Preserve RKE2 release compatibility for additive Plan reviews #118

Merged

gitchegumi merged 1 commit from kiyi/rke2-review-compatibility into main

2026-10-17 13:30:08 -05:00

kiyi commented

2026-10-17 13:23:36 -05:00

Member

Also preserve the controller’s upstream privileged execution and CAP_SYS_BOOT when Plans explicitly select root for the new non-root image. A custom Plan securityContext replaces the generated default; requiring UID/GID alone would silently drop those host-upgrade settings. Validate the complete bounded context without changing exemption scope, target versions or workflow/status names.

Validation: all 83 RKE2 regression tests pass, including additive-review release discovery, unchanged signed receipt reuse, changed/removed/expired/invalid review rejection, and missing or broadened upgrade privileges. Actual paired Platform source checks preserve controller/bootstrap inventories and manifests; the published payload’s complete image findings pass under its three exact reviews. Ruff F, diff checks and native staged Gitleaks pass. Source-only validation; no deployment or workflow dispatch occurred.

Publish and promote this correction before activating Platform’s published upgrade-payload adoption.

Adding the three approved RKE2 upgrade-payload reviews to Platform currently makes the already accepted controller release incompatible: delivery requires the entire repository mitigation policy to remain byte-for-byte equivalent. Allow additive reviews while requiring every retained signed approval, including its scope, owner, controls and expiry, to remain unchanged. Evaluate retained findings against both policies. Signatures, artifact hashes, inventory/manifests, source ancestry, expiry checks and fresh deployment image scans remain required. Removed or edited approvals still require a new build. Also preserve the controller’s upstream privileged execution and CAP_SYS_BOOT when Plans explicitly select root for the new non-root image. A custom Plan securityContext replaces the generated default; requiring UID/GID alone would silently drop those host-upgrade settings. Validate the complete bounded context without changing exemption scope, target versions or workflow/status names. Validation: all 83 RKE2 regression tests pass, including additive-review release discovery, unchanged signed receipt reuse, changed/removed/expired/invalid review rejection, and missing or broadened upgrade privileges. Actual paired Platform source checks preserve controller/bootstrap inventories and manifests; the published payload’s complete image findings pass under its three exact reviews. Ruff F, diff checks and native staged Gitleaks pass. Source-only validation; no deployment or workflow dispatch occurred. Publish and promote this correction before activating Platform’s published upgrade-payload adoption.

kiyi added 1 commit

2026-10-17 13:23:36 -05:00

Preserve RKE2 release compatibility for additive Plan reviews

Repository security / security-1 (pull_request) Successful in 2m27s

Details

Workflow acceptance / acceptance (pull_request) Successful in 3m2s

Details

Library checks / tests (pull_request) Successful in 4m42s

Details

93e8f295dd

kiyi added this to the Homelab Roadmap project

2026-10-17 13:24:40 -05:00

portegumi approved these changes

2026-10-17 13:25:12 -05:00

portegumi left a comment

Reviewed exact head 93e8f295dd. The RKE2 receipt path accepts only additive mitigation-policy entries while retaining the signed policy version and each existing review, then evaluates the retained findings against both policies; signed file hashes, inventory/manifests, ancestry and deployment scan checks remain in place. The owned non-root upgrade Plan context must explicitly retain root UID/GID, privileged execution and exactly CAP_SYS_BOOT; the existing target, inventory and scoped UDS exemption checks remain unchanged. Source and regression cases cover additive discovery/reuse, changed or removed reviews, expiry and missing/broadened privileges. This is a source approval, not deployment or scan acceptance: Workflow acceptance, Repository security and Library checks were pending at review time, and required gates must pass before merge. I did not independently execute tests or deploy.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed exact head 93e8f295dd8169db238167246f37949cce3bc6c8. The RKE2 receipt path accepts only additive mitigation-policy entries while retaining the signed policy version and each existing review, then evaluates the retained findings against both policies; signed file hashes, inventory/manifests, ancestry and deployment scan checks remain in place. The owned non-root upgrade Plan context must explicitly retain root UID/GID, privileged execution and exactly CAP_SYS_BOOT; the existing target, inventory and scoped UDS exemption checks remain unchanged. Source and regression cases cover additive discovery/reuse, changed or removed reviews, expiry and missing/broadened privileges. This is a source approval, not deployment or scan acceptance: Workflow acceptance, Repository security and Library checks were pending at review time, and required gates must pass before merge. I did not independently execute tests or deploy. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.