Fix image publication policies and support Homelab RKE2 tools #111
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!111
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/rke2-owned-tool-images"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Base-images run 264 passed its complete source and Docker image scans, then publication falsely reported “Mitigation expired.” The signed evidence retained only the checkout-root policy, losing the image-context approvals. Retain both exact reviewed policies in the existing mitigation asset, deduplicate identical entries, reject conflicts and report which decision is blocked. Approval scope, November 6 expiry, scan gates, receipt schema and evidence inventory stay intact.
The published controller/helper rebuilds also need the RKE2 implementation to accept their two exact Homelab repositories. Bind reviewed tool release/version/source metadata into controller inventories, preserve legacy Rancher receipt shapes, and select the correct helper/controller paths and digests during Zarf postflight and upgrade Job verification. Bootstrap resources, Plan target, identities, manual approvals and workflow/status names are unchanged.
Validation: 113 affected source-only container/base-image/evidence/security/RKE2 regression tests pass in WSL; the final added tamper assertion also passes in the 11-test container suite. Ruff F checks, git diff --check and the active native Gitleaks 8.30.1 hook pass. The actual Platform caller contract and all three source inventories validate with this library; bootstrap and Plan inventories/manifests are identical to merged Platform main. The broad local suite is limited by missing defusedxml and Windows-linked Git metadata in WSL; hosted full-library/integration checks remain required. No local container build or live operation ran.
Merge, publish one workflow release and promote it to stable-v1 before fresh owning runs. Then Docker can be rebuilt/published through base-images, and the separate Platform digest-adoption PR can pass its new hosted checks and build a signed controller bundle. These PRs do not deploy a controller or activate Plans.
Independent source review of
c0a406141d: publication combines and validates the checkout and selected-context mitigation policies before the source/image scans, retains their signed evidence inventory, and re-evaluates both decisions before registry publication; duplicate entries and conflicting/expired policies fail closed. The RKE2 contract restricts owned controller/kubectl repositories and binds each pin to a version/source declaration; the controller postflight and Plan Job checks select role-specific image paths and signed digests while legacy Rancher references remain supported. Reviewed the added positive/negative regression cases for policy loss/tamper, release metadata, registry rewrites, and wrong running digests. No changed deployment manifests, gateway/route ownership, admission policies, or scan gates in this PR; the existing UDS packaging and policy checks remain in the delivery path. Source approval only: Workflow acceptance, Repository security, and Library checks are pending at this SHA; their results, pinned UDS render/runtime behavior, and any real deployment remain separate acceptance gates. No merge or publication authorized.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.