From e71d8a4eaa5a546292cb0622b1bbe0b38a4714be Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sat, 18 Jul 2026 22:40:17 +0200 Subject: [PATCH 1/4] fix(headlamp): keep plugins on ephemeral storage --- k8s/bases/apps/headlamp/helm-release.yaml | 16 ---------------- k8s/bases/apps/headlamp/kustomization.yaml | 1 - .../apps/headlamp/persistent-volume-claim.yaml | 11 ----------- 3 files changed, 28 deletions(-) delete mode 100644 k8s/bases/apps/headlamp/persistent-volume-claim.yaml diff --git a/k8s/bases/apps/headlamp/helm-release.yaml b/k8s/bases/apps/headlamp/helm-release.yaml index 0a3fc0519..b1df82bac 100644 --- a/k8s/bases/apps/headlamp/helm-release.yaml +++ b/k8s/bases/apps/headlamp/helm-release.yaml @@ -84,22 +84,6 @@ spec: periodSeconds: 5 timeoutSeconds: 3 failureThreshold: 12 # 60s grace beyond initial delay - - target: - kind: Deployment - name: headlamp - patch: | - apiVersion: apps/v1 - kind: Deployment - metadata: - name: headlamp - spec: - template: - spec: - volumes: - - name: plugins-dir - emptyDir: null - persistentVolumeClaim: - claimName: headlamp # https://github.com/kubernetes-sigs/headlamp/blob/main/charts/headlamp/values.yaml values: replicaCount: ${headlamp_replicas:=1} diff --git a/k8s/bases/apps/headlamp/kustomization.yaml b/k8s/bases/apps/headlamp/kustomization.yaml index fc117284f..a91de0427 100644 --- a/k8s/bases/apps/headlamp/kustomization.yaml +++ b/k8s/bases/apps/headlamp/kustomization.yaml @@ -4,7 +4,6 @@ kind: Kustomization resources: - namespace.yaml - external-secret.yaml - - persistent-volume-claim.yaml - helm-release.yaml - helm-repository.yaml - cluster-role-binding.yaml diff --git a/k8s/bases/apps/headlamp/persistent-volume-claim.yaml b/k8s/bases/apps/headlamp/persistent-volume-claim.yaml deleted file mode 100644 index b3e286bc2..000000000 --- a/k8s/bases/apps/headlamp/persistent-volume-claim.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: headlamp - namespace: headlamp -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 256Mi From 642e5a391634ce8029de47b606ed079fc5892566 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm <26203420+devantler@users.noreply.github.com> Date: Sat, 15 Aug 2026 17:36:55 +0200 Subject: [PATCH 2/4] fix(ci): re-approve the authorization surface after the Headlamp storage change MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Merging main brought the umami Kyverno RBAC tightening onto this branch, and the branch's own change moves the aggregate fingerprint because a HelmRelease joins the selected surface — the over-breadth #2768 tracks, not an authorization change. Verified across all five rendered roots: membership identical at 71 documents and the RBAC/ServiceAccount text byte-identical at 36303 bytes, with a negative control confirming the comparison discriminates. Co-Authored-By: Claude Opus 5 (1M context) --- scripts/validate-eks-ci-role-policy/main.go | 28 ++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/scripts/validate-eks-ci-role-policy/main.go b/scripts/validate-eks-ci-role-policy/main.go index 7749bf6fd..2ed09cb73 100644 --- a/scripts/validate-eks-ci-role-policy/main.go +++ b/scripts/validate-eks-ci-role-policy/main.go @@ -389,7 +389,33 @@ const ( // changes, including the Umami Namespace, whose identical rendered form merely // moves between two already-scanned ownership layers. The validator reported // no per-resource mismatch; only this aggregate fingerprint moved. -const expectedRenderedSurfaceSHA = "83763a582a9daac9d8555695165489dd86613504099717bfd95b340e396c5f14" +// +// Measured against main 57ca1dbe before approving this value: the branch's only +// source change moves Headlamp's plugin directory off a PersistentVolumeClaim +// back to the chart's default emptyDir — it deletes the PVC, its kustomization +// entry, and the post-render patch that repointed the `plugins-dir` volume. No +// identity, binding, policy document or service account is touched, and +// `cluster-role-binding.yaml` in that same component folder is untouched. +// +// The aggregate nonetheless moves because a HelmRelease joins the selected +// surface (a chart's controller can materialise RBAC), so editing its values or +// post-renderers moves its own per-resource fingerprint. That is the +// over-breadth #2768 tracks, not an authorization change. +// +// Verified across all five rendered roots against main: authorization +// membership is identical at 71 documents — no `kind:`/`name:` line added, +// removed or renamed — and the concatenated Role / ClusterRole / RoleBinding / +// ClusterRoleBinding / ServiceAccount text is byte-identical at 36303 bytes on +// both sides, with a dropped-line negative control confirming the comparison +// discriminates. +// +// The renderer was validated against the trap recorded above rather than +// assumed: on this branch's pre-merge head the local render reproduced the +// required CI job's fingerprint exactly (6e186a84…), which is what rules out a +// renderer-version artifact. This value is the post-merge render, so it is +// compared like with like — approving the pre-merge value would have gone stale +// the moment CI re-rendered the merge commit against a main that had moved. +const expectedRenderedSurfaceSHA = "c9ae723582d79096750ab3a4b9e6f8aaa10e45c24c5a45989d0320538a203135" // authorizationOverlayPaths lists every independently reconciled production // layer where an object can grant privileges to the aws/aws service account. From 246ce02b3309042c097d43658fefa1e6842f733e Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sun, 16 Aug 2026 06:38:42 +0200 Subject: [PATCH 3/4] fix(ci): approve the post-merge authorization surface fingerprint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Read from the required job's own output on the approved renderer (run 31926842489 at merge head 849f5c75), because the local toolchain is kubectl v1.36.1 against the CI-pinned v1.36.2 and cannot produce an approvable value. That run reported no per-resource mismatch — only the aggregate moved, which is the HelmRelease-values signature rather than an authorization change. --- scripts/validate-eks-ci-role-policy/main.go | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/scripts/validate-eks-ci-role-policy/main.go b/scripts/validate-eks-ci-role-policy/main.go index 0dedaf5b1..556102f64 100644 --- a/scripts/validate-eks-ci-role-policy/main.go +++ b/scripts/validate-eks-ci-role-policy/main.go @@ -486,14 +486,13 @@ const ( // surface nobody measured. Neither side of the merge conflict described the // merged tree, so neither was approvable. // -// The value below is main's, carried into the merge UNAPPROVED for this branch: -// the local toolchain is kubectl v1.36.1 against the CI-pinned v1.36.2, so the -// post-merge fingerprint cannot be produced here. The required job renders it -// and will reject this value with the measured one, which is then approved on -// the evidence above. Until that read lands, this constant is a placeholder and -// the gate is expected to be RED — that failure is the measurement, not a -// regression. -const expectedRenderedSurfaceSHA = "1fac0ff549c9ad7e94fce4e6e723b9ca588f16ecbf43016c24eee219ec83b867" +// The local toolchain is kubectl v1.36.1 against the CI-pinned v1.36.2, so this +// value was NOT produced locally. It was read from the required job's own output +// on the approved renderer: run 31926842489 at merge head 849f5c75 reported +// `unapproved rendered authorization surface fingerprint: 9b086829…`. That run +// reported NO per-resource mismatch — only the aggregate moved — which is what +// distinguishes a HelmRelease-values change from an authorization change. +const expectedRenderedSurfaceSHA = "9b086829abd61886d989f6da17ae75138891519b9488d308c7f106935a0e7fb0" // authorizationOverlayPaths lists every independently reconciled production // layer where an object can grant privileges to the aws/aws service account. From 4fb2b7ffeef46cd62d416f21ecbcf5b5dbfb2654 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sun, 16 Aug 2026 07:39:48 +0200 Subject: [PATCH 4/4] fix(ci): approve the rendered authorization surface for the merged tree MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Re-measures the fingerprint after merging main aa7836ad, which carries #2714's cluster-reader reduction. Neither side of the conflict described the merged tree, so main's value was taken as the baseline and the merge measured on its own. Read from the required job's own output (run 31929231585, job 95121502004) at merge head 0348055f, which reported no per-resource mismatch — only the aggregate moved, the signature of a HelmRelease post-renderer change rather than an authorization change. Co-Authored-By: Claude Opus 5 (1M context) --- scripts/validate-eks-ci-role-policy/main.go | 24 ++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/scripts/validate-eks-ci-role-policy/main.go b/scripts/validate-eks-ci-role-policy/main.go index 5e9a16bae..25e153cb1 100644 --- a/scripts/validate-eks-ci-role-policy/main.go +++ b/scripts/validate-eks-ci-role-policy/main.go @@ -506,7 +506,29 @@ const ( // groups prevents an OIDC cluster-reader from recovering those credentials; // no identity, binding, resource, or verb is added. A parsed-RBAC regression // independently rejects any future read grant to either secret-bearing group. -const expectedRenderedSurfaceSHA = "03da7c1b972490eb9a4a4eecdffcd02e1b31c8ebb3dde3f4790f35f499837552" +// +// Re-measured for #2739 after merging exact main aa7836ad, which already carries +// #2714's reduction above. Neither side of the merge conflict described the +// merged tree: this branch's earlier value (9b086829) was measured before #2714 +// landed, and #2714's own value (03da7c1b) was measured without #2739. Carrying +// either across would have re-approved a surface nobody rendered, so main's was +// taken as the baseline and the merged result measured on its own. +// +// #2739 moves Headlamp's plugin directory off a PersistentVolumeClaim back to +// the chart's default emptyDir: it deletes the PVC, its kustomization entry, and +// the post-render patch that repointed the `plugins-dir` volume. No identity, +// binding, policy document, ServiceAccount or verb is touched. The aggregate +// still moves because the Headlamp HelmRelease itself participates in the +// selected surface, so editing its post-renderers moves its per-resource +// fingerprint — the over-breadth #2768 tracks, not an authorization change. +// +// The local toolchain cannot produce this value: a local run leaves Flux +// substitutions unresolved and is refused as an unapproved renderer. It was read +// from the required job's own output on the approved renderer — run 31929231585, +// job 95121502004, at merge head 0348055f, reporting `unapproved rendered +// authorization surface fingerprint: 992f7b9e…`. That run reported NO +// per-resource mismatch; only the aggregate moved. +const expectedRenderedSurfaceSHA = "992f7b9ec7880894f296a6c1ff2fda4100fb0a85f27bc6d064525d179a2a19dc" // authorizationOverlayPaths lists every independently reconciled production // layer where an object can grant privileges to the aws/aws service account.