3 Commits

Include renames

Author	SHA1	Message	Date
jakman85andClaude Opus 5.5	d2c4bd5194	fix(buildkit): allow buildkitd egress to Gitea's backend so the Gateway stops 403ing the push ... Images run 337's push failed with "403 Forbidden: Access denied". Measured read-only: Gitea never logged the request; an unauthenticated GET /v2/ via the Gateway gets 401 from Gitea when sent from act-runner (egress unrestricted) but 403 from buildkitd; Hubble logs it as an L7 http-request DROPPED with traffic_direction EGRESS. Cilium >= 1.16.8 (CVE-2025-30162) re-checks the source pod's egress against the proxied backend identity, and buildkitd's egress only allowed world and the ingress entity. Same fix as 68690e5 for Keycloak. Gitea's ingress already admits reserved:ingress and is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-30 00:38:54 -05:00
jakman85andClaude Opus 5.5	04eb38584a	fix(conformance): workload-mTLS certificates may use a private CA, if they prove they are workload-internal ... R-TLS-01/docs/08 govern externally reachable TLS and ADR-0006 puts workload mTLS out of scope, but tls-lifecycle-automated required ACME for every Certificate, which platform/buildkit's internal CA cannot satisfy. Clause (5b) accepts the tls-scope=workload-mtls annotation only when the certificate proves it: no Gateway serves it, internal names only, namespaced selfSigned/ca issuer backed by an exempt CA certificate. Also fixes yamllint comma spacing in the buildkitd mounts. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-29 23:59:55 -05:00
jakman85andClaude Opus 5.5	f65c12b395	feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages ... Operator decision on PR #81: no CI job may reach a privileged daemon. The act runner is untouched. - platform/buildkit (+ clusters/base/buildkit.yaml): moby/buildkit v0.34.1-rootless pinned by digest, uid 1000, not privileged; caps drop ALL + SETUID/SETGID, seccomp/AppArmor Unconfined, read-only rootfs (each measured under podman). cert-manager CA + server/client certs, ClusterIP :1234, default-deny with ingress only from the act-runner pod (DinD masquerades jobs to it). No Kyverno exception: every applied policy matches app-namespace=true only. - Each Containerfile names its shipped stage and ends in a `verify` stage holding every former `docker run` assertion (uid 65532, RUN --network=none, writable-path inventory standing in for the read-only rootfs). The old `&& echo` checks that could never fail are real assertions now. - images.sh drives buildkitd with a pinned buildx (sha256-checked) via bake; PRs build verify targets with agent-runner FROM the in-run toolbox (target: context); main verifies, then pushes. Fails loudly when the builder secrets are absent or buildkitd is unreachable. - infra/gitea/buildkit-client-secret.sh copies the client cert into Actions secrets. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-29 23:59:55 -05:00