Expose safe permission details for RKE2 deployment denials #115

Merged

gitchegumi merged 1 commit from kiyi/rke2-denial-diagnostics into main

2026-10-17 06:44:34 -05:00

kiyi commented

2026-10-16 23:33:01 -05:00

Member

Controller deploy 5012 passed permission probes but UDS archive deployment failed with only kubernetes_authorization. The captured CLI error was discarded, and the Loki search did not surface the denied operation.

Parse standard Kubernetes Forbidden errors into up to three distinct permission summaries: verb, resource, API group and namespace/cluster scope. Every emitted value is allowlisted; unknown values become fixed placeholders. Usernames, object names, trailing reasons, command arguments and raw output remain withheld. No RBAC, admission policy, credentials, workflow inputs or check names change.

Validation: 99 RKE2/channel/release-tag regressions passed, including 11 diagnostic tests for private-value leakage, malformed errors, ANSI output, namespaced/cluster/subresource denials, deduplication and bounded output. Ruff F, diff checks and the active Gitleaks 8.30.1 hook passed.

After review, release and promote the library to stable-v1, then request approval for a fresh owning controller deploy retry. The existing signed controller bundle does not need rebuilding for this logging change. The denied operation and any permission correction remain unverified until that run.

Controller deploy 5012 passed permission probes but UDS archive deployment failed with only `kubernetes_authorization`. The captured CLI error was discarded, and the Loki search did not surface the denied operation. Parse standard Kubernetes Forbidden errors into up to three distinct permission summaries: verb, resource, API group and namespace/cluster scope. Every emitted value is allowlisted; unknown values become fixed placeholders. Usernames, object names, trailing reasons, command arguments and raw output remain withheld. No RBAC, admission policy, credentials, workflow inputs or check names change. Validation: 99 RKE2/channel/release-tag regressions passed, including 11 diagnostic tests for private-value leakage, malformed errors, ANSI output, namespaced/cluster/subresource denials, deduplication and bounded output. Ruff F, diff checks and the active Gitleaks 8.30.1 hook passed. After review, release and promote the library to `stable-v1`, then request approval for a fresh owning controller deploy retry. The existing signed controller bundle does not need rebuilding for this logging change. The denied operation and any permission correction remain unverified until that run.

kiyi added 1 commit

2026-10-16 23:33:01 -05:00

Report safe Kubernetes permission details for RKE2 deployment denials

Workflow acceptance / acceptance (pull_request) Successful in 1m39s

Details

Repository security / security-1 (pull_request) Successful in 5m28s

Details

Library checks / tests (pull_request) Successful in 8m8s

Details

749f6fa510

kiyi added this to the Homelab Roadmap project

2026-10-16 23:33:38 -05:00

portegumi approved these changes

2026-10-16 23:34:23 -05:00

portegumi left a comment

Reviewed authenticated head 749f6fa510. The changed RKE2 diagnostic path strips ANSI sequences, limits each captured stream to its final 128 KiB, parses Forbidden permissions within each stream, emits only fixed allowlisted verbs/resource-group pairs/scopes, deduplicates and caps summaries at three, and continues withholding raw CLI output, arguments and input from CommandError. I inspected the changed diagnostic tests and delivery documentation, and traced the deploy command through the existing signed-bundle/security/preflight path. This is diagnostic-only; it does not change UDS package selection, RBAC, admission, routing, or policy gates. No source blocker found. Source approval does not establish a successful deployment or identify the denial from run 5012. Workflow acceptance, repository security, and Library checks are pending at review time; all required gates must pass before merge, and a fresh owning deploy retry requires separate operator approval after library promotion.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed authenticated head 749f6fa51013820ebd7c5f225b82655c7eafd86c. The changed RKE2 diagnostic path strips ANSI sequences, limits each captured stream to its final 128 KiB, parses Forbidden permissions within each stream, emits only fixed allowlisted verbs/resource-group pairs/scopes, deduplicates and caps summaries at three, and continues withholding raw CLI output, arguments and input from CommandError. I inspected the changed diagnostic tests and delivery documentation, and traced the deploy command through the existing signed-bundle/security/preflight path. This is diagnostic-only; it does not change UDS package selection, RBAC, admission, routing, or policy gates. No source blocker found. Source approval does not establish a successful deployment or identify the denial from run 5012. Workflow acceptance, repository security, and Library checks are pending at review time; all required gates must pass before merge, and a fresh owning deploy retry requires separate operator approval after library promotion. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi referenced this pull request from Homelab/Documentation

2026-10-16 23:36:53 -05:00

Record signed controller build and current RKE2 delivery blockers #54