Homelab/workflows

Watch

Fork 0

Support the current Core and init profile for the first RKE2 upgrade #110

Merged

gitchegumi merged 3 commits from kiyi/rke2-init-preflight-diagnostics into main

2026-10-16 00:40:36 -05:00

kiyi commented

2026-10-16 00:04:28 -05:00

Member

Support the two exact reviewed Core/init profiles: 1.13.1 → 0.73.0 and the retained 1.14.1 → 0.86.0. Activation still requires the exact configured Core version. Report only numeric expected/observed init versions or fixed absent/invalid metadata state. Validate nested package metadata before accessing its version; malformed records preserve a fixed redacted error through preflight. Permissions, release verification and existing workflow/check names stay unchanged.

Validation: 82 credential-free RKE2/identity regression tests passed, including both profiles and absent/null/non-mapping metadata through every component preflight. All three proposed Platform source contracts also passed local client-only rendering. Native Gitleaks 8.30.1 and diff checks passed. Hosted checks and exact-head approval remain required. Core 1.13/RKE2 1.36 compatibility acceptance is still required before activation.

Release/promote this correction before merging the matching Platform required_core=1.13.1 declaration. That changes signed inventory, so build and deploy a new owning bootstrap release rather than substituting r7501 against a changed contract. No additional Terraform apply is needed. The owner-selected later sequence is Core 1.14.1/init 0.86.0, Core 1.15.0, RKE2 1.37.1, auto updates, Harbor, then image migration.

Bootstrap run 4975 passed credential issuance, permission probes and OpenBao revocation, then stopped before deployment because the original profile expected init 0.86.0. The owner confirmed installed Core 1.13.1/init 0.73.0 and selected the first RKE2 1.36.5 upgrade before Core 1.14.1/init 0.86.0. Support the two exact reviewed Core/init profiles: 1.13.1 → 0.73.0 and the retained 1.14.1 → 0.86.0. Activation still requires the exact configured Core version. Report only numeric expected/observed init versions or fixed absent/invalid metadata state. Validate nested package metadata before accessing its version; malformed records preserve a fixed redacted error through preflight. Permissions, release verification and existing workflow/check names stay unchanged. Validation: 82 credential-free RKE2/identity regression tests passed, including both profiles and absent/null/non-mapping metadata through every component preflight. All three proposed Platform source contracts also passed local client-only rendering. Native Gitleaks 8.30.1 and diff checks passed. Hosted checks and exact-head approval remain required. Core 1.13/RKE2 1.36 compatibility acceptance is still required before activation. Release/promote this correction before merging the matching Platform required_core=1.13.1 declaration. That changes signed inventory, so build and deploy a new owning bootstrap release rather than substituting r7501 against a changed contract. No additional Terraform apply is needed. The owner-selected later sequence is Core 1.14.1/init 0.86.0, Core 1.15.0, RKE2 1.37.1, auto updates, Harbor, then image migration.

kiyi added 1 commit

2026-10-16 00:04:28 -05:00

Report observed Zarf init package state before RKE2 delivery

Workflow acceptance / acceptance (pull_request) Successful in 1m46s

Details

Repository security / security-1 (pull_request) Successful in 7m25s

Details

Library checks / tests (pull_request) Successful in 10m5s

Details

46d0322214

portegumi requested changes

2026-10-16 00:05:47 -05:00

Dismissed

portegumi left a comment

Blocking source finding in pipeline/rke2_delivery.py::package_version: the new fixed-error handling checks only the version value after indexing data['data']['metadata']. A syntactically valid decoded zarf-package-init record with {"name":"init","data":{}} raises KeyError('metadata'); with {"name":"init","data":{"metadata":null}} it raises AttributeError on .get. In both cases common_preflight exits before printing expected=0.86.0; observed=invalid version metadata, defeating the stated malformed-metadata diagnostic. Please have kiyi validate the nested metadata mapping before accessing its version, return the fixed safe failure for absent/non-mapping metadata, and add regression cases for both shapes. Keep the exact init guard and Secret/redaction boundary intact. This is an RKE2 delivery preflight diagnostic, not a UDS package, routing, admission, or scan-policy change; I found no reason to add gateways, exemptions, or bypass any gates. Workflow acceptance, Repository security, and Library checks are pending at this head, so this review does not assert hosted acceptance or merge readiness.

Blocking source finding in `pipeline/rke2_delivery.py::package_version`: the new fixed-error handling checks only the `version` value after indexing `data['data']['metadata']`. A syntactically valid decoded `zarf-package-init` record with `{"name":"init","data":{}}` raises `KeyError('metadata')`; with `{"name":"init","data":{"metadata":null}}` it raises `AttributeError` on `.get`. In both cases `common_preflight` exits before printing `expected=0.86.0; observed=invalid version metadata`, defeating the stated malformed-metadata diagnostic. Please have kiyi validate the nested metadata mapping before accessing its version, return the fixed safe failure for absent/non-mapping metadata, and add regression cases for both shapes. Keep the exact init guard and Secret/redaction boundary intact. This is an RKE2 delivery preflight diagnostic, not a UDS package, routing, admission, or scan-policy change; I found no reason to add gateways, exemptions, or bypass any gates. Workflow acceptance, Repository security, and Library checks are pending at this head, so this review does not assert hosted acceptance or merge readiness.

kiyi added this to the Homelab Roadmap project

2026-10-16 00:05:56 -05:00

kiyi added 1 commit

2026-10-16 00:28:39 -05:00

Support the current Core and init profile for initial RKE2 upgrade

Workflow acceptance / acceptance (pull_request) Failing after 34s

Details

Repository security / security-1 (pull_request) Successful in 3m46s

Details

Library checks / tests (pull_request) Has been cancelled

Details

a44deac3bc

portegumi requested changes

2026-10-16 00:30:12 -05:00

Dismissed

portegumi left a comment

Blocking regression persists on this exact head in pipeline/rke2_delivery.py::package_version: after decoding the named package record it indexes data['data']['metadata'].get('version') before validating that metadata is a mapping. For a valid decoded record {"name":"init","data":{}}, this raises KeyError('metadata'); for {"name":"init","data":{"metadata":null}}, it raises AttributeError. Both skip the fixed Zarf package version metadata is missing or invalid error and the intended expected=...; observed=invalid version metadata diagnostic in common_preflight. The added test covers missing version inside an existing metadata mapping, not these two shapes. Kiyi: validate nested metadata before indexing, preserve the fixed redacted error and exact init guard, and add regression cases for absent/non-mapping metadata through the preflight path. This remains an RKE2 preflight diagnostic, not a UDS package/routing/admission/policy change; no gateway, exemption, or scan bypass is indicated. Separately, Workflow acceptance failed before checkout because its runner could not create the pinned job image (No such image), not because its tests rejected the source; Library checks and Repository security remain pending. Required checks and a subsequent exact-head review still gate merging.

Blocking regression persists on this exact head in `pipeline/rke2_delivery.py::package_version`: after decoding the named package record it indexes `data['data']['metadata'].get('version')` before validating that `metadata` is a mapping. For a valid decoded record `{"name":"init","data":{}}`, this raises `KeyError('metadata')`; for `{"name":"init","data":{"metadata":null}}`, it raises `AttributeError`. Both skip the fixed `Zarf package version metadata is missing or invalid` error and the intended `expected=...; observed=invalid version metadata` diagnostic in `common_preflight`. The added test covers missing `version` inside an existing metadata mapping, not these two shapes. Kiyi: validate nested metadata before indexing, preserve the fixed redacted error and exact init guard, and add regression cases for absent/non-mapping metadata through the preflight path. This remains an RKE2 preflight diagnostic, not a UDS package/routing/admission/policy change; no gateway, exemption, or scan bypass is indicated. Separately, Workflow acceptance failed before checkout because its runner could not create the pinned job image (`No such image`), not because its tests rejected the source; Library checks and Repository security remain pending. Required checks and a subsequent exact-head review still gate merging.

kiyi changed title from ~~Report observed Zarf init package state before RKE2 delivery~~ to Support the current Core and init profile for the first RKE2 upgrade

2026-10-16 00:31:01 -05:00

kiyi added 1 commit

2026-10-16 00:33:00 -05:00

Validate nested package metadata before reporting init state

Workflow acceptance / acceptance (pull_request) Successful in 1m32s

Details

Repository security / security-1 (pull_request) Successful in 4m54s

Details

Library checks / tests (pull_request) Successful in 4m58s

Details

fcc88b9ada

portegumi approved these changes

2026-10-16 00:34:18 -05:00

portegumi left a comment

Reviewed the exact fcc88b9ada source and tests. The two earlier blocking malformed-metadata cases are addressed: package_version now checks the decoded data and nested metadata are dictionaries before accessing version, and raises the fixed PackageVersionError for missing/non-string version. common_preflight reports the profile-specific expected init and fixed observed=invalid version metadata without echoing Secret data. Regression cases exercise absent, null, list, and non-mapping nested metadata through each component preflight for both Core 1.13.1/init 0.73.0 and Core 1.14.1/init 0.86.0. The exact init requirement, Core check at activation, receipt verification, permissions, and deployment gates remain intact. This is an RKE2 preflight/profile change; I found no UDS package, routing, admission, or policy boundary change warranting additional resources or exemptions. Source review approves this head and resolves my older change requests. I did not run local tests or verify live Core/RKE2 compatibility; the reported local tests are author-provided. Workflow acceptance, Repository security, and Library checks remain pending on this SHA and must pass before merge; approval does not authorize deployment or establish live compatibility.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the exact fcc88b9adaed82aa8a0ed108906e4c91188ae45c source and tests. The two earlier blocking malformed-metadata cases are addressed: `package_version` now checks the decoded `data` and nested `metadata` are dictionaries before accessing `version`, and raises the fixed `PackageVersionError` for missing/non-string version. `common_preflight` reports the profile-specific expected init and fixed `observed=invalid version metadata` without echoing Secret data. Regression cases exercise absent, null, list, and non-mapping nested metadata through each component preflight for both Core 1.13.1/init 0.73.0 and Core 1.14.1/init 0.86.0. The exact init requirement, Core check at activation, receipt verification, permissions, and deployment gates remain intact. This is an RKE2 preflight/profile change; I found no UDS package, routing, admission, or policy boundary change warranting additional resources or exemptions. Source review approves this head and resolves my older change requests. I did not run local tests or verify live Core/RKE2 compatibility; the reported local tests are author-provided. Workflow acceptance, Repository security, and Library checks remain pending on this SHA and must pass before merge; approval does not authorize deployment or establish live compatibility. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi commented

2026-10-16 00:39:24 -05:00

Author

Member

Replying to the metadata findings in review 6888 and review 6891: fixed in fcc88b9ada. The decoded package, metadata mapping and version are now validated before access. Absent/null/non-mapping metadata raises PackageVersionError with the fixed redacted message, and common_preflight logs only the profile expected version plus observed=invalid version metadata before preserving that error.

Validation: 82 credential-free regressions passed, including absent metadata, null metadata, non-mapping package/metadata and synthetic private fields through all three components and both exact profiles. Native Gitleaks 8.30.1 passed. Required hosted checks remain in place; I am investigating the runner image setup failure and requesting a fresh exact-head review. These findings were review-summary comments, with no resolvable inline thread.

Replying to the metadata findings in [review 6888](https://git.gitchegumi.com/Homelab/workflows/pulls/110#issuecomment-6888) and [review 6891](https://git.gitchegumi.com/Homelab/workflows/pulls/110#issuecomment-6891): fixed in fcc88b9adaed82aa8a0ed108906e4c91188ae45c. The decoded package, metadata mapping and version are now validated before access. Absent/null/non-mapping metadata raises PackageVersionError with the fixed redacted message, and common_preflight logs only the profile expected version plus observed=invalid version metadata before preserving that error. Validation: 82 credential-free regressions passed, including absent metadata, null metadata, non-mapping package/metadata and synthetic private fields through all three components and both exact profiles. Native Gitleaks 8.30.1 passed. Required hosted checks remain in place; I am investigating the runner image setup failure and requesting a fresh exact-head review. These findings were review-summary comments, with no resolvable inline thread.