diff --git a/README.md b/README.md index 580604de4..21005750d 100644 --- a/README.md +++ b/README.md @@ -8,8 +8,13 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Project status -This source tree provides Catalog `v0.3.16`; its GitHub tag and Release determine -when it is published. It exposes one Native project template and twenty-one +Catalog `v0.3.17` includes thirteen new numeric template revisions that consume +qualified Ubuntu security backports in the corresponding component images. +Only packages already installed in each runtime are updated; configuration, +the coreutils provider and the established plugin ownership boundaries remain +unchanged. Previously published numeric revisions remain available. + +The catalog exposes one Native project template and twenty-one reviewed infrastructure entries. See [SUPPORTED.md](SUPPORTED.md) for the current versions and [catalog-provenance.json](catalog-provenance.json) for preserved upstream origins. General third-party application examples and the @@ -25,11 +30,12 @@ Officially unfixed Low/Medium findings remain tracked, not resolved; narrowly scoped VEX decisions require product-specific evidence and retain the raw scan. A clean gate is not a claim that every dependency has zero reported CVEs. -Network Services revision 13 uses NPM `v0.8.25` and Metadata `v0.10.6`. -Both runtime GitHub Releases report `immutable: false`; the recorded OCI -manifest digests identify verified content, not a GitHub release lock. -Metadata106 retains 44 reviewed unfixed raw findings (38 Medium, 6 Low), -tracked separately from publication and environment acceptance. +Network Services revision 14 uses Network Plugin Manager `v0.8.25`, Metadata +`v0.10.7` and Internal DNS `v0.17.14`. The recorded OCI manifest digests identify +verified image content; they do not imply that GitHub has locked a release. +Runtime SBOMs, raw and interpreted findings, producer commits and publication +receipts are recorded per image in `catalog-images.json`. Remaining findings +are tracked separately from publication and environment acceptance. Catalog validation covers template structure, retained versions, Traditional Chinese labels, exact image references and Catalog Service API lookups. CI uses diff --git a/SUPPORTED.md b/SUPPORTED.md index 6acf64784..a0a1c560a 100644 --- a/SUPPORTED.md +++ b/SUPPORTED.md @@ -9,33 +9,40 @@ or out-of-scope templates from being presented as deployable software. | Entry | Type | Version | Image policy | Release state | |---|---|---|---|---| | PastureStack Native | Project template | v0.3.0 | Composes only reviewed, semantic-versioned infrastructure entries | Clean single-host provisioning and restart passed; restored-data validation pending | -| PastureStack Container Schedule | Infrastructure scheduling service | v0.6.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | -| PastureStack System Image Preloader | Infrastructure image-cache service | v0.3.2 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | +| PastureStack Container Schedule | Infrastructure scheduling service | v0.6.2 | container-cron:v0.6.2 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack System Image Preloader | Infrastructure image-cache service | v0.3.3 | system-image-preloader:v0.3.3 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | | PastureStack Amazon ECR Credential Sync | Infrastructure registry service | v3.1.6 | Public PastureStack GHCR image with an explicit version tag | Published component; full runtime raw scan has zero findings; Catalog integration and environment acceptance remain distinct | -| Metadata Healthcheck | Infrastructure stack | v0.3.17 | Public PastureStack GHCR image with a non-overwritten version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | -| PastureStack Network Services | Infrastructure system stack | v0.3.11 | Network Plugin Manager v0.8.25; Metadata Service v0.10.6; Internal DNS v0.17.13 unchanged from revision 12 | OCI digest/SBOM evidence is in catalog-images.json; both runtime GitHub Releases report immutable=false, not locked; Metadata106 retains 44 reviewed unfixed Low/Medium raw findings; environment upgrade/rollback remains separate | +| Metadata Healthcheck | Infrastructure stack | v0.3.18 | metadata-healthcheck:v0.3.18 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack Network Services | Infrastructure system stack | v0.3.12 | metadata-service:v0.10.7 and internal-dns:v0.17.14; Network Plugin Manager remains v0.8.25 | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | | PastureStack Network Diagnostics | Infrastructure diagnostics service | v0.2.2 | Two public PastureStack GHCR images with explicit version tags | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | -| PastureStack Network Policy Manager | Infrastructure network-policy agent | v0.3.4 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | -| PastureStack IPsec Overlay | Infrastructure network driver | v0.3.11 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | +| PastureStack Network Policy Manager | Infrastructure network-policy agent | v0.3.5 | network-policy-manager:v0.3.3 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack IPsec Overlay | Infrastructure network driver | v0.3.12 | ipsec-vxlan-overlay-network:v0.14.41 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | | PastureStack Windows ECR Credential Sync | Windows infrastructure registry service | v3.1.2 | Public PastureStack GHCR Windows image with an explicit version tag | Source tests, cross-compilation, PE, license, anonymous distribution, and vulnerability gates passed; Windows-host runtime pending | | PastureStack Windows Network Services | Windows infrastructure Metadata and DNS stack | v0.3.0 | Two public PastureStack GHCR Windows images with explicit version tags | Source tests, cross-compilation, PE, license, anonymous distribution, and vulnerability gates passed; Windows-host runtime pending | -| PastureStack Windows Container Networking | Windows NAT and transparent network-driver definition | v0.1.1 | Reviewed selector-only placeholder image with an explicit version tag | Catalog rendering and compatibility-boundary review passed; Windows-host network-driver lifecycle pending | -| PastureStack Layer 2 Flat Network | Optional infrastructure network driver | v0.3.5 | Reviewed network image with a semantic version tag; bridge setup is opt-in | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | -| Resource Scheduler | Infrastructure scheduling agent | v0.8.20 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | +| PastureStack Windows Container Networking | Windows NAT and transparent network-driver definition | v0.1.2 | pod-pause-image:v3.0.6 for its existing Linux sandbox role; Windows restrictions remain | Exact publication evidence is in catalog-images.json; this does not qualify a new Windows-host runtime matrix | +| PastureStack Layer 2 Flat Network | Optional infrastructure network driver | v0.3.6 | ipsec-vxlan-overlay-network:v0.14.41 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| Resource Scheduler | Infrastructure scheduling agent | v0.8.21 | resource-scheduler:v0.8.21 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | | PastureStack Route 53 DNS Sync | Infrastructure external-DNS agent | v0.8.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | | PastureStack Amazon EBS Storage | Infrastructure block-storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | | PastureStack Amazon EFS Storage | Infrastructure shared-storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | | PastureStack NFS Storage | Infrastructure storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | -| PastureStack Secret Volume | Infrastructure secret-volume driver | v0.1.3 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | -| PastureStack Vault Volume | Infrastructure Vault token-volume driver | v0.2.2 | Two public PastureStack GHCR images with explicit version tags | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | -| PastureStack Per-Host Subnet Network | Optional infrastructure network driver | v0.3.3 | Reviewed network image with a semantic version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | -| PastureStack VXLAN Overlay Network | Optional infrastructure network driver | v0.3.4 | Reviewed network image with a semantic version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | +| PastureStack Secret Volume | Infrastructure secret-volume driver | v0.1.4 | secrets-flexvolume-plugin:v0.2.2 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack Vault Volume | Infrastructure Vault token-volume driver | v0.2.3 | vault-secrets-bridge:v0.1.3 and secrets-flexvolume-plugin:v0.2.2 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack Per-Host Subnet Network | Optional infrastructure network driver | v0.3.4 | ipsec-vxlan-overlay-network:v0.14.41 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack VXLAN Overlay Network | Optional infrastructure network driver | v0.3.5 | ipsec-vxlan-overlay-network:v0.14.41 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | Deployable image references contain semantic version tags only. A published version tag must never be replaced. Manifest digests are retained only in the corresponding GitHub Release verification evidence; they are not placed in Catalog, Compose, API, or user-interface values. +Catalog `v0.3.17` adds the numeric revisions listed above and preserves all +previously published revisions. Each updated image has its own producer, +manifest digest, runtime SBOM and vulnerability evidence in `catalog-images.json`. +Component publication and Catalog validation are distinct from managed-host +upgrade and rollback acceptance; the historical evidence below retains its +original version and scope. + ## Historical acceptance evidence The sections below preserve earlier environment and feature acceptance context. @@ -94,8 +101,8 @@ Catalog card never exposes a manifest digest. ## PastureStack Network Diagnostics evidence Catalog version `1` remains available for already-installed stacks and retains -the reviewed `v0.2.0` agent and service image tags. Version `2` is the current -default and adds localized question metadata without changing those image tags. +the reviewed `v0.2.0` agent and service image tags. At that review, version `2` +became the default and added localized questions without changing those tags. - Agent image: `ghcr.io/pasturestack/network-diagnostics-agent:v0.2.0` - Agent source: [`PastureStack/network-diagnostics-agent@01f8eefa4db9735a084e6470d814aaef4722e924`](https://github.com/PastureStack/network-diagnostics-agent/tree/01f8eefa4db9735a084e6470d814aaef4722e924) @@ -119,8 +126,8 @@ Catalog publishes port `8091` by default to avoid the control-plane port. ## PastureStack Network Policy Manager evidence Catalog version `1` remains available for already-installed stacks and retains -the reviewed `v0.3.1` image tag. Version `2` is the current default metadata -revision. +the reviewed `v0.3.1` image tag. Version `2` was the default metadata revision +at the time of that validation. - Image: `ghcr.io/pasturestack/network-policy-manager:v0.3.1` - Source: [`PastureStack/network-policy-manager@dfcfc9e22126208587176130d9e6279245d502ba`](https://github.com/PastureStack/network-policy-manager/tree/dfcfc9e22126208587176130d9e6279245d502ba) @@ -253,8 +260,8 @@ Complete multi-host upgrade and rollback remain release-candidate gates. ## PastureStack Secret Volume evidence Catalog version `1` remains available for already-installed stacks and retains -the reviewed `v0.1.1` image tag. Version `2` is the current default metadata -revision. +the reviewed `v0.1.1` image tag. Version `2` was the default metadata revision +at the time of that validation. - Image: `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.1.1` - Source: [`PastureStack/secrets-flexvolume-plugin@6f0d6ed72a37ad9b8169a355e9bcb99472acb7fe`](https://github.com/PastureStack/secrets-flexvolume-plugin/tree/6f0d6ed72a37ad9b8169a355e9bcb99472acb7fe) @@ -410,19 +417,19 @@ release-candidate gates. - Distribution gate: public GHCR and unauthenticated semantic-version-tag pull passed - Component integration: link-local Metadata, long polling, HAProxy configuration and socket, credential compatibility, event reporting, TCP readiness, and stdout/stderr stream separation passed -This entry remains a release candidate. Version `v0.3.16` keeps the established -link-local default from `v0.3.15` and routes routine lifecycle messages to +At that review, this entry was a release candidate. Version `v0.3.16` kept the +established link-local default from `v0.3.15` and routed lifecycle messages to standard output while reserving standard error for actual failures. A fresh -multi-host upgrade, rollback, and complete infrastructure-stack removal remain -release blockers. +multi-host upgrade, rollback, and complete infrastructure-stack removal had not +yet been accepted for that version. ## PastureStack Network Services evidence -The current directory is `13` (`v0.3.11`), using NPM `v0.8.25`, Metadata -`v0.10.6`, and the retained DNS `v0.17.13`. Exact new identities and raw scan +The current directory is `14` (`v0.3.12`), using NPM `v0.8.25`, Metadata +`v0.10.7`, and DNS `v0.17.14`. Exact new identities and raw scan counts are recorded above and in `catalog-images.json`; GitHub release `immutable=false` is distinct from the recorded OCI digest. The directory -`9`/`10` evidence below is historical and is not acceptance of directory `13`. +`9`/`10` evidence below is historical and is not acceptance of directory `14`. Directory `10` is the Network Services `v0.3.8` candidate and changes only Network Plugin Manager to published `v0.8.22` for legacy/current CNI configuration @@ -502,7 +509,7 @@ validate or authorize deployment of directory `4`. - Vulnerability gate: 0 HIGH, 0 CRITICAL, and 0 detected image secrets with Trivy 0.70.0 - Runtime gates: encrypted two-host IPsec traffic, managed CNI, Metadata, DNS, published host ports, daemon restart recovery, rolling replacement, native upgrade, and rollback passed -This entry remains a privileged release candidate. Managed workloads exchanged +That version was reviewed as a privileged release candidate. Managed workloads exchanged bidirectional HTTP and ICMP traffic through AES-GCM XFRM state, resolved service DNS, reached Metadata, and published the same host port on both isolated hosts. Complete infrastructure-stack removal and a clean multi-VM acceptance run diff --git a/catalog-images.json b/catalog-images.json index 1bafcf974..c23e4d9ac 100644 --- a/catalog-images.json +++ b/catalog-images.json @@ -1571,6 +1571,614 @@ "sha256": "91f7cce56e1755e9625e2c6bfd0c6f0c9f73d9158b887037520abca7930186b2", "url": "https://github.com/PastureStack/network-plugin-manager/releases/download/v0.8.25/network-plugin-manager-0.8.25-image.cdx.json" } + }, + { + "reference": "ghcr.io/pasturestack/internal-dns:v0.17.14", + "sourceRepository": "https://github.com/PastureStack/internal-dns", + "sourcePath": "package/linux/amd64/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/internal-dns", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu and other packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "5ad61af813e7361a19c0d50f4d8926533776c4c3", + "manifestDigest": "sha256:526e1f6b5128cc07df555e641a31f3737a614695589bfcae6a76ae34fa6d7061", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/internal-dns/releases/download/v0.17.14/image.cdx.json", + "sha256": "ca3ab94c230224fda405d1e2c8d7e73f3acc5807f9ed6d8641c4bcf536c415e3" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 16, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/internal-dns/releases/download/v0.17.14/image-security.json", + "sha256": "6ddba7297538edbcae1f0d8fd34b8f39b7c098f0f6b4285bb7af9399d9c5e6b4" + }, + "effective": { + "url": "https://github.com/PastureStack/internal-dns/releases/download/v0.17.14/image-security.effective.json", + "sha256": "b0b53281c37adb601fe0b7520cae2b42619f328d6b8abe2dc29b145ca76f2a48" + }, + "evidence": "https://github.com/PastureStack/internal-dns/actions/runs/40141480861" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config and SHA-256-checked published SBOM, scans and installation receipts", + "workflowRun": "https://github.com/PastureStack/internal-dns/actions/runs/40141480861" + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/metadata-healthcheck:v0.3.18", + "sourceRepository": "https://github.com/PastureStack/metadata-healthcheck", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/metadata-healthcheck", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu and HAProxy packages retain their upstream licenses", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "c1ec40205e290646141b299d34591d0fdfcc7c02", + "manifestDigest": "sha256:7c081b446f4675c73d38f79198491e64fdd59bea0e5931085639e876803b92b5", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/metadata-healthcheck/releases/download/v0.3.18/image.cdx.json", + "sha256": "e28e552805f5d21a9fca1ac5b6901245ebae722636f233344c1185df34cafc69" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 16, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/metadata-healthcheck/releases/download/v0.3.18/image-security.json", + "sha256": "f61a2b30d3111cb2c1130dfa623a4f5439b70f5057142add16351080f932a4fb" + }, + "effective": { + "url": "https://github.com/PastureStack/metadata-healthcheck/releases/download/v0.3.18/image-security.effective.json", + "sha256": "9d1488870735d11f22586f1953ec837d23a784b1a2a1ab4e88ec082d73e43fed" + }, + "evidence": "https://github.com/PastureStack/metadata-healthcheck/actions/runs/40141487886" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config and SHA-256-checked published SBOM, scans and installation receipts", + "workflowRun": "https://github.com/PastureStack/metadata-healthcheck/actions/runs/40141487886" + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/metadata-service:v0.10.7", + "sourceRepository": "https://github.com/PastureStack/metadata-service", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/metadata-service", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu and other packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "e5b0473d8daabff3bf7b3d02237441f5b4b3a2ba", + "manifestDigest": "sha256:b0a45fce30552f522673e0c84c4feaf3ec9f1a4e4cd688cc04e192a170a68a87", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/metadata-service/releases/download/v0.10.7/image.cdx.json", + "sha256": "e98063a5d1f4ccd9b6596c96fe1562cbe04eef2ee395462d6a8e5b6ba9cd1b7a" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 10, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2025-1352", + "CVE-2025-1376", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228" + ], + "raw": { + "url": "https://github.com/PastureStack/metadata-service/releases/download/v0.10.7/image-security.json", + "sha256": "763abb61cc95126a3da36e5fc1408b946e5000b06050fc54a1ded9e4cbd3c59a" + }, + "effective": { + "url": "https://github.com/PastureStack/metadata-service/releases/download/v0.10.7/image-security.effective.json", + "sha256": "a546b0a342e85b3c6572480359b6582b5990ff4a2ec2bfa8a6b34740932bde2f" + }, + "evidence": "https://github.com/PastureStack/metadata-service/actions/runs/40141494386" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config and SHA-256-checked published SBOM, scans and installation receipts", + "workflowRun": "https://github.com/PastureStack/metadata-service/actions/runs/40141494386" + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/network-policy-manager:v0.3.3", + "sourceRepository": "https://github.com/PastureStack/network-policy-manager", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/network-policy-manager", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu, nftables, and other packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "22ae03cbc38683ad1be08bf202672d175ed568d6", + "manifestDigest": "sha256:efc77b837959af49ea5b80058b07e53deccc5defba2e98888685836eb2547eb8", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/network-policy-manager/releases/download/v0.3.3/image.cdx.json", + "sha256": "65d288089f76c37cd30f9e06a3e03fe8e05f6ba613911c23b706986f8c75c02d" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 8, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228" + ], + "raw": { + "url": "https://github.com/PastureStack/network-policy-manager/releases/download/v0.3.3/image-security.json", + "sha256": "869865202237c702560ffb5f9ac7c57567f88eb25e25fc56dcf01c4d96201377" + }, + "effective": { + "url": "https://github.com/PastureStack/network-policy-manager/releases/download/v0.3.3/image-security.effective.json", + "sha256": "01d484b84565ec211488de1feff50b7820005cd110daab0c64a8a0c8d966cd1e" + }, + "evidence": "https://github.com/PastureStack/network-policy-manager/actions/runs/40141500698" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config and SHA-256-checked published SBOM, scans and installation receipts", + "workflowRun": "https://github.com/PastureStack/network-policy-manager/actions/runs/40141500698" + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41", + "sourceRepository": "https://github.com/PastureStack/ipsec-vxlan-overlay-network", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/ipsec-vxlan-overlay-network", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu, strongSwan, CNI, Weave, and other packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "87ad41dabf802c49a1c2111cc46650a43adeace3", + "manifestDigest": "sha256:ab0165d2289910ebbc283c41ce76ec52f36feeaad7483a59400bdf5cef8fee97", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/download/v0.14.41/image-sbom.cdx.json", + "sha256": "c215e0ae3e8432f6eb0a0b98cb8472a49cd76670a3a7120482edb8a609e975a8" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 19, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2025-1352", + "CVE-2025-1376", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/download/v0.14.41/runtime-security.json", + "sha256": "194401c9c4e827507bd1050d6a3e58dd323ddae17413a82e16867a848bdd896b" + }, + "effective": { + "url": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/download/v0.14.41/runtime-security.effective.json", + "sha256": "0c4e7d5373591ed27cba8d077e3f3f88e531165b003676c31d6a309991520273" + }, + "evidence": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/actions/runs/40144779932" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config and SHA-256-checked published SBOM, scans and installation receipts", + "workflowRun": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/actions/runs/40144779932" + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/pod-pause-image:v3.0.6", + "sourceRepository": "https://github.com/PastureStack/pod-pause-image", + "sourcePath": "Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/pod-pause-image", + "licenseBoundary": "Apache-2.0 source and image; the pinned Ubuntu base and build packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "24cb33a2ac1f7d3bae0faf4e8a7dfd19401362be", + "manifestDigest": "sha256:b0c284a56412dbb22bf15919332da18d519ae0965654f4d8b9a595de1804afea", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/pod-pause-image/releases/download/v3.0.6/runtime.cdx.json", + "sha256": "e5887e9b9f8016cbc314b7703a8bbe89c2f89d4bba0ca4a9f5d83a717c09d791" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 8, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228" + ], + "raw": { + "url": "https://github.com/PastureStack/pod-pause-image/releases/download/v3.0.6/runtime-security-raw.json", + "sha256": "f1b94ec8f4fca947e59a0485d86708547d1443e98ecc588996428579036659e2" + }, + "effective": { + "url": "https://github.com/PastureStack/pod-pause-image/releases/download/v3.0.6/runtime-security.json", + "sha256": "3f85d185e67ccd5fa005f71b6a9fb34c4ca3f9860da8a5804f47073548760e69" + }, + "evidence": "https://github.com/PastureStack/pod-pause-image/actions/runs/40140946513" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config and SHA-256-checked published SBOM, scans and installation receipts", + "workflowRun": "https://github.com/PastureStack/pod-pause-image/actions/runs/40140946513" + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/container-cron:v0.6.2", + "sourceRepository": "https://github.com/PastureStack/container-cron", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/container-cron", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu and Go dependencies retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "5ed8566ff366573a31b18fbffcc7030cc5b82917", + "manifestDigest": "sha256:0eaabd6eb7d407f97c1411ceb146c6b72e2a51a1db8e2bb4f83309b7bd249c8a", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/container-cron/releases/download/v0.6.2/runtime.cdx.json", + "sha256": "d9aaa74d63acbc1d3612a16fcec41b993993aad7050c0bf4011133a403b512d1" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 8, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228" + ], + "raw": { + "url": "https://github.com/PastureStack/container-cron/releases/download/v0.6.2/runtime-security-raw.json", + "sha256": "92313277fd5df0cc8363893db761ae3110034e8dc7a3bb5e1ee985be9122136d" + }, + "effective": { + "url": "https://github.com/PastureStack/container-cron/releases/download/v0.6.2/runtime-security.json", + "sha256": "990540b6e5fca8e67988358095f9e653b2e6b0a7deb9f29120a6787b3f88d437" + }, + "evidence": "https://github.com/PastureStack/container-cron/actions/runs/40144617903" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config and SHA-256-checked published SBOM, scans and installation receipts", + "workflowRun": "https://github.com/PastureStack/container-cron/actions/runs/40144617903" + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.2", + "sourceRepository": "https://github.com/PastureStack/secrets-flexvolume-plugin", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/secrets-flexvolume-plugin", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu, Go toolchain, and CA certificate packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "b7f4c9a36c0f45680cafcf575e57dbcb6f32f11b", + "manifestDigest": "sha256:6b19ea27d1af2c2abb6382b643fae24690fb96bfea314702e8ffb57f128f43f9", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/secrets-flexvolume-plugin/releases/download/v0.2.2/secrets-flexvolume-plugin-sbom.cdx.json", + "sha256": "421b4df2cf136f013fa83f9954d324117a3abdaa32a8447cb08489ff9c4279af" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 8, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228" + ], + "raw": { + "url": "https://github.com/PastureStack/secrets-flexvolume-plugin/releases/download/v0.2.2/secrets-flexvolume-plugin-security-raw.json", + "sha256": "4fcf0e77e7d97714da65a9b964329dc8f1ee33541958360d47c13649a56e8965" + }, + "effective": { + "url": "https://github.com/PastureStack/secrets-flexvolume-plugin/releases/download/v0.2.2/secrets-flexvolume-plugin-security.json", + "sha256": "84ce297d8bf5ae2dcc9c9b0c6a5c44fa5af920b790196f673999623b76b4e36e" + }, + "evidence": "https://github.com/PastureStack/secrets-flexvolume-plugin/actions/runs/40140965006" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config and SHA-256-checked published SBOM, scans and installation receipts", + "workflowRun": "https://github.com/PastureStack/secrets-flexvolume-plugin/actions/runs/40140965006" + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/system-image-preloader:v0.3.3", + "sourceRepository": "https://github.com/PastureStack/system-image-preloader", + "sourcePath": "Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/system-image-preloader", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu, Docker CLI, yq, gomplate, and other dependencies retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "1dd8646ac431514a0e1d7ec0ab92f73cb099042c", + "manifestDigest": "sha256:5baad75c4d82d0096be64c6db22351518f0ff9bc7cd5d0268eb88f09f532e2e0", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.3/system-image-preloader-sbom.cdx.json", + "sha256": "8806345410e3ed130146d2b34e8633b4ad0d65ac164d130a6341a7e2b31672dc" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "original verified runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 16, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.3/system-image-preloader-security.json", + "sha256": "cd49187fbb22847573c3c501a3aa96280704e7781be754d5c747e227d84c8348" + }, + "effective": { + "url": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.3/system-image-preloader-security-effective.json", + "sha256": "ccf4ad37bc78a90c0c878e8d618a9f0ed3b57b6fe18b270032a873c528a44a95" + }, + "evidence": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.3/publication-completion.json" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "original verified producer files completed without rebuilding, retagging or replacing published bytes", + "workflowRun": "https://github.com/PastureStack/system-image-preloader/actions/runs/40141464002", + "originalPublishConclusion": "failure", + "completion": { + "url": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.3/publication-completion.json", + "sha256": "db99750381b8bb2eb79fc965b3a595d72832e5ce254f0b16687929e4813273fa" + } + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/vault-secrets-bridge:v0.1.3", + "sourceRepository": "https://github.com/PastureStack/vault-secrets-bridge", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/vault-secrets-bridge", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu, Go toolchain, and CA certificate packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "51fefe19eedb91d41f292ea1c82c4b5fb7067ae8", + "manifestDigest": "sha256:2ac43747b3aaee851ef6c1c94d2a9e29ccb7b40aaf577ec96cf20127a3c087f8", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/vault-secrets-bridge/releases/download/v0.1.3/vault-secrets-bridge-sbom.cdx.json", + "sha256": "79b0f46af9e6cd800f86d575746f07af06e9b86d657ceb30582d2df9677cacba" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "original verified runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 8, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228" + ], + "raw": { + "url": "https://github.com/PastureStack/vault-secrets-bridge/releases/download/v0.1.3/vault-secrets-bridge-security.json", + "sha256": "a8882cab72178da4b30b6cff13ef5b5c420f8f18034bb25d074b1e9700c038fb" + }, + "effective": { + "url": "https://github.com/PastureStack/vault-secrets-bridge/releases/download/v0.1.3/vault-secrets-bridge-security-backports.json", + "sha256": "9a2c912b4e62c14d40f8cc98a88b950038b93bece2921a4fbf097ae1e4a479c9" + }, + "evidence": "https://github.com/PastureStack/vault-secrets-bridge/releases/download/v0.1.3/publication-completion.json" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "original verified producer files completed without rebuilding, retagging or replacing published bytes", + "workflowRun": "https://github.com/PastureStack/vault-secrets-bridge/actions/runs/40141474402", + "originalPublishConclusion": "failure", + "completion": { + "url": "https://github.com/PastureStack/vault-secrets-bridge/releases/download/v0.1.3/publication-completion.json", + "sha256": "6e2f95c381ca80448d581e1544e610fde141694f6b428a6490dc6a2d7714c809" + } + }, + "reviewedAt": "2026-10-25" + }, + { + "reference": "ghcr.io/pasturestack/resource-scheduler:v0.8.21", + "sourceRepository": "https://github.com/PastureStack/resource-scheduler", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/resource-scheduler", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu and other packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "publicationStatus": "published", + "sourceCommit": "b9f0c18d2318a5ccd6c6d0a2ace27715bec6e8a6", + "manifestDigest": "sha256:0818b05b49d73bb789b83932a91df3bf6a09d78fab3b370a7afe51f5c2ec2bdf", + "sbom": { + "status": "published", + "format": "CycloneDX", + "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.21/resource-scheduler-0.8.21-image.cdx.json", + "sha256": "18f6caa7d3400b93808bfdfe8dd6a2107ae7752a1d1bd6c08c88eea518fcb032", + "provenance": { + "verified": true, + "predicateType": "https://slsa.dev/provenance/v1", + "signerWorkflow": "PastureStack/resource-scheduler/.github/workflows/release.yml", + "sourceRef": "refs/tags/v0.8.21", + "sourceCommit": "b9f0c18d2318a5ccd6c6d0a2ace27715bec6e8a6" + } + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "remainingFindings": 16, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.21/resource-scheduler-0.8.21-security.json", + "sha256": "786e01b5c43c062c3ead2f2d6a485ed7ec4e86f0db74a2528257452415d98a69" + }, + "effective": { + "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.21/resource-scheduler-0.8.21-security.effective.json", + "sha256": "2493d22410837ac6e38078c975d479a3adcf9e6725f29c4fafd5ce329feb649a" + }, + "evidence": "https://github.com/PastureStack/resource-scheduler/actions/runs/40144768957", + "fixedAvailable": 0 + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config, published SHA-256 receipts and native SBOM provenance against the exact tag, source and workflow invocation", + "workflowRun": "https://github.com/PastureStack/resource-scheduler/actions/runs/40144768957" + }, + "reviewedAt": "2026-10-25" } ] } diff --git a/catalog-provenance.json b/catalog-provenance.json index e30a9e6aa..c2d8cec1e 100644 --- a/catalog-provenance.json +++ b/catalog-provenance.json @@ -61,22 +61,23 @@ "sourcePath": "infra-templates/scheduler", "originStatus": "supported", "maintainedRelease": { - "reference": "ghcr.io/pasturestack/resource-scheduler:v0.8.20", - "releaseTag": "v0.8.20", - "releaseUrl": "https://github.com/PastureStack/resource-scheduler/releases/tag/v0.8.20", + "reference": "ghcr.io/pasturestack/resource-scheduler:v0.8.21", + "releaseTag": "v0.8.21", + "releaseUrl": "https://github.com/PastureStack/resource-scheduler/releases/tag/v0.8.21", "sourceRepository": "https://github.com/PastureStack/resource-scheduler", - "sourceCommit": "35d3a67c62df4b22d7167da3d73dd9dbc4905e66", - "manifestDigest": "sha256:e5a389273344585fca5c4513060e5289b30ca13046d8ec286b8563952f1325d4", + "sourceCommit": "b9f0c18d2318a5ccd6c6d0a2ace27715bec6e8a6", + "manifestDigest": "sha256:0818b05b49d73bb789b83932a91df3bf6a09d78fab3b370a7afe51f5c2ec2bdf", "sbom": { + "status": "published", "format": "CycloneDX", - "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.20/resource-scheduler-0.8.20-image.cdx.json", - "sha256": "56de083886f393483d988c210d307d71a0b9252b5d25a36095b2161bbab15e91", + "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.21/resource-scheduler-0.8.21-image.cdx.json", + "sha256": "18f6caa7d3400b93808bfdfe8dd6a2107ae7752a1d1bd6c08c88eea518fcb032", "provenance": { "verified": true, "predicateType": "https://slsa.dev/provenance/v1", "signerWorkflow": "PastureStack/resource-scheduler/.github/workflows/release.yml", - "sourceRef": "refs/tags/v0.8.20", - "sourceCommit": "35d3a67c62df4b22d7167da3d73dd9dbc4905e66" + "sourceRef": "refs/tags/v0.8.21", + "sourceCommit": "b9f0c18d2318a5ccd6c6d0a2ace27715bec6e8a6" } } }, @@ -100,6 +101,26 @@ "sourceCommit": "d1720ddb65a285ed615f1461ccb44e50c2ad67a7" } } + }, + "v0.8.20": { + "reference": "ghcr.io/pasturestack/resource-scheduler:v0.8.20", + "releaseTag": "v0.8.20", + "releaseUrl": "https://github.com/PastureStack/resource-scheduler/releases/tag/v0.8.20", + "sourceRepository": "https://github.com/PastureStack/resource-scheduler", + "sourceCommit": "35d3a67c62df4b22d7167da3d73dd9dbc4905e66", + "manifestDigest": "sha256:e5a389273344585fca5c4513060e5289b30ca13046d8ec286b8563952f1325d4", + "sbom": { + "format": "CycloneDX", + "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.20/resource-scheduler-0.8.20-image.cdx.json", + "sha256": "56de083886f393483d988c210d307d71a0b9252b5d25a36095b2161bbab15e91", + "provenance": { + "verified": true, + "predicateType": "https://slsa.dev/provenance/v1", + "signerWorkflow": "PastureStack/resource-scheduler/.github/workflows/release.yml", + "sourceRef": "refs/tags/v0.8.20", + "sourceCommit": "35d3a67c62df4b22d7167da3d73dd9dbc4905e66" + } + } } } }, diff --git a/infra-templates/container-schedule/4/README.md b/infra-templates/container-schedule/4/README.md new file mode 100644 index 000000000..904342484 --- /dev/null +++ b/infra-templates/container-schedule/4/README.md @@ -0,0 +1,70 @@ + + +# PastureStack Container Schedule v0.6.2 candidate + +## Source candidate + +This source prepares numeric revision 4 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 3 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/container-cron:v0.6.1` -> `ghcr.io/pasturestack/container-cron:v0.6.2` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 3 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This infrastructure service watches Docker container events and runs scheduled +`start`, `stop`, or `restart` actions. A managed workload opts in with these +labels: + +- `cron.schedule`: required six-field Cron expression. +- `cron.action`: optional `start`, `stop`, or `restart`; the default is + `start`. +- `cron.restart_timeout`: optional stop or restart timeout in seconds. + +### Reviewed image + +- Image: `ghcr.io/pasturestack/container-cron:v0.6.1` +- Source: [`PastureStack/container-cron@2cce2cc80f2590239d5ef758a21c54a3f1e0f2b9`](https://github.com/PastureStack/container-cron/tree/2cce2cc80f2590239d5ef758a21c54a3f1e0f2b9) +- Source license: Apache-2.0; Ubuntu and bundled Go dependencies retain their + upstream licenses +- Security gate: Trivy HIGH 0 and CRITICAL 0 for the operating system and Go + binary +- Distribution gate: public GHCR and anonymous version-tag manifest access + passed + +### Security boundary + +The service mounts `/var/run/docker.sock` read-write so it can control +containers. Docker socket access is equivalent to host administrator access. +Deploy this card only as a trusted global infrastructure service. It does not +request privileged mode, publish a host port, or accept a remote Docker +endpoint by default. + +The compatible control plane requires the literal `rancher-compose.yml` +filename and `io.rancher.*` scheduling labels in this template. They are +protocol identifiers, not PastureStack branding. + +### Validation + +The release passed race-enabled unit tests, static analysis, image metadata and +license checks, a current HIGH/CRITICAL vulnerability scan, and an isolated +Docker lifecycle test. The test created one stopped workload and one +running workload, then verified that the service started the first and stopped +the second on schedule. All test containers were removed afterward. + +The deployment intentionally uses the neutral container-event mode. It does +not depend on a branded legacy command-line switch or on service-state +translation through Metadata. diff --git a/infra-templates/container-schedule/4/README.zh-TW.md b/infra-templates/container-schedule/4/README.zh-TW.md new file mode 100644 index 000000000..63f9761dd --- /dev/null +++ b/infra-templates/container-schedule/4/README.zh-TW.md @@ -0,0 +1,56 @@ + + +# PastureStack 容器定時排程 v0.6.2 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 4，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 3。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/container-cron:v0.6.1` → `ghcr.io/pasturestack/container-cron:v0.6.2` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 3 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此基礎架構服務會監看 Docker 容器事件，並依排程執行 `start`、 +`stop` 或 `restart`。受管工作負載可使用下列標籤啟用排程： + +- `cron.schedule`：必填，使用六欄式 Cron 表達式。 +- `cron.action`：選填，可設為 `start`、`stop` 或 `restart`； + 預設為 `start`。 +- `cron.restart_timeout`：選填，停止或重新啟動容器的逾時秒數。 + +### 已審核映像 + +- 映像：`ghcr.io/pasturestack/container-cron:v0.6.1` +- 原始碼： + [`PastureStack/container-cron@2cce2cc80f2590239d5ef758a21c54a3f1e0f2b9`](https://github.com/PastureStack/container-cron/tree/2cce2cc80f2590239d5ef758a21c54a3f1e0f2b9) +- 原始碼採 Apache-2.0 授權；Ubuntu 與內含的 Go 相依套件保留各自的 + 上游授權。 +- Trivy 掃描結果為 HIGH 0、CRITICAL 0。 +- 公開 GHCR 與未登入存取版本標籤的驗證已通過。 + +### 安全性界線 + +此服務需要以讀寫方式掛載 `/var/run/docker.sock` 才能控制容器。 +Docker Socket 權限等同主機管理者權限，因此只能將此範本當成受信任 +的全域基礎架構服務部署。此服務預設不要求特權模式、不公開主機連接埠， +也不接受遠端 Docker 端點。 + +相容控制平面仍需要名為 `rancher-compose.yml` 的檔案及 +`io.rancher.*` 排程標籤。這些是相容協定識別名稱，不是目前的產品 +品牌。 + +### 驗證 + +此版本已通過啟用競爭偵測的單元測試、靜態分析、映像中繼資料與授權 +檢查、弱點掃描，以及 Docker 隔離環境生命週期測試。測試確認 +服務能依排程啟動一個已停止的工作負載，並停止另一個執行中的工作負載； +測試資源已精確移除。 + +部署採用中性的容器事件模式，不依賴舊品牌的命令列參數，也不透過 +中繼資料轉譯服務狀態。 diff --git a/infra-templates/container-schedule/4/docker-compose.yml.tpl b/infra-templates/container-schedule/4/docker-compose.yml.tpl new file mode 100644 index 000000000..7f9752565 --- /dev/null +++ b/infra-templates/container-schedule/4/docker-compose.yml.tpl @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: MIT +version: '2' +services: + container-schedule: + image: ghcr.io/pasturestack/container-cron:v0.6.2 + restart: always + command: container-cron{{- if eq .Values.ENABLE_DEBUG "true" }} --debug{{- end }}{{- if eq .Values.ENABLE_METRICS "true" }} --metrics{{- end }} + volumes: + - /var/run/docker.sock:/var/run/docker.sock + expose: + - '9191' + labels: + io.rancher.scheduler.global: 'true' + io.rancher.container.hostname_override: container_name + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' diff --git a/infra-templates/container-schedule/4/rancher-compose.yml b/infra-templates/container-schedule/4/rancher-compose.yml new file mode 100644 index 000000000..926403854 --- /dev/null +++ b/infra-templates/container-schedule/4/rancher-compose.yml @@ -0,0 +1,28 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Container Schedule + version: v0.6.2 + description: Run scheduled start, stop, or restart actions from container labels. + minimum_rancher_version: v1.6.15-rc1 + labels: + io.pasturestack.catalog.question.enable_metrics.label.zh-tw: '啟用指標端點' + io.pasturestack.catalog.question.enable_metrics.description.zh-tw: '在容器連接埠 9191 提供 Prometheus 工作執行次數。' + io.pasturestack.catalog.question.enable_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.enable_debug.description.zh-tw: '記錄較詳細的事件與排程診斷資訊。' + questions: + - variable: ENABLE_METRICS + label: Enable the metrics endpoint + description: Expose Prometheus job counts on container port 9191. + type: boolean + default: false + required: true + - variable: ENABLE_DEBUG + label: Enable debug logging + description: Write detailed event and scheduling diagnostics. + type: boolean + default: false + required: true + +container-schedule: + scale: 1 + start_on_create: true diff --git a/infra-templates/container-schedule/config.yml b/infra-templates/container-schedule/config.yml index 7105273c0..25a55ce5f 100644 --- a/infra-templates/container-schedule/config.yml +++ b/infra-templates/container-schedule/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Container Schedule description: Run scheduled start, stop, or restart actions from container labels. -version: v0.6.1 +version: v0.6.2 category: System maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and bundled dependency licenses apply diff --git a/infra-templates/healthcheck/3/README.md b/infra-templates/healthcheck/3/README.md new file mode 100644 index 000000000..962a87489 --- /dev/null +++ b/infra-templates/healthcheck/3/README.md @@ -0,0 +1,46 @@ + + +# Metadata Healthcheck v0.3.18 candidate + +## Source candidate + +This source prepares numeric revision 3 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 2 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/metadata-healthcheck:v0.3.17` -> `ghcr.io/pasturestack/metadata-healthcheck:v0.3.18` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 2 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This infrastructure stack runs one healthcheck agent on every eligible host. The agent reads health declarations from the established link-local Metadata endpoint, manages its private HAProxy process, and reports stable state changes to the compatible control API. + +### Reviewed image + +- Image: `ghcr.io/pasturestack/metadata-healthcheck:v0.3.17` +- Source: [`PastureStack/metadata-healthcheck@410993d3b3b2493bbd84a36f7d67cfefb8dd6705`](https://github.com/PastureStack/metadata-healthcheck/tree/410993d3b3b2493bbd84a36f7d67cfefb8dd6705) +- Source license: Apache-2.0; bundled operating-system packages retain their upstream licenses +- Security gate: Trivy HIGH 0, CRITICAL 0, image secrets 0, and source secrets 0 +- Distribution gate: public GHCR and unauthenticated version-tag pull passed + +### Compatibility boundary + +The compatible control plane requires the literal `rancher-compose.yml` filename and the `io.rancher.*` labels in this template. They are protocol identifiers, not PastureStack branding. The `create_agent` flow supplies scoped per-instance credentials; the image translates those injected compatibility names to its public `PLATFORM_*` configuration only when explicit neutral values are absent. + +`PLATFORM_CA_ROOT` points to the established read-only agent certificate mount. TCP 42 is a container-network readiness endpoint and is not published on a host port. The template does not mount the Docker socket, request privileged mode, or add Linux capabilities. + +### Release boundary + +The image-level integration gate passed with the default link-local address, without a neutral Metadata DNS alias, and with routine lifecycle messages on standard output while actual failures remain on standard error. Earlier Catalog-created deployments verified credential injection, compatibility mapping, global scheduling, readiness, restart, two-daemon reporting, and removal. Managed multi-host upgrade, rollback, and complete infrastructure-stack removal remain separate deployment acceptance checks. Do not use this template to modify an existing production control plane. diff --git a/infra-templates/healthcheck/3/README.zh-TW.md b/infra-templates/healthcheck/3/README.zh-TW.md new file mode 100644 index 000000000..5a65bde2f --- /dev/null +++ b/infra-templates/healthcheck/3/README.zh-TW.md @@ -0,0 +1,51 @@ + + +# 中繼資料健康檢查 v0.3.18 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 3，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 2。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/metadata-healthcheck:v0.3.17` → `ghcr.io/pasturestack/metadata-healthcheck:v0.3.18` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 2 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此基礎架構堆疊會在每台符合條件的主機上執行一個健康檢查代理程式。 +代理程式從既有的連結本機中繼資料端點讀取健康狀態宣告、管理自己的 +HAProxy 處理程序，並把穩定的狀態變更回報給相容控制 API。 + +### 已審核映像 + +- 映像：`ghcr.io/pasturestack/metadata-healthcheck:v0.3.17` +- 原始碼： + [`PastureStack/metadata-healthcheck@410993d3b3b2493bbd84a36f7d67cfefb8dd6705`](https://github.com/PastureStack/metadata-healthcheck/tree/410993d3b3b2493bbd84a36f7d67cfefb8dd6705) +- 原始碼採 Apache-2.0 授權；作業系統套件保留各自的上游授權。 +- Trivy 結果為 HIGH 0、CRITICAL 0，映像及原始碼的機密資料掃描均為 0。 +- 公開 GHCR 與未登入拉取版本標籤的驗證已通過。 + +### 相容性界線 + +相容控制平面仍需要名為 `rancher-compose.yml` 的檔案及 +`io.rancher.*` 標籤。這些是協定識別名稱，不是目前的產品品牌。 +`create_agent` 流程會提供範圍受限的執行個體登入資訊；若未明確設定 +中性名稱，映像才會把相容名稱轉換成公開的 `PLATFORM_*` 設定。 + +`PLATFORM_CA_ROOT` 指向既有的唯讀代理程式憑證掛載。容器網路上的 +TCP 42 是就緒狀態端點，不會公開成主機連接埠。此範本不會掛載 Docker +Socket、不要求特權模式，也不新增 Linux Capability。 + +### 發布界線 + +映像層級的整合測試已使用預設連結本機位址通過，且不依賴中性的 +中繼資料 DNS 別名；一般生命週期訊息會寫入標準輸出，只有實際失敗 +才會寫入標準錯誤。較早的商店部署也驗證過登入資訊注入、相容名稱 +映射、全域排程、就緒狀態、重新啟動、雙常駐程式回報及移除流程。 +多主機升級、回復及完整基礎架構堆疊移除仍須在隔離 VM 快照完成 +部署驗收。請勿使用此範本直接變更既有的 +正式控制平面。 diff --git a/infra-templates/healthcheck/3/docker-compose.yml b/infra-templates/healthcheck/3/docker-compose.yml new file mode 100644 index 000000000..929add464 --- /dev/null +++ b/infra-templates/healthcheck/3/docker-compose.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: MIT +version: '2' +services: + healthcheck: + image: ghcr.io/pasturestack/metadata-healthcheck:v0.3.18 + restart: always + command: + - --metadata-url + - http://169.254.169.250/2015-12-19 + environment: + PLATFORM_CA_ROOT: /var/lib/rancher/etc/ssl/ca.crt + labels: + io.rancher.container.create_agent: 'true' + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' diff --git a/infra-templates/healthcheck/3/rancher-compose.yml b/infra-templates/healthcheck/3/rancher-compose.yml new file mode 100644 index 000000000..b6bdd138c --- /dev/null +++ b/infra-templates/healthcheck/3/rancher-compose.yml @@ -0,0 +1,18 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: Metadata Healthcheck + version: v0.3.18 + description: Report metadata-defined workload health through the compatible control API. + minimum_rancher_version: v1.6.0 + +healthcheck: + scale: 1 + start_on_create: true + health_check: + port: 42 + interval: 2000 + response_timeout: 2000 + unhealthy_threshold: 3 + healthy_threshold: 2 + initializing_timeout: 60000 + reinitializing_timeout: 60000 diff --git a/infra-templates/healthcheck/config.yml b/infra-templates/healthcheck/config.yml index 7fb4706c6..b0b76be40 100644 --- a/infra-templates/healthcheck/config.yml +++ b/infra-templates/healthcheck/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Metadata Healthcheck description: Report metadata-defined workload health through the compatible control API. -version: v0.3.17 +version: v0.3.18 category: Infrastructure maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and third-party package licenses apply diff --git a/infra-templates/ipsec-overlay/14/README.md b/infra-templates/ipsec-overlay/14/README.md new file mode 100644 index 000000000..89c5cf2a2 --- /dev/null +++ b/infra-templates/ipsec-overlay/14/README.md @@ -0,0 +1,56 @@ + + +# PastureStack IPsec Overlay v0.3.12 candidate + +## Source candidate + +This source prepares numeric revision 14 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 13 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` -> `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 13 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This infrastructure template deploys the IPsec overlay data plane on every eligible host. A network-holder service owns the managed namespace, the router applies host XFRM and route state, the connectivity sidecar exposes the control-plane health contract, and the CNI sidecar supplies the bridge and address-management executables. + +### Published image + +- Image: [`ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/tag/v0.14.40). +- Source: [`4711833178a05e5d225e364cce856bd108bdc707`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/4711833178a05e5d225e364cce856bd108bdc707), with a verified signed tag. +- Revision 13 preserves revision 12's namespaces, sidekicks, XFRM, firewall selection and CNI ownership. Existing numeric revisions remain unchanged. +- The full runtime scan has no available fix, High/Critical finding, unknown severity or secret. The 54 officially unfixed Low/Medium findings remain tracked, not resolved; the SBOM, digest and report are recorded in `catalog-images.json`. +- Source license: Apache-2.0; bundled dependencies retain their upstream licenses and notices. + +### Privilege and secret boundary + +The router is privileged and uses host PID and network namespaces. In all three firewall backends it synchronizes IPsec XFRM state and routes, but does not write host firewall chains. Network Plugin Manager alone owns the overlay bridge-subnet forward mark, NAT exclusion, and host-port rules. The router does not create a second nftables mark table, patch the manager's `CATTLE_*` chains, or change Docker's tables. The router receives a read-only Docker socket mount to query the actual firewall driver; Unix socket access still grants a powerful Docker API capability, so it remains confined to this trusted privileged system service. The CNI sidecar also accesses the Docker socket. These permissions are required by this compatibility architecture and must not be copied to ordinary workloads. + +The router receives a scoped create-agent credential from the compatible control plane and downloads the generated IPsec pre-shared key through the authenticated `configcontent/psk` contract. This template does not accept a user-supplied key and never places a key in the public Catalog repository, Compose variables, image, or logs. + +### Compatibility boundary + +The literal `rancher-compose.yml` filename, `minimum_rancher_version` key, required `io.rancher.*` orchestration labels, `rancher-cni-driver` shared volume, and `ipsec` agent-service marker are consumed by the compatible control plane and network plugin manager. They are protocol identifiers, not PastureStack branding. User-facing names, image coordinates, commands, environment variables, CNI names, log paths, and the `pasture.internal` search suffix use current PastureStack identifiers. + +The data plane currently supports the compatibility network `10.42.0.0/16`; the template intentionally does not expose a subnet selector that the runtime cannot safely honor. Its explicit `allowSharedSubnetIngress` contract is consumed only by Network Plugin Manager. The IPsec router continues to own XFRM and routes without writing host firewall rules. + +The host firewall backend is selected explicitly or left at `auto`. The four supported choices are `auto`, native `nftables`, `iptables-nft`, and `iptables-legacy`. The selection is passed only to `overlay-router` through `PASTURESTACK_FIREWALL_BACKEND`. The router checks Docker's actual driver and live rule owner, not the Ubuntu version: even on Ubuntu 26.04 and later, an existing `iptables-legacy` or `iptables-nft` deployment keeps that active path. An explicit mismatch or ambiguous state fails safely without switching backends or activating unloaded legacy modules. Align the choice with the Network Services template on the same environment. + +The Native project definition lists Network Services before IPsec, but list order alone does not establish a health dependency. Before creating or upgrading this overlay, apply the matching Network Services version and wait until Network Plugin Manager is healthy on every target host. In native `nftables` mode, first satisfy that template's Docker firewall-backend, bridge-accept-fwmark, and persistent IPv4-forwarding prerequisites; an IPsec router alone cannot provide the manager-owned forwarding and NAT rules. + +### Deployment boundary + +Published runtime and Catalog validation are separate from managed deployment acceptance. Verify the selected firewall backend, peer restart, upgrade and rollback on isolated hosts before applying the stack to an existing environment. A successful CNI address allocation alone does not prove the encrypted multi-host lifecycle. diff --git a/infra-templates/ipsec-overlay/14/README.zh-TW.md b/infra-templates/ipsec-overlay/14/README.zh-TW.md new file mode 100644 index 000000000..2ef070c7e --- /dev/null +++ b/infra-templates/ipsec-overlay/14/README.zh-TW.md @@ -0,0 +1,79 @@ + + +# PastureStack IPsec 加密網路 v0.3.12 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 14，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 13。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` → `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 13 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此基礎架構範本會在每台符合條件的主機上安裝 IPsec 加密 +網路資料平面。網路持有服務負責受管命名空間；路由器套用主機 XFRM +與路由狀態；連線檢查相關容器提供控制平面健康狀態契約；CNI 相關 +容器則提供網橋與位址管理執行檔。 + +### 正式發布映像 + +- [映像 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/tag/v0.14.40)。 +- [來源 `4711833178a05e5d225e364cce856bd108bdc707`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/4711833178a05e5d225e364cce856bd108bdc707)，簽署版本標籤已驗證。 +- 第 13 版保留第 12 版的命名空間、相關容器、XFRM、防火牆選擇與 CNI 責任；既有數字版目錄內容不變。 +- 完整執行映像掃描沒有可用修補、High/Critical、未知嚴重度或機密資料；54 筆官方尚無修補的 Low/Medium 持續追蹤，不視為已解決。SBOM、摘要與報告記錄於 `catalog-images.json`。 +- 原始碼採 Apache-2.0 授權；隨附相依套件保留各自的上游授權及聲明。 + +### 權限與機密資料界線 + +路由器使用特權模式並加入主機 PID 與網路命名空間。在三種防火牆 +後端，它只同步 IPsec XFRM 狀態與路由，不寫入主機防火牆規則。 +網路外掛管理器獨自維護 overlay 網橋子網路的轉送標記、NAT 排除及 +主機連接埠規則。路由器不另建 nftables 標記表、不修改管理器的 +`CATTLE_*` 規則鏈，也不修改 Docker 的規則表。路由器以唯讀掛載 Docker Socket 查詢 +實際防火牆驅動程式；唯讀掛載仍賦予強大的 Docker API 存取能力， +只限此受信任的特權系統服務使用。CNI 相關容器也存取 Docker Socket。 +這些權限是相容架構所需， +不得套用到一般工作負載。 + +路由器會從相容控制平面取得範圍受限的代理程式登入資訊，再透過已驗證 +的 `configcontent/psk` 契約下載 IPsec 預先共用金鑰。此範本不接受 +使用者提供的金鑰，也不會把金鑰放入公開商店、Compose 變數、映像或 +日誌。 + +### 相容性界線 + +`rancher-compose.yml`、`minimum_rancher_version`、必要的 +`io.rancher.*` 編排標籤、`rancher-cni-driver` 共用磁碟區及 +`ipsec` 代理程式服務標記是相容控制平面與網路外掛管理器使用的協定 +識別名稱。使用者可見名稱、映像位置、命令、環境變數、CNI 名稱、 +日誌路徑及 `pasture.internal` 搜尋後綴均採用 PastureStack 名稱。 + +資料平面目前支援 `10.42.0.0/16` 相容網路。執行環境無法安全套用 +任意子網路，因此範本不提供無效的子網路選項。 +明確的 `allowSharedSubnetIngress` 契約只由網路外掛管理器處理；IPsec +路由器仍只負責 XFRM 與路由，不寫入主機防火牆規則。 + +主機防火牆後端可選 `auto`、原生 `nftables`、`iptables-nft` 或 +`iptables-legacy`。選擇會透過 `PASTURESTACK_FIREWALL_BACKEND` 傳給 +`overlay-router`。路由器檢查 Docker 實際驅動程式與現役規則擁有者， +不以 Ubuntu 版本推斷；Ubuntu 26.04 及更新版若已使用 `iptables-legacy` +或 `iptables-nft`，仍維持該現役路徑。明確指定與實際後端不符或狀態 +無法判定時安全停止，不切換後端，也不載入尚未啟用的 legacy 模組。 +同環境的 Network Services 範本應使用一致的選項。 + +Native 專案定義將 Network Services 排在 IPsec 前面，但清單順序 +本身不保證健康狀態相依。建立或升級加密網路前，應先套用相符版本 +的 Network Services，等待每台目標主機上的網路外掛管理器恢復 +健康。使用原生 `nftables` 時，須先完成該範本列出的 Docker +防火牆後端、`bridge-accept-fwmark` 與持久 IPv4 轉送前置設定； +只有 IPsec 路由器無法提供管理器負責的轉送及 NAT 規則。 + +### 部署界線 + +正式執行映像與 Catalog 驗證不同於受管部署驗收。套用既有環境前，須於隔離主機驗證所選防火牆後端、對端重啟、升級及回復。單純完成 CNI 位址分配不能代替加密跨主機生命週期驗收。 diff --git a/infra-templates/ipsec-overlay/14/docker-compose.yml.tpl b/infra-templates/ipsec-overlay/14/docker-compose.yml.tpl new file mode 100644 index 000000000..1ea55e90f --- /dev/null +++ b/infra-templates/ipsec-overlay/14/docker-compose.yml.tpl @@ -0,0 +1,115 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + overlay-network: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + command: + - /bin/bash + - -c + - 'mkfifo /tmp/overlay-log; exec cat /tmp/overlay-log' + network_mode: ipsec + labels: + io.pasturestack.component: ipsec-overlay + io.rancher.sidekicks: overlay-router,connectivity-check + io.rancher.scheduler.global: 'true' + io.rancher.cni.link_mtu_overhead: '0' + io.rancher.network.macsync: 'true' + io.rancher.network.arpsync: 'true' + + overlay-router: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + command: start-ipsec.sh + privileged: true + network_mode: container:overlay-network + pid: host + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + PASTURESTACK_FIREWALL_BACKEND: '${FIREWALL_BACKEND}' + PASTURESTACK_NETWORK_XFRM_NETNS_PATH: /proc/1/ns/net + PASTURESTACK_NETWORK_XFRM_TUNNEL_SOURCE: host + PASTURESTACK_NETWORK_RUN_IN_HOST_NETNS: 'true' + PASTURESTACK_NETWORK_ARP_INTERFACE: '${DOCKER_BRIDGE}' + PASTURESTACK_NETWORK_SYNC_HOST_ROUTES: 'true' + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + labels: + io.pasturestack.component: ipsec-overlay-router + io.rancher.container.create_agent: 'true' + io.rancher.container.agent_service.ipsec: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + sysctls: + net.ipv4.conf.all.send_redirects: '0' + net.ipv4.conf.default.send_redirects: '0' + + connectivity-check: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + command: + - ipsec-vxlan-connectivity-check + - --connectivity-check-interval + - '${CONNECTIVITY_CHECK_INTERVAL}' + - --peer-connection-timeout + - '${PEER_CONNECTION_TIMEOUT}' + network_mode: container:overlay-network + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + PASTURESTACK_METADATA_ADDRESS: 169.254.169.250 + labels: + io.pasturestack.component: ipsec-overlay-connectivity + + cni-driver: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + command: start-cni-driver.sh + privileged: true + network_mode: host + pid: host + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + labels: + io.pasturestack.component: ipsec-overlay-cni + io.rancher.scheduler.global: 'true' + io.rancher.network.cni.binary: pasture-bridge + io.rancher.container.dns: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - rancher-cni-driver:/opt/cni-driver + network_driver: + name: PastureStack IPsec Overlay + default_network: + name: ipsec + host_ports: {{ .Values.HOST_PORTS }} + subnets: + - network_address: 10.42.0.0/16 + dns: + - 169.254.169.250 + dns_search: + - pasture.internal + cni_config: + '10-pasturestack.conf': + name: pasturestack-cni-network + type: pasture-bridge + bridge: $DOCKER_BRIDGE + bridgeSubnet: 10.42.0.0/16 + allowSharedSubnetIngress: true + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + isDefaultGateway: true + hostNat: true + hairpinMode: {{ .Values.PASTURESTACK_HAIRPIN_MODE }} + promiscMode: {{ .Values.PASTURESTACK_PROMISCUOUS_MODE }} + mtu: ${MTU} + linkMTUOverhead: 98 + ipam: + type: metadata-cni-ipam + subnetPrefixSize: /16 + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' diff --git a/infra-templates/ipsec-overlay/14/rancher-compose.yml b/infra-templates/ipsec-overlay/14/rancher-compose.yml new file mode 100644 index 000000000..220baf20a --- /dev/null +++ b/infra-templates/ipsec-overlay/14/rancher-compose.yml @@ -0,0 +1,97 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack IPsec Overlay + version: v0.3.12 + description: Provide an encrypted host-to-host network for managed workloads. + minimum_rancher_version: v1.6.19-rc1 + labels: + io.pasturestack.catalog.question.docker_bridge.label.zh-tw: 'Docker 網橋' + io.pasturestack.catalog.question.docker_bridge.description.zh-tw: '受管工作負載流量使用的主機網橋。' + io.pasturestack.catalog.question.firewall_backend.label.zh-tw: '主機防火牆後端' + io.pasturestack.catalog.question.firewall_backend.description.zh-tw: '依 Docker 現役後端自動選擇；不論 Ubuntu 版本，原生 nftables、iptables-nft 與 iptables-legacy 分開使用。指定不符時安全停止，不會自動切換後端。' + io.pasturestack.catalog.question.mtu.label.zh-tw: '網路 MTU' + io.pasturestack.catalog.question.mtu.description.zh-tw: '請與主機網路 MTU 一致；GCE 常用 1460，一般乙太網路常用 1500。' + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的加密網路元件診斷資訊。' + io.pasturestack.catalog.question.host_ports.label.zh-tw: '啟用主機連接埠' + io.pasturestack.catalog.question.host_ports.description.zh-tw: '允許受管工作負載在主機上公開連接埠。' + io.pasturestack.catalog.question.pasturestack_hairpin_mode.label.zh-tw: '啟用 Hairpin 模式' + io.pasturestack.catalog.question.pasturestack_hairpin_mode.description.zh-tw: 'Hairpin 模式與混雜模式不可同時啟用。' + io.pasturestack.catalog.question.pasturestack_promiscuous_mode.label.zh-tw: '啟用混雜模式' + io.pasturestack.catalog.question.pasturestack_promiscuous_mode.description.zh-tw: '混雜模式與 Hairpin 模式不可同時啟用。' + io.pasturestack.catalog.question.connectivity_check_interval.label.zh-tw: '對等主機檢查間隔' + io.pasturestack.catalog.question.connectivity_check_interval.description.zh-tw: '兩次加密對等主機連線檢查之間的毫秒數。' + io.pasturestack.catalog.question.peer_connection_timeout.label.zh-tw: '對等主機連線逾時' + io.pasturestack.catalog.question.peer_connection_timeout.description.zh-tw: '每次嘗試連線對等主機可使用的毫秒數。' + questions: + - variable: DOCKER_BRIDGE + label: Docker bridge + description: Host bridge used for managed workload traffic. + type: string + default: docker0 + required: true + - variable: FIREWALL_BACKEND + label: Host firewall backend + description: Follow Docker's active firewall backend on any supported Ubuntu version, or explicitly select native nftables, iptables-nft, or iptables-legacy. An explicit mismatch fails safely; legacy is never a fallback. + type: enum + default: auto + required: true + options: + - auto + - nftables + - iptables-nft + - iptables-legacy + - variable: MTU + label: Network MTU + description: Match the host network MTU; common values are 1460 for GCE and 1500 for Ethernet. + type: int + default: 1500 + required: true + - variable: PASTURESTACK_DEBUG + label: Enable debug logs + description: Enable verbose diagnostic logging for the overlay components. + type: boolean + default: 'false' + required: true + - variable: HOST_PORTS + label: Enable host ports + description: Allow managed workloads to publish ports on their hosts. + type: boolean + default: 'true' + required: true + - variable: PASTURESTACK_HAIRPIN_MODE + label: Enable hairpin mode + description: Hairpin mode and promiscuous mode must not both be enabled. + type: boolean + default: 'false' + required: true + - variable: PASTURESTACK_PROMISCUOUS_MODE + label: Enable promiscuous mode + description: Promiscuous mode and hairpin mode must not both be enabled. + type: boolean + default: 'true' + required: true + - variable: CONNECTIVITY_CHECK_INTERVAL + label: Peer check interval + description: Milliseconds between encrypted peer-connectivity checks. + type: int + default: 10000 + required: true + - variable: PEER_CONNECTION_TIMEOUT + label: Peer connection timeout + description: Milliseconds allowed for each peer connection attempt. + type: int + default: 60000 + required: true + +overlay-network: + health_check: + request_line: GET "/connectivity" "HTTP/1.0" + port: 80 + interval: 5000 + initializing_timeout: 60000 + reinitializing_timeout: 60000 + response_timeout: 2000 + healthy_threshold: 2 + unhealthy_threshold: 3 + strategy: none diff --git a/infra-templates/ipsec-overlay/config.yml b/infra-templates/ipsec-overlay/config.yml index 8530bc4af..fb1aaa03b 100644 --- a/infra-templates/ipsec-overlay/config.yml +++ b/infra-templates/ipsec-overlay/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: IPsec Overlay description: Provide an encrypted host-to-host network for managed workloads. -version: v0.3.11 +version: v0.3.12 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and third-party package licenses apply diff --git a/infra-templates/layer-2-flat-network/8/README.md b/infra-templates/layer-2-flat-network/8/README.md new file mode 100644 index 000000000..6282d7536 --- /dev/null +++ b/infra-templates/layer-2-flat-network/8/README.md @@ -0,0 +1,56 @@ + + +# PastureStack Layer 2 Flat Network v0.3.6 candidate + +## Source candidate + +This source prepares numeric revision 8 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 7 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` -> `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 7 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This infrastructure template connects managed workloads directly to a shared +physical Layer 2 subnet. Every participating host must reach the same subnet +and gateway, and the selected workload range must not overlap DHCP, host, or +infrastructure addresses. + +Automatic bridge setup is disabled by default because moving a host's physical +interface into a bridge can interrupt remote access when the interface, subnet, +or gateway is wrong. Prepare the bridge through the operating system first, or +verify out-of-band console access before enabling automatic setup. + +The template uses +`ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40`, which contains the +reviewed `pasture-bridge` and `flat-cni-ipam` executables. The image source is +[`PastureStack/ipsec-vxlan-overlay-network@4711833178a05e5d225e364cce856bd108bdc707`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/4711833178a05e5d225e364cce856bd108bdc707); +the Flat CNI IPAM source is +[`PastureStack/flat-cni-ipam@v0.1.6`](https://github.com/PastureStack/flat-cni-ipam/releases/tag/v0.1.6). + +The template files and icon are MIT licensed. The runtime projects are +Apache-2.0; operating-system packages and bundled components retain their own +upstream licenses and notices. + +Version 6 retains version 5's correctly typed `PASTURESTACK_DEBUG` value and +bridge ownership boundary. Flat IPAM now distinguishes an explicit host +address from a network prefix: it keeps the explicit address, or selects the +first usable address only when that address is present on the bridge. If a +multi-address bridge remains ambiguous, allocation fails instead of guessing. +The change does not alter firewall, IPsec, VXLAN, or physical-interface setup. +Verify the real Layer 2 path and rollback before enabling this optional driver +on a host. diff --git a/infra-templates/layer-2-flat-network/8/README.zh-TW.md b/infra-templates/layer-2-flat-network/8/README.zh-TW.md new file mode 100644 index 000000000..71f1afd05 --- /dev/null +++ b/infra-templates/layer-2-flat-network/8/README.zh-TW.md @@ -0,0 +1,42 @@ + + +# PastureStack 第 2 層平面網路 v0.3.6 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 8，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 7。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` → `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 7 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此基礎架構範本會透過主機網橋，將受管工作負載直接連接到共用的實體 +第 2 層子網路。每台參與主機都必須能連上相同的子網路與閘道，而且 +選定的工作負載位址範圍不得與 DHCP、主機或基礎架構位址重疊。 + +自動設定網橋預設為停用。若實體介面、子網路或閘道設定錯誤，把主機 +實體介面移入網橋可能會中斷遠端連線。請優先透過作業系統準備網橋； +若要啟用自動設定，請先確認具備頻外主控台存取方式。 + +此範本使用 +`ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40`， +其中包含經審核的 `pasture-bridge` 與 `flat-cni-ipam` 執行檔。 +映像原始碼位於 +[`PastureStack/ipsec-vxlan-overlay-network@4711833178a05e5d225e364cce856bd108bdc707`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/4711833178a05e5d225e364cce856bd108bdc707)， +Flat CNI IPAM 原始碼位於 +[`PastureStack/flat-cni-ipam@v0.1.6`](https://github.com/PastureStack/flat-cni-ipam/releases/tag/v0.1.6)。 + +範本檔案與圖示採 MIT 授權；執行專案採 Apache-2.0 授權。作業系統 +套件及隨附元件保留各自的上游授權及聲明。 + +第 6 版保留第 5 版的除錯選項型別與網橋權責。Flat IPAM 現在會區分 +明確的主機位址與網路前綴：明確位址會原樣保留；若設定的是網路前綴， +只有當第一個可用位址確實存在於網橋時才會選用。多位址網橋若仍有歧義， +會停止配置而不擅自猜測。此變更不改動防火牆、IPsec、VXLAN 或實體介面 +設定。啟用此選用驅動程式前，仍須驗證真實第 2 層連線及回復方式。 diff --git a/infra-templates/layer-2-flat-network/8/docker-compose.yml.tpl b/infra-templates/layer-2-flat-network/8/docker-compose.yml.tpl new file mode 100644 index 000000000..4e29924b8 --- /dev/null +++ b/infra-templates/layer-2-flat-network/8/docker-compose.yml.tpl @@ -0,0 +1,70 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + layer-2-flat-cni: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + privileged: true + network_mode: host + pid: host +{{- if eq .Values.AUTO_SETUP_LAYER_2_BRIDGE "true" }} + command: + - /bin/bash + - -ceu + - start-flat.sh && exec start-cni-driver.sh +{{- else }} + command: start-cni-driver.sh +{{- end }} + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + PASTURESTACK_METADATA_ADDRESS: '${PASTURESTACK_METADATA_ADDRESS}' + FLAT_IF: '${FLAT_INTERFACE}' + FLAT_BRIDGE: '${LAYER_2_BRIDGE}' + MTU: '${MTU}' + labels: + io.pasturestack.component: layer-2-flat-cni + io.rancher.network.cni.binary: pasture-bridge + io.rancher.container.dns: 'true' + io.rancher.scheduler.global: 'true' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - rancher-cni-driver:/opt/cni-driver + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + network_driver: + name: PastureStack Layer 2 Flat Network + default_network: + name: layer-2-flat + host_ports: {{ .Values.HOST_PORTS }} + subnets: + - network_address: ${SUBNET} + start_address: ${START_ADDRESS} + end_address: ${END_ADDRESS} + dns: + - 169.254.169.250 + dns_search: + - pasture.internal + cni_config: + '10-pasturestack-layer-2-flat.conf': + name: pasturestack-layer-2-flat-network + type: pasture-bridge + bridge: ${LAYER_2_BRIDGE} + bridgeSubnet: ${SUBNET} + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + hostNat: false + mtu: ${MTU} + skipBridgeConfigureIP: true + skipFastPath: true + ipam: + type: flat-cni-ipam + metadataURL: http://169.254.169.250/2015-12-19 + metadataAddress: 169.254.169.250 + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + routes: + - dst: 0.0.0.0/0 + gw: ${GATEWAY} diff --git a/infra-templates/layer-2-flat-network/8/rancher-compose.yml b/infra-templates/layer-2-flat-network/8/rancher-compose.yml new file mode 100644 index 000000000..0ecf1c265 --- /dev/null +++ b/infra-templates/layer-2-flat-network/8/rancher-compose.yml @@ -0,0 +1,96 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Layer 2 Flat Network + version: v0.3.6 + description: Connect managed workloads directly to a shared Layer 2 subnet through a host bridge. + minimum_rancher_version: v1.6.26-rc1 + labels: + io.pasturestack.catalog.question.layer_2_bridge.label.zh-tw: '第 2 層網橋' + io.pasturestack.catalog.question.layer_2_bridge.description.zh-tw: '共用第 2 層網路使用的既有或自動設定主機網橋。' + io.pasturestack.catalog.question.flat_interface.label.zh-tw: '實體網路介面' + io.pasturestack.catalog.question.flat_interface.description.zh-tw: '只有啟用自動網橋設定時，才會把此主機實體介面加入網橋。' + io.pasturestack.catalog.question.auto_setup_layer_2_bridge.label.zh-tw: '自動設定網橋' + io.pasturestack.catalog.question.auto_setup_layer_2_bridge.description.zh-tw: '把實體介面的位址移到第 2 層網橋；啟用前請先確認可使用主控台連線。' + io.pasturestack.catalog.question.subnet.label.zh-tw: '共用子網路' + io.pasturestack.catalog.question.subnet.description.zh-tw: '主機、網橋、閘道與受管工作負載共用的 IPv4 子網路。' + io.pasturestack.catalog.question.start_address.label.zh-tw: '第一個工作負載位址' + io.pasturestack.catalog.question.start_address.description.zh-tw: '控制平面可分配給受管工作負載的第一個 IPv4 位址。' + io.pasturestack.catalog.question.end_address.label.zh-tw: '最後一個工作負載位址' + io.pasturestack.catalog.question.end_address.description.zh-tw: '控制平面可分配給受管工作負載的最後一個 IPv4 位址。' + io.pasturestack.catalog.question.gateway.label.zh-tw: '預設閘道' + io.pasturestack.catalog.question.gateway.description.zh-tw: '共用子網路中受管工作負載使用的 IPv4 閘道。' + io.pasturestack.catalog.question.mtu.label.zh-tw: '網路 MTU' + io.pasturestack.catalog.question.mtu.description.zh-tw: '實體第 2 層網路端對端支援的 MTU。' + io.pasturestack.catalog.question.host_ports.label.zh-tw: '啟用主機連接埠' + io.pasturestack.catalog.question.host_ports.description.zh-tw: '允許受管工作負載在主機上公開連接埠。' + io.pasturestack.catalog.question.pasturestack_metadata_address.label.zh-tw: '中繼資料服務位址' + io.pasturestack.catalog.question.pasturestack_metadata_address.description.zh-tw: '相容中繼資料服務使用的連結本機 IPv4 位址。' + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的網橋設定與 CNI 操作診斷資訊。' + questions: + - variable: LAYER_2_BRIDGE + label: Layer 2 bridge + description: Existing or automatically configured host bridge used by the shared Layer 2 network. + type: string + default: flatbr0 + required: true + - variable: FLAT_INTERFACE + label: Physical interface + description: Physical host interface to attach to the bridge only when automatic bridge setup is enabled. + type: string + default: eth0 + required: true + - variable: AUTO_SETUP_LAYER_2_BRIDGE + label: Configure the bridge automatically + description: Move the physical interface address onto the Layer 2 bridge. Verify console access before enabling this option. + type: boolean + default: 'false' + required: true + - variable: SUBNET + label: Shared subnet + description: IPv4 subnet shared by the hosts, bridge, gateway, and managed workloads. + type: string + default: 192.0.2.0/24 + required: true + - variable: START_ADDRESS + label: First workload address + description: First IPv4 address that the control plane may assign to a managed workload. + type: string + default: 192.0.2.100 + required: true + - variable: END_ADDRESS + label: Last workload address + description: Last IPv4 address that the control plane may assign to a managed workload. + type: string + default: 192.0.2.199 + required: true + - variable: GATEWAY + label: Default gateway + description: IPv4 gateway for managed workloads on the shared subnet. + type: string + default: 192.0.2.1 + required: true + - variable: MTU + label: Network MTU + description: MTU supported end to end by the physical Layer 2 network. + type: int + default: 1500 + required: true + - variable: HOST_PORTS + label: Enable host ports + description: Allow managed workloads to publish ports on their hosts. + type: boolean + default: 'true' + required: true + - variable: PASTURESTACK_METADATA_ADDRESS + label: Metadata address + description: Link-local IPv4 address of the compatible metadata service. + type: string + default: 169.254.169.250 + required: true + - variable: PASTURESTACK_DEBUG + label: Enable debug logs + description: Enable verbose diagnostics for bridge setup and CNI operations. + type: boolean + default: 'false' + required: true diff --git a/infra-templates/layer-2-flat-network/config.yml b/infra-templates/layer-2-flat-network/config.yml index 1c66a2fd5..52ed69f70 100644 --- a/infra-templates/layer-2-flat-network/config.yml +++ b/infra-templates/layer-2-flat-network/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Layer 2 Flat Network description: Connect managed workloads directly to a shared Layer 2 subnet through a host bridge. -version: v0.3.5 +version: v0.3.6 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and bundled component licenses apply diff --git a/infra-templates/network-policy-manager/5/README.md b/infra-templates/network-policy-manager/5/README.md new file mode 100644 index 000000000..e3853e15a --- /dev/null +++ b/infra-templates/network-policy-manager/5/README.md @@ -0,0 +1,71 @@ + + +# PastureStack Network Policy Manager v0.3.5 candidate + +## Source candidate + +This source prepares numeric revision 5 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 4 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/network-policy-manager:v0.3.2` -> `ghcr.io/pasturestack/network-policy-manager:v0.3.3` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 4 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This infrastructure entry installs one policy agent on every eligible managed +host. Each agent reads the established link-local Metadata endpoint, compiles +the active network policy, and atomically replaces only +`table inet pasturestack_policy`. + +### Runtime behavior + +The agent checks Metadata every 20 seconds. Valid policy changes preserve +established and related connections, allow required system traffic, and apply +the configured default action to local application workloads. A transient +Metadata or policy error keeps the last-known-good table. If valid Metadata +remains unavailable for ten minutes, the agent enters a visible availability- +safe fail-open state and restores enforcement after reconciliation succeeds. + +The diagnostic readiness endpoint listens on host port `8092`. Rancher 1.6 +cannot address a health target for a host-network container without a container +IP, so this revision deliberately does not declare a Rancher health check that +would remain indefinitely in `initializing`. Operators can query `/readyz` +directly on each managed host; failures omit identifiers, addresses, labels, +selectors, and policy documents. + +### Security boundary + +The container uses host networking and only `NET_ADMIN`. It drops every other +capability, runs with a read-only root filesystem and +`no-new-privileges`, and does not use privileged mode, host PID, a +container-engine socket, host filesystem mounts, API credentials, or secret +input. + +Graceful stack removal stops reconciliation and deletes only the independently +owned nftables table. An unexpected container or host failure leaves the +last-known-good table in place. Review the source repository before changing +the polling, stale-data, or shutdown behavior. + +### License and provenance + +The template files and original icon are MIT-licensed PastureStack +contributions. The image source retains its Apache License 2.0, preserved +upstream history, authorship, and notices. Ubuntu, nftables, and bundled +dependencies retain their respective upstream licenses. + +PastureStack is an independent community effort to preserve, audit, and +modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by +Rancher Labs or SUSE. diff --git a/infra-templates/network-policy-manager/5/README.zh-TW.md b/infra-templates/network-policy-manager/5/README.zh-TW.md new file mode 100644 index 000000000..79addb333 --- /dev/null +++ b/infra-templates/network-policy-manager/5/README.zh-TW.md @@ -0,0 +1,54 @@ + + +# PastureStack 網路政策管理器 v0.3.5 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 5，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 4。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/network-policy-manager:v0.3.2` → `ghcr.io/pasturestack/network-policy-manager:v0.3.3` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 4 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此基礎架構範本會在每台符合條件的受管主機上安裝一個政策代理程式。 +每個代理程式都會讀取既有的連結本機中繼資料端點、編譯有效的網路 +政策，並以不可分割方式只替換 `table inet pasturestack_policy`。 + +### 執行方式 + +代理程式每 20 秒檢查一次中繼資料。有效政策變更會保留已建立及相關 +連線、允許必要系統流量，並把設定的預設動作套用到本機應用程式工作 +負載。暫時性中繼資料或政策錯誤會保留最後一份有效規則。若有效中繼 +資料持續無法使用十分鐘，代理程式會進入畫面可見、以維持可用性為主 +的開放狀態；協調成功後會自動恢復政策強制執行。 + +診斷用就緒狀態端點使用主機連接埠 `8092`。Rancher 1.6 無法為沒有 +容器 IP 的主機網路容器定位健康檢查目標，因此本版刻意不宣告會永遠 +停在「初始化中」的 Rancher 健康檢查。管理者可直接查詢每台受管主機 +的 `/readyz`；失敗回報不含識別碼、位址、標籤、選取條件或政策內容。 + +### 安全性界線 + +容器使用主機網路，且只保留 `NET_ADMIN`。其他 Capability 全部移除； +根檔案系統為唯讀並啟用 `no-new-privileges`。容器不使用特權模式、 +主機 PID、容器引擎 Socket、主機檔案掛載、API 登入資訊或機密資料 +輸入。 + +正常移除堆疊時會停止協調，並只刪除自己擁有的 nftables 表。非預期 +的容器或主機故障會保留最後一份有效規則。變更輪詢、過期資料或停止 +行為前，請先審查原始碼儲存庫。 + +### 授權與出處 + +範本檔案與原創圖示是 PastureStack 依 MIT 授權提供的新貢獻。映像 +原始碼保留 Apache License 2.0、上游歷史、作者與聲明。Ubuntu、 +nftables 及隨附相依套件保留各自的上游授權。 + +PastureStack 是獨立的社群計畫，目的在保存、稽核與現代化 Rancher +1.6 生態系；本計畫與 Rancher Labs 或 SUSE 無隸屬或背書關係。 diff --git a/infra-templates/network-policy-manager/5/docker-compose.yml b/infra-templates/network-policy-manager/5/docker-compose.yml new file mode 100644 index 000000000..1c82a6123 --- /dev/null +++ b/infra-templates/network-policy-manager/5/docker-compose.yml @@ -0,0 +1,35 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + network-policy-manager: + image: ghcr.io/pasturestack/network-policy-manager:v0.3.3 + command: + - serve + - --poll-interval + - 20s + - --fail-open-after + - 10m + - --health-listen + - 0.0.0.0:8092 + - --cleanup-on-exit + network_mode: host + cap_drop: + - ALL + cap_add: + - NET_ADMIN + read_only: true + tmpfs: + - /tmp:rw,noexec,nosuid,size=8m + security_opt: + - 'no-new-privileges:true' + labels: + io.pasturestack.component: network-policy-manager + io.rancher.scheduler.global: 'true' + cpu_shares: 128 + mem_limit: 64m + logging: + driver: json-file + options: + max-size: 10m + max-file: '2' diff --git a/infra-templates/network-policy-manager/5/rancher-compose.yml b/infra-templates/network-policy-manager/5/rancher-compose.yml new file mode 100644 index 000000000..59eabfcbf --- /dev/null +++ b/infra-templates/network-policy-manager/5/rancher-compose.yml @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Network Policy Manager + version: v0.3.5 + description: Enforce metadata-defined network policy on every managed host with independently owned nftables rules. + minimum_rancher_version: v1.6.26-rc1 + +network-policy-manager: + start_on_create: true diff --git a/infra-templates/network-policy-manager/config.yml b/infra-templates/network-policy-manager/config.yml index 27a39d045..2d1054e13 100644 --- a/infra-templates/network-policy-manager/config.yml +++ b/infra-templates/network-policy-manager/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Network Policy Manager description: Enforce metadata-defined network policy on every managed host with independently owned nftables rules. -version: v0.3.4 +version: v0.3.5 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and bundled dependency licenses apply diff --git a/infra-templates/network-services/14/README.md b/infra-templates/network-services/14/README.md new file mode 100644 index 000000000..7fedf5657 --- /dev/null +++ b/infra-templates/network-services/14/README.md @@ -0,0 +1,88 @@ + + +# PastureStack Network Services v0.3.12 candidate + +## Source candidate + +This source prepares numeric revision 14 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 13 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/metadata-service:v0.10.6` -> `ghcr.io/pasturestack/metadata-service:v0.10.7` +- `ghcr.io/pasturestack/internal-dns:v0.17.13` -> `ghcr.io/pasturestack/internal-dns:v0.17.14` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 13 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +Version 13 (visible version `v0.3.11`) uses the published Network Plugin Manager `v0.8.25`, Metadata Service `v0.10.6`, and Internal DNS `v0.17.13`. This dependency update retains version 12's firewall ownership, CNI convergence, Catalog questions, sidekicks and shared volumes. Earlier numeric revisions remain unchanged. Published source, image digests and runtime scan evidence are recorded in `catalog-images.json`. + +The NPM25 and Metadata106 GitHub Releases report `immutable: false`; recorded OCI manifest digests and SBOM SHA256 values identify the verified content, not a GitHub release lock. Metadata106's full raw report retains 44 reviewed unfixed findings (38 Medium and 6 Low), not zero findings. Metadata106 preserves the platform's opaque `revision-hash` change tokens so existing long-poll clients observe updates without a protocol change. + +### CNI configuration convergence + +The manager preflights all desired CNI configurations and writes each through an atomic replacement with mode `0600`. Only after every desired configuration has been written successfully may it retire an obsolete platform configuration. The historical `10-rancher.conf` must have the exact name/type/IPAM triplet `rancher-cni-network` / `rancher-bridge` / `rancher-cni-ipam`; the current `10-pasturestack.conf` must have `pasturestack-cni-network` / `pasture-bridge` / `metadata-cni-ipam`. The same ownership check applies when the selected provider requires the historical configuration again. + +Retirement renames the obsolete file with a `.pasturestack-retired` suffix, preserving its original bytes outside the CNI `.conf` / `.json` execution set. An existing retirement backup must be byte-identical; a conflicting backup causes an error. Unrelated administrator configurations are preserved. Malformed or partially matching platform configurations, symlinks, and unsafe metadata paths cause an explicit error. The manager never sweeps the configuration directory or removes CNI binary aliases as part of this migration. + +Each component is a published security rebuild. Full-severity evidence is recorded separately from deployment acceptance; publication does not establish that an existing infrastructure stack has completed its managed upgrade. + +### Provider and lifecycle convergence + +The manager selects one eligible CNI provider per binary from the infrastructure-service metadata on the local host. The highest numeric OCI image version wins; an unversioned or nonnumeric development label cannot replace a numeric release, and ties use a deterministic immutable container-ID ordering. The generated wrapper stays bound to that exact provider and does not relist containers by service label at invocation time. It executes the provider's private `/opt/cni/bin` copy with a bounded compatibility fallback for older images. Wrapper replacement uses an exclusive temporary inode and atomic rename; content, file type, and mode drift are repaired without following a replacement symlink. + +When platform metadata temporarily reports a host-port container before its primary address, the manager may read the exact running container's network namespace. It accepts only one IPv4 address inside that network's configured managed subnet and revalidates the same Docker container PID after the namespace read. Missing, ambiguous, out-of-subnet, or lifecycle-raced results fail closed and retain the last known-good host-port rules until metadata and CNI converge. + +### Firewall backend + +`FIREWALL_BACKEND` defaults to `auto`. It reads Docker's actual firewall driver: Docker's native `nftables` driver uses native nft rules, while Docker's `iptables` driver selects the frontend that owns Docker's active NAT chain. That may be `iptables-nft` or `iptables-legacy` on **any supported host**, including Ubuntu 26.04 and later. The OS release, installed executable, or unloaded kernel module alone never selects a backend. To pin one path, choose: + +- `nftables`: Docker's native nftables firewall backend. This is **not** the same as the iptables-nft compatibility CLI. +- `iptables-nft`: xtables compatibility CLI backed by nf_tables, for Docker's iptables firewall driver. +- `iptables-legacy`: legacy xtables, only when the running Docker daemon actually owns the active rules through that frontend. + +The manager refuses a mismatched or ambiguous selection and does not fall back, switch Docker's backend, or load legacy modules. An Ubuntu 26.04+ host already using `iptables-legacy` or `iptables-nft` must keep its live Docker path; do not turn on native nftables merely because the OS is new. A deliberate migration requires a separate host change, rollback point, and network lifecycle test. + +This manager alone owns the host NAT and host-port `CATTLE_*` chains. Its +masquerade rules exclude destinations inside the managed overlay subnet in +all three backends; the IPsec host-XFRM router must not patch these chains. +For the per-host-subnet driver, the manager also excludes other active hosts' +validated subnets from masquerade and adds a bounded forwarding exception. +Inactive registrations are ignored; missing or overlapping labels on an active +host fail closed. This is a routed, unencrypted network; protect the host +transport separately. +Upgrade Network Services first and verify manager health on every host before +upgrading the matching IPsec Overlay version. + +Shared-subnet ingress is enabled only when CNI metadata explicitly sets +`allowSharedSubnetIngress: true`, or for the legacy fixed-subnet contract that +already declares both `bridgeSubnet` and `hostNat: true`. It is rejected for +host-label-based subnets, where only validated active peer ranges are trusted. + +For Docker's native nftables driver, configure Docker itself with `"firewall-backend": "nftables"` and `"bridge-accept-fwmark": "0x1068/0x1068"` before upgrading this stack. Persist `net.ipv4.ip_forward=1` on the host and verify it remains enabled after a reboot: Docker's native nftables backend does not enable IPv4 forwarding for you. The mark allows Docker's bridge forwarding rules to accept the manager's published-host-port traffic; the template cannot configure the host daemon or kernel settings. Check and explicitly migrate any stale `iptables-nft` `FORWARD DROP` policy or previous platform hooks before switching Docker. The manager refuses that mixed state rather than changing the host's global firewall policy. Docker's native nftables backend remains an experimental Docker feature; qualify it against the installed Docker release before production use. + +### Other configuration + +- `DOCKER_BRIDGE`: host bridge for managed workload traffic. +- `DNS_RECURSER_TIMEOUT`, `TTL`: upstream DNS timeout and service-discovery cache time. +- `CPU_PERIOD`, `CPU_QUOTA`: Metadata Service CPU scheduling limits. +- `RELOAD_INTERVAL_LIMIT`, `ARP_SYNC_INTERVAL`: metadata reload and host ARP reconciliation intervals. + +Network Plugin Manager still requires host networking, host PID visibility, the Docker socket, Docker state, kernel-module and runtime mounts, and the shared CNI volume. Metadata Service starts as root only to assign its link-local address, then drops to UID/GID 10001. Internal DNS shares its namespace. The `rancher-compose.yml` filename, `io.rancher.*` labels, `CATTLE_*` fallback variables, `/var/lib/rancher` CA path, and `rancher-cni-driver` volume are compatibility contracts, not a request to use legacy firewall rules. + +These template files are MIT-licensed. The manager, metadata service, and internal DNS retain their Apache-2.0 licenses and bundled dependency notices. Verify image source and the recorded manifest digest in `catalog-images.json` before deployment. + +Metadata and DNS are managed by the Server lifecycle. The manager no longer removes overlapping instances during upgrades and remains unready while waiting for Metadata recovery. Verify service health before completing an upgrade; image publication alone is not runtime acceptance. + +Driver stop/start events and periodic reconciliation refresh the selected provider. Only eligible running local providers with a live process ID can be selected. Temporary metadata or Docker inspection failures remain visible and are retried; an unrelated unavailable driver does not block a healthy provider for another binary. No host firewall mode or administrator configuration is changed by provider selection. diff --git a/infra-templates/network-services/14/README.zh-TW.md b/infra-templates/network-services/14/README.zh-TW.md new file mode 100644 index 000000000..89cc055f7 --- /dev/null +++ b/infra-templates/network-services/14/README.zh-TW.md @@ -0,0 +1,67 @@ + + +# PastureStack 網路服務 v0.3.12 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 14，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 13。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/metadata-service:v0.10.6` → `ghcr.io/pasturestack/metadata-service:v0.10.7` +- `ghcr.io/pasturestack/internal-dns:v0.17.13` → `ghcr.io/pasturestack/internal-dns:v0.17.14` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 13 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +第 13 版（顯示版本 `v0.3.11`）使用已正式發布的網路外掛管理器 `v0.8.25`、中繼資料服務 `v0.10.6` 與內部 DNS `v0.17.13`。此次相依套件更新保留第 12 版的防火牆責任、CNI 收斂、Catalog 問題、相關容器與共用磁碟區；較早數字版目錄內容不變。正式來源、映像摘要及執行環境掃描證據記錄於 `catalog-images.json`。 + +NPM25 與 Metadata106 的 GitHub Release 均回報 `immutable: false`；記錄的 OCI manifest digest 與 SBOM SHA256 用於識別已驗證內容，不代表 GitHub 發行已鎖定。Metadata106 的完整 raw 報告保留 44 筆已審查但官方尚無修補的發現（38 筆 Medium、6 筆 Low），不是零筆發現。Metadata106 保留平台的 opaque `revision-hash` 變更代號，讓既有長輪詢用戶端不改通訊協定即可接收更新。 + +### CNI 設定收斂 + +管理器會先檢查所有預期 CNI 設定，再以原子置換逐檔寫入，權限為 `0600`。只有全部預期設定都寫入成功後，才可退役已不再使用的平台設定。歷史 `10-rancher.conf` 的 name/type/IPAM 必須完整符合 `rancher-cni-network` / `rancher-bridge` / `rancher-cni-ipam`；現行 `10-pasturestack.conf` 則必須完整符合 `pasturestack-cni-network` / `pasture-bridge` / `metadata-cni-ipam`。選定的 provider 再次需要歷史設定時，也會套用相同的身分判定。 + +退役時會將舊檔更名為加上 `.pasturestack-retired` 後綴的備份，保留原始位元組，並移出 CNI `.conf` / `.json` 執行集合。若備份已存在，其內容必須完全一致；內容衝突則明確報錯。管理者的其他設定會保留；格式損壞、只符合部分平台身分、符號連結及不安全的中繼資料路徑都會明確報錯。此次遷移不會掃除整個設定目錄，也不會移除 CNI 執行檔別名。 + +各元件均為正式發布的安全重建。完整嚴重度證據與部署驗收分開記錄；元件發布不代表既有基礎架構堆疊已完成受管升級。 + +### Provider 與生命週期收斂 + +管理器會依本機主機上的基礎架構服務中繼資料，為每個 CNI 執行檔選出唯一合格的 provider。數字型 OCI 映像版本以最高版為準；未標示版本或非數字的開發標籤不得取代正式數字版本，版本相同時再以不可變的容器 ID 做固定排序。產生的 wrapper 只綁定這個精確 provider，呼叫時不會再以服務標籤重新列舉容器。它優先執行 provider 私有的 `/opt/cni/bin` 程式，並只為舊映像保留有限的相容路徑。wrapper 以排他暫存 inode 與原子更名更新；內容、檔案型態或權限漂移時會安全修復，不會沿著遭置換的符號連結寫入。 + +若平台中繼資料暫時先出現主機連接埠容器、尚未填入主要位址，管理器可讀取該精確執行中容器的網路命名空間。只有該網路設定之受管子網路內恰好一個 IPv4 位址可被接受，讀取後還會再次確認同一 Docker 容器 PID。缺少、歧義、超出子網路或生命週期競態都會安全失敗，並保留上一份可用的主機連接埠規則，直到中繼資料與 CNI 完成收斂。 + +### 防火牆後端 + +`FIREWALL_BACKEND` 預設為 `auto`，依 Docker 實際防火牆驅動程式選擇單一路徑：Docker 原生 `nftables` 使用原生 nft 規則；Docker `iptables` 驅動程式則辨識哪一套前端擁有 Docker 現役 NAT 鏈。任何受支援主機（包括 Ubuntu 26.04 及更新版）都可能使用 `iptables-nft` 或 `iptables-legacy`；作業系統版本、執行檔存在或尚未載入的核心模組，均不足以決定後端。需要固定路徑時可選： + +- `nftables`：Docker 原生 nftables 防火牆後端，**不是** iptables-nft 相容命令。 +- `iptables-nft`：由 nf_tables 支援的 xtables 相容命令，搭配 Docker 的 iptables 防火牆驅動程式。 +- `iptables-legacy`：只在現役 Docker 確實透過這套前端持有規則時選用。 + +選擇與 Docker 實際後端不符或無法判定時，管理器會拒絕啟動，不會自動降級、切換 Docker 後端或載入 legacy 模組。Ubuntu 26.04 及更新版若已使用 `iptables-legacy` 或 `iptables-nft`，就應維持現役 Docker 路徑；不能只因系統較新便替它切成原生 nftables。刻意遷移須另外準備主機變更、回復點及網路生命週期驗收。 + +主機 NAT 與主機連接埠的 `CATTLE_*` 規則鏈只由此管理器維護；三種後端的來源位址轉換規則都排除受管 overlay 子網路內的目的位址。每主機子網路還會排除其他有效主機的已驗證子網路，並加入限定來源與目的子網路的轉送例外；非現役主機不列入，現役主機若缺少標籤或子網路重疊則安全地拒絕套用。此網路只提供路由、不加密，須另行保護主機間傳輸。IPsec 主機 XFRM 路由器不得再插入補丁規則。升級時應先升級網路服務，逐台確認管理器健康，再升級相符的 IPsec 加密網路版本。 + +只有 CNI 中繼資料明確設定 `allowSharedSubnetIngress: true` 時才啟用共用子網路輸入轉送；為維持既有固定子網路契約相容性，同時具有 `bridgeSubnet` 與 `hostNat: true` 的舊設定也會採用相同行為。使用主機標籤決定子網路時會拒絕此選項，只信任已驗證的現役對端範圍。 + +使用 Docker 原生 nftables 前，必須先在主機 Docker 設定加入 `"firewall-backend": "nftables"` 及 `"bridge-accept-fwmark": "0x1068/0x1068"`，再升級此堆疊。還須在主機持久設定 `net.ipv4.ip_forward=1`，並於重開機後確認仍啟用；Docker 原生 nftables 後端不會代為啟用 IPv4 轉送。此標記讓 Docker 網橋轉送規則接受管理器發布的主機連接埠流量；範本無法替主機設定 Docker daemon 或核心參數。切換前還須檢查並明確遷移殘留的 `iptables-nft FORWARD DROP` 全域政策與舊平台掛鉤。管理器遇到混用狀態會拒絕啟動，不會自行修改主機全域防火牆政策。Docker 原生 nftables 目前仍屬實驗性功能，正式環境使用前應針對安裝的 Docker 版本完成驗收。 + +### 其他設定 + +- `DOCKER_BRIDGE`：受管工作負載使用的主機網橋。 +- `DNS_RECURSER_TIMEOUT`、`TTL`：上游 DNS 逾時與服務探索快取時間。 +- `CPU_PERIOD`、`CPU_QUOTA`：中繼資料服務的 CPU 排程限制。 +- `RELOAD_INTERVAL_LIMIT`、`ARP_SYNC_INTERVAL`：中繼資料重新載入與主機 ARP 協調間隔。 + +網路外掛管理器仍需主機網路、主機 PID、Docker Socket、Docker 狀態、核心模組與執行環境掛載，以及共用 CNI 磁碟區。中繼資料服務僅在指派連結本機位址時以 root 啟動，之後切換為 UID/GID 10001；內部 DNS 與其共用網路命名空間。`rancher-compose.yml`、`io.rancher.*`、`CATTLE_*` 備援變數、`/var/lib/rancher` CA 路徑及 `rancher-cni-driver` 磁碟區是既有協定的相容契約，不代表必須使用 legacy 防火牆規則。 + +範本檔案採 MIT 授權；管理器、中繼資料服務與內部 DNS 保留 Apache-2.0 授權及隨附相依套件聲明。部署前應以 `catalog-images.json` 核對映像來源與記錄的 manifest digest。 + +中繼資料與 DNS 容器由 Server 生命週期管理。網路管理器不再刪除升級期間並存的執行個體，並在中繼資料恢復前保持未就緒狀態。完成升級前仍須確認服務健康；映像發布不代表實機驗收已完成。 + +Driver 停止／啟動事件與定期協調都會重新選擇 provider；只有本機合法、執行中且具有效程序 ID 的 provider 能被選用。暫時的中繼資料或 Docker 檢查錯誤會明確回報並重試；其他 driver 暫時不可用，不得阻擋不同執行檔的健康 provider。選擇 provider 不會變更主機防火牆模式或管理者設定。 diff --git a/infra-templates/network-services/14/docker-compose.yml.tpl b/infra-templates/network-services/14/docker-compose.yml.tpl new file mode 100644 index 000000000..7fca2c7e3 --- /dev/null +++ b/infra-templates/network-services/14/docker-compose.yml.tpl @@ -0,0 +1,95 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + network-plugin-manager: + image: ghcr.io/pasturestack/network-plugin-manager:v0.8.25 + privileged: true + network_mode: host + pid: host + command: + - network-plugin-manager + - --metadata-url + - http://169.254.169.250/2016-07-29 + - --arpsync-interval + - '${ARP_SYNC_INTERVAL}' + - --firewall-backend + - '${FIREWALL_BACKEND}' + environment: + DOCKER_BRIDGE: '${DOCKER_BRIDGE}' + METADATA_IP: 169.254.169.250 + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - /var/lib/docker:/var/lib/docker + - /lib/modules:/lib/modules:ro + - /run:/run + - /var/run:/var/run + - rancher-cni-driver:/etc/cni + - rancher-cni-driver:/opt/cni + labels: + io.pasturestack.component: network-plugin-manager + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + + metadata: + image: ghcr.io/pasturestack/metadata-service:v0.10.7 + user: root + cap_add: + - NET_ADMIN + network_mode: bridge + command: + - /bin/bash + - -ec + - | + export PLATFORM_URL="$${PLATFORM_URL:-$${CATTLE_URL:-}}" + export PLATFORM_ACCESS_KEY="$${PLATFORM_ACCESS_KEY:-$${CATTLE_ACCESS_KEY:-}}" + export PLATFORM_SECRET_KEY="$${PLATFORM_SECRET_KEY:-$${CATTLE_SECRET_KEY:-}}" + exec metadata-service --reload-interval-limit="${RELOAD_INTERVAL_LIMIT}" --subscribe + environment: + PLATFORM_CA_ROOT: /var/lib/rancher/etc/ssl/ca.crt + labels: + io.pasturestack.component: metadata-service + io.rancher.sidekicks: dns + io.rancher.container.create_agent: 'true' + io.rancher.scheduler.global: 'true' + io.rancher.container.agent_service.metadata: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + sysctls: + net.ipv4.conf.all.send_redirects: '0' + net.ipv4.conf.default.send_redirects: '0' + cpu_period: ${CPU_PERIOD} + cpu_quota: ${CPU_QUOTA} + + dns: + image: ghcr.io/pasturestack/internal-dns:v0.17.14 + network_mode: container:metadata + command: + - internal-dns + - --listen + - 169.254.169.250:53 + - --recurser-timeout + - '${DNS_RECURSER_TIMEOUT}' + - --ttl + - '${TTL}' + environment: + PLATFORM_METADATA_ENABLED: 'true' + PLATFORM_METADATA_URL: http://localhost/2016-07-29 + PLATFORM_METADATA_ANSWER: 169.254.169.250 + NEVER_RECURSE_TO: 169.254.169.250 + PLATFORM_DNS_ANSWERS_FILE: /etc/internal-dns/answers.json + labels: + io.pasturestack.component: internal-dns + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' diff --git a/infra-templates/network-services/14/rancher-compose.yml b/infra-templates/network-services/14/rancher-compose.yml new file mode 100644 index 000000000..8c3258b75 --- /dev/null +++ b/infra-templates/network-services/14/rancher-compose.yml @@ -0,0 +1,77 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Network Services + version: v0.3.12 + description: Install host networking, metadata, and internal DNS services required by managed workloads. + minimum_rancher_version: v1.6.26-rc1 + labels: + io.pasturestack.catalog.question.docker_bridge.label.zh-tw: 'Docker 網橋' + io.pasturestack.catalog.question.docker_bridge.description.zh-tw: '受管工作負載流量使用的主機網橋。' + io.pasturestack.catalog.question.firewall_backend.label.zh-tw: '主機防火牆後端' + io.pasturestack.catalog.question.firewall_backend.description.zh-tw: '依 Docker 現役後端自動選擇；不論 Ubuntu 版本，原生 nftables、iptables-nft 與 iptables-legacy 互不混用。切換原生 nftables 前須先設定 Docker bridge-accept-fwmark。' + io.pasturestack.catalog.question.dns_recurser_timeout.label.zh-tw: 'DNS 遞迴查詢逾時' + io.pasturestack.catalog.question.dns_recurser_timeout.description.zh-tw: '等待上游 DNS 查詢回應的秒數。' + io.pasturestack.catalog.question.ttl.label.zh-tw: '服務探索 DNS 紀錄存留時間' + io.pasturestack.catalog.question.ttl.description.zh-tw: '內部服務探索 DNS 回應可保留的秒數。' + io.pasturestack.catalog.question.cpu_period.label.zh-tw: '中繼資料服務 CPU 週期' + io.pasturestack.catalog.question.cpu_period.description.zh-tw: '分配給每個中繼資料服務執行個體的 CPU 排程週期。' + io.pasturestack.catalog.question.cpu_quota.label.zh-tw: '中繼資料服務 CPU 配額' + io.pasturestack.catalog.question.cpu_quota.description.zh-tw: '分配給每個中繼資料服務執行個體的 CPU 配額。' + io.pasturestack.catalog.question.reload_interval_limit.label.zh-tw: '中繼資料重新載入間隔' + io.pasturestack.catalog.question.reload_interval_limit.description.zh-tw: '兩次中繼資料設定重新載入之間的最短毫秒數。' + io.pasturestack.catalog.question.arp_sync_interval.label.zh-tw: 'ARP 同步間隔' + io.pasturestack.catalog.question.arp_sync_interval.description.zh-tw: '兩次主機 ARP 協調作業之間的秒數。' + questions: + - variable: DOCKER_BRIDGE + label: Docker bridge + description: Host bridge used for managed workload traffic. + type: string + default: docker0 + required: true + - variable: FIREWALL_BACKEND + label: Host firewall backend + description: Follow Docker's active firewall backend on any supported Ubuntu version, or explicitly select native nftables, iptables-nft, or iptables-legacy. A mismatch fails safely; native nftables requires Docker bridge-accept-fwmark on the host. + type: enum + default: auto + required: true + options: + - auto + - nftables + - iptables-nft + - iptables-legacy + - variable: DNS_RECURSER_TIMEOUT + label: DNS recursion timeout + description: Seconds allowed for an upstream DNS query. + type: int + default: 2 + required: true + - variable: TTL + label: Service discovery TTL + description: Seconds that internal service-discovery answers remain valid. + type: int + default: 1 + required: true + - variable: CPU_PERIOD + label: Metadata CPU period + description: CPU scheduler period assigned to each metadata service instance. + type: int + default: 400000 + required: true + - variable: CPU_QUOTA + label: Metadata CPU quota + description: CPU quota assigned to each metadata service instance. + type: int + default: 200000 + required: true + - variable: RELOAD_INTERVAL_LIMIT + label: Metadata reload interval + description: Minimum milliseconds between metadata configuration reloads. + type: int + default: 1000 + required: true + - variable: ARP_SYNC_INTERVAL + label: ARP synchronization interval + description: Seconds between host ARP reconciliation passes. + type: int + default: 5 + required: true diff --git a/infra-templates/network-services/config.yml b/infra-templates/network-services/config.yml index 597e0ae95..ebd938618 100644 --- a/infra-templates/network-services/config.yml +++ b/infra-templates/network-services/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Network Services description: Install host networking, metadata, and internal DNS services required by managed workloads. -version: v0.3.11 +version: v0.3.12 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 images and third-party package licenses apply diff --git a/infra-templates/per-host-subnet-network/6/README.md b/infra-templates/per-host-subnet-network/6/README.md new file mode 100644 index 000000000..6e126d600 --- /dev/null +++ b/infra-templates/per-host-subnet-network/6/README.md @@ -0,0 +1,62 @@ + + +# PastureStack Per-Host Subnet Network v0.3.4 candidate + +## Source candidate + +This source prepares numeric revision 6 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 5 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` -> `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 5 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This infrastructure template assigns a different workload subnet to each host +and maintains marked host-gateway routes between those subnets. Before +deployment, add a unique label to every participating host: + +```text +io.pasturestack.network.per-host-subnet.subnet=10.50.1.0/24 +``` + +Use a different, non-overlapping subnet on each host. Optional allocation +bounds use +`io.pasturestack.network.per-host-subnet.range-start` and +`io.pasturestack.network.per-host-subnet.range-end`. The controller accepts +`io.pasturestack.network.per-host-subnet.override-agent-ip` only when metadata +does not advertise the address that other hosts can route through. + +The template uses +`ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40`. The image source is +[`PastureStack/ipsec-vxlan-overlay-network@4711833178a05e5d225e364cce856bd108bdc707`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/4711833178a05e5d225e364cce856bd108bdc707); +the bundled controller is from +[`PastureStack/per-host-subnet@v0.2.5`](https://github.com/PastureStack/per-host-subnet/releases/tag/v0.2.5), +and the bundled IPAM executable is from +[`PastureStack/host-local-cni-ipam@v0.1.6`](https://github.com/PastureStack/host-local-cni-ipam/releases/tag/v0.1.6). + +The template files and icon are MIT licensed. The runtime projects are +Apache-2.0; operating-system packages and bundled components retain their own +upstream licenses and notices. + +Version 4 preserves `PASTURESTACK_DEBUG` as a string in the generated CNI JSON, +matching the CNI schema when the Catalog answer is a boolean. Version 3 resolves +host-specific bridge and IPAM labels through the control +plane's plain-text `/self/host/labels/` endpoint. The previous version's +JSON assumption prevented managed workload creation on a real host. A subnet +label must be valid and non-overlapping; Network Plugin Manager validates it +before applying host firewall rules. This driver is optional, not a second +Catalog vendor or an automatic replacement for the encrypted IPsec overlay. diff --git a/infra-templates/per-host-subnet-network/6/README.zh-TW.md b/infra-templates/per-host-subnet-network/6/README.zh-TW.md new file mode 100644 index 000000000..40d32b3b0 --- /dev/null +++ b/infra-templates/per-host-subnet-network/6/README.zh-TW.md @@ -0,0 +1,51 @@ + + +# PastureStack 每台主機獨立子網路 v0.3.4 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 6，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 5。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` → `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 5 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此基礎架構範本會為每台主機分配不同的工作負載子網路，並維護這些 +子網路之間帶有專用標記的主機閘道路由。部署前，請為每台參與主機 +新增唯一標籤： + +```text +io.pasturestack.network.per-host-subnet.subnet=10.50.1.0/24 +``` + +每台主機必須使用互不重疊的子網路。可用 +`io.pasturestack.network.per-host-subnet.range-start` 與 +`io.pasturestack.network.per-host-subnet.range-end` 限制分配範圍。 +只有中繼資料沒有提供其他主機可路由的位址時，控制器才會接受 +`io.pasturestack.network.per-host-subnet.override-agent-ip`。 + +此範本使用 +`ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40`。 +映像原始碼位於 +[`PastureStack/ipsec-vxlan-overlay-network@4711833178a05e5d225e364cce856bd108bdc707`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/4711833178a05e5d225e364cce856bd108bdc707)， +隨附控制器來自 +[`PastureStack/per-host-subnet@v0.2.5`](https://github.com/PastureStack/per-host-subnet/releases/tag/v0.2.5)， +隨附 IPAM 執行檔來自 +[`PastureStack/host-local-cni-ipam@v0.1.6`](https://github.com/PastureStack/host-local-cni-ipam/releases/tag/v0.1.6)。 + +範本檔案與圖示採 MIT 授權；執行專案採 Apache-2.0 授權。作業系統 +套件及隨附元件保留各自的上游授權及聲明。 + +第 4 版會把 Catalog 的布林除錯選項明確保留為 CNI JSON 所要求的字串， +避免受管工作負載建立時發生型別解析錯誤。第 3 版透過控制平面實際提供的 +純文字 `/self/host/labels/` +端點解析主機專屬網橋及 IPAM 標籤；舊版將回應誤當 JSON，會使真機 +受管工作負載建立失敗。子網路標籤必須有效且互不重疊，網路外掛管理器 +會在套用主機防火牆規則前驗證。本驅動程式為選用功能，不會另外建立 +商店供應者，也不會自動取代加密的 IPsec 覆疊網路。 diff --git a/infra-templates/per-host-subnet-network/6/docker-compose.yml.tpl b/infra-templates/per-host-subnet-network/6/docker-compose.yml.tpl new file mode 100644 index 000000000..37b482471 --- /dev/null +++ b/infra-templates/per-host-subnet-network/6/docker-compose.yml.tpl @@ -0,0 +1,78 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + per-host-subnet-controller: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + command: per-host-subnet + privileged: true + network_mode: host + pid: host + environment: + PLATFORM_DEBUG: '${PASTURESTACK_DEBUG}' + PLATFORM_METADATA_URL: http://169.254.169.250/2016-07-29 + PLATFORM_METADATA_STARTUP_TIMEOUT: '${METADATA_STARTUP_TIMEOUT}' + PLATFORM_WATCH_INTERVAL: '${WATCH_INTERVAL}' + PLATFORM_ENABLE_ROUTE_UPDATE: '${ENABLE_ROUTE_UPDATE}' + PLATFORM_ROUTE_UPDATE_PROVIDER: host-gateway + labels: + io.pasturestack.component: per-host-subnet-controller + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + + per-host-subnet-cni: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + command: start-cni-driver.sh + privileged: true + network_mode: host + pid: host + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + labels: + io.pasturestack.component: per-host-subnet-cni + io.rancher.network.cni.binary: pasture-bridge + io.rancher.container.dns: 'true' + io.rancher.scheduler.global: 'true' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - rancher-cni-driver:/opt/cni-driver + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + network_driver: + name: PastureStack Per-Host Subnet Network + default_network: + name: per-host-subnet + host_ports: {{ .Values.HOST_PORTS }} + dns: + - 169.254.169.250 + dns_search: + - pasture.internal + cni_config: + '10-pasturestack-per-host-subnet.conf': + name: pasturestack-per-host-subnet-network + type: pasture-bridge + bridge: ${BRIDGE} + bridgeSubnet: '__host_label__: io.pasturestack.network.per-host-subnet.subnet' + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + isDefaultGateway: true + hostNat: {{ .Values.HOST_NAT }} + hairpinMode: {{ .Values.HAIRPIN_MODE }} + promiscMode: {{ .Values.PROMISCUOUS_MODE }} + mtu: ${MTU} + ipam: + type: host-local-cni-ipam + subnet: '__host_label__: io.pasturestack.network.per-host-subnet.subnet' + rangeStart: '__host_label__: io.pasturestack.network.per-host-subnet.range-start' + rangeEnd: '__host_label__: io.pasturestack.network.per-host-subnet.range-end' + dataDir: /opt/cni/state + metadataURL: http://169.254.169.250/2016-07-29 + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' diff --git a/infra-templates/per-host-subnet-network/6/rancher-compose.yml b/infra-templates/per-host-subnet-network/6/rancher-compose.yml new file mode 100644 index 000000000..e18cf8882 --- /dev/null +++ b/infra-templates/per-host-subnet-network/6/rancher-compose.yml @@ -0,0 +1,88 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Per-Host Subnet Network + version: v0.3.4 + description: Assign a distinct workload subnet to each host and maintain host-gateway routes between hosts. + minimum_rancher_version: v1.6.26-rc1 + labels: + io.pasturestack.catalog.question.bridge.label.zh-tw: '工作負載網橋' + io.pasturestack.catalog.question.bridge.description.zh-tw: '每台主機的受管工作負載子網路使用的主機網橋。' + io.pasturestack.catalog.question.mtu.label.zh-tw: '網路 MTU' + io.pasturestack.catalog.question.mtu.description.zh-tw: '所有參與主機之間端對端支援的 MTU。' + io.pasturestack.catalog.question.enable_route_update.label.zh-tw: '維護主機路由' + io.pasturestack.catalog.question.enable_route_update.description.zh-tw: '維護前往其他主機工作負載子網路且帶有專用標記的主機閘道路由。' + io.pasturestack.catalog.question.host_nat.label.zh-tw: '啟用主機 NAT' + io.pasturestack.catalog.question.host_nat.description.zh-tw: '對離開各主機專用工作負載子網路的流量套用主機 NAT。' + io.pasturestack.catalog.question.host_ports.label.zh-tw: '啟用主機連接埠' + io.pasturestack.catalog.question.host_ports.description.zh-tw: '允許受管工作負載在主機上公開連接埠。' + io.pasturestack.catalog.question.hairpin_mode.label.zh-tw: '啟用 Hairpin 模式' + io.pasturestack.catalog.question.hairpin_mode.description.zh-tw: 'Hairpin 模式與混雜模式不可同時啟用。' + io.pasturestack.catalog.question.promiscuous_mode.label.zh-tw: '啟用混雜模式' + io.pasturestack.catalog.question.promiscuous_mode.description.zh-tw: '混雜模式與 Hairpin 模式不可同時啟用。' + io.pasturestack.catalog.question.metadata_startup_timeout.label.zh-tw: '中繼資料服務啟動逾時' + io.pasturestack.catalog.question.metadata_startup_timeout.description.zh-tw: '控制器結束前，等待中繼資料服務可用的最長時間。' + io.pasturestack.catalog.question.watch_interval.label.zh-tw: '中繼資料監看間隔' + io.pasturestack.catalog.question.watch_interval.description.zh-tw: '協調主機路由時使用的重試及長輪詢間隔。' + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的子網路、路由與 CNI 操作診斷資訊。' + questions: + - variable: BRIDGE + label: Workload bridge + description: Host bridge used for each host's managed workload subnet. + type: string + default: docker0 + required: true + - variable: MTU + label: Network MTU + description: MTU supported end to end between all participating hosts. + type: int + default: 1500 + required: true + - variable: ENABLE_ROUTE_UPDATE + label: Maintain host routes + description: Maintain marked host-gateway routes for the other hosts' workload subnets. + type: boolean + default: 'true' + required: true + - variable: HOST_NAT + label: Enable host NAT + description: Apply host NAT to traffic leaving each host-specific workload subnet. + type: boolean + default: 'true' + required: true + - variable: HOST_PORTS + label: Enable host ports + description: Allow managed workloads to publish ports on their hosts. + type: boolean + default: 'true' + required: true + - variable: HAIRPIN_MODE + label: Enable hairpin mode + description: Hairpin mode and promiscuous mode must not both be enabled. + type: boolean + default: 'false' + required: true + - variable: PROMISCUOUS_MODE + label: Enable promiscuous mode + description: Promiscuous mode and hairpin mode must not both be enabled. + type: boolean + default: 'true' + required: true + - variable: METADATA_STARTUP_TIMEOUT + label: Metadata startup timeout + description: Maximum time to wait for the metadata service before the controller exits. + type: string + default: 2m + required: true + - variable: WATCH_INTERVAL + label: Metadata watch interval + description: Retry and long-poll interval used while reconciling host routes. + type: string + default: 5s + required: true + - variable: PASTURESTACK_DEBUG + label: Enable debug logs + description: Enable verbose diagnostics for subnet, route, and CNI operations. + type: boolean + default: 'false' + required: true diff --git a/infra-templates/per-host-subnet-network/config.yml b/infra-templates/per-host-subnet-network/config.yml index 8d3bd85a2..6a8ee8f56 100644 --- a/infra-templates/per-host-subnet-network/config.yml +++ b/infra-templates/per-host-subnet-network/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Per-Host Subnet Network description: Assign a distinct workload subnet to each host and maintain host-gateway routes between hosts. -version: v0.3.3 +version: v0.3.4 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and bundled component licenses apply diff --git a/infra-templates/resource-scheduler/7/README.md b/infra-templates/resource-scheduler/7/README.md new file mode 100644 index 000000000..b3dfc4ae0 --- /dev/null +++ b/infra-templates/resource-scheduler/7/README.md @@ -0,0 +1,47 @@ + + +# Resource Scheduler v0.8.21 candidate + +## Source candidate + +This source prepares numeric revision 7 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 6 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/resource-scheduler:v0.8.20` -> `ghcr.io/pasturestack/resource-scheduler:v0.8.21` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 6 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This template deploys the functional PastureStack resource scheduler as the +control plane's scheduling agent. It consumes the established control-plane +event and Metadata contracts while using the native PastureStack executable, +debug option, public image, and semantic version tag. + +The runtime executes as UID and GID `10001:10001`. Only the scheduler binary +has permission to bind the compatibility health-check port. + +This version reconnects the control-plane event subscriber after a clean +disconnect or an error and restarts the Metadata watcher after an error or a +recovered panic. + +`/healthcheck` reports process liveness. `/readiness` reports whether the +control-plane and Metadata dependencies are currently available. A planned +control-plane restart can therefore make the service temporarily unready +without replacing the scheduler container. + +This dependency-only security update uses the official Go and Ubuntu fixes. +Scheduling, questions, credentials, and health-check contracts are unchanged. +Packaged CI health evidence does not qualify a managed-system upgrade or rollback. diff --git a/infra-templates/resource-scheduler/7/README.zh-TW.md b/infra-templates/resource-scheduler/7/README.zh-TW.md new file mode 100644 index 000000000..7be7bb922 --- /dev/null +++ b/infra-templates/resource-scheduler/7/README.zh-TW.md @@ -0,0 +1,34 @@ + + +# 資源排程器 v0.8.21 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 7，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 6。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/resource-scheduler:v0.8.20` → `ghcr.io/pasturestack/resource-scheduler:v0.8.21` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 6 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此範本會把可正常運作的 PastureStack 資源排程器部署成控制平面的 +排程代理程式。排程器使用既有的控制平面事件及中繼資料契約，同時採用 +原生 PastureStack 執行檔、除錯選項、公開映像與語意化版本標籤。 + +執行環境使用 UID/GID `10001:10001`。只有排程器執行檔具備綁定 +相容健康檢查連接埠的權限。 + +此版本會在控制平面事件訂閱正常中斷或發生錯誤後重新連線，並在中繼 +資料監看發生錯誤或已攔截的異常後重新啟動監看程序。 + +`/healthcheck` 只回報處理程序是否存活；`/readiness` 則回報控制平面與 +中繼資料相依服務目前是否可用。因此，控制平面進行計畫性重新啟動時， +排程器可以暫時呈現尚未就緒，而不會因此被替換容器。 + +此次僅採用 Go 與 Ubuntu 官方相依套件安全修補，排程、問題欄位、憑證及 +健康檢查契約均維持不變。成品 CI 健康驗證不代表已完成受管系統升級或回復驗收。 diff --git a/infra-templates/resource-scheduler/7/docker-compose.yml b/infra-templates/resource-scheduler/7/docker-compose.yml new file mode 100644 index 000000000..8c5178e15 --- /dev/null +++ b/infra-templates/resource-scheduler/7/docker-compose.yml @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: MIT +version: '2' +services: + resource-scheduler: + image: ghcr.io/pasturestack/resource-scheduler:v0.8.21 + command: resource-scheduler --metadata-address 169.254.169.250 + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + labels: + io.rancher.container.create_agent: 'true' + io.rancher.container.agent_service.scheduling: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' diff --git a/infra-templates/resource-scheduler/7/rancher-compose.yml b/infra-templates/resource-scheduler/7/rancher-compose.yml new file mode 100644 index 000000000..b4dc5bd2c --- /dev/null +++ b/infra-templates/resource-scheduler/7/rancher-compose.yml @@ -0,0 +1,75 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: Resource Scheduler + description: Schedule native workloads from control-plane events and current Metadata state. + version: v0.8.21 + minimum_rancher_version: v1.6.26-rc1 + labels: + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的排程器診斷資訊。' + io.pasturestack.catalog.question.healthcheck_interval.label.zh-tw: '健康檢查間隔' + io.pasturestack.catalog.question.healthcheck_interval.description.zh-tw: '兩次健康檢查之間的毫秒數。' + io.pasturestack.catalog.question.healthcheck_init_timeout.label.zh-tw: '初始化逾時' + io.pasturestack.catalog.question.healthcheck_init_timeout.description.zh-tw: '等待排程器初次就緒的毫秒數上限。' + io.pasturestack.catalog.question.healthcheck_reinit_timeout.label.zh-tw: '重新初始化逾時' + io.pasturestack.catalog.question.healthcheck_reinit_timeout.description.zh-tw: '等待排程器重新初始化的毫秒數上限。' + io.pasturestack.catalog.question.healthcheck_response_timeout.label.zh-tw: '回應逾時' + io.pasturestack.catalog.question.healthcheck_response_timeout.description.zh-tw: '等待單次健康檢查回應的毫秒數上限。' + io.pasturestack.catalog.question.healthcheck_unhealthy_threshold.label.zh-tw: '判定為不健康的失敗次數' + io.pasturestack.catalog.question.healthcheck_unhealthy_threshold.description.zh-tw: '連續失敗達到此次數時，將服務標示為不健康。' + io.pasturestack.catalog.question.healthcheck_healthy_threshold.label.zh-tw: '判定為健康的成功次數' + io.pasturestack.catalog.question.healthcheck_healthy_threshold.description.zh-tw: '連續成功達到此次數時，將服務標示為健康。' + questions: + - variable: PASTURESTACK_DEBUG + label: Enable debug logging + description: Enable verbose scheduler diagnostics. + type: boolean + default: false + required: true + - variable: HEALTHCHECK_INTERVAL + label: Health-check interval + description: Milliseconds between health checks. + type: int + default: 2000 + required: true + - variable: HEALTHCHECK_INIT_TIMEOUT + label: Initialization timeout + description: Milliseconds allowed for initial scheduler readiness. + type: int + default: 10000 + required: true + - variable: HEALTHCHECK_REINIT_TIMEOUT + label: Reinitialization timeout + description: Milliseconds allowed for scheduler reinitialization. + type: int + default: 10000 + required: true + - variable: HEALTHCHECK_RESPONSE_TIMEOUT + label: Response timeout + description: Milliseconds allowed for an individual health-check response. + type: int + default: 30000 + required: true + - variable: HEALTHCHECK_UNHEALTHY_THRESHOLD + label: Unhealthy threshold + description: Consecutive failed checks required to mark the service unhealthy. + type: int + default: 3 + required: true + - variable: HEALTHCHECK_HEALTHY_THRESHOLD + label: Healthy threshold + description: Consecutive successful checks required to mark the service healthy. + type: int + default: 2 + required: true + +resource-scheduler: + health_check: + request_line: GET /healthcheck HTTP/1.0 + port: 80 + interval: ${HEALTHCHECK_INTERVAL} + initializing_timeout: ${HEALTHCHECK_INIT_TIMEOUT} + reinitializing_timeout: ${HEALTHCHECK_REINIT_TIMEOUT} + response_timeout: ${HEALTHCHECK_RESPONSE_TIMEOUT} + unhealthy_threshold: ${HEALTHCHECK_UNHEALTHY_THRESHOLD} + healthy_threshold: ${HEALTHCHECK_HEALTHY_THRESHOLD} diff --git a/infra-templates/resource-scheduler/config.yml b/infra-templates/resource-scheduler/config.yml index 93478eac6..66a023b22 100644 --- a/infra-templates/resource-scheduler/config.yml +++ b/infra-templates/resource-scheduler/config.yml @@ -1,6 +1,6 @@ # SPDX-License-Identifier: MIT name: Resource Scheduler -version: v0.8.20 +version: v0.8.21 category: System description: Schedule native workloads from control-plane events and current Metadata state. projectURL: https://github.com/PastureStack/resource-scheduler diff --git a/infra-templates/secret-volume-driver/4/README.md b/infra-templates/secret-volume-driver/4/README.md new file mode 100644 index 000000000..c098a276a --- /dev/null +++ b/infra-templates/secret-volume-driver/4/README.md @@ -0,0 +1,83 @@ + + +# PastureStack Secret Volume v0.1.4 candidate + +## Source candidate + +This source prepares numeric revision 4 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 3 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1` -> `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.2` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 3 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This infrastructure entry installs one host-local Docker volume driver on +every eligible managed host. The compatible control plane supplies an opaque +authorization token for each approved secret volume. The driver fetches only +the corresponding encrypted records, verifies their signatures, decrypts them +with the host identity key, and exposes read-only files to the target workload +through an isolated in-memory filesystem. + +### Security boundary + +The service uses +`ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1`. The Catalog and user +interface intentionally use the semantic version tag without a manifest +digest. + +The container: + +- drops all Linux capabilities before adding `SYS_ADMIN`, which is needed to + create and remove the isolated `tmpfs`, and `CHOWN`, which is needed to + apply the workload's requested numeric ownership to secret files, plus + `FOWNER`, which is needed to lock the final mode after that ownership + change; +- disables Docker's default AppArmor profile because that generic profile + blocks the required `tmpfs` mount syscall; the container remains + non-privileged, drops every capability except `SYS_ADMIN`, `CHOWN`, and + `FOWNER`, uses `no-new-privileges`, and is constrained by the remaining + controls below; +- uses a read-only root filesystem and a bounded, non-executable temporary + directory; +- does not use privileged mode, host networking, the host PID namespace, or a + container-engine socket; +- reads the host identity key through one read-only bind mount; and +- writes only its Docker plugin socket and the dedicated shared volume root. + +Secret files accept only safe relative paths, bounded UID and GID values, and +read-only modes. Values, tokens, credentials, identity keys, file names, and +encrypted envelopes are excluded from health responses and logs. A volume is +unmounted and erased after its final workload consumer releases it. + +### Workload use + +Create a secret through the compatible control plane, then select it from a +workload's **Secrets** section. The control plane creates the required volume +and supplies the authorization token; operators do not place secret material +in Compose, Catalog answers, or command-line arguments. + +The driver registers as `pasturestack-secret-volume`. Health faults are +reported without automatically recreating the driver container so that active +mounts are not disturbed by a restart loop. + +Source, operating instructions, security details, licensing, and release +evidence are available from the +[PastureStack Secret Volume Driver repository](https://github.com/PastureStack/secrets-flexvolume-plugin). + +PastureStack is an independent community effort to preserve, audit, and +modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by +Rancher Labs or SUSE. diff --git a/infra-templates/secret-volume-driver/4/README.zh-TW.md b/infra-templates/secret-volume-driver/4/README.zh-TW.md new file mode 100644 index 000000000..6edd0dcb4 --- /dev/null +++ b/infra-templates/secret-volume-driver/4/README.zh-TW.md @@ -0,0 +1,60 @@ + + +# PastureStack 機密資料磁碟區 v0.1.4 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 4，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 3。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1` → `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.2` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 3 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此基礎架構範本會在每台符合條件的受管主機上安裝一個主機本機 Docker +磁碟區驅動程式。相容控制平面會為每個已核准的機密資料磁碟區提供不透明 +授權權杖。驅動程式只會取得對應的加密紀錄、驗證簽章、使用主機身分 +金鑰解密，再透過隔離的記憶體檔案系統向目標工作負載提供唯讀檔案。 + +### 安全性界線 + +服務使用 `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1`。 +商店與使用者介面只顯示語意化版本標籤，不顯示映像摘要。 + +容器： + +- 先移除所有 Linux Capability，再加入建立及移除隔離 `tmpfs` 所需 + 的 `SYS_ADMIN`、套用工作負載要求數字擁有者所需的 `CHOWN`，以及 + 變更擁有者後鎖定最終模式所需的 `FOWNER`； +- 停用 Docker 預設 AppArmor 設定檔，因為該通用設定會阻擋必要的 + `tmpfs` 掛載系統呼叫；容器仍不是特權容器、只保留上述三個 + Capability、啟用 `no-new-privileges`，並受下列其他控制限制； +- 使用唯讀根檔案系統與有容量上限、不可執行的暫存目錄； +- 不使用特權模式、主機網路、主機 PID 或容器引擎 Socket； +- 只透過一個唯讀綁定掛載讀取主機身分金鑰；以及 +- 只寫入 Docker 外掛 Socket 與專用共用磁碟區根目錄。 + +機密資料檔案只接受安全的相對路徑、有範圍限制的 UID/GID，以及唯讀 +模式。健康狀態回應與日誌均排除資料值、權杖、登入資訊、身分金鑰、 +檔名及加密封裝。最後一個工作負載使用者釋放磁碟區後，磁碟區會卸載 +並清除。 + +### 工作負載使用方式 + +請先透過相容控制平面建立機密資料，再從工作負載的「機密資料」區段 +選取。控制平面會建立必要磁碟區並提供授權權杖；管理者不需把機密資料 +放入 Compose、商店答案或命令列參數。 + +驅動程式註冊名稱為 `pasturestack-secret-volume`。健康狀態故障不會 +自動重建驅動程式容器，以免重新啟動循環干擾正在使用的掛載。 + +原始碼、操作方式、安全性、授權及發布證據請參閱 +[PastureStack 機密資料磁碟區驅動程式儲存庫](https://github.com/PastureStack/secrets-flexvolume-plugin)。 + +PastureStack 是獨立的社群計畫，目的在保存、稽核與現代化 Rancher +1.6 生態系；本計畫與 Rancher Labs 或 SUSE 無隸屬或背書關係。 diff --git a/infra-templates/secret-volume-driver/4/docker-compose.yml b/infra-templates/secret-volume-driver/4/docker-compose.yml new file mode 100644 index 000000000..199177da3 --- /dev/null +++ b/infra-templates/secret-volume-driver/4/docker-compose.yml @@ -0,0 +1,34 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + secret-volume-driver: + image: ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.2 + cap_drop: + - ALL + cap_add: + - SYS_ADMIN + - CHOWN + - FOWNER + read_only: true + tmpfs: + - /tmp:rw,noexec,nosuid,nodev,size=16m + security_opt: + - 'apparmor:unconfined' + - 'no-new-privileges:true' + labels: + io.pasturestack.component: secret-volume-driver + io.rancher.container.agent.role: environment,agent + io.rancher.container.create_agent: 'true' + io.rancher.scheduler.global: 'true' + volumes: + - /run/docker/plugins:/run/docker/plugins + - /var/lib/pasturestack/volumes:/var/lib/pasturestack/volumes:shared + - /var/lib/rancher/etc/ssl/host.key:/var/lib/pasturestack/etc/ssl/host.key:ro + cpu_shares: 128 + mem_limit: 96m + logging: + driver: json-file + options: + max-size: 10m + max-file: '2' diff --git a/infra-templates/secret-volume-driver/4/rancher-compose.yml b/infra-templates/secret-volume-driver/4/rancher-compose.yml new file mode 100644 index 000000000..67dade8ff --- /dev/null +++ b/infra-templates/secret-volume-driver/4/rancher-compose.yml @@ -0,0 +1,27 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Secret Volume + version: v0.1.4 + description: Deliver approved encrypted secrets to workloads through isolated in-memory volumes. + minimum_rancher_version: v1.6.15-rc1 + +secret-volume-driver: + storage_driver: + name: pasturestack-secret-volume + description: Secure in-memory secret volume driver + scope: local + create_supported: false + volume_access_mode: singleHostRW + volume_capabilities: + - secrets + start_on_create: true + health_check: + request_line: GET /readyz HTTP/1.0 + port: 8093 + interval: 10000 + initializing_timeout: 120000 + reinitializing_timeout: 120000 + response_timeout: 3000 + healthy_threshold: 2 + unhealthy_threshold: 3 + strategy: none diff --git a/infra-templates/secret-volume-driver/config.yml b/infra-templates/secret-volume-driver/config.yml index c29a96f32..51e6f77d3 100644 --- a/infra-templates/secret-volume-driver/config.yml +++ b/infra-templates/secret-volume-driver/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Secret Volume description: Deliver approved encrypted secrets to workloads through isolated in-memory volumes. -version: v0.1.3 +version: v0.1.4 category: Storage maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and bundled dependency licenses apply diff --git a/infra-templates/system-image-preloader/4/README.md b/infra-templates/system-image-preloader/4/README.md new file mode 100644 index 000000000..4a538798d --- /dev/null +++ b/infra-templates/system-image-preloader/4/README.md @@ -0,0 +1,66 @@ + + +# PastureStack System Image Preloader v0.3.3 candidate + +## Source candidate + +This source prepares numeric revision 4 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 3 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/system-image-preloader:v0.3.2` -> `ghcr.io/pasturestack/system-image-preloader:v0.3.3` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 3 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This global, start-once infrastructure service discovers the images used by +compatible system stacks and asks each host Docker daemon to cache images that +are not already present. + +### Reviewed image + +- Image: `ghcr.io/pasturestack/system-image-preloader:v0.3.2` +- Source: [`PastureStack/system-image-preloader@bcd89e7fb6baafea381de380c256e4e8d62f1df2`](https://github.com/PastureStack/system-image-preloader/tree/bcd89e7fb6baafea381de380c256e4e8d62f1df2) +- Source license: Apache-2.0; Ubuntu, Docker CLI, `yq`, `gomplate`, and their + dependencies retain their upstream licenses and notices +- Security gate: full-severity scan, no available fix, no unreviewed finding or secret +- Distribution gate: public GHCR and anonymous version-tag manifest access + passed + +### Security boundary + +The service mounts `/var/run/docker.sock` read-write. Docker socket access is +equivalent to host administrator access, so deploy only the reviewed image and +restrict who can edit this stack. The service receives scoped compatibility API +credentials automatically and never enables credential-bearing shell tracing. + +Private-registry credentials are optional. When enabled, the selected host +Docker `config.json` is mounted read-only. Privileged mode remains off by +default and should be enabled only when required by the host security policy. +Image-pull retries and CPU-pressure waits are bounded. + +The compatible control plane requires the literal `rancher-compose.yml` +filename and `io.rancher.*` agent and scheduling labels in this template. They +are protocol identifiers, not PastureStack branding. + +### Validation + +The release passed offline retry and URL-contract tests, container help and +version smoke tests, OCI metadata and license checks, a full-severity +vulnerability scan, and an isolated end-to-end lifecycle test. The lifecycle +test used mock metadata, environment, and Catalog APIs and verified that the +runtime discovered a Compose image and cached its semantic tag through a real +Docker socket. It removed only its exact test resources and performed no broad +prune. diff --git a/infra-templates/system-image-preloader/4/README.zh-TW.md b/infra-templates/system-image-preloader/4/README.zh-TW.md new file mode 100644 index 000000000..7fac42ce6 --- /dev/null +++ b/infra-templates/system-image-preloader/4/README.zh-TW.md @@ -0,0 +1,54 @@ + + +# PastureStack 系統映像預先下載 v0.3.3 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 4，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 3。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/system-image-preloader:v0.3.2` → `ghcr.io/pasturestack/system-image-preloader:v0.3.3` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 3 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此全域、只執行一次的基礎架構服務會找出相容系統堆疊使用的映像，並 +要求每台主機的 Docker 常駐程式預先快取尚未存在的映像。 + +### 已審核映像 + +- 映像：`ghcr.io/pasturestack/system-image-preloader:v0.3.2` +- 原始碼： + [`PastureStack/system-image-preloader@bcd89e7fb6baafea381de380c256e4e8d62f1df2`](https://github.com/PastureStack/system-image-preloader/tree/bcd89e7fb6baafea381de380c256e4e8d62f1df2) +- 原始碼採 Apache-2.0 授權；Ubuntu、Docker CLI、`yq`、`gomplate` + 及相依套件保留各自的上游授權及聲明。 +- 完整嚴重度掃描沒有可用修補、未審核項目或機密資料；官方尚無修補的 Low/Medium 持續追蹤。 +- 公開 GHCR 與未登入存取版本標籤的驗證已通過。 + +### 安全性界線 + +此服務需要以讀寫方式掛載 `/var/run/docker.sock`。Docker Socket +權限等同主機管理者權限，因此只能部署經審核的映像，並限制可編輯此 +堆疊的使用者。服務會自動取得範圍受限的相容 API 登入資訊，且不會 +啟用可能顯示登入資訊的 Shell 追蹤。 + +私有登錄登入資訊為選用功能。啟用後，選取的主機 Docker +`config.json` 會以唯讀方式掛載。特權模式預設關閉，只能在主機 +安全性政策確實要求時啟用。映像拉取重試與 CPU 使用量等待都有明確 +上限。 + +相容控制平面仍需要名為 `rancher-compose.yml` 的檔案及 +`io.rancher.*` 代理程式與排程標籤。這些是協定識別名稱，不是目前 +的產品品牌。 + +### 驗證 + +此版本已通過離線重試與 URL 契約測試、容器說明及版本煙霧測試、 +OCI 中繼資料與授權檢查、弱點掃描，以及隔離環境端對端生命週期測試。 +生命週期測試使用模擬中繼資料、環境及商店 API，並透過真正的 Docker +Socket 驗證執行環境能找出 Compose 映像及快取其語意化版本標籤。 +測試只移除精確建立的資源，沒有執行大範圍清理。 diff --git a/infra-templates/system-image-preloader/4/docker-compose.yml.tpl b/infra-templates/system-image-preloader/4/docker-compose.yml.tpl new file mode 100644 index 000000000..70541181f --- /dev/null +++ b/infra-templates/system-image-preloader/4/docker-compose.yml.tpl @@ -0,0 +1,34 @@ +# SPDX-License-Identifier: MIT +version: '2' +services: + system-image-preloader: + image: ghcr.io/pasturestack/system-image-preloader:v0.3.3 + {{ if eq .Values.PRIVILEGED "true"}} + privileged: true + {{ end}} + environment: + CHECK_CPU_USAGE: '${CHECK_CPU_USAGE}' + CPU_USAGE_MAX: '${CPU_USAGE_MAX}' + CPU_USAGE_SLEEP: '${CPU_USAGE_SLEEP}' + CPU_WAIT_MAX_ATTEMPTS: '${CPU_WAIT_MAX_ATTEMPTS}' + IMAGE_PULL_MAX_ATTEMPTS: '${IMAGE_PULL_MAX_ATTEMPTS}' + IMAGE_PULL_RETRY_DELAY_SECONDS: '${IMAGE_PULL_RETRY_DELAY_SECONDS}' + PLATFORM_AGENT_IMAGE: '${PLATFORM_AGENT_IMAGE}' + PLATFORM_TLS_VERIFY: '${PLATFORM_TLS_VERIFY}' + PLATFORM_VERSION: '${PLATFORM_VERSION}' + RANDOM_SLEEP: '${RANDOM_SLEEP}' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + {{ if eq .Values.MOUNT_DOCKER_CONFIG "true"}} + - ${DOCKER_CONFIG_LOCATION}:/root/.docker/config.json:ro + {{ end}} + labels: + io.rancher.container.agent.role: environment + io.rancher.container.start_once: 'true' + io.rancher.container.create_agent: 'true' + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' diff --git a/infra-templates/system-image-preloader/4/rancher-compose.yml b/infra-templates/system-image-preloader/4/rancher-compose.yml new file mode 100644 index 000000000..99f48ad08 --- /dev/null +++ b/infra-templates/system-image-preloader/4/rancher-compose.yml @@ -0,0 +1,116 @@ +# SPDX-License-Identifier: MIT +version: '2' +.catalog: + name: PastureStack System Image Preloader + version: v0.3.3 + description: Preload the container images required by compatible infrastructure stacks. + minimum_rancher_version: v1.6.15-rc1 + labels: + io.pasturestack.catalog.question.check_cpu_usage.label.zh-tw: '拉取前檢查 CPU 使用率' + io.pasturestack.catalog.question.check_cpu_usage.description.zh-tw: '主機 CPU 使用率高於設定上限時暫停等待。' + io.pasturestack.catalog.question.cpu_usage_max.label.zh-tw: 'CPU 使用率上限' + io.pasturestack.catalog.question.cpu_usage_max.description.zh-tw: '開始拉取映像前可接受的最高主機 CPU 使用率百分比。' + io.pasturestack.catalog.question.cpu_usage_sleep.label.zh-tw: 'CPU 檢查重試間隔' + io.pasturestack.catalog.question.cpu_usage_sleep.description.zh-tw: '兩次 CPU 使用率檢查之間等待的秒數。' + io.pasturestack.catalog.question.cpu_wait_max_attempts.label.zh-tw: 'CPU 檢查次數上限' + io.pasturestack.catalog.question.cpu_wait_max_attempts.description.zh-tw: '達到此檢查次數仍無法拉取時，以錯誤結束。' + io.pasturestack.catalog.question.image_pull_max_attempts.label.zh-tw: '映像拉取次數上限' + io.pasturestack.catalog.question.image_pull_max_attempts.description.zh-tw: '每個映像拉取失敗達到此次數時，以錯誤結束。' + io.pasturestack.catalog.question.image_pull_retry_delay_seconds.label.zh-tw: '映像拉取重試間隔' + io.pasturestack.catalog.question.image_pull_retry_delay_seconds.description.zh-tw: '映像拉取失敗後等待的秒數。' + io.pasturestack.catalog.question.mount_docker_config.label.zh-tw: '掛載 Docker 用戶端設定' + io.pasturestack.catalog.question.mount_docker_config.description.zh-tw: '從選取的主機檔案讀取私有登錄登入資訊。' + io.pasturestack.catalog.question.docker_config_location.label.zh-tw: 'Docker 用戶端設定路徑' + io.pasturestack.catalog.question.docker_config_location.description.zh-tw: 'Docker 用戶端 config.json 檔案的主機絕對路徑。' + io.pasturestack.catalog.question.privileged.label.zh-tw: '以特權模式執行' + io.pasturestack.catalog.question.privileged.description.zh-tw: '只有主機安全性政策確實要求時才能啟用。' + io.pasturestack.catalog.question.random_sleep.label.zh-tw: '分散各主機的映像拉取時間' + io.pasturestack.catalog.question.random_sleep.description.zh-tw: '依中繼資料為各主機加入不同的隨機延遲。' + io.pasturestack.catalog.question.platform_agent_image.label.zh-tw: '其他代理程式映像' + io.pasturestack.catalog.question.platform_agent_image.description.zh-tw: '基礎架構映像完成後要額外預先下載的選用語意化映像標籤。' + io.pasturestack.catalog.question.platform_version.label.zh-tw: '相容平台版本' + io.pasturestack.catalog.question.platform_version.description.zh-tw: '選取相容商店範本修訂版時使用的平台版本。' + io.pasturestack.catalog.question.platform_tls_verify.label.zh-tw: '驗證平台 TLS 憑證' + io.pasturestack.catalog.question.platform_tls_verify.description.zh-tw: '要求相容 API 使用受信任的 TLS 憑證。' + questions: + - variable: CHECK_CPU_USAGE + label: Check CPU usage before pulling + description: Wait while host CPU usage is above the configured limit. + type: boolean + default: true + required: true + - variable: CPU_USAGE_MAX + label: Maximum CPU usage + description: Highest host CPU usage percentage accepted before a pull. + type: int + default: 75 + required: true + - variable: CPU_USAGE_SLEEP + label: CPU retry delay + description: Seconds to wait between CPU usage checks. + type: int + default: 30 + required: true + - variable: CPU_WAIT_MAX_ATTEMPTS + label: Maximum CPU checks + description: Stop with an error after this many CPU usage checks. + type: int + default: 60 + required: true + - variable: IMAGE_PULL_MAX_ATTEMPTS + label: Maximum image pull attempts + description: Stop with an error after this many failed pulls per image. + type: int + default: 5 + required: true + - variable: IMAGE_PULL_RETRY_DELAY_SECONDS + label: Image pull retry delay + description: Seconds to wait after a failed image pull. + type: int + default: 10 + required: true + - variable: MOUNT_DOCKER_CONFIG + label: Mount a Docker client configuration + description: Read private-registry credentials from the selected host file. + type: boolean + default: false + required: true + - variable: DOCKER_CONFIG_LOCATION + label: Docker client configuration path + description: Absolute host path of the Docker client config.json file. + type: string + default: /root/.docker/config.json + required: true + - variable: PRIVILEGED + label: Run in privileged mode + description: Enable only when the host security policy requires it. + type: boolean + default: false + required: true + - variable: RANDOM_SLEEP + label: Stagger image pulls between hosts + description: Add a metadata-derived random delay between image pulls. + type: boolean + default: false + required: true + - variable: PLATFORM_AGENT_IMAGE + label: Additional agent image + description: Optional semantic image tag to preload after infrastructure images. + type: string + default: '' + required: false + - variable: PLATFORM_VERSION + label: Compatible platform version + description: Version used when selecting compatible Catalog template revisions. + type: string + default: v1.6.282 + required: true + - variable: PLATFORM_TLS_VERIFY + label: Verify platform TLS certificates + description: Require a trusted certificate for compatibility API requests. + type: boolean + default: false + required: true + +system-image-preloader: + start_on_create: true diff --git a/infra-templates/system-image-preloader/config.yml b/infra-templates/system-image-preloader/config.yml index 0f7bea940..40a4d78cb 100644 --- a/infra-templates/system-image-preloader/config.yml +++ b/infra-templates/system-image-preloader/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: System Image Preloader description: Preload the container images required by compatible infrastructure stacks. -version: v0.3.2 +version: v0.3.3 category: System maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and bundled dependency licenses apply diff --git a/infra-templates/vault-volume-driver/5/README.md b/infra-templates/vault-volume-driver/5/README.md new file mode 100644 index 000000000..cea068019 --- /dev/null +++ b/infra-templates/vault-volume-driver/5/README.md @@ -0,0 +1,103 @@ + + +# PastureStack Vault Volume v0.2.3 candidate + +## Source candidate + +This source prepares numeric revision 5 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 4 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/vault-secrets-bridge:v0.1.2` -> `ghcr.io/pasturestack/vault-secrets-bridge:v0.1.3` +- `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1` -> `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.2` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 4 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This infrastructure entry installs one unprivileged environment bridge and one +host-local Docker volume driver on every eligible managed host. A workload +requests an allowed policy set; the driver signs the request with the host +identity key, and the bridge verifies the active host before asking Vault for a +short-lived, response-wrapped child token. + +The bridge is configured with an existing platform Secret containing one +renewable, narrowly scoped issuing token. The Secret is mounted read-only and +read from a file. It is not placed in Compose environment values, command-line +arguments, health responses, or logs. + +### Vault preparation + +Create a token role whose allowed policies are limited to the applications in +this environment. Create a renewable issuing token that can create child tokens +through that role and revoke their accessors, store the token as a platform +Secret, and select that Secret while installing this card. Keep the child-token +and response-wrapping lifetimes short. + +The Catalog allowlist is an additional boundary: a workload request must be a +subset of the comma-separated policies entered during installation. + +### Workload use + +```yaml +version: '2' +services: + application: + image: example/application:v1.0.0 + volumes: + - vault-token:/run/vault:ro + +volumes: + vault-token: + driver: pasturestack-vault-volume + driver_opts: + io.pasturestack.vault.policies: default,application + io.pasturestack.vault.file: token + io.pasturestack.vault.uid: '1000' + io.pasturestack.vault.gid: '1000' + io.pasturestack.vault.mode: '0400' + per_container: true +``` + +The file contains a response-wrapping token, not the issuing token or an +unwrapped child token. The application unwraps it once through the Vault API. +After the final workload consumer releases the volume, the driver asks the +bridge to revoke the child-token accessor and erases the memory-backed volume. + +### Security boundary + +The bridge uses +`ghcr.io/pasturestack/vault-secrets-bridge:v0.1.2`. It runs as UID 65532, +drops all Linux capabilities, uses a read-only root filesystem, and persists +only an encrypted accessor record in its dedicated state volume. + +The driver uses +`ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1`. It drops all +capabilities before adding only `SYS_ADMIN`, `CHOWN`, and `FOWNER` for the +isolated `tmpfs` lifecycle and requested read-only ownership. It does not use +privileged mode, host networking, the host PID namespace, or a +container-engine socket. + +Both images are public and use semantic version tags in Catalog and user +interfaces. Manifest digests remain release-verification evidence and are not +shown as deployment coordinates. + +Source, security details, licensing, and release evidence are available from +the [Vault Secrets Bridge](https://github.com/PastureStack/vault-secrets-bridge) +and [Secret Volume Driver](https://github.com/PastureStack/secrets-flexvolume-plugin) +repositories. + +PastureStack is an independent community effort to preserve, audit, and +modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by +Rancher Labs or SUSE. diff --git a/infra-templates/vault-volume-driver/5/README.zh-TW.md b/infra-templates/vault-volume-driver/5/README.zh-TW.md new file mode 100644 index 000000000..54402625e --- /dev/null +++ b/infra-templates/vault-volume-driver/5/README.zh-TW.md @@ -0,0 +1,87 @@ + + +# PastureStack Vault 存取權杖磁碟區 v0.2.3 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 5，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 4。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/vault-secrets-bridge:v0.1.2` → `ghcr.io/pasturestack/vault-secrets-bridge:v0.1.3` +- `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1` → `ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.2` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 4 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此基礎架構項目會安裝一個非特權的環境橋接服務，並在每台符合條件的受管 +主機安裝一個主機本機 Docker 磁碟區驅動程式。工作負載提出允許的存取 +政策集合後，驅動程式會以主機身分金鑰簽署要求；橋接服務先確認主機仍為 +作用中，再向 Vault 申請短效且經回應封裝的子權杖。 + +橋接服務使用既有的平台機密資料，其中包含一個可續期且權限範圍最小化的 +發行用權杖。該機密資料以唯讀方式掛載，並由檔案讀取；不會寫入 Compose +環境值、命令列參數、健康狀態回應或日誌。 + +### Vault 事前準備 + +建立一個權杖角色，將其允許的存取政策限制在本環境內的應用程式。接著 +建立一個可續期的發行用權杖；該權杖只能透過此角色建立子權杖及撤銷其 +Accessor。請將權杖存入平台機密資料，並在安裝本卡片時選取該機密資料。 +子權杖與回應封裝的存留時間均應保持精簡。 + +商店允許清單是額外的安全界線：工作負載提出的政策必須是安裝時所填半形 +逗號分隔政策的子集合。 + +### 工作負載使用方式 + +```yaml +version: '2' +services: + application: + image: example/application:v1.0.0 + volumes: + - vault-token:/run/vault:ro + +volumes: + vault-token: + driver: pasturestack-vault-volume + driver_opts: + io.pasturestack.vault.policies: default,application + io.pasturestack.vault.file: token + io.pasturestack.vault.uid: '1000' + io.pasturestack.vault.gid: '1000' + io.pasturestack.vault.mode: '0400' + per_container: true +``` + +檔案內存放的是回應封裝權杖，不是發行用權杖或已解封裝的子權杖。應用程式 +透過 Vault API 解封裝一次即可使用。最後一個工作負載使用者釋放磁碟區後， +驅動程式會要求橋接服務撤銷子權杖 Accessor，並清除記憶體磁碟區。 + +### 安全界線 + +橋接服務使用 +`ghcr.io/pasturestack/vault-secrets-bridge:v0.1.2`。程序以 UID 65532 +執行、移除全部 Linux capabilities、使用唯讀根檔案系統，且只在專用狀態 +磁碟區保存加密後的 Accessor 紀錄。 + +驅動程式使用 +`ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1`。程序先移除全部 +capabilities，再僅加入隔離 `tmpfs` 生命週期及指定唯讀擁有權所需的 +`SYS_ADMIN`、`CHOWN` 與 `FOWNER`。它不使用特權模式、主機網路、主機 +PID 命名空間或容器引擎 Socket。 + +兩個映像皆可公開取得；商店與使用者介面只顯示語意版本標籤。映像資訊摘要 +僅保留於發行驗證證據，不會顯示為部署座標。 + +原始碼、安全性說明、授權與發行證據請參閱 +[Vault 機密資料橋接服務](https://github.com/PastureStack/vault-secrets-bridge) +及 +[機密資料磁碟區驅動程式](https://github.com/PastureStack/secrets-flexvolume-plugin)。 + +PastureStack 是獨立的社群計畫，目的在保存、稽核與現代化 Rancher +1.6 生態系；本計畫與 Rancher Labs 或 SUSE 無隸屬或背書關係。 diff --git a/infra-templates/vault-volume-driver/5/docker-compose.yml b/infra-templates/vault-volume-driver/5/docker-compose.yml new file mode 100644 index 000000000..cabc980a6 --- /dev/null +++ b/infra-templates/vault-volume-driver/5/docker-compose.yml @@ -0,0 +1,81 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + vault-secrets-bridge: + image: ghcr.io/pasturestack/vault-secrets-bridge:v0.1.3 + read_only: true + cap_drop: + - ALL + tmpfs: + - /tmp:rw,noexec,nosuid,nodev,size=16m + security_opt: + - 'no-new-privileges:true' + environment: + VAULT_ADDR: '${VAULT_URL}' + VAULT_ROLE: '${VAULT_ROLE}' + PASTURESTACK_VAULT_ALLOWED_POLICIES: '${VAULT_ALLOWED_POLICIES}' + PASTURESTACK_VAULT_ISSUER_TOKEN_FILE: '/run/secrets/{{.Values.ISSUING_TOKEN_SECRET}}' + secrets: + - "{{.Values.ISSUING_TOKEN_SECRET}}" + volumes: + - vault-secrets-bridge-state:/var/lib/pasturestack/vault-secrets-bridge + labels: + io.pasturestack.component: vault-secrets-bridge + io.rancher.container.agent.role: environment + io.rancher.container.create_agent: 'true' + io.rancher.container.dns: 'true' + cpu_shares: 128 + mem_limit: 64m + logging: + driver: json-file + options: + max-size: 10m + max-file: '2' + + vault-volume-driver: + image: ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.2 + environment: + PASTURESTACK_SECRET_PROVIDER: vault + PASTURESTACK_SECRET_DRIVER_NAME: pasturestack-vault-volume + PASTURESTACK_SECRET_SOCKET: /run/docker/plugins/pasturestack-vault-volume.sock + PASTURESTACK_SECRET_VOLUME_ROOT: /var/lib/pasturestack/volumes/vault-volume + PASTURESTACK_SECRET_HEALTH_LISTEN: 0.0.0.0:8094 + PASTURESTACK_VAULT_BRIDGE_URL: http://vault-secrets-bridge:8080 + cap_drop: + - ALL + cap_add: + - SYS_ADMIN + - CHOWN + - FOWNER + read_only: true + tmpfs: + - /tmp:rw,noexec,nosuid,nodev,size=16m + security_opt: + - 'apparmor:unconfined' + - 'no-new-privileges:true' + links: + - vault-secrets-bridge:vault-secrets-bridge + labels: + io.pasturestack.component: vault-volume-driver + io.rancher.scheduler.global: 'true' + io.rancher.container.dns: 'true' + volumes: + - /run/docker/plugins:/run/docker/plugins + - /var/lib/pasturestack/volumes:/var/lib/pasturestack/volumes:shared + - /var/lib/rancher/etc/ssl/host.key:/var/lib/pasturestack/etc/ssl/host.key:ro + cpu_shares: 128 + mem_limit: 96m + logging: + driver: json-file + options: + max-size: 10m + max-file: '2' + +volumes: + vault-secrets-bridge-state: + driver: local + +secrets: + "{{.Values.ISSUING_TOKEN_SECRET}}": + external: true diff --git a/infra-templates/vault-volume-driver/5/rancher-compose.yml b/infra-templates/vault-volume-driver/5/rancher-compose.yml new file mode 100644 index 000000000..f0f38dda1 --- /dev/null +++ b/infra-templates/vault-volume-driver/5/rancher-compose.yml @@ -0,0 +1,69 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Vault Volume + version: v0.2.3 + description: Deliver response-wrapped, short-lived Vault tokens through host-authenticated read-only volumes. + minimum_rancher_version: v1.6.15-rc1 + labels: + io.pasturestack.catalog.question.vault_url.label.zh-tw: 'Vault API 網址' + io.pasturestack.catalog.question.vault_url.description.zh-tw: 'Vault API 的 HTTPS 基底網址；隔離網路亦可使用內部 HTTP 端點。' + io.pasturestack.catalog.question.vault_role.label.zh-tw: 'Vault 權杖角色' + io.pasturestack.catalog.question.vault_role.description.zh-tw: '發行用權杖透過此角色建立短效子權杖。' + io.pasturestack.catalog.question.vault_allowed_policies.label.zh-tw: '允許的 Vault 存取政策' + io.pasturestack.catalog.question.vault_allowed_policies.description.zh-tw: '工作負載磁碟區可要求的存取政策允許清單，以半形逗號分隔。' + io.pasturestack.catalog.question.issuing_token_secret.label.zh-tw: 'Vault 發行用權杖機密資料' + io.pasturestack.catalog.question.issuing_token_secret.description.zh-tw: '既有平台機密資料，內容為可續期且權限範圍最小化的 Vault 發行用權杖。' + questions: + - variable: VAULT_URL + label: Vault API URL + description: HTTPS Vault API base URL, or a private HTTP endpoint for an isolated network. + type: string + required: true + - variable: VAULT_ROLE + label: Vault token role + description: Token role used by the issuing token to create short-lived child tokens. + type: string + required: true + - variable: VAULT_ALLOWED_POLICIES + label: Allowed Vault policies + description: Comma-separated allowlist of policies that workload volumes may request. + type: string + default: default + required: true + - variable: ISSUING_TOKEN_SECRET + label: Vault issuing-token Secret + description: Existing platform Secret containing one renewable, narrowly scoped Vault issuing token. + type: secret + required: true + +vault-secrets-bridge: + scale: 1 + start_on_create: true + health_check: + request_line: GET /readyz HTTP/1.0 + port: 8080 + interval: 10000 + initializing_timeout: 120000 + reinitializing_timeout: 120000 + response_timeout: 3000 + healthy_threshold: 2 + unhealthy_threshold: 3 + strategy: none + +vault-volume-driver: + storage_driver: + name: pasturestack-vault-volume + description: Host-authenticated, response-wrapped Vault token volumes + scope: local + volume_access_mode: singleHostRW + start_on_create: true + health_check: + request_line: GET /readyz HTTP/1.0 + port: 8094 + interval: 10000 + initializing_timeout: 120000 + reinitializing_timeout: 120000 + response_timeout: 3000 + healthy_threshold: 2 + unhealthy_threshold: 3 + strategy: none diff --git a/infra-templates/vault-volume-driver/config.yml b/infra-templates/vault-volume-driver/config.yml index f7f882982..e379ff9a0 100644 --- a/infra-templates/vault-volume-driver/config.yml +++ b/infra-templates/vault-volume-driver/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Vault Volume description: Deliver response-wrapped, short-lived Vault tokens through host-authenticated read-only volumes. -version: v0.2.2 +version: v0.2.3 category: Storage maintainer: PastureStack contributors license: MIT template; Apache-2.0 images and bundled dependency licenses apply diff --git a/infra-templates/vxlan-overlay-network/7/README.md b/infra-templates/vxlan-overlay-network/7/README.md new file mode 100644 index 000000000..4434eab3e --- /dev/null +++ b/infra-templates/vxlan-overlay-network/7/README.md @@ -0,0 +1,67 @@ + + +# PastureStack VXLAN Overlay Network v0.3.5 candidate + +## Source candidate + +This source prepares numeric revision 7 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 6 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` -> `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 6 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This optional infrastructure template installs an unencrypted VXLAN data +plane across managed hosts. It publishes UDP port `4789`, runs one router +sidecar per network holder, and installs the reviewed CNI executables on each +eligible host. + +### Reviewed image + +- Image: `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` +- Template version `5` explicitly declares `allowSharedSubnetIngress: true` for the fixed `10.42.0.0/16` CNI network. Network Plugin Manager `v0.8.20` uses this bounded contract for cross-host workload forwarding; version `4` remains available for existing stacks. +- Source: [`PastureStack/ipsec-vxlan-overlay-network@4711833178a05e5d225e364cce856bd108bdc707`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/4711833178a05e5d225e364cce856bd108bdc707) +- Source license: Apache-2.0; Ubuntu, CNI, Weave, and bundled dependencies retain their upstream licenses and notices +- Security gate: Trivy HIGH 0, CRITICAL 0, image secrets 0, and personal-marker scan passed +- Runtime gate: the earlier version passed isolated two-node VXLAN forwarding; repeat the managed lifecycle gate for this new image before treating it as production-ready + +### Security and network boundary + +VXLAN encapsulates traffic but does not encrypt or authenticate it. Use this +driver only on a trusted host network. Every participating host must allow +inbound and outbound UDP port `4789`. Select the IPsec template when encrypted +host-to-host traffic is required. + +The router receives `NET_ADMIN` in the network-holder namespace. The CNI +sidecar is privileged, joins the host network and PID namespaces, and accesses +the Docker socket so it can install and operate the compatibility CNI path. +These permissions must not be copied to ordinary workloads. + +The managed network is `10.42.0.0/16`. This release intentionally does not +expose a subnet selector because the reviewed startup path does not safely +honor arbitrary subnets. Network Plugin Manager alone consumes the explicit +shared-subnet ingress contract and owns the corresponding host forwarding +rule; the VXLAN router remains confined to its data-plane namespace. + +### Compatibility boundary + +The literal `rancher-compose.yml` filename, `minimum_rancher_version` key, +required `io.rancher.*` orchestration labels, and `rancher-cni-driver` shared +volume are consumed by the compatible control plane. They are protocol +identifiers, not PastureStack branding. User-facing names, image coordinates, +environment variables, CNI names, log paths, and the `pasture.internal` search +suffix use current PastureStack identifiers. diff --git a/infra-templates/vxlan-overlay-network/7/README.zh-TW.md b/infra-templates/vxlan-overlay-network/7/README.zh-TW.md new file mode 100644 index 000000000..06599d06d --- /dev/null +++ b/infra-templates/vxlan-overlay-network/7/README.zh-TW.md @@ -0,0 +1,58 @@ + + +# PastureStack VXLAN 覆疊網路 v0.3.5 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 7，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 6。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` → `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 6 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此選用基礎架構範本會在受管主機間安裝未加密的 VXLAN 資料平面。 +範本會公開 UDP `4789`、為每個網路持有服務執行一個路由相關容器， +並在每台符合條件的主機上安裝經審核的 CNI 執行檔。 + +### 已審核映像 + +- 映像：`ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40` +- 第 `5` 版為固定的 `10.42.0.0/16` CNI 網路明確設定 + `allowSharedSubnetIngress: true`。網路外掛管理器 `v0.8.20` 依此有限 + 契約處理跨主機工作負載轉送；第 `4` 版仍供既有堆疊使用。 +- 原始碼： + [`PastureStack/ipsec-vxlan-overlay-network@4711833178a05e5d225e364cce856bd108bdc707`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/4711833178a05e5d225e364cce856bd108bdc707) +- 原始碼採 Apache-2.0 授權；Ubuntu、CNI、Weave 及隨附相依套件 + 保留各自的上游授權及聲明。 +- Trivy 結果為 HIGH 0、CRITICAL 0，映像機密資料與個人識別標記 + 掃描均已通過。 +- 舊版已通過隔離雙節點 VXLAN 轉送；此新版映像仍須重新完成受管生命週期驗收，才能宣稱適合正式環境。 + +### 安全性與網路界線 + +VXLAN 只封裝流量，不提供加密或身分驗證。此驅動程式只能用於受信任 +的主機網路，每台參與主機都必須允許 UDP `4789` 的輸入及輸出流量。 +需要主機間加密時，請改用 IPsec 加密網路範本。 + +路由器在網路持有服務的命名空間中使用 `NET_ADMIN`。CNI 相關容器 +使用特權模式、加入主機網路與 PID 命名空間，並存取 Docker Socket +以安裝及操作相容 CNI 路徑。這些權限不得套用到一般工作負載。 + +受管網路為 `10.42.0.0/16`。經審核的啟動流程無法安全套用任意 +子網路，因此此版本不提供無效的子網路選項。只有網路外掛管理器會 +處理明確的共用子網路輸入契約及相對應的主機轉送規則；VXLAN 路由器 +仍只在自己的資料平面命名空間內運作。 + +### 相容性界線 + +`rancher-compose.yml`、`minimum_rancher_version`、必要的 +`io.rancher.*` 編排標籤及 `rancher-cni-driver` 共用磁碟區是相容 +控制平面使用的協定識別名稱，不是目前的產品品牌。使用者可見名稱、 +映像位置、環境變數、CNI 名稱、日誌路徑及 `pasture.internal` +搜尋後綴均採 PastureStack 名稱。 diff --git a/infra-templates/vxlan-overlay-network/7/docker-compose.yml.tpl b/infra-templates/vxlan-overlay-network/7/docker-compose.yml.tpl new file mode 100644 index 000000000..c7b45d8ad --- /dev/null +++ b/infra-templates/vxlan-overlay-network/7/docker-compose.yml.tpl @@ -0,0 +1,97 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + vxlan-network: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + command: + - /bin/bash + - -c + - 'mkfifo /tmp/overlay-log; exec cat /tmp/overlay-log' + network_mode: vxlan + ports: + - 4789:4789/udp + labels: + io.pasturestack.component: vxlan-overlay + io.rancher.sidekicks: vxlan-router + io.rancher.scheduler.global: 'true' + io.rancher.cni.link_mtu_overhead: '0' + io.rancher.internal.service.vxlan: 'true' + io.rancher.service.selector.link: io.rancher.internal.service.vxlan=true + io.rancher.network.macsync: 'true' + io.rancher.network.arpsync: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + + vxlan-router: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + command: start-vxlan.sh + cap_add: + - NET_ADMIN + network_mode: container:vxlan-network + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + sysctls: + net.ipv4.conf.all.send_redirects: '0' + net.ipv4.conf.default.send_redirects: '0' + + cni-driver: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41 + command: start-cni-driver.sh + privileged: true + network_mode: host + pid: host + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + labels: + io.pasturestack.component: vxlan-overlay-cni + io.rancher.scheduler.global: 'true' + io.rancher.network.cni.binary: pasture-bridge + io.rancher.container.dns: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - rancher-cni-driver:/opt/cni-driver + network_driver: + name: PastureStack VXLAN Overlay Network + default_network: + name: vxlan + host_ports: {{ .Values.HOST_PORTS }} + subnets: + - network_address: 10.42.0.0/16 + dns: + - 169.254.169.250 + dns_search: + - pasture.internal + cni_config: + '10-pasturestack-vxlan.conf': + name: pasturestack-cni-network + type: pasture-bridge + bridge: $DOCKER_BRIDGE + bridgeSubnet: 10.42.0.0/16 + allowSharedSubnetIngress: true + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + isDefaultGateway: true + hostNat: true + hairpinMode: {{ .Values.PASTURESTACK_HAIRPIN_MODE }} + promiscMode: {{ .Values.PASTURESTACK_PROMISCUOUS_MODE }} + mtu: ${MTU} + linkMTUOverhead: 50 + ipam: + type: metadata-cni-ipam + subnetPrefixSize: /16 + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' diff --git a/infra-templates/vxlan-overlay-network/7/rancher-compose.yml b/infra-templates/vxlan-overlay-network/7/rancher-compose.yml new file mode 100644 index 000000000..c0029cdec --- /dev/null +++ b/infra-templates/vxlan-overlay-network/7/rancher-compose.yml @@ -0,0 +1,56 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack VXLAN Overlay Network + version: v0.3.5 + description: Provide an unencrypted UDP VXLAN network across managed hosts. + minimum_rancher_version: v1.6.11-rc1 + labels: + io.pasturestack.catalog.question.docker_bridge.label.zh-tw: 'Docker 網橋' + io.pasturestack.catalog.question.docker_bridge.description.zh-tw: '受管工作負載流量使用的主機網橋。' + io.pasturestack.catalog.question.mtu.label.zh-tw: '網路 MTU' + io.pasturestack.catalog.question.mtu.description.zh-tw: '請與主機網路 MTU 一致；GCE 常用 1460，一般乙太網路常用 1500。' + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的 VXLAN 元件診斷資訊。' + io.pasturestack.catalog.question.host_ports.label.zh-tw: '啟用主機連接埠' + io.pasturestack.catalog.question.host_ports.description.zh-tw: '允許受管工作負載在主機上公開連接埠。' + io.pasturestack.catalog.question.pasturestack_hairpin_mode.label.zh-tw: '啟用 Hairpin 模式' + io.pasturestack.catalog.question.pasturestack_hairpin_mode.description.zh-tw: 'Hairpin 模式與混雜模式不可同時啟用。' + io.pasturestack.catalog.question.pasturestack_promiscuous_mode.label.zh-tw: '啟用混雜模式' + io.pasturestack.catalog.question.pasturestack_promiscuous_mode.description.zh-tw: '混雜模式與 Hairpin 模式不可同時啟用。' + questions: + - variable: DOCKER_BRIDGE + label: Docker bridge + description: Host bridge used for managed workload traffic. + type: string + default: docker0 + required: true + - variable: MTU + label: Network MTU + description: Match the host network MTU; common values are 1460 for GCE and 1500 for Ethernet. + type: int + default: 1500 + required: true + - variable: PASTURESTACK_DEBUG + label: Enable debug logs + description: Enable verbose diagnostic logging for the VXLAN components. + type: boolean + default: 'false' + required: true + - variable: HOST_PORTS + label: Enable host ports + description: Allow managed workloads to publish ports on their hosts. + type: boolean + default: 'true' + required: true + - variable: PASTURESTACK_HAIRPIN_MODE + label: Enable hairpin mode + description: Hairpin mode and promiscuous mode must not both be enabled. + type: boolean + default: 'false' + required: true + - variable: PASTURESTACK_PROMISCUOUS_MODE + label: Enable promiscuous mode + description: Promiscuous mode and hairpin mode must not both be enabled. + type: boolean + default: 'true' + required: true diff --git a/infra-templates/vxlan-overlay-network/config.yml b/infra-templates/vxlan-overlay-network/config.yml index 29f9253ef..2020e89ff 100644 --- a/infra-templates/vxlan-overlay-network/config.yml +++ b/infra-templates/vxlan-overlay-network/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: VXLAN Overlay Network description: Provide an unencrypted UDP VXLAN network across managed hosts. -version: v0.3.4 +version: v0.3.5 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and third-party package licenses apply diff --git a/infra-templates/windows-container-networking/4/README.md b/infra-templates/windows-container-networking/4/README.md new file mode 100644 index 000000000..34e312f02 --- /dev/null +++ b/infra-templates/windows-container-networking/4/README.md @@ -0,0 +1,54 @@ + + +# PastureStack Windows Container Networking v0.1.2 candidate + +## Source candidate + +This source prepares numeric revision 4 only. It is not published or +deployed. Catalog v0.3.16 and numeric revision 3 remain the published +installation coordinates. New component digests, producer identities, SBOMs +and scan receipts are pending. The candidate cannot pass the publication- +evidence gate yet; no new component acceptance is claimed. + +Planned image replacements (published input -> unpublished candidate): + +- `ghcr.io/pasturestack/pod-pause-image:v3.0.5` -> `ghcr.io/pasturestack/pod-pause-image:v3.0.6` + +The runtime definitions preserve the prior revision byte-for-byte except for +these image tags and the visible Catalog version. Commands, defaults, resource +parameters, permissions, sidekicks, volumes, firewall choices and plugin +responsibilities retain their existing contracts. Obtain real publication +evidence before promoting this source candidate. + +## Published revision 3 reference + +The following guidance and validation statements describe the previous +published inputs only. Their evidence does not validate the candidate images. + +This infrastructure entry defines the `nat` and `transparent` Docker network +drivers consumed by compatible Windows container workloads. Install it before +PastureStack Windows Network Services. + +PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE. + +### Compatibility boundary + +The Compose services are selector-only resources; the referenced pause image +is required by the legacy service schema but is not launched as a Windows +workload. The `io.rancher.service.selector.container` key and its historical +selector value are retained solely as control-protocol identifiers for +existing Windows agents. They are not user-facing branding and must be removed +only together with a replacement Windows agent contract. + +### Validation status + +The template parses through the reviewed Catalog Service and is restricted to +the Windows orchestration mode. No Windows host was available for an +end-to-end network-driver gate, so this entry remains a release candidate. + +### License and provenance + +The template files are MIT-licensed PastureStack contributions. The +selector-only placeholder image and bundled dependencies retain their +respective licenses and notices. The preserved Git history retains the +upstream Windows template provenance and authorship. diff --git a/infra-templates/windows-container-networking/4/README.zh-TW.md b/infra-templates/windows-container-networking/4/README.zh-TW.md new file mode 100644 index 000000000..2c0154fd7 --- /dev/null +++ b/infra-templates/windows-container-networking/4/README.zh-TW.md @@ -0,0 +1,30 @@ + + +# PastureStack Windows 容器網路 v0.1.2 候選版 + +## 目前來源候選 + +本來源只準備數字修訂 4，尚未發布或部署。目前已發布的安裝座標仍是 Catalog v0.3.16 與數字修訂 3。新元件的 digest、producer、SBOM 與掃描收據尚待提供，因此不宣稱新成品已通過驗收；目前仍會被 image 發布證據 gate 阻擋。 + +預計替換的映像（已發布輸入 → 尚未發布候選）： + +- `ghcr.io/pasturestack/pod-pause-image:v3.0.5` → `ghcr.io/pasturestack/pod-pause-image:v3.0.6` + +除了這些映像 tag 與 Catalog 顯示版號，runtime 定義逐位元組保留原修訂。命令、預設值、資源參數、權限、附屬容器、磁碟區、防火牆選項與 plugin 職責都沿用既有契約。取得真實發布證據後才能提升本來源候選。 + +## 已發布修訂 3 的參考說明 + +以下相容性說明與驗證陳述只對應先前已發布的輸入，不能作為新候選映像的驗收證據。 + +此基礎架構項目會定義相容 Windows 容器工作負載使用的 `nat` 與 `transparent` +Docker 網路驅動程式。請在 PastureStack Windows 網路服務之前安裝。 + +PastureStack 是獨立的社群計畫，目的在保存、稽核與現代化 Rancher 1.6 +生態系；本計畫與 Rancher Labs 或 SUSE 無隸屬或背書關係。 + +Compose 服務只用來選取既有 Windows 代理程式；相容服務結構雖然要求提供映像， +但不會將該映像當成 Windows 工作負載啟動。歷史選取值僅屬控制協定識別值， +不能在尚未同步更換 Windows 代理程式契約前單獨移除。 + +此範本已通過 Catalog Service 解析，並限制於 Windows 協調模式。由於目前沒有 +Windows 主機完成網路驅動程式的端對端驗證，此項目仍屬候選版本。 diff --git a/infra-templates/windows-container-networking/4/docker-compose.yml b/infra-templates/windows-container-networking/4/docker-compose.yml new file mode 100644 index 000000000..0a0ec9c06 --- /dev/null +++ b/infra-templates/windows-container-networking/4/docker-compose.yml @@ -0,0 +1,13 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + windows-nat-network: + image: ghcr.io/pasturestack/pod-pause-image:v3.0.6 + labels: + io.rancher.service.selector.container: experimental-windows-rancher + + windows-transparent-network: + image: ghcr.io/pasturestack/pod-pause-image:v3.0.6 + labels: + io.rancher.service.selector.container: experimental-windows-rancher diff --git a/infra-templates/windows-container-networking/4/rancher-compose.yml b/infra-templates/windows-container-networking/4/rancher-compose.yml new file mode 100644 index 000000000..d70fea2ff --- /dev/null +++ b/infra-templates/windows-container-networking/4/rancher-compose.yml @@ -0,0 +1,34 @@ +# SPDX-License-Identifier: MIT +version: '2' +.catalog: + name: PastureStack Windows Container Networking + version: v0.1.2 + description: Define NAT and transparent Docker network drivers for compatible Windows container hosts. + minimum_rancher_version: v1.6.15-rc1 + labels: + io.pasturestack.catalog.name.zh-tw: 'PastureStack Windows 容器網路' + io.pasturestack.catalog.description.zh-tw: '為相容的 Windows 容器主機定義 NAT 與透明 Docker 網路驅動程式。' + io.pasturestack.catalog.question.transparent_network_driver_name.label.zh-tw: '透明網路驅動程式名稱' + io.pasturestack.catalog.question.transparent_network_driver_name.description.zh-tw: 'Windows 主機上已設定的透明網路驅動程式名稱。' + questions: + - variable: TRANSPARENT_NETWORK_DRIVER_NAME + label: Transparent network driver name + description: Existing transparent network driver name configured on the Windows host. + type: string + required: true + default: transparent + +services: + windows-nat-network: + network_driver: + name: PastureStack Windows NAT Network + default_network: + name: nat + kind: nat + + windows-transparent-network: + network_driver: + name: PastureStack Windows Transparent Network + default_network: + name: transparent + kind: $TRANSPARENT_NETWORK_DRIVER_NAME diff --git a/infra-templates/windows-container-networking/config.yml b/infra-templates/windows-container-networking/config.yml index f5baa935b..e98cabd9e 100644 --- a/infra-templates/windows-container-networking/config.yml +++ b/infra-templates/windows-container-networking/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Windows Container Networking description: Define NAT and transparent Docker network drivers for compatible Windows container hosts. -version: v0.1.1 +version: v0.1.2 category: Networking maintainer: PastureStack contributors license: MIT template; selector-only placeholder image retains its Apache-2.0 and bundled dependency licenses diff --git a/integration/core/test_catalog.py b/integration/core/test_catalog.py index c0ac4eb47..0d68662fe 100644 --- a/integration/core/test_catalog.py +++ b/integration/core/test_catalog.py @@ -183,10 +183,10 @@ def test_catalog_list(): assert by_folder[('infra', 'container-schedule')][ 'name'] == 'Container Schedule' assert by_folder[('infra', 'container-schedule')][ - 'defaultVersion'] == 'v0.6.1' + 'defaultVersion'] == 'v0.6.2' assert by_folder[('infra', 'container-schedule')][ 'links']['defaultVersion'].endswith( - ':3') + ':4') assert by_folder[('infra', 'ecr-credential-sync')][ 'name'] == 'Amazon ECR Credential Sync' assert by_folder[('infra', 'ecr-credential-sync')][ @@ -197,24 +197,24 @@ def test_catalog_list(): assert by_folder[('infra', 'healthcheck')][ 'name'] == 'Metadata Healthcheck' assert by_folder[('infra', 'healthcheck')][ - 'defaultVersion'] == 'v0.3.17' + 'defaultVersion'] == 'v0.3.18' assert by_folder[('infra', 'healthcheck')][ 'links']['defaultVersion'].endswith( - ':2') + ':3') assert by_folder[('infra', 'ipsec-overlay')]['name'] == ( 'IPsec Overlay') assert by_folder[('infra', 'ipsec-overlay')][ - 'defaultVersion'] == 'v0.3.11' + 'defaultVersion'] == 'v0.3.12' assert by_folder[('infra', 'ipsec-overlay')][ 'links']['defaultVersion'].endswith( - ':13') + ':14') assert by_folder[('infra', 'layer-2-flat-network')]['name'] == ( 'Layer 2 Flat Network') assert by_folder[('infra', 'layer-2-flat-network')][ - 'defaultVersion'] == 'v0.3.5' + 'defaultVersion'] == 'v0.3.6' assert by_folder[('infra', 'layer-2-flat-network')][ 'links']['defaultVersion'].endswith( - ':7') + ':8') assert by_folder[('infra', 'network-diagnostics')]['name'] == ( 'Network Diagnostics') assert by_folder[('infra', 'network-diagnostics')][ @@ -225,17 +225,17 @@ def test_catalog_list(): assert by_folder[('infra', 'network-policy-manager')]['name'] == ( 'Network Policy Manager') assert by_folder[('infra', 'network-policy-manager')][ - 'defaultVersion'] == 'v0.3.4' + 'defaultVersion'] == 'v0.3.5' assert by_folder[('infra', 'network-policy-manager')][ 'links']['defaultVersion'].endswith( - ':4') + ':5') assert by_folder[('infra', 'network-services')]['name'] == ( 'Network Services') assert by_folder[('infra', 'network-services')][ - 'defaultVersion'] == 'v0.3.11' + 'defaultVersion'] == 'v0.3.12' assert by_folder[('infra', 'network-services')][ 'links']['defaultVersion'].endswith( - ':13') + ':14') assert by_folder[('infra', 'nfs-storage')][ 'name'] == 'NFS Storage' assert by_folder[('infra', 'nfs-storage')][ @@ -246,30 +246,30 @@ def test_catalog_list(): assert by_folder[('infra', 'secret-volume-driver')][ 'name'] == 'Secret Volume' assert by_folder[('infra', 'secret-volume-driver')][ - 'defaultVersion'] == 'v0.1.3' + 'defaultVersion'] == 'v0.1.4' assert by_folder[('infra', 'secret-volume-driver')][ 'links']['defaultVersion'].endswith( - ':3') + ':4') assert by_folder[('infra', 'vault-volume-driver')][ 'name'] == 'Vault Volume' assert by_folder[('infra', 'vault-volume-driver')][ - 'defaultVersion'] == 'v0.2.2' + 'defaultVersion'] == 'v0.2.3' assert by_folder[('infra', 'vault-volume-driver')][ 'links']['defaultVersion'].endswith( - ':4') + ':5') assert by_folder[('infra', 'per-host-subnet-network')]['name'] == ( 'Per-Host Subnet Network') assert by_folder[('infra', 'per-host-subnet-network')][ - 'defaultVersion'] == 'v0.3.3' + 'defaultVersion'] == 'v0.3.4' assert by_folder[('infra', 'per-host-subnet-network')][ - 'links']['defaultVersion'].endswith(':5') + 'links']['defaultVersion'].endswith(':6') assert by_folder[('infra', 'resource-scheduler')][ 'name'] == 'Resource Scheduler' assert by_folder[('infra', 'resource-scheduler')][ - 'defaultVersion'] == 'v0.8.20' + 'defaultVersion'] == 'v0.8.21' assert by_folder[('infra', 'resource-scheduler')][ 'links']['defaultVersion'].endswith( - ':6') + ':7') assert by_folder[('infra', 'route53-dns-sync')][ 'name'] == 'Route 53 DNS Sync' assert by_folder[('infra', 'route53-dns-sync')][ @@ -280,24 +280,24 @@ def test_catalog_list(): assert by_folder[('infra', 'system-image-preloader')]['name'] == ( 'System Image Preloader') assert by_folder[('infra', 'system-image-preloader')][ - 'defaultVersion'] == 'v0.3.2' + 'defaultVersion'] == 'v0.3.3' assert by_folder[('infra', 'system-image-preloader')][ 'links']['defaultVersion'].endswith( - ':3') + ':4') assert by_folder[('infra', 'vxlan-overlay-network')]['name'] == ( 'VXLAN Overlay Network') assert by_folder[('infra', 'vxlan-overlay-network')][ - 'defaultVersion'] == 'v0.3.4' + 'defaultVersion'] == 'v0.3.5' assert by_folder[('infra', 'vxlan-overlay-network')][ 'links']['defaultVersion'].endswith( - ':6') + ':7') assert by_folder[('infra', 'windows-container-networking')][ 'name'] == 'Windows Container Networking' assert by_folder[('infra', 'windows-container-networking')][ - 'defaultVersion'] == 'v0.1.1' + 'defaultVersion'] == 'v0.1.2' assert by_folder[('infra', 'windows-container-networking')][ 'links']['defaultVersion'].endswith( - ':3') + ':4') assert by_folder[('infra', 'windows-ecr-credential-sync')][ 'name'] == 'Windows ECR Credential Sync' assert by_folder[('infra', 'windows-ecr-credential-sync')][ @@ -499,7 +499,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): container_schedule_platform = container_schedule_files[ 'rancher-compose.yml'] container_schedule_image = ( - 'ghcr.io/pasturestack/container-cron:v0.6.1') + 'ghcr.io/pasturestack/container-cron:v0.6.2') assert container_schedule_docker.count( 'image: {}'.format(container_schedule_image)) == 1 assert '\n container-schedule:\n' in container_schedule_docker @@ -547,7 +547,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): health_files = health_version['files'] health_docker = health_files['docker-compose.yml'] health_platform = health_files['rancher-compose.yml'] - health_image = 'ghcr.io/pasturestack/metadata-healthcheck:v0.3.17' + health_image = 'ghcr.io/pasturestack/metadata-healthcheck:v0.3.18' assert "version: '2'\nservices:\n healthcheck:" in health_docker assert health_docker.count('image: {}'.format(health_image)) == 1 assert ( @@ -565,7 +565,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): overlay_docker = overlay_files['docker-compose.yml.tpl'] overlay_platform = overlay_files['rancher-compose.yml'] overlay_image = ( - 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40') + 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41') assert overlay_docker.count('image: {}'.format(overlay_image)) == 4 assert overlay_docker.count( "PASTURESTACK_FIREWALL_BACKEND: '${FIREWALL_BACKEND}'") == 1 @@ -607,7 +607,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): vxlan_docker = vxlan_files['docker-compose.yml.tpl'] vxlan_platform = vxlan_files['rancher-compose.yml'] alternative_network_image = ( - 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40') + 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41') assert vxlan_docker.count( 'image: {}'.format(alternative_network_image)) == 3 assert '\n vxlan-network:\n' in vxlan_docker @@ -632,7 +632,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): layer_2_docker = layer_2_files['docker-compose.yml.tpl'] layer_2_platform = layer_2_files['rancher-compose.yml'] flat_network_image = ( - 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.40') + 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41') assert layer_2_docker.count( 'image: {}'.format(flat_network_image)) == 1 assert '\n layer-2-flat-cni:\n' in layer_2_docker @@ -697,7 +697,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): policy_docker = policy_files['docker-compose.yml'] policy_platform = policy_files['rancher-compose.yml'] policy_image = ( - 'ghcr.io/pasturestack/network-policy-manager:v0.3.2') + 'ghcr.io/pasturestack/network-policy-manager:v0.3.3') assert policy_docker.count( 'image: {}'.format(policy_image)) == 1 assert '\n network-policy-manager:\n' in policy_docker @@ -726,8 +726,8 @@ def test_catalog_compose_shapes_are_runtime_compatible(): network_platform = network_files['rancher-compose.yml'] network_manager_image = ( 'ghcr.io/pasturestack/network-plugin-manager:v0.8.25') - metadata_image = 'ghcr.io/pasturestack/metadata-service:v0.10.6' - dns_image = 'ghcr.io/pasturestack/internal-dns:v0.17.13' + metadata_image = 'ghcr.io/pasturestack/metadata-service:v0.10.7' + dns_image = 'ghcr.io/pasturestack/internal-dns:v0.17.14' assert network_docker.count( 'image: {}'.format(network_manager_image)) == 1 assert network_docker.count('image: {}'.format(metadata_image)) == 1 @@ -790,7 +790,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): secret_docker = secret_files['docker-compose.yml'] secret_platform = secret_files['rancher-compose.yml'] secret_image = ( - 'ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1') + 'ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.2') assert secret_docker.count('image: {}'.format(secret_image)) == 1 assert '\n secret-volume-driver:\n' in secret_docker assert 'privileged:' not in secret_docker @@ -843,9 +843,9 @@ def test_catalog_compose_shapes_are_runtime_compatible(): 'issuing_token_secret.label.zh-tw' ] == 'Vault 發行用權杖機密資料' vault_bridge_image = ( - 'ghcr.io/pasturestack/vault-secrets-bridge:v0.1.2') + 'ghcr.io/pasturestack/vault-secrets-bridge:v0.1.3') vault_driver_image = ( - 'ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.1') + 'ghcr.io/pasturestack/secrets-flexvolume-plugin:v0.2.2') assert vault_docker.count( 'image: {}'.format(vault_bridge_image)) == 1 assert vault_docker.count( @@ -920,7 +920,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): scheduler_files = scheduler_version['files'] scheduler_docker = scheduler_files['docker-compose.yml'] scheduler_platform = scheduler_files['rancher-compose.yml'] - scheduler_image = 'ghcr.io/pasturestack/resource-scheduler:v0.8.20' + scheduler_image = 'ghcr.io/pasturestack/resource-scheduler:v0.8.21' assert scheduler_docker.count( 'image: {}'.format(scheduler_image)) == 1 assert '\n resource-scheduler:\n' in scheduler_docker @@ -968,7 +968,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): preloader_docker = preloader_files['docker-compose.yml.tpl'] preloader_platform = preloader_files['rancher-compose.yml'] preloader_image = ( - 'ghcr.io/pasturestack/system-image-preloader:v0.3.2') + 'ghcr.io/pasturestack/system-image-preloader:v0.3.3') assert preloader_docker.count( 'image: {}'.format(preloader_image)) == 1 assert '\n system-image-preloader:\n' in preloader_docker @@ -982,7 +982,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): assert '{{- if' not in preloader_docker assert '{{- end' not in preloader_docker assert '@sha256:' not in preloader_docker - assert 'ghcr.io/pasturestack/system-image-preloader:v0.3.2' in ( + assert 'ghcr.io/pasturestack/system-image-preloader:v0.3.3' in ( preloader_docker) assert 'default: v1.6.282' in preloader_platform assert 'default: false' in preloader_platform @@ -1062,7 +1062,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): windows_container_network_files['rancher-compose.yml']) selector_image = ( 'ghcr.io/pasturestack/pod-pause-image:' - 'v3.0.5') + 'v3.0.6') assert windows_container_network_docker.count( 'image: {}'.format(selector_image)) == 2 assert windows_container_network_docker.count( @@ -1594,25 +1594,38 @@ def test_scheduler19_template_preserves_version4_contract(): assert maintained['sbom'] == sbom -def test_scheduler20_published_provenance_matches_current_image(): - image = 'ghcr.io/pasturestack/resource-scheduler:v0.8.20' +@pytest.mark.parametrize('tag,source_commit,manifest_digest,sbom_sha', [ + ('v0.8.20', + '35d3a67c62df4b22d7167da3d73dd9dbc4905e66', + 'sha256:e5a389273344585fca5c4513060e5289b' + '30ca13046d8ec286b8563952f1325d4', + '56de083886f393483d988c210d307d71a0b' + '9252b5d25a36095b2161bbab15e91'), + ('v0.8.21', + 'b9f0c18d2318a5ccd6c6d0a2ace27715bec6e8a6', + 'sha256:0818b05b49d73bb789b83932a91df3bf6' + 'a09d78fab3b370a7afe51f5c2ec2bdf', + '18f6caa7d3400b93808bfdfe8dd6a2107' + 'ae7752a1d1bd6c08c88eea518fcb032'), +]) +def test_scheduler_published_provenance_matches_current_and_retained_image( + tag, source_commit, manifest_digest, sbom_sha): + image = 'ghcr.io/pasturestack/resource-scheduler:' + tag with open(_file('catalog-images.json'), encoding='utf-8') as source: release = next(item for item in json.load(source)['images'] if item['reference'] == image) with open(_file('catalog-provenance.json'), encoding='utf-8') as source: - maintained = json.load(source)['entries'][ - 'resource-scheduler']['maintainedRelease'] + entry = json.load(source)['entries']['resource-scheduler'] + maintained = (entry['maintainedRelease'] if tag == 'v0.8.21' + else entry['retainedReleases'][tag]) assert maintained['reference'] == image assert maintained['sourceCommit'] == release['sourceCommit'] == ( - '35d3a67c62df4b22d7167da3d73dd9dbc4905e66') + source_commit) assert maintained['manifestDigest'] == release['manifestDigest'] == ( - 'sha256:e5a389273344585fca5c4513060e5289b' - '30ca13046d8ec286b8563952f1325d4') + manifest_digest) assert maintained['sbom'] == release['sbom'] - assert release['sbom']['sha256'] == ( - '56de083886f393483d988c210d307d71a0b' - '9252b5d25a36095b2161bbab15e91') - assert release['sbom']['provenance']['sourceRef'] == 'refs/tags/v0.8.20' + assert release['sbom']['sha256'] == sbom_sha + assert release['sbom']['provenance']['sourceRef'] == 'refs/tags/' + tag assert release['vulnerabilityScan']['fixedAvailable'] == 0 @@ -1633,3 +1646,129 @@ def test_scheduler_upgrade_versions_remain_available(number, image_tag): files['rancher-compose.yml']) assert 'README.md' in files assert 'README.zh-TW.md' in files + + +@pytest.mark.parametrize( + "template,old_number,new_number,old_version,new_version,replacements", + [('container-schedule', + '3', + '4', + 'v0.6.1', + 'v0.6.2', + [('container-cron:v0.6.1', 'container-cron:v0.6.2')]), + ('healthcheck', + '2', + '3', + 'v0.3.17', + 'v0.3.18', + [('metadata-healthcheck:v0.3.17', 'metadata-healthcheck:v0.3.18')]), + ('ipsec-overlay', + '13', + '14', + 'v0.3.11', + 'v0.3.12', + [('ipsec-vxlan-overlay-network:v0.14.40', + 'ipsec-vxlan-overlay-network:v0.14.41')]), + ('layer-2-flat-network', + '7', + '8', + 'v0.3.5', + 'v0.3.6', + [('ipsec-vxlan-overlay-network:v0.14.40', + 'ipsec-vxlan-overlay-network:v0.14.41')]), + ('network-policy-manager', + '4', + '5', + 'v0.3.4', + 'v0.3.5', + [('network-policy-manager:v0.3.2', + 'network-policy-manager:v0.3.3')]), + ('network-services', + '13', + '14', + 'v0.3.11', + 'v0.3.12', + [('metadata-service:v0.10.6', 'metadata-service:v0.10.7'), + ('internal-dns:v0.17.13', 'internal-dns:v0.17.14')]), + ('per-host-subnet-network', + '5', + '6', + 'v0.3.3', + 'v0.3.4', + [('ipsec-vxlan-overlay-network:v0.14.40', + 'ipsec-vxlan-overlay-network:v0.14.41')]), + ('resource-scheduler', + '6', + '7', + 'v0.8.20', + 'v0.8.21', + [('resource-scheduler:v0.8.20', 'resource-scheduler:v0.8.21')]), + ('secret-volume-driver', + '3', + '4', + 'v0.1.3', + 'v0.1.4', + [('secrets-flexvolume-plugin:v0.2.1', + 'secrets-flexvolume-plugin:v0.2.2')]), + ('system-image-preloader', + '3', + '4', + 'v0.3.2', + 'v0.3.3', + [('system-image-preloader:v0.3.2', + 'system-image-preloader:v0.3.3')]), + ('vault-volume-driver', + '4', + '5', + 'v0.2.2', + 'v0.2.3', + [('vault-secrets-bridge:v0.1.2', 'vault-secrets-bridge:v0.1.3'), + ('secrets-flexvolume-plugin:v0.2.1', + 'secrets-flexvolume-plugin:v0.2.2')]), + ('vxlan-overlay-network', + '6', + '7', + 'v0.3.4', + 'v0.3.5', + [('ipsec-vxlan-overlay-network:v0.14.40', + 'ipsec-vxlan-overlay-network:v0.14.41')]), + ('windows-container-networking', + '3', + '4', + 'v0.1.1', + 'v0.1.2', + [('pod-pause-image:v3.0.5', 'pod-pause-image:v3.0.6')])] +) +def test_qualified_backport_source_contract( + template, old_number, new_number, old_version, new_version, + replacements): + """Only image/version changes; no Catalog Service or runtime required.""" + prefix = "infra-templates/" + template + "/" + for filename in ("docker-compose.yml", "docker-compose.yml.tpl"): + old_path = _file(prefix + old_number + "/" + filename) + if not os.path.isfile(old_path): + continue + with open(old_path, encoding="utf-8") as source: + expected = source.read() + for old_image, new_image in replacements: + expected = expected.replace(old_image, new_image) + with open(_file(prefix + new_number + "/" + filename), + encoding="utf-8") as source: + assert source.read() == expected + with open(_file(prefix + old_number + "/rancher-compose.yml"), + encoding="utf-8") as source: + expected = source.read().replace( + " version: " + old_version + "\n", + " version: " + new_version + "\n") + with open(_file(prefix + new_number + "/rancher-compose.yml"), + encoding="utf-8") as source: + assert source.read() == expected + with open(_file(prefix + "config.yml"), encoding="utf-8") as source: + assert "\nversion: " + new_version + "\n" in source.read() + for filename in ("README.md", "README.zh-TW.md"): + with open(_file(prefix + new_number + "/" + filename), + encoding="utf-8") as source: + doc = source.read() + assert doc.strip() + for old_image, new_image in replacements: + assert old_image in doc and new_image in doc diff --git a/scripts/audit_deployable_images.py b/scripts/audit_deployable_images.py index 3f184da5d..fa26104a8 100644 --- a/scripts/audit_deployable_images.py +++ b/scripts/audit_deployable_images.py @@ -35,6 +35,7 @@ r"v?\d+\.\d+\.\d+$" ) COMMIT_PATTERN = re.compile(r"^[0-9a-f]{40}$") +DIGEST_PATTERN = re.compile(r"^sha256:[0-9a-f]{64}$") EXPECTED_INFRA_TEMPLATE_COUNT = 21 EXPECTED_QUESTION_COUNT = 142 NON_TAIWAN_TERMS = ( @@ -53,23 +54,23 @@ RETAINED_VERSION_LAYOUTS = { "amazon-efs-storage": ("2", "3"), "amazon-ebs-storage": ("2", "3"), - "container-schedule": ("2", "3"), + "container-schedule": ("2", "3", "4"), "ecr-credential-sync": ("2", "3", "4"), - "healthcheck": ("0", "1", "2"), - "ipsec-overlay": ("1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13"), - "layer-2-flat-network": ("2", "3", "4", "5", "6", "7"), + "healthcheck": ("0", "1", "2", "3"), + "ipsec-overlay": ("1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14"), + "layer-2-flat-network": ("2", "3", "4", "5", "6", "7", "8"), "network-diagnostics": ("1", "2", "3"), - "network-policy-manager": ("1", "2", "3", "4"), - "network-services": ("1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13"), + "network-policy-manager": ("1", "2", "3", "4", "5"), + "network-services": ("1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14"), "nfs-storage": ("1", "2", "3"), - "per-host-subnet-network": ("2", "3", "4", "5"), + "per-host-subnet-network": ("2", "3", "4", "5", "6"), "route53-dns-sync": ("2", "3"), - "resource-scheduler": ("1", "2", "3", "4", "5", "6"), - "secret-volume-driver": ("1", "2", "3"), - "system-image-preloader": ("2", "3"), - "vault-volume-driver": ("3", "4"), - "vxlan-overlay-network": ("2", "3", "4", "5", "6"), - "windows-container-networking": ("2", "3"), + "resource-scheduler": ("1", "2", "3", "4", "5", "6", "7"), + "secret-volume-driver": ("1", "2", "3", "4"), + "system-image-preloader": ("2", "3", "4"), + "vault-volume-driver": ("3", "4", "5"), + "vxlan-overlay-network": ("2", "3", "4", "5", "6", "7"), + "windows-container-networking": ("2", "3", "4"), } RETAINED_VERSION_HASHES = { "infra-templates/healthcheck/0/README.md": "1b18863d98ba3c042676f81daf6d6fc510c255cd1df275495985ed41f3b13aaa", @@ -149,6 +150,12 @@ def main() -> int: blocker(f"only semantic version tags are permitted: {reference}", failures) if not COMMIT_PATTERN.fullmatch(str(item.get("sourceCommit", ""))): blocker(f"sourceCommit must be a full SHA for: {reference}", failures) + digest = item.get("manifestDigest") + if digest is not None and not DIGEST_PATTERN.fullmatch(str(digest)): + blocker( + f"manifestDigest must be an immutable SHA-256 for: {reference}", + failures, + ) if not str(item.get("sourceRepository", "")).startswith("https://github.com/"): blocker(f"sourceRepository must be an HTTPS GitHub URL for: {reference}", failures) scan = item.get("vulnerabilityScan", {}) diff --git a/scripts/test b/scripts/test index 717543192..8a3a7329c 100755 --- a/scripts/test +++ b/scripts/test @@ -146,7 +146,20 @@ for version_id in \ per-host-subnet-network:4 \ vxlan-overlay-network:2 \ vxlan-overlay-network:3 \ - vxlan-overlay-network:5; do + vxlan-overlay-network:5 \ + container-schedule:4 \ + healthcheck:3 \ + ipsec-overlay:14 \ + layer-2-flat-network:8 \ + network-policy-manager:5 \ + network-services:14 \ + per-host-subnet-network:6 \ + resource-scheduler:7 \ + secret-volume-driver:4 \ + system-image-preloader:4 \ + vault-volume-driver:5 \ + vxlan-overlay-network:7 \ + windows-container-networking:4; do version_url="http://localhost:8088/v1-catalog/templateversions/library:infra*${version_id}" if ! curl -fsS "$version_url" >/dev/null; then echo "catalog-service version lookup failed: ${version_id} (${version_url}), pinned commit ${source_commit}" >&2