. Hosted current-head Linux/full source-scan checks and approvals remain required; no scan/status names changed. Merge #101 → #99 → #100 → #102 and make one release for the remaining batch. Cluster upgrades still precede SeaweedFS integration, which must finish before Harbor.

Run 697 batch recovery is included in b955d25, the latest combined batch head. See the [diagnosis and fix in #101](https://git.gitchegumi.com/Homelab/workflows/pulls/101#issuecomment-6648): a passing clean source scan was followed by a reset Semgrep download. The shared downloader now uses at most three attempts with one/two-second backoff for temporary transport failures, while TLS, rule checksums and fail-closed scanner reports remain enforced. Validation on b955d25 completed 177 local cases with eight Windows symlink skips, covering the new recovery/failure cases, native Gitleaks payload regressions, RKE2 admission transport guards, Terraform, Node, bundle, base-image and channel contracts. Staged Gitleaks and diff checks passed, and merge simulations remain clean. Hosted current-head Linux/full source-scan checks and approvals remain required; no scan/status names changed. Merge #101 → #99 → #100 → #102 and make one release for the remaining batch. Cluster upgrades still precede SeaweedFS integration, which must finish before Harbor.

gitchegumi added 1 commit 2026-10-15 12:06:37 -05:00

Merge branch 'main' into kiyi/rke2-infrastructure-delivery 817697f291

portegumi approved these changes 2026-10-15 12:09:32 -05:00

Dismissed

portegumi left a comment

Copy link

Source review of the authenticated live head 817697f291: re-read the open PR and prior human reviews, all changed-file paths (Forgejo omitted patch hunks), current reusable RKE2 delivery and validation workflows, signed receipt/fetch and image-rescan paths, scoped identity/RBAC and admission CEL with allow/deny tests, Plan activation/postflight and pause guards, plus the combined Node and package-image security adapters. The source retains protected owner/main and exact-source checks, verifies signatures before archive download, separates privileged bootstrap from routine controller/Plan credentials, and targets central uds-policy-exemptions separately from system-upgrade release storage. No new gateway/route or duplicate controller is introduced; no ghost routing bundle is needed. I found no source-blocking issue in the inspected paths. This is source approval only. Exact-head Workflow acceptance (API 7356) and Repository security (7357) are running; Library checks (7358) are waiting. No scan, CEL execution, package build, rendered platform #128 resources, live UDS 1.14.1 admission, OpenBao issuance, or cluster acceptance is established by this approval. Require successful error-free exact-head checks and separate pinned UDS/render and operational acceptance before merge/release/deploy. No merge, promotion, waiver or deployment authorized.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Source review of the authenticated live head 817697f291393b13a219b21c6b4a252a74319164: re-read the open PR and prior human reviews, all changed-file paths (Forgejo omitted patch hunks), current reusable RKE2 delivery and validation workflows, signed receipt/fetch and image-rescan paths, scoped identity/RBAC and admission CEL with allow/deny tests, Plan activation/postflight and pause guards, plus the combined Node and package-image security adapters. The source retains protected owner/main and exact-source checks, verifies signatures before archive download, separates privileged bootstrap from routine controller/Plan credentials, and targets central uds-policy-exemptions separately from system-upgrade release storage. No new gateway/route or duplicate controller is introduced; no ghost routing bundle is needed. I found no source-blocking issue in the inspected paths. This is source approval only. Exact-head Workflow acceptance (API 7356) and Repository security (7357) are running; Library checks (7358) are waiting. No scan, CEL execution, package build, rendered platform #128 resources, live UDS 1.14.1 admission, OpenBao issuance, or cluster acceptance is established by this approval. Require successful error-free exact-head checks and separate pinned UDS/render and operational acceptance before merge/release/deploy. No merge, promotion, waiver or deployment authorized. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi added 1 commit 2026-10-15 12:46:08 -05:00

Merge current main while preserving RKE2 workflow coverage 7b296f9520

kiyi commented 2026-10-15 12:46:31 -05:00

Author

Member

Copy link

Resolved the test_reporting.py and test_workflow_channel.py merge conflicts against current main in 7b296f9520. The merge retains both RKE2/package-image reporting inventories and the dynamic reusable-workflow inventory with explicit RKE2 assertions. Owner branch updates and the merged #100 work are preserved.

Validation: the full resulting Git tree is identical to the previously passing 817697f head. All 20 focused reporting, Forgejo-contract and frozen-channel checks passed; no unmerged files remain, diff checks passed and native Gitleaks 8.30.1 passed. No workflow/job/status names or source behavior changed. Forgejo now shows no conflict banner. Fresh checks 780–782 are queued and must pass before merge.

Resolved the test_reporting.py and test_workflow_channel.py merge conflicts against current main in 7b296f9520. The merge retains both RKE2/package-image reporting inventories and the dynamic reusable-workflow inventory with explicit RKE2 assertions. Owner branch updates and the merged #100 work are preserved. Validation: the full resulting Git tree is identical to the previously passing 817697f head. All 20 focused reporting, Forgejo-contract and frozen-channel checks passed; no unmerged files remain, diff checks passed and native Gitleaks 8.30.1 passed. No workflow/job/status names or source behavior changed. Forgejo now shows no conflict banner. Fresh checks 780–782 are queued and must pass before merge.

portegumi approved these changes 2026-10-15 12:47:49 -05:00

portegumi left a comment

Copy link

Source follow-up for exact head 7b296f9520 after the main-branch merge: inspected the live changed-file inventory, previously submitted human reviews and current RKE2 reusable delivery/validation workflows, delivery, identity, admission, source/caller contracts, and reporting/channel/Forgejo contract tests at this SHA. The conflict-resolution tests retain both RKE2 and package-image report inventory and frozen-channel assertions; the delivery source still requires protected owner/main, exact signed release verification before archive use, image rescans before scoped credential issuance, dedicated bootstrap/controller/Plans authority, explicit activation acceptance, and postflight checks. UDS policy Exemptions target the central uds-policy-exemptions namespace while release storage/workloads remain in system-upgrade; no new gateway, route, or duplicate controller is introduced. I find no source-blocking regression in the inspected head. Forgejo supplied no patch hunks, and I did not independently prove the author's claim that this merge tree is byte-identical to 817697f. This is SOURCE approval only: current-head Workflow acceptance (780), Repository security (781), and Library checks (782) remain pending, not passing. Require exact-head successful/error-free checks and separate platform #128 render, pinned UDS admission, OpenBao and live cluster acceptance before merge/release/deployment. No merge, publication, gate waiver or deployment authorized.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Source follow-up for exact head 7b296f952033011974795f8ef5d5dd85bfdb2999 after the main-branch merge: inspected the live changed-file inventory, previously submitted human reviews and current RKE2 reusable delivery/validation workflows, delivery, identity, admission, source/caller contracts, and reporting/channel/Forgejo contract tests at this SHA. The conflict-resolution tests retain both RKE2 and package-image report inventory and frozen-channel assertions; the delivery source still requires protected owner/main, exact signed release verification before archive use, image rescans before scoped credential issuance, dedicated bootstrap/controller/Plans authority, explicit activation acceptance, and postflight checks. UDS policy Exemptions target the central uds-policy-exemptions namespace while release storage/workloads remain in system-upgrade; no new gateway, route, or duplicate controller is introduced. I find no source-blocking regression in the inspected head. Forgejo supplied no patch hunks, and I did not independently prove the author's claim that this merge tree is byte-identical to 817697f. This is SOURCE approval only: current-head Workflow acceptance (780), Repository security (781), and Library checks (782) remain pending, not passing. Require exact-head successful/error-free checks and separate platform #128 render, pinned UDS admission, OpenBao and live cluster acceptance before merge/release/deployment. No merge, publication, gate waiver or deployment authorized. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

gitchegumi merged commit e27b4aa844 into main 2026-10-15 12:52:34 -05:00

gitchegumi deleted branch kiyi/rke2-infrastructure-delivery 2026-10-15 12:52:35 -05:00

gitchegumi referenced this pull request from a commit 2026-10-15 12:52:35 -05:00

Merge pull request 'Add signed RKE2 infrastructure delivery and scoped credentials' (#102) from kiyi/rke2-infrastructure-delivery into main

Sign in to join this conversation.

Reviewers

No reviewers

portegumi

Labels

Clear labels

  

app-migration

  

bug

Something is not working

  

ci-cd

  

cluster

  

Documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

gpu

  

invalid

Something is wrong

  

networking

  

question

More information is needed

  

security

  

Storage

  

wontfix

This won't be fixed

No labels

app-migration

bug

ci-cd

cluster

Documentation

duplicate

enhancement

gpu

invalid

networking

question

security

Storage

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Homelab/workflows!102

No description provided.