Support version-bound reusable RKE2 upgrade images #117

Merged

gitchegumi merged 1 commit from kiyi/rke2-upgrade-image into main

2026-10-17 12:43:20 -05:00

kiyi commented

2026-10-17 12:28:52 -05:00

Member

Allow the RKE2 Plan bundle to consume a separately built, scanned and published homelab/tool-images/rke2-upgrade payload. Require its exact image, readable release tag, selected RKE2 version and source commit in upgrade-image.json; keep the existing Rancher pin contract supported. The non-root image requires explicit root selection in the privileged upgrade containers.

Bind this declaration only into Plan receipts. A credential-free before/after source comparison confirms that adopting the payload leaves controller and bootstrap inventories/manifests identical, so the accepted controller does not need rebuilding. No image digest or Plan target is changed by this PR.

Validation: all 80 RKE2 regressions passed in Linux fixtures, including missing/mismatched target, digest, source, repository, tag and schema rejection. Actual source-contract checks accept the new payload and reject missing upgrade-root selection. Ruff F, diff checks and native staged Gitleaks passed. Existing workflow/check names and protected operations are unchanged.

Allow the RKE2 Plan bundle to consume a separately built, scanned and published `homelab/tool-images/rke2-upgrade` payload. Require its exact image, readable release tag, selected RKE2 version and source commit in `upgrade-image.json`; keep the existing Rancher pin contract supported. The non-root image requires explicit root selection in the privileged upgrade containers. Bind this declaration only into Plan receipts. A credential-free before/after source comparison confirms that adopting the payload leaves controller and bootstrap inventories/manifests identical, so the accepted controller does not need rebuilding. No image digest or Plan target is changed by this PR. Validation: all 80 RKE2 regressions passed in Linux fixtures, including missing/mismatched target, digest, source, repository, tag and schema rejection. Actual source-contract checks accept the new payload and reject missing upgrade-root selection. Ruff F, diff checks and native staged Gitleaks passed. Existing workflow/check names and protected operations are unchanged.

kiyi added 1 commit

2026-10-17 12:28:52 -05:00

Support version-bound reusable RKE2 upgrade images

Repository security / security-1 (pull_request) Successful in 2m15s

Details

Workflow acceptance / acceptance (pull_request) Successful in 3m49s

Details

Library checks / tests (pull_request) Successful in 7m33s

Details

ff8bfeeb00

portegumi approved these changes

2026-10-17 12:31:51 -05:00

portegumi left a comment

Reviewed exact head ff8bfeeb00: the owned RKE2 upgrade image is restricted to the approved repository, immutable digest and release-tag shape, with a schema-exact declaration binding image, selected target and source SHA. Legacy Rancher pin behavior remains accepted; both Plan upgrade containers require explicit root for the owned non-root payload. The Plan image remains in the package inventory and signed receipt/security gate; no manifest, route, gateway or UDS policy source is changed. The targeted regression exercises accepted legacy/owned references and rejected missing or mismatched metadata. Source approval only: acceptance, security and Library checks all failed while creating their pinned runner job container ('No such image'), before source tests/scans could run. Restore the affected runner image/startup path and rerun checks at this head; do not treat this approval as CI or merge readiness.

CI at submission: failure. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed exact head ff8bfeeb0008ba0f6f0ba73544b8631405872033: the owned RKE2 upgrade image is restricted to the approved repository, immutable digest and release-tag shape, with a schema-exact declaration binding image, selected target and source SHA. Legacy Rancher pin behavior remains accepted; both Plan upgrade containers require explicit root for the owned non-root payload. The Plan image remains in the package inventory and signed receipt/security gate; no manifest, route, gateway or UDS policy source is changed. The targeted regression exercises accepted legacy/owned references and rejected missing or mismatched metadata. Source approval only: acceptance, security and Library checks all failed while creating their pinned runner job container ('No such image'), before source tests/scans could run. Restore the affected runner image/startup path and rerun checks at this head; do not treat this approval as CI or merge readiness. CI at submission: failure. This is a source-review approval, not a scan verdict; required checks still block merge.

kiyi added this to the Homelab Roadmap project

2026-10-17 12:37:23 -05:00