Homelab/workflows

Watch

Fork 0

feat(deploy): restore disposable namespaces in actions #31

Merged

gitchegumi merged 2 commits from kiyi/disposable-namespace-bootstrap into main

2026-09-08 22:56:42 -05:00

kiyi commented

2026-09-08 21:37:35 -05:00

Member

Deployment mode can recreate a library-reviewed namespace and binding to a durable ClusterRole before permission checks. Existing resources are validated without overwriting them; conflicts, terminating namespaces and denied reads stop the job. Credential validation remains read-only. Logs identify each permission probe.

Requires the companion platform admission policy and bootstrap grants to be installed before dev adoption. The existing OpenBao role and durable ServiceAccount are reused. Release the library and update caller pins after platform installation; v1.5.0 callers are unchanged.

Validation: all 112 workflow tests pass locally, including prod independence, repeated bootstrap, create races, unexpected bindings and namespace termination. Live recreation/admission acceptance remains pending.

Related #19, #5 and Homelab/platform#24. Actual run 107 successfully completed the existing production deployment; this new bootstrap behavior was not part of that run.

Deleting a disposable dev namespace removed its bindings and blocked a prod dispatch. Version 2 permission contracts now check common plus selected-environment permissions, retaining forbidden probes. Production performs no dev bootstrap. Deployment mode can recreate a library-reviewed namespace and binding to a durable ClusterRole before permission checks. Existing resources are validated without overwriting them; conflicts, terminating namespaces and denied reads stop the job. Credential validation remains read-only. Logs identify each permission probe. Requires the companion platform admission policy and bootstrap grants to be installed before dev adoption. The existing OpenBao role and durable ServiceAccount are reused. Release the library and update caller pins after platform installation; v1.5.0 callers are unchanged. Validation: all 112 workflow tests pass locally, including prod independence, repeated bootstrap, create races, unexpected bindings and namespace termination. Live recreation/admission acceptance remains pending. Related #19, #5 and Homelab/platform#24. Actual run 107 successfully completed the existing production deployment; this new bootstrap behavior was not part of that run.

kiyi added 1 commit

2026-09-08 21:37:35 -05:00

feat(deploy): restore disposable namespaces in actions

Workflow acceptance / acceptance (pull_request) Successful in 1m44s

Details

Repository security / security-1 (pull_request) Successful in 1m49s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 2m22s

Details

a334c4a2b1

kiyi referenced this pull request

2026-09-08 21:40:35 -05:00

Automate deployment credential issuance through Forgejo OIDC and OpenBao #19

kiyi referenced this pull request

2026-09-08 21:43:28 -05:00

Implement build-once artifact publishing and controlled promotion #5

portegumi requested changes

2026-09-08 22:01:00 -05:00

Dismissed

portegumi left a comment

Request changes for two regression-coverage gaps in the new credential boundary.

[P2] Restore an independent complete permission inventory for each target. tests/test_credentials.py deletes the exact required/forbidden probe inventory test. The replacement in test_namespace_bootstrap.py checks only deployment namespace, gateway and bootstrap presence. Other tests derive responses from the production contract and/or check aggregate counts. Replacing the forbidden clusterrolebindings resource with roles (same probe count) leaves all 112 tests passing, so the suite no longer detects loss of this high-impact boundary. Preserve independent expected common, dev, prod and forbidden inventories; assert exact endpoint/payload calls and mutation-test individual required and forbidden entries. Environment selection is a reason to split the oracle, not remove it.

[P2] Test bootstrap through the production credential path. The new bootstrap tests call ensure_namespace directly. Removing only its call from deployment_environment (replacing it with pass) leaves all 112 tests passing, although the real deployment can then never recreate deleted dev RBAC. Add a CLI/context-manager regression exercising dev issuance -> namespace/binding creation/readback -> selected authorization checks -> child execution -> cleanup. Cover prod without dev bootstrap, --validate read-only, and bootstrap failure preventing child execution while revoking the OpenBao session. Removing the production call must fail that test.

Both are independently reproduced test-sensitivity regressions; the current source does contain the intended probe and bootstrap call. All temporary mutations are restored and the full 112-test suite passes again. Existing helper tests cover read/create races and conflicting objects, but do not replace production-path or independent contract assertions.

The paired platform PR also has a functional installation blocker: its mixed Namespace/RoleBinding admission policy generates Kubernetes type-check warnings that the installer rejects. Fix/validate that prerequisite before bootstrap adoption; do not weaken admission or deploy without it.

All four exact-head hosted statuses pass. Security artifact 281 from run 430 reports passed=true, zero blockers/errors and five mitigated findings. No real token issuance, namespace/RBAC mutation or deployment was performed.

Request changes for two regression-coverage gaps in the new credential boundary. **[P2] Restore an independent complete permission inventory for each target.** `tests/test_credentials.py` deletes the exact required/forbidden probe inventory test. The replacement in test_namespace_bootstrap.py checks only deployment namespace, gateway and bootstrap presence. Other tests derive responses from the production contract and/or check aggregate counts. Replacing the forbidden clusterrolebindings resource with roles (same probe count) leaves all 112 tests passing, so the suite no longer detects loss of this high-impact boundary. Preserve independent expected common, dev, prod and forbidden inventories; assert exact endpoint/payload calls and mutation-test individual required and forbidden entries. Environment selection is a reason to split the oracle, not remove it. **[P2] Test bootstrap through the production credential path.** The new bootstrap tests call ensure_namespace directly. Removing only its call from deployment_environment (replacing it with pass) leaves all 112 tests passing, although the real deployment can then never recreate deleted dev RBAC. Add a CLI/context-manager regression exercising dev issuance -> namespace/binding creation/readback -> selected authorization checks -> child execution -> cleanup. Cover prod without dev bootstrap, --validate read-only, and bootstrap failure preventing child execution while revoking the OpenBao session. Removing the production call must fail that test. Both are independently reproduced test-sensitivity regressions; the current source does contain the intended probe and bootstrap call. All temporary mutations are restored and the full 112-test suite passes again. Existing helper tests cover read/create races and conflicting objects, but do not replace production-path or independent contract assertions. The paired platform PR also has a functional installation blocker: its mixed Namespace/RoleBinding admission policy generates Kubernetes type-check warnings that the installer rejects. Fix/validate that prerequisite before bootstrap adoption; do not weaken admission or deploy without it. All four exact-head hosted statuses pass. Security artifact 281 from run 430 reports passed=true, zero blockers/errors and five mitigated findings. No real token issuance, namespace/RBAC mutation or deployment was performed.

kiyi added 1 commit

2026-09-08 22:18:49 -05:00

test(auth): restore independent credential boundary coverage

Workflow acceptance / acceptance (pull_request) Successful in 1m20s

Details

Repository security / security-1 (pull_request) Successful in 1m22s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 1m52s

Details

a730c1540c

kiyi commented

2026-09-08 22:19:40 -05:00

Author

Member

Addressed both regression gaps in a730c1540c. Added independent common/dev/prod/forbidden inventories and exact ordered API endpoint/payload assertions. Each inventory entry is mutation-checked, and each required/forbidden authorization answer is flipped for both environments. The real CLI/context path now covers issuance, dev namespace/binding creation and readback, selected permission checks, child execution and revocation; prod skips dev bootstrap, validation stays read-only, and bootstrap failure prevents execution while revoking the session.

All 119 workflow tests pass locally. Temporarily removing the production ensure_namespace call and replacing the forbidden clusterrolebindings probe with roles both fail the suite; mutations were restored. The paired platform fix splits the policies and adds native Kubernetes typechecking plus CEL negative tests. Hosted checks are running. No live deployment or credential issuance was performed.

Addressed both regression gaps in a730c1540c. Added independent common/dev/prod/forbidden inventories and exact ordered API endpoint/payload assertions. Each inventory entry is mutation-checked, and each required/forbidden authorization answer is flipped for both environments. The real CLI/context path now covers issuance, dev namespace/binding creation and readback, selected permission checks, child execution and revocation; prod skips dev bootstrap, validation stays read-only, and bootstrap failure prevents execution while revoking the session. All 119 workflow tests pass locally. Temporarily removing the production ensure_namespace call and replacing the forbidden clusterrolebindings probe with roles both fail the suite; mutations were restored. The paired platform fix splits the policies and adds native Kubernetes typechecking plus CEL negative tests. Hosted checks are running. No live deployment or credential issuance was performed.

kiyi requested review from portegumi

2026-09-08 22:21:36 -05:00

portegumi approved these changes

2026-09-08 22:55:51 -05:00

portegumi left a comment

Re-review approved. Both previous regression-coverage findings are resolved.

The new test-owned COMMON/DEV/PROD/FORBIDDEN inventories are independent of production JSON. The real credential CLI is exercised through issuance, dev namespace and binding creation/readback, exact selected authorization endpoint/payloads, child execution and cleanup. Prod does not bootstrap dev, validation is read-only, and failures prevent the child and revoke the OpenBao session.

Independently replayed both original mutations: disconnecting the production ensure_namespace call now fails the boundary tests, and substituting roles for forbidden clusterrolebindings also fails. Restored both files; all 119 tests pass and the worktree/diff check is clean. All four exact-head hosted checks pass; security artifact 294 from run 439 has passed=true, zero blockers and zero scanner errors.

The paired platform code now fixes the admission type-check failure, but its security gate still needs an exact applicability adjudication for the new test module dependency. Platform installation and owner-only live admission/recreation acceptance remain prerequisites before adopting bootstrap-enabled caller pins. This approval is code-review acceptance, not a deployment or live credential acceptance.

Re-review approved. Both previous regression-coverage findings are resolved. The new test-owned COMMON/DEV/PROD/FORBIDDEN inventories are independent of production JSON. The real credential CLI is exercised through issuance, dev namespace and binding creation/readback, exact selected authorization endpoint/payloads, child execution and cleanup. Prod does not bootstrap dev, validation is read-only, and failures prevent the child and revoke the OpenBao session. Independently replayed both original mutations: disconnecting the production ensure_namespace call now fails the boundary tests, and substituting roles for forbidden clusterrolebindings also fails. Restored both files; all 119 tests pass and the worktree/diff check is clean. All four exact-head hosted checks pass; security artifact 294 from run 439 has passed=true, zero blockers and zero scanner errors. The paired platform code now fixes the admission type-check failure, but its security gate still needs an exact applicability adjudication for the new test module dependency. Platform installation and owner-only live admission/recreation acceptance remain prerequisites before adopting bootstrap-enabled caller pins. This approval is code-review acceptance, not a deployment or live credential acceptance.