chore(kyverno): retire the dead ghcr image-verification policies #477

Open

ryangr0 wants to merge 1 commit from feat/retire-ghcr-policies into main

pull from: feat/retire-ghcr-policies

merge into: webgrip:main

webgrip:main

webgrip:renovate/patch-mise-tools

webgrip:renovate/harbor.webgrip.dev-dockerhub-amazon-aws-cli-2.36.x

webgrip:renovate/docker.io-amazon-aws-cli-2.36.x

webgrip:fix/litellm-ingress-ploeg

webgrip:renovate/harbor.webgrip.dev-dockerhub-n8nio-n8n-2.x

webgrip:renovate/harbor.webgrip.dev-dockerhub-python-3.14-alpine

webgrip:renovate/docker.io-python-3.14-slim

webgrip:renovate/harbor.webgrip.dev-dockerhub-n8nio-n8n-2.34.x

webgrip:renovate/harbor.webgrip.dev-dockerhub-library-docker-29.7.x

webgrip:feat/ploeg-bench-team

webgrip:fix/runner-mem-request-node-pressure

webgrip:fix/runner-mem-grype-oom

webgrip:fix/harbor-ci-robot-tag-delete

webgrip:renovate/platform-patch-flux-oci-helm-charts-(platform)

webgrip:renovate/docker.io-renovate-renovate-43.x

webgrip:renovate/ghcr.io-siderolabs-kubelet-1.36.x

webgrip:renovate/harbor.webgrip.dev-dockerhub-dxflrs-garage-2.x

webgrip:renovate/docker.io-alpine-3.x

webgrip:renovate/patch-flux-controllers

webgrip:renovate/harbor.webgrip.dev-dockerhub-invoiceninja-invoiceninja-5.13.x

webgrip:feat/renovate-enable-gomod

Conversation 0 Commits 1 Files changed 7 +209 -216

ryangr0 commented 2026-07-31 13:44:59 +00:00

Owner

Copy link

image-verify-audit and image-attestations-audit both target ghcr.io/webgrip/*.
Forgejo publishes only to Harbor now. Verified against the live cluster before
removing: both policies produce ZERO PolicyReport results, and no ghcr.io/webgrip
image is running anywhere. image-verify-harbor-audit remains and is working
(6 pass / 7 fail, the failures being "missing digest" on tag-deployed workloads).

exception-arc-runner-attestations goes with them — it excepted a policy that no
longer exists.

The CLI test was already broken: it loaded ../../policies/*.yaml but the manifests
live in ../../policies/app/, so it could not have run. Repointed at the Harbor
policy and kept the assertion that actually matters — that a verifyImages policy
does NOT claim jurisdiction over third-party images.

Adds RFC: container runtime isolation. ADR-0026 rejected "keep DinD, sandbox the
node (gVisor/Kata)" in two lines, correctly, for the question it was asking — how
to build images without privileged: true. Rootless BuildKit answers that better.
The RFC asks the separate question ADR-0026 left open: once the build engine is
rootless, what still contains the arbitrary repo code CI runs, while it holds a
Harbor push credential and OpenBao signing capability? Proposes gVisor (Talos
core-tier extension, no KVM needed) then Kata on worker-1, in measured waves.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

image-verify-audit and image-attestations-audit both target ghcr.io/webgrip/*. Forgejo publishes only to Harbor now. Verified against the live cluster before removing: both policies produce ZERO PolicyReport results, and no ghcr.io/webgrip image is running anywhere. image-verify-harbor-audit remains and is working (6 pass / 7 fail, the failures being "missing digest" on tag-deployed workloads). exception-arc-runner-attestations goes with them — it excepted a policy that no longer exists. The CLI test was already broken: it loaded ../../policies/*.yaml but the manifests live in ../../policies/app/, so it could not have run. Repointed at the Harbor policy and kept the assertion that actually matters — that a verifyImages policy does NOT claim jurisdiction over third-party images. Adds RFC: container runtime isolation. ADR-0026 rejected "keep DinD, sandbox the node (gVisor/Kata)" in two lines, correctly, for the question it was asking — how to build images without privileged: true. Rootless BuildKit answers that better. The RFC asks the separate question ADR-0026 left open: once the build engine is rootless, what still contains the arbitrary repo code CI runs, while it holds a Harbor push credential and OpenBao signing capability? Proposes gVisor (Talos core-tier extension, no KVM needed) then Kata on worker-1, in measured waves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ryangr0 added 1 commit 2026-07-31 13:44:59 +00:00

chore(kyverno): retire the dead ghcr image-verification policies ... bc73ae3782

image-verify-audit and image-attestations-audit both target ghcr.io/webgrip/*.
Forgejo publishes only to Harbor now. Verified against the live cluster before
removing: both policies produce ZERO PolicyReport results, and no ghcr.io/webgrip
image is running anywhere. image-verify-harbor-audit remains and is working
(6 pass / 7 fail, the failures being "missing digest" on tag-deployed workloads).

exception-arc-runner-attestations goes with them — it excepted a policy that no
longer exists.

The CLI test was already broken: it loaded ../../policies/*.yaml but the manifests
live in ../../policies/app/, so it could not have run. Repointed at the Harbor
policy and kept the assertion that actually matters — that a verifyImages policy
does NOT claim jurisdiction over third-party images.

Adds RFC: container runtime isolation. ADR-0026 rejected "keep DinD, sandbox the
node (gVisor/Kata)" in two lines, correctly, for the question it was asking — how
to build images without privileged: true. Rootless BuildKit answers that better.
The RFC asks the separate question ADR-0026 left open: once the build engine is
rootless, what still contains the arbitrary repo code CI runs, while it holds a
Harbor push credential and OpenBao signing capability? Proposes gVisor (Talos
core-tier extension, no KVM needed) then Kata on worker-1, in measured waves.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Some checks failed

Hide all checks

e2e / Kyverno Chainsaw (KinD) (pull_request) Failing after 4m17s

Required

Details

e2e / Lint & static validation (pull_request) Failing after 4m26s

Required

Details

e2e / Validate Renovate config (pull_request) Successful in 6m8s

Required

Details

e2e / Flux-local render (pull_request) Successful in 5m2s

Required

Details

This pull request has changes conflicting with the target branch.

• kubernetes/apps/kyverno/exceptions/app/exception-arc-runners.yaml
• kubernetes/apps/kyverno/policies/app/image-attestations-audit.yaml
• kubernetes/apps/kyverno/policies/app/image-verify-audit.yaml
• kubernetes/apps/kyverno/policies/app/kustomization.yaml
• kubernetes/apps/kyverno/tests/cli/image-verification/kyverno-test.yaml

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title Merge pull request 'chore(kyverno): retire the dead ghcr image-verification policies' (#477) from feat/retire-ghcr-policies into main

Merge commit body Reviewed-on: https://forgejo.webgrip.dev/webgrip/homelab-cluster/pulls/477

Merge pull request 'chore(kyverno): retire the dead ghcr image-verification policies' (#477) from feat/retire-ghcr-policies into main Reviewed-on: https://forgejo.webgrip.dev/webgrip/homelab-cluster/pulls/477 Copy merge commit message

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/retire-ghcr-policies:feat/retire-ghcr-policies

git switch feat/retire-ghcr-policies

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

pull-request

Mirrored from GitHub Pull Request

No labels

pull-request

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/homelab-cluster!477

No description provided.