Allow namespaced exemption readiness reads for RKE2 delivery #116

Merged

gitchegumi merged 1 commit from kiyi/rke2-exemption-discovery into main

2026-10-17 07:47:24 -05:00

kiyi commented

2026-10-17 07:32:29 -05:00

Member

Controller deploy 5015 identified a denied list request for uds.dev/exemptions in uds-policy-exemptions. The pinned Zarf readiness informer performs both list and watch without an object-name selector.

Add only those two namespaced read verbs to the controller and Plan delivery Roles and their generated preflight contracts (79 required/14 forbidden probes). Preserve named/admission-constrained writes, Secret restrictions, all cluster-wide boundaries, workflow inputs and check names. Document the existing bootstrap/Terraform maintenance path and temporary-login retirement.

Validation: 100 RKE2/channel/release-tag tests, 13 Platform guard tests, all paired source contracts and Platform source validation passed. A before/after comparison proves exactly two bootstrap Roles gain the read rule and the controller/Plan runtime contracts remain identical, so the signed controller bundle remains reusable. Ruff F and Gitleaks passed.

Merge/release/promote this library before merging paired Platform identity source. A new signed bootstrap build/deploy is required to update live Roles; the old bootstrap archive lacks the correction. The retired bootstrap login must be temporarily restored through reviewed Terraform plan/apply and retired again afterward. No live permission change or manual dispatch is included.

Controller deploy 5015 identified a denied list request for `uds.dev/exemptions` in `uds-policy-exemptions`. The pinned Zarf readiness informer performs both list and watch without an object-name selector. Add only those two namespaced read verbs to the controller and Plan delivery Roles and their generated preflight contracts (79 required/14 forbidden probes). Preserve named/admission-constrained writes, Secret restrictions, all cluster-wide boundaries, workflow inputs and check names. Document the existing bootstrap/Terraform maintenance path and temporary-login retirement. Validation: 100 RKE2/channel/release-tag tests, 13 Platform guard tests, all paired source contracts and Platform source validation passed. A before/after comparison proves exactly two bootstrap Roles gain the read rule and the controller/Plan runtime contracts remain identical, so the signed controller bundle remains reusable. Ruff F and Gitleaks passed. Merge/release/promote this library before merging paired Platform identity source. A new signed bootstrap build/deploy is required to update live Roles; the old bootstrap archive lacks the correction. The retired bootstrap login must be temporarily restored through reviewed Terraform plan/apply and retired again afterward. No live permission change or manual dispatch is included.

kiyi added 1 commit

2026-10-17 07:32:29 -05:00

Allow namespaced exemption readiness reads for RKE2 delivery

Workflow acceptance / acceptance (pull_request) Successful in 1m56s

Details

Repository security / security-1 (pull_request) Successful in 4m25s

Details

Library checks / tests (pull_request) Successful in 6m20s

Details

2528245426

kiyi added this to the Homelab Roadmap project

2026-10-17 07:33:15 -05:00

portegumi approved these changes

2026-10-17 07:33:56 -05:00

portegumi left a comment

Reviewed exact head 2528245426. The changed-file inventory has five paths; I read the complete changed identity source, both generated controller/Plan permission contracts, the added negative-boundary test, and delivery notes. The exemption Roles for both routine identities now grant only namespace-scoped uds.dev/exemptions list/watch without resourceNames; create remains admission-constrained, get/patch/update remain named, the unrelated Secret remains patch-only, and no cluster-wide exemption read appears. The required probes contain both new verbs; forbidden probes still reject unrelated exemption patch and Secret get. I cross-checked the pinned UDS CLI v0.38.0 vendored Zarf watcher: it requests namespace-scoped list and watch through an informer. No deployment gateway/routing ownership changes are involved. I found no source blocker and APPROVE this SHA. Forgejo's changed-files endpoint omitted patch hunks, so this review used exact-head complete source plus the bounded changed-file inventory rather than a base-to-head diff; I did not independently run local tests. Library checks, workflow acceptance, and repository security are still pending and remain mandatory merge gates. Approval does not update live Roles or authorize merge/deployment: the matching Platform identity change, new signed bootstrap build/deploy and separately reviewed Terraform temporary-login restoration/retirement remain operational steps.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed exact head 2528245426e17530462e99a6316d23b8eb933929. The changed-file inventory has five paths; I read the complete changed identity source, both generated controller/Plan permission contracts, the added negative-boundary test, and delivery notes. The exemption Roles for both routine identities now grant only namespace-scoped `uds.dev/exemptions` list/watch without resourceNames; create remains admission-constrained, get/patch/update remain named, the unrelated Secret remains patch-only, and no cluster-wide exemption read appears. The required probes contain both new verbs; forbidden probes still reject unrelated exemption patch and Secret get. I cross-checked the pinned UDS CLI v0.38.0 vendored Zarf watcher: it requests namespace-scoped list and watch through an informer. No deployment gateway/routing ownership changes are involved. I found no source blocker and APPROVE this SHA. Forgejo's changed-files endpoint omitted patch hunks, so this review used exact-head complete source plus the bounded changed-file inventory rather than a base-to-head diff; I did not independently run local tests. Library checks, workflow acceptance, and repository security are still pending and remain mandatory merge gates. Approval does not update live Roles or authorize merge/deployment: the matching Platform identity change, new signed bootstrap build/deploy and separately reviewed Terraform temporary-login restoration/retirement remain operational steps. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.