Simplify RKE2 release selection and expose safe deployment diagnostics #114

Merged

gitchegumi merged 1 commit from kiyi/rke2-release-selection into main

2026-10-16 22:11:53 -05:00

kiyi commented

2026-10-16 22:01:54 -05:00

Member

RKE2 delivery currently makes the operator copy release tags between build and deploy, and controller run 5007 hid the UDS error after passing scans, permissions and ownership checks.

Leave release blank to select the newest published signed build matching the current component inventory, rendered manifests and mitigation policy. An explicit tag remains an override. Plan activation with blank controller_release retrieves the exact controller already accepted on the approved cluster and rechecks its signed receipt and acceptance marker; it never selects a newer undeployed controller. Record the resolved tag/source/receipt hash in release-selection.json. Existing signature, archive integrity, scans, source ancestry, actor/credential, adoption and activation gates remain in place. No workflow/job/check names change.

Command failures now report the named stage, exit code and fixed diagnostic hints without forwarding captured CLI/API text, arguments or credentials. Unknown failures remain explicitly unclassified. This enables a useful retry diagnostic; it does not establish the root cause of run 5007 or claim a successful deployment.

Validation: 90 RKE2/channel/release-tag regression tests passed in disposable Linux Git fixtures; the final 19 focused selection/diagnostic tests passed after adding controller acceptance-tag coverage. The actual three Platform callers and all component source contracts passed, as did Platform source validation (378 files, 199 YAML files, 28 Kustomize roots), 13 RKE2 source guards, Ruff F checks and staged Gitleaks 8.30.1. Remote transport, signing and deployment are mocked in unit tests. No image build, scan, cluster mutation or Actions dispatch was performed locally.

Merge, publish and promote this library change to stable-v1 before the paired Platform input-label/runbook PR. Then use a fresh owning controller deploy to obtain the improved diagnostic. The existing compatible signed controller build can be reused. Plan build 5006 remains separately blocked by the Rancher upgrade image findings.

RKE2 delivery currently makes the operator copy release tags between build and deploy, and controller run 5007 hid the UDS error after passing scans, permissions and ownership checks. Leave `release` blank to select the newest published signed build matching the current component inventory, rendered manifests and mitigation policy. An explicit tag remains an override. Plan activation with blank `controller_release` retrieves the exact controller already accepted on the approved cluster and rechecks its signed receipt and acceptance marker; it never selects a newer undeployed controller. Record the resolved tag/source/receipt hash in `release-selection.json`. Existing signature, archive integrity, scans, source ancestry, actor/credential, adoption and activation gates remain in place. No workflow/job/check names change. Command failures now report the named stage, exit code and fixed diagnostic hints without forwarding captured CLI/API text, arguments or credentials. Unknown failures remain explicitly unclassified. This enables a useful retry diagnostic; it does not establish the root cause of run 5007 or claim a successful deployment. Validation: 90 RKE2/channel/release-tag regression tests passed in disposable Linux Git fixtures; the final 19 focused selection/diagnostic tests passed after adding controller acceptance-tag coverage. The actual three Platform callers and all component source contracts passed, as did Platform source validation (378 files, 199 YAML files, 28 Kustomize roots), 13 RKE2 source guards, Ruff F checks and staged Gitleaks 8.30.1. Remote transport, signing and deployment are mocked in unit tests. No image build, scan, cluster mutation or Actions dispatch was performed locally. Merge, publish and promote this library change to `stable-v1` before the paired Platform input-label/runbook PR. Then use a fresh owning controller deploy to obtain the improved diagnostic. The existing compatible signed controller build can be reused. Plan build 5006 remains separately blocked by the Rancher upgrade image findings.

kiyi added 1 commit

2026-10-16 22:01:54 -05:00

Select compatible signed RKE2 releases automatically and report safe failure hints

Workflow acceptance / acceptance (pull_request) Successful in 1m36s

Details

Repository security / security-1 (pull_request) Successful in 5m2s

Details

Library checks / tests (pull_request) Successful in 8m0s

Details

a6f06ea02a

kiyi added this to the Homelab Roadmap project

2026-10-16 22:02:18 -05:00

portegumi approved these changes

2026-10-16 22:03:20 -05:00

portegumi left a comment

Reviewed the exact-head RKE2 delivery workflow, complete release-selection/diagnostic source and focused regression tests. Automatic selection verifies signed receipt and metadata against the reviewed inventory, rendered manifests and mitigation policy before the archive is fetched; final fetch still checks signature, artifact hashes, scans, policy and source ancestry. Plan activation resolves the accepted controller marker for this cluster rather than an undeployed latest release and rechecks it in activation preflight. Fixed diagnostic categories withhold raw subprocess output/arguments; no UDS gateway, route, admission policy or deployment packaging changes are introduced by this PR. Source approval only: Workflow acceptance, Repository security and Library checks are pending on this SHA. No live controller deployment or root-cause confirmation for run 5007 is established, and required checks remain merge gates.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi referenced this pull request from Homelab/Documentation

2026-10-16 22:07:25 -05:00

Record signed controller build and current RKE2 delivery blockers #54