diff --git a/README.md b/README.md index 21005750d..ecde0978c 100644 --- a/README.md +++ b/README.md @@ -8,10 +8,10 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Project status -Catalog `v0.3.17` includes thirteen new numeric template revisions that consume -qualified Ubuntu security backports in the corresponding component images. -Only packages already installed in each runtime are updated; configuration, -the coreutils provider and the established plugin ownership boundaries remain +Catalog `v0.3.18` adds eight numeric template revisions using published +System Image Preloader `v0.3.4`, Metadata Healthcheck `v0.3.19`, Internal DNS +`v0.17.15`, Resource Scheduler `v0.8.22` and IPsec `v0.14.42` images. Existing +questions, resource parameters, firewall choices and plugin ownership remain unchanged. Previously published numeric revisions remain available. The catalog exposes one Native project template and twenty-one @@ -30,8 +30,8 @@ Officially unfixed Low/Medium findings remain tracked, not resolved; narrowly scoped VEX decisions require product-specific evidence and retain the raw scan. A clean gate is not a claim that every dependency has zero reported CVEs. -Network Services revision 14 uses Network Plugin Manager `v0.8.25`, Metadata -`v0.10.7` and Internal DNS `v0.17.14`. The recorded OCI manifest digests identify +Network Services revision 15 uses Network Plugin Manager `v0.8.25`, Metadata +`v0.10.7` and Internal DNS `v0.17.15`. The recorded OCI manifest digests identify verified image content; they do not imply that GitHub has locked a release. Runtime SBOMs, raw and interpreted findings, producer commits and publication receipts are recorded per image in `catalog-images.json`. Remaining findings diff --git a/SUPPORTED.md b/SUPPORTED.md index a0a1c560a..21757069f 100644 --- a/SUPPORTED.md +++ b/SUPPORTED.md @@ -10,33 +10,33 @@ or out-of-scope templates from being presented as deployable software. |---|---|---|---|---| | PastureStack Native | Project template | v0.3.0 | Composes only reviewed, semantic-versioned infrastructure entries | Clean single-host provisioning and restart passed; restored-data validation pending | | PastureStack Container Schedule | Infrastructure scheduling service | v0.6.2 | container-cron:v0.6.2 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | -| PastureStack System Image Preloader | Infrastructure image-cache service | v0.3.3 | system-image-preloader:v0.3.3 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack System Image Preloader | Infrastructure image-cache service | v0.3.4 | system-image-preloader:v0.3.4 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | | PastureStack Amazon ECR Credential Sync | Infrastructure registry service | v3.1.6 | Public PastureStack GHCR image with an explicit version tag | Published component; full runtime raw scan has zero findings; Catalog integration and environment acceptance remain distinct | -| Metadata Healthcheck | Infrastructure stack | v0.3.18 | metadata-healthcheck:v0.3.18 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | -| PastureStack Network Services | Infrastructure system stack | v0.3.12 | metadata-service:v0.10.7 and internal-dns:v0.17.14; Network Plugin Manager remains v0.8.25 | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| Metadata Healthcheck | Infrastructure stack | v0.3.19 | metadata-healthcheck:v0.3.19 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack Network Services | Infrastructure system stack | v0.3.13 | metadata-service:v0.10.7 and internal-dns:v0.17.15; Network Plugin Manager remains v0.8.25 | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | | PastureStack Network Diagnostics | Infrastructure diagnostics service | v0.2.2 | Two public PastureStack GHCR images with explicit version tags | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | | PastureStack Network Policy Manager | Infrastructure network-policy agent | v0.3.5 | network-policy-manager:v0.3.3 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | -| PastureStack IPsec Overlay | Infrastructure network driver | v0.3.12 | ipsec-vxlan-overlay-network:v0.14.41 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack IPsec Overlay | Infrastructure network driver | v0.3.13 | ipsec-vxlan-overlay-network:v0.14.42 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | | PastureStack Windows ECR Credential Sync | Windows infrastructure registry service | v3.1.2 | Public PastureStack GHCR Windows image with an explicit version tag | Source tests, cross-compilation, PE, license, anonymous distribution, and vulnerability gates passed; Windows-host runtime pending | | PastureStack Windows Network Services | Windows infrastructure Metadata and DNS stack | v0.3.0 | Two public PastureStack GHCR Windows images with explicit version tags | Source tests, cross-compilation, PE, license, anonymous distribution, and vulnerability gates passed; Windows-host runtime pending | | PastureStack Windows Container Networking | Windows NAT and transparent network-driver definition | v0.1.2 | pod-pause-image:v3.0.6 for its existing Linux sandbox role; Windows restrictions remain | Exact publication evidence is in catalog-images.json; this does not qualify a new Windows-host runtime matrix | -| PastureStack Layer 2 Flat Network | Optional infrastructure network driver | v0.3.6 | ipsec-vxlan-overlay-network:v0.14.41 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | -| Resource Scheduler | Infrastructure scheduling agent | v0.8.21 | resource-scheduler:v0.8.21 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack Layer 2 Flat Network | Optional infrastructure network driver | v0.3.7 | ipsec-vxlan-overlay-network:v0.14.42 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| Resource Scheduler | Infrastructure scheduling agent | v0.8.22 | resource-scheduler:v0.8.22 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | | PastureStack Route 53 DNS Sync | Infrastructure external-DNS agent | v0.8.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | | PastureStack Amazon EBS Storage | Infrastructure block-storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | | PastureStack Amazon EFS Storage | Infrastructure shared-storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | | PastureStack NFS Storage | Infrastructure storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate | | PastureStack Secret Volume | Infrastructure secret-volume driver | v0.1.4 | secrets-flexvolume-plugin:v0.2.2 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | | PastureStack Vault Volume | Infrastructure Vault token-volume driver | v0.2.3 | vault-secrets-bridge:v0.1.3 and secrets-flexvolume-plugin:v0.2.2 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | -| PastureStack Per-Host Subnet Network | Optional infrastructure network driver | v0.3.4 | ipsec-vxlan-overlay-network:v0.14.41 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | -| PastureStack VXLAN Overlay Network | Optional infrastructure network driver | v0.3.5 | ipsec-vxlan-overlay-network:v0.14.41 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack Per-Host Subnet Network | Optional infrastructure network driver | v0.3.5 | ipsec-vxlan-overlay-network:v0.14.42 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | +| PastureStack VXLAN Overlay Network | Optional infrastructure network driver | v0.3.6 | ipsec-vxlan-overlay-network:v0.14.42 with qualified Ubuntu runtime backports | Exact publication and runtime evidence is in catalog-images.json; managed-host upgrade and rollback remain separate | Deployable image references contain semantic version tags only. A published version tag must never be replaced. Manifest digests are retained only in the corresponding GitHub Release verification evidence; they are not placed in Catalog, Compose, API, or user-interface values. -Catalog `v0.3.17` adds the numeric revisions listed above and preserves all +Catalog `v0.3.18` adds the numeric revisions listed above and preserves all previously published revisions. Each updated image has its own producer, manifest digest, runtime SBOM and vulnerability evidence in `catalog-images.json`. Component publication and Catalog validation are distinct from managed-host diff --git a/catalog-images.json b/catalog-images.json index c23e4d9ac..f79bd0754 100644 --- a/catalog-images.json +++ b/catalog-images.json @@ -2179,6 +2179,427 @@ "workflowRun": "https://github.com/PastureStack/resource-scheduler/actions/runs/40144768957" }, "reviewedAt": "2026-10-25" + }, + { + "sourceRepository": "https://github.com/PastureStack/metadata-healthcheck", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/metadata-healthcheck", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu and HAProxy packages retain their upstream licenses", + "platforms": [ + "linux/amd64" + ], + "reference": "ghcr.io/pasturestack/metadata-healthcheck:v0.3.19", + "publicationStatus": "published", + "sourceCommit": "6fd1fa81623dc9061d6b72a7a4d4b1c5d3b5fc37", + "manifestDigest": "sha256:cb0ac0b0bf40bac5122035d2386ccd193ba33dd493779a8708465c7fe3981672", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/metadata-healthcheck/releases/download/v0.3.19/image.cdx.json", + "sha256": "b96d520c6a87a4cedc739ea435314f92295f3befac0cba1eff8b4e8d33a5eef4" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "rawFindings": 51, + "remainingFindings": 16, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/metadata-healthcheck/releases/download/v0.3.19/image-security.json", + "sha256": "42e4216985a9ffe240e3a67d4028e25145a2f205b4a0599b87dc322b9cd3e951" + }, + "effective": { + "url": "https://github.com/PastureStack/metadata-healthcheck/releases/download/v0.3.19/image-security.effective.json", + "sha256": "1c3060f344686d267fcd6158f769568b12ed1d18b096303185ecddf803a31872" + }, + "evidence": "https://github.com/PastureStack/metadata-healthcheck/actions/runs/40176354360" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config, byte-equal public assets, exact source identity and checksum-bound consumer guard", + "workflowRun": "https://github.com/PastureStack/metadata-healthcheck/actions/runs/40176354360", + "nativeImageProvenanceVerified": true, + "fileSbomAttestationProvidedByWorkflow": false, + "fileSbomAttestationVerified": false + }, + "ubuntuBackports": { + "bundle": "ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19", + "evidence": { + "url": "https://github.com/PastureStack/metadata-healthcheck/releases/download/v0.3.19/ubuntu-backports-evidence.tar", + "sha256": "2effe218692578e8f1aed8e6b3a1dd03850b554fe4af99e87c53c83e35b7b434" + }, + "consumerVerification": { + "url": "https://github.com/PastureStack/metadata-healthcheck/releases/download/v0.3.19/ubuntu-backports-validation.json", + "sha256": "830709803d4464e14578faee8eadbe3d77c24b4ff6a782c213b21cd673cf7a44" + }, + "selectedPackages": [ + "libbrotli1", + "libc-bin", + "libc-gconv-modules-extra", + "libc6", + "libp11-kit0", + "libpcre2-8-0", + "rust-coreutils" + ], + "qualifiedFixedVexPairs": 83, + "qualifiedCodeAbsentVexPairs": 3 + }, + "reviewedAt": "2026-10-25" + }, + { + "sourceRepository": "https://github.com/PastureStack/internal-dns", + "sourcePath": "package/linux/amd64/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/internal-dns", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu and other packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "reference": "ghcr.io/pasturestack/internal-dns:v0.17.15", + "publicationStatus": "published", + "sourceCommit": "49eba633ceeaf9282ef35a04448dce34141ed220", + "manifestDigest": "sha256:0eefa43952598c28b37a1195df8d854a3ad55f83a897732aae85106280fc3c86", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/internal-dns/releases/download/v0.17.15/image.cdx.json", + "sha256": "efad8ab6e66c1ac2028c29364ed7593d73724784d40119e1db49682bd050ddf9" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "rawFindings": 51, + "remainingFindings": 16, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/internal-dns/releases/download/v0.17.15/image-security.json", + "sha256": "35625341cd7c7bef2d3cfaf9c2ff2f303092465e5b02a661ad3b9ab4bd5d249a" + }, + "effective": { + "url": "https://github.com/PastureStack/internal-dns/releases/download/v0.17.15/image-security.effective.json", + "sha256": "a50f073c3f3965eee00abd00e1b3f855d3791af07d42edbdd400da72740689b6" + }, + "evidence": "https://github.com/PastureStack/internal-dns/actions/runs/40176343793" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config, byte-equal public assets, exact source identity and checksum-bound consumer guard", + "workflowRun": "https://github.com/PastureStack/internal-dns/actions/runs/40176343793", + "nativeImageProvenanceVerified": true, + "fileSbomAttestationProvidedByWorkflow": false, + "fileSbomAttestationVerified": false + }, + "ubuntuBackports": { + "bundle": "ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19", + "evidence": { + "url": "https://github.com/PastureStack/internal-dns/releases/download/v0.17.15/ubuntu-backports-evidence.tar", + "sha256": "e44c918dc7d0cb9e7979ac43740f5cfdc6a11c62f5584ff33ddbcb5caa1ec2d6" + }, + "consumerVerification": { + "url": "https://github.com/PastureStack/internal-dns/releases/download/v0.17.15/ubuntu-backports-validation.json", + "sha256": "830709803d4464e14578faee8eadbe3d77c24b4ff6a782c213b21cd673cf7a44" + }, + "selectedPackages": [ + "libbrotli1", + "libc-bin", + "libc-gconv-modules-extra", + "libc6", + "libp11-kit0", + "libpcre2-8-0", + "rust-coreutils" + ], + "qualifiedFixedVexPairs": 83, + "qualifiedCodeAbsentVexPairs": 3 + }, + "reviewedAt": "2026-10-25" + }, + { + "sourceRepository": "https://github.com/PastureStack/system-image-preloader", + "sourcePath": "Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/system-image-preloader", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu, Docker CLI, yq, gomplate, and other dependencies retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "reference": "ghcr.io/pasturestack/system-image-preloader:v0.3.4", + "publicationStatus": "published", + "sourceCommit": "624a45cd001a92cdf5132f487ba14e161dff40d2", + "manifestDigest": "sha256:d5a48e9705613c752d0a92abab307d87b986f573efcc57e291b10f3bd10f7f4f", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.4/system-image-preloader-sbom.cdx.json", + "sha256": "9875c77c53c009b72d074744e3671fd85081a0a9c61b088bb04fc9d79325224a" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "rawFindings": 62, + "remainingFindings": 16, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.4/system-image-preloader-security.json", + "sha256": "8c433ea53973c0625da8c61e8586695a0f959ccbf8238387df8735b70ae77ec9" + }, + "effective": { + "url": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.4/system-image-preloader-security-effective.json", + "sha256": "2c49a92b10123db689c815e90aaba49ecac2d58baf1310095eab442dcca2c84f" + }, + "evidence": "https://github.com/PastureStack/system-image-preloader/actions/runs/40176624910" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config, byte-equal public assets, exact source identity and checksum-bound consumer guard", + "workflowRun": "https://github.com/PastureStack/system-image-preloader/actions/runs/40176624910", + "nativeImageProvenanceVerified": false, + "fileSbomAttestationProvidedByWorkflow": false, + "fileSbomAttestationVerified": false + }, + "ubuntuBackports": { + "bundle": "ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19", + "evidence": { + "url": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.4/ubuntu-backports-evidence.tar", + "sha256": "7b69497456a1c2e76e0b7b5f108423e02b7a543d8aef9f5e94e9683c4d3531cb" + }, + "consumerVerification": { + "url": "https://github.com/PastureStack/system-image-preloader/releases/download/v0.3.4/ubuntu-backports-validation.json", + "sha256": "528d25a3eff6c3f8482922a28af52921a287e115ed32beeb14214b22fc2d1cdd" + }, + "selectedPackages": [ + "jq", + "libbrotli1", + "libc-bin", + "libc-gconv-modules-extra", + "libc6", + "libjq1", + "libp11-kit0", + "libpcre2-8-0", + "rust-coreutils" + ], + "qualifiedFixedVexPairs": 83, + "qualifiedCodeAbsentVexPairs": 3 + }, + "reviewedAt": "2026-10-25" + }, + { + "sourceRepository": "https://github.com/PastureStack/resource-scheduler", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/resource-scheduler", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu and other packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "reference": "ghcr.io/pasturestack/resource-scheduler:v0.8.22", + "publicationStatus": "published", + "sourceCommit": "902b453fb06a8b2dd73e1bf6de85c7554a7d5c12", + "manifestDigest": "sha256:fbd4b6604b6963be64a804e26b747037413f7c61dac909e739b2a44be2604e05", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.22/resource-scheduler-0.8.22-image.cdx.json", + "sha256": "bb518ed28b9bc911805250b3f18a28bfd88bfae6c6bb9dfc0c60a6d362a1a3a5" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "rawFindings": 51, + "remainingFindings": 16, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.22/resource-scheduler-0.8.22-security.json", + "sha256": "9481c6b984bca92469f84e859ef38fc2452b9714e2f2149a083829737d01cac2" + }, + "effective": { + "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.22/resource-scheduler-0.8.22-security.effective.json", + "sha256": "bebdcb1d471267b3e74f9d73f18beb67cf8ff76c074db63d170b62fe8329ad8a" + }, + "evidence": "https://github.com/PastureStack/resource-scheduler/actions/runs/40177309291" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config, byte-equal public assets, exact source identity and checksum-bound consumer guard", + "workflowRun": "https://github.com/PastureStack/resource-scheduler/actions/runs/40177309291", + "nativeImageProvenanceVerified": null, + "fileSbomAttestationProvidedByWorkflow": true, + "fileSbomAttestationVerified": true + }, + "ubuntuBackports": { + "bundle": "ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19", + "evidence": { + "url": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.22/ubuntu-backports-evidence.tar", + "sha256": "288b82936914d472c1b3acc5c64fd7bc96ac9177e8a031e9d65591dc41dce7b5" + }, + "consumerVerification": { + "status": "verified", + "inputEvidence": "https://github.com/PastureStack/resource-scheduler/releases/download/v0.8.22/ubuntu-backports-evidence.tar", + "workflowRun": "https://github.com/PastureStack/resource-scheduler/actions/runs/40177309291" + }, + "selectedPackages": [ + "libbrotli1", + "libc-bin", + "libc-gconv-modules-extra", + "libc6", + "libp11-kit0", + "libpcre2-8-0", + "rust-coreutils" + ], + "qualifiedFixedVexPairs": 83, + "qualifiedCodeAbsentVexPairs": 3 + }, + "reviewedAt": "2026-10-25" + }, + { + "sourceRepository": "https://github.com/PastureStack/ipsec-vxlan-overlay-network", + "sourcePath": "package/Dockerfile", + "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/ipsec-vxlan-overlay-network", + "licenseBoundary": "Apache-2.0 source and image; bundled Ubuntu, strongSwan, CNI, Weave, and other packages retain their upstream licenses and notices", + "platforms": [ + "linux/amd64" + ], + "reference": "ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42", + "publicationStatus": "published", + "sourceCommit": "9500770cb74817666aba2ce198ab1b4e064b3c88", + "manifestDigest": "sha256:fe97cba5afd5699e25a686bd4525bd4ad1b60b638b300b82c39e2db7b714cdfc", + "sbom": { + "status": "published", + "url": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/download/v0.14.42/image-sbom.cdx.json", + "sha256": "7decd797f3e95eb7cbb2863238093d962aa3d87150c3479d1d0df8a509d45aaa" + }, + "vulnerabilityScan": { + "status": "passed-with-tracked-unfixed-findings", + "scope": "published runtime; exact-package qualified VEX; original raw scan retained", + "critical": 0, + "high": 0, + "secrets": 0, + "rawFindings": 54, + "remainingFindings": 19, + "remainingCves": [ + "CVE-2024-56433", + "CVE-2025-1352", + "CVE-2025-1376", + "CVE-2026-102473", + "CVE-2026-102474", + "CVE-2026-107161", + "CVE-2026-18477", + "CVE-2026-18508", + "CVE-2026-40228", + "CVE-2026-67693", + "CVE-2026-88647", + "CVE-2026-88648", + "CVE-2026-95184", + "CVE-2026-95209", + "CVE-2026-95210" + ], + "raw": { + "url": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/download/v0.14.42/runtime-security.json", + "sha256": "ff0bd963c919ef4d402044b1c88eccff3762902d3057922ef9f7c8438231f30a" + }, + "effective": { + "url": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/download/v0.14.42/runtime-security.effective.json", + "sha256": "62422bc5aae8654ebe331adfcc6b4f773ddd61d16f4bfd50247804581a52e49c" + }, + "evidence": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/actions/runs/40177327704" + }, + "publicationVerification": { + "status": "verified", + "anonymousReadback": true, + "source": "anonymous OCI manifest/config, byte-equal public assets, exact source identity and checksum-bound consumer guard", + "workflowRun": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/actions/runs/40177327704", + "nativeImageProvenanceVerified": null, + "fileSbomAttestationProvidedByWorkflow": true, + "fileSbomAttestationVerified": true + }, + "ubuntuBackports": { + "bundle": "ghcr.io/pasturestack/ubuntu-security-backports:v0.1.1@sha256:45d6b507b63a18459ae5cf76afd4d9731f8ef43b9c40e4c3dbb01899e1752b19", + "evidence": { + "url": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/download/v0.14.42/ubuntu-backports-evidence.tar", + "sha256": "c65012dbf40238c5274a6ce7134a5701cd41f1f5c8952dd9fc121e9fb2574fc3" + }, + "consumerVerification": { + "status": "verified", + "inputEvidence": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/download/v0.14.42/ubuntu-backports-evidence.tar", + "workflowRun": "https://github.com/PastureStack/ipsec-vxlan-overlay-network/actions/runs/40177327704" + }, + "selectedPackages": [ + "libbrotli1", + "libc-bin", + "libc-gconv-modules-extra", + "libc6", + "libp11-kit0", + "libpcre2-8-0", + "rust-coreutils" + ], + "qualifiedFixedVexPairs": 83, + "qualifiedCodeAbsentVexPairs": 3 + }, + "reviewedAt": "2026-10-25" } ] } diff --git a/infra-templates/healthcheck/4/README.md b/infra-templates/healthcheck/4/README.md new file mode 100644 index 000000000..065531533 --- /dev/null +++ b/infra-templates/healthcheck/4/README.md @@ -0,0 +1,34 @@ + + +# Metadata Healthcheck + +Numeric revision 4 uses the published image `ghcr.io/pasturestack/metadata-healthcheck:v0.3.19`. +Previous revision 3 remains available with `ghcr.io/pasturestack/metadata-healthcheck:v0.3.18`. +Questions, service configuration, scheduling and permissions retain their established contracts. + +This infrastructure stack runs a healthcheck agent on each eligible host. It reads +health declarations from the established link-local Metadata endpoint, manages +its private HAProxy process, and reports stable state changes to the compatible control API. + +## Image and compatibility + +- Image: `ghcr.io/pasturestack/metadata-healthcheck:v0.3.19` +- Source: [PastureStack/metadata-healthcheck@6fd1fa81623dc9061d6b72a7a4d4b1c5d3b5fc37](https://github.com/PastureStack/metadata-healthcheck/tree/6fd1fa81623dc9061d6b72a7a4d4b1c5d3b5fc37) +- Source license: Apache-2.0; bundled packages retain their upstream licenses and notices. +- Exact manifest digest, runtime SBOM, raw/effective findings and publication evidence are recorded in `catalog-images.json`. + +The compatible control plane requires the literal `rancher-compose.yml` filename +and `io.rancher.*` protocol labels. The `create_agent` flow supplies scoped +per-instance credentials; compatibility names map to public `PLATFORM_*` +configuration only when explicit neutral values are absent. + +`PLATFORM_CA_ROOT` uses the established read-only agent certificate mount. +Container-network TCP 42 is a readiness endpoint and is not a published host port. +The template does not mount the Docker socket, request privileged mode, or add Linux capabilities. + +## Upgrade boundary + +Published image verification and tracked unfixed Low/Medium findings are separate +from deployment acceptance. Preserve existing lifecycle evidence; verify the +affected readiness path and managed-host upgrade/rollback before changing an +existing installation. Do not treat publication as a new full role or host matrix PASS. diff --git a/infra-templates/healthcheck/4/README.zh-TW.md b/infra-templates/healthcheck/4/README.zh-TW.md new file mode 100644 index 000000000..a669a8ad8 --- /dev/null +++ b/infra-templates/healthcheck/4/README.zh-TW.md @@ -0,0 +1,32 @@ + + +# 中繼資料健康檢查 + +數字修訂 4 使用已發布的 `ghcr.io/pasturestack/metadata-healthcheck:v0.3.19`。 +舊修訂 3 與 `ghcr.io/pasturestack/metadata-healthcheck:v0.3.18` 保留可用。 +問題、服務設定、排程與權限均沿用既有契約。 + +此基礎架構堆疊會在每台符合條件的主機執行健康檢查代理程式。 +代理程式從既有連結本機中繼資料端點讀取健康狀態宣告，管理自己的 +HAProxy 處理程序，並把穩定的狀態變更回報給相容控制 API。 + +## 映像與相容性 + +- 映像：`ghcr.io/pasturestack/metadata-healthcheck:v0.3.19` +- 原始碼：[PastureStack/metadata-healthcheck@6fd1fa81623dc9061d6b72a7a4d4b1c5d3b5fc37](https://github.com/PastureStack/metadata-healthcheck/tree/6fd1fa81623dc9061d6b72a7a4d4b1c5d3b5fc37) +- 原始碼採 Apache-2.0 授權；隨附套件保留各自的上游授權與聲明。 +- 精準 manifest digest、runtime SBOM、原始／有效發現及發布證據記錄於 `catalog-images.json`。 + +相容控制平面仍需要 `rancher-compose.yml` 檔名及 `io.rancher.*` 協定標籤。 +`create_agent` 提供範圍受限的執行個體登入資訊；只有未明確設定中性名稱時， +才會把相容名稱映射到公開的 `PLATFORM_*` 設定。 + +`PLATFORM_CA_ROOT` 使用既有唯讀代理程式憑證掛載。容器網路 TCP 42 是就緒 +端點，不會公開成主機連接埠。範本不掛載 Docker socket、不要求特權模式， +也不新增 Linux capability。 + +## 升級界線 + +已發布映像的驗證與官方未修補 Low/Medium 追蹤，均和部署驗收分開。 +保留既有生命週期證據，變更既有安裝前再確認受影響的 readiness 路徑及 +主機受管升級／回復。映像發布不代表重新通過完整角色或主機矩陣。 diff --git a/infra-templates/healthcheck/4/docker-compose.yml b/infra-templates/healthcheck/4/docker-compose.yml new file mode 100644 index 000000000..f7980796a --- /dev/null +++ b/infra-templates/healthcheck/4/docker-compose.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: MIT +version: '2' +services: + healthcheck: + image: ghcr.io/pasturestack/metadata-healthcheck:v0.3.19 + restart: always + command: + - --metadata-url + - http://169.254.169.250/2015-12-19 + environment: + PLATFORM_CA_ROOT: /var/lib/rancher/etc/ssl/ca.crt + labels: + io.rancher.container.create_agent: 'true' + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' diff --git a/infra-templates/healthcheck/4/rancher-compose.yml b/infra-templates/healthcheck/4/rancher-compose.yml new file mode 100644 index 000000000..3425674fd --- /dev/null +++ b/infra-templates/healthcheck/4/rancher-compose.yml @@ -0,0 +1,18 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: Metadata Healthcheck + version: v0.3.19 + description: Report metadata-defined workload health through the compatible control API. + minimum_rancher_version: v1.6.0 + +healthcheck: + scale: 1 + start_on_create: true + health_check: + port: 42 + interval: 2000 + response_timeout: 2000 + unhealthy_threshold: 3 + healthy_threshold: 2 + initializing_timeout: 60000 + reinitializing_timeout: 60000 diff --git a/infra-templates/healthcheck/config.yml b/infra-templates/healthcheck/config.yml index b0b76be40..c5b143a03 100644 --- a/infra-templates/healthcheck/config.yml +++ b/infra-templates/healthcheck/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Metadata Healthcheck description: Report metadata-defined workload health through the compatible control API. -version: v0.3.18 +version: v0.3.19 category: Infrastructure maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and third-party package licenses apply diff --git a/infra-templates/ipsec-overlay/15/README.md b/infra-templates/ipsec-overlay/15/README.md new file mode 100644 index 000000000..18ca6601d --- /dev/null +++ b/infra-templates/ipsec-overlay/15/README.md @@ -0,0 +1,38 @@ + + +# IPsec Overlay + +This infrastructure driver provides encrypted host-to-host networking while preserving Network Plugin Manager firewall ownership. + +Numeric revision 15 (display version `v0.3.13`) uses the published image `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`. +Previous revision 14 and `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` remain available. +Questions, environment, resource parameters, volumes, permissions and plugin ownership are unchanged. +Exact publication records are in `catalog-images.json`; environment acceptance remains separate. + +### Published image + +- Image: [`ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/tag/v0.14.40). +- Source: [`9500770cb74817666aba2ce198ab1b4e064b3c88`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/9500770cb74817666aba2ce198ab1b4e064b3c88), with a verified signed tag. +- Revision 13 preserves revision 12's namespaces, sidekicks, XFRM, firewall selection and CNI ownership. Existing numeric revisions remain unchanged. +- The full runtime scan has no available fix, High/Critical finding, unknown severity or secret. The 54 officially unfixed Low/Medium findings remain tracked, not resolved; the SBOM, digest and report are recorded in `catalog-images.json`. +- Source license: Apache-2.0; bundled dependencies retain their upstream licenses and notices. + +### Privilege and secret boundary + +The router is privileged and uses host PID and network namespaces. In all three firewall backends it synchronizes IPsec XFRM state and routes, but does not write host firewall chains. Network Plugin Manager alone owns the overlay bridge-subnet forward mark, NAT exclusion, and host-port rules. The router does not create a second nftables mark table, patch the manager's `CATTLE_*` chains, or change Docker's tables. The router receives a read-only Docker socket mount to query the actual firewall driver; Unix socket access still grants a powerful Docker API capability, so it remains confined to this trusted privileged system service. The CNI sidecar also accesses the Docker socket. These permissions are required by this compatibility architecture and must not be copied to ordinary workloads. + +The router receives a scoped create-agent credential from the compatible control plane and downloads the generated IPsec pre-shared key through the authenticated `configcontent/psk` contract. This template does not accept a user-supplied key and never places a key in the public Catalog repository, Compose variables, image, or logs. + +### Compatibility boundary + +The literal `rancher-compose.yml` filename, `minimum_rancher_version` key, required `io.rancher.*` orchestration labels, `rancher-cni-driver` shared volume, and `ipsec` agent-service marker are consumed by the compatible control plane and network plugin manager. They are protocol identifiers, not PastureStack branding. User-facing names, image coordinates, commands, environment variables, CNI names, log paths, and the `pasture.internal` search suffix use current PastureStack identifiers. + +The data plane currently supports the compatibility network `10.42.0.0/16`; the template intentionally does not expose a subnet selector that the runtime cannot safely honor. Its explicit `allowSharedSubnetIngress` contract is consumed only by Network Plugin Manager. The IPsec router continues to own XFRM and routes without writing host firewall rules. + +The host firewall backend is selected explicitly or left at `auto`. The four supported choices are `auto`, native `nftables`, `iptables-nft`, and `iptables-legacy`. The selection is passed only to `overlay-router` through `PASTURESTACK_FIREWALL_BACKEND`. The router checks Docker's actual driver and live rule owner, not the Ubuntu version: even on Ubuntu 26.04 and later, an existing `iptables-legacy` or `iptables-nft` deployment keeps that active path. An explicit mismatch or ambiguous state fails safely without switching backends or activating unloaded legacy modules. Align the choice with the Network Services template on the same environment. + +The Native project definition lists Network Services before IPsec, but list order alone does not establish a health dependency. Before creating or upgrading this overlay, apply the matching Network Services version and wait until Network Plugin Manager is healthy on every target host. In native `nftables` mode, first satisfy that template's Docker firewall-backend, bridge-accept-fwmark, and persistent IPv4-forwarding prerequisites; an IPsec router alone cannot provide the manager-owned forwarding and NAT rules. + +### Deployment boundary + +Published runtime and Catalog validation are separate from managed deployment acceptance. Verify the selected firewall backend, peer restart, upgrade and rollback on isolated hosts before applying the stack to an existing environment. A successful CNI address allocation alone does not prove the encrypted multi-host lifecycle. diff --git a/infra-templates/ipsec-overlay/15/README.zh-TW.md b/infra-templates/ipsec-overlay/15/README.zh-TW.md new file mode 100644 index 000000000..9159597a0 --- /dev/null +++ b/infra-templates/ipsec-overlay/15/README.zh-TW.md @@ -0,0 +1,67 @@ + + +# IPsec 加密網路 + +此基礎架構 driver 提供加密的主機間網路，並保留網路外掛管理器的防火牆職責。 + +數字修訂 15（顯示版本 `v0.3.13`）使用已發布的 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`。 +舊修訂 14 及 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` 保留可用。 +問題、環境、資源參數、磁碟區、權限與 plugin 職責不變。 +精準發布記錄見 `catalog-images.json`，環境驗收仍須分開確認。 + +### 正式發布映像 + +- [映像 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/releases/tag/v0.14.40)。 +- [來源 `9500770cb74817666aba2ce198ab1b4e064b3c88`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/9500770cb74817666aba2ce198ab1b4e064b3c88)，簽署版本標籤已驗證。 +- 第 13 版保留第 12 版的命名空間、相關容器、XFRM、防火牆選擇與 CNI 責任；既有數字版目錄內容不變。 +- 完整執行映像掃描沒有可用修補、High/Critical、未知嚴重度或機密資料；54 筆官方尚無修補的 Low/Medium 持續追蹤，不視為已解決。SBOM、摘要與報告記錄於 `catalog-images.json`。 +- 原始碼採 Apache-2.0 授權；隨附相依套件保留各自的上游授權及聲明。 + +### 權限與機密資料界線 + +路由器使用特權模式並加入主機 PID 與網路命名空間。在三種防火牆 +後端，它只同步 IPsec XFRM 狀態與路由，不寫入主機防火牆規則。 +網路外掛管理器獨自維護 overlay 網橋子網路的轉送標記、NAT 排除及 +主機連接埠規則。路由器不另建 nftables 標記表、不修改管理器的 +`CATTLE_*` 規則鏈，也不修改 Docker 的規則表。路由器以唯讀掛載 Docker Socket 查詢 +實際防火牆驅動程式；唯讀掛載仍賦予強大的 Docker API 存取能力， +只限此受信任的特權系統服務使用。CNI 相關容器也存取 Docker Socket。 +這些權限是相容架構所需， +不得套用到一般工作負載。 + +路由器會從相容控制平面取得範圍受限的代理程式登入資訊，再透過已驗證 +的 `configcontent/psk` 契約下載 IPsec 預先共用金鑰。此範本不接受 +使用者提供的金鑰，也不會把金鑰放入公開商店、Compose 變數、映像或 +日誌。 + +### 相容性界線 + +`rancher-compose.yml`、`minimum_rancher_version`、必要的 +`io.rancher.*` 編排標籤、`rancher-cni-driver` 共用磁碟區及 +`ipsec` 代理程式服務標記是相容控制平面與網路外掛管理器使用的協定 +識別名稱。使用者可見名稱、映像位置、命令、環境變數、CNI 名稱、 +日誌路徑及 `pasture.internal` 搜尋後綴均採用 PastureStack 名稱。 + +資料平面目前支援 `10.42.0.0/16` 相容網路。執行環境無法安全套用 +任意子網路，因此範本不提供無效的子網路選項。 +明確的 `allowSharedSubnetIngress` 契約只由網路外掛管理器處理；IPsec +路由器仍只負責 XFRM 與路由，不寫入主機防火牆規則。 + +主機防火牆後端可選 `auto`、原生 `nftables`、`iptables-nft` 或 +`iptables-legacy`。選擇會透過 `PASTURESTACK_FIREWALL_BACKEND` 傳給 +`overlay-router`。路由器檢查 Docker 實際驅動程式與現役規則擁有者， +不以 Ubuntu 版本推斷；Ubuntu 26.04 及更新版若已使用 `iptables-legacy` +或 `iptables-nft`，仍維持該現役路徑。明確指定與實際後端不符或狀態 +無法判定時安全停止，不切換後端，也不載入尚未啟用的 legacy 模組。 +同環境的 Network Services 範本應使用一致的選項。 + +Native 專案定義將 Network Services 排在 IPsec 前面，但清單順序 +本身不保證健康狀態相依。建立或升級加密網路前，應先套用相符版本 +的 Network Services，等待每台目標主機上的網路外掛管理器恢復 +健康。使用原生 `nftables` 時，須先完成該範本列出的 Docker +防火牆後端、`bridge-accept-fwmark` 與持久 IPv4 轉送前置設定； +只有 IPsec 路由器無法提供管理器負責的轉送及 NAT 規則。 + +### 部署界線 + +正式執行映像與 Catalog 驗證不同於受管部署驗收。套用既有環境前，須於隔離主機驗證所選防火牆後端、對端重啟、升級及回復。單純完成 CNI 位址分配不能代替加密跨主機生命週期驗收。 diff --git a/infra-templates/ipsec-overlay/15/docker-compose.yml.tpl b/infra-templates/ipsec-overlay/15/docker-compose.yml.tpl new file mode 100644 index 000000000..38b6e31b5 --- /dev/null +++ b/infra-templates/ipsec-overlay/15/docker-compose.yml.tpl @@ -0,0 +1,115 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + overlay-network: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + command: + - /bin/bash + - -c + - 'mkfifo /tmp/overlay-log; exec cat /tmp/overlay-log' + network_mode: ipsec + labels: + io.pasturestack.component: ipsec-overlay + io.rancher.sidekicks: overlay-router,connectivity-check + io.rancher.scheduler.global: 'true' + io.rancher.cni.link_mtu_overhead: '0' + io.rancher.network.macsync: 'true' + io.rancher.network.arpsync: 'true' + + overlay-router: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + command: start-ipsec.sh + privileged: true + network_mode: container:overlay-network + pid: host + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + PASTURESTACK_FIREWALL_BACKEND: '${FIREWALL_BACKEND}' + PASTURESTACK_NETWORK_XFRM_NETNS_PATH: /proc/1/ns/net + PASTURESTACK_NETWORK_XFRM_TUNNEL_SOURCE: host + PASTURESTACK_NETWORK_RUN_IN_HOST_NETNS: 'true' + PASTURESTACK_NETWORK_ARP_INTERFACE: '${DOCKER_BRIDGE}' + PASTURESTACK_NETWORK_SYNC_HOST_ROUTES: 'true' + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + labels: + io.pasturestack.component: ipsec-overlay-router + io.rancher.container.create_agent: 'true' + io.rancher.container.agent_service.ipsec: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + sysctls: + net.ipv4.conf.all.send_redirects: '0' + net.ipv4.conf.default.send_redirects: '0' + + connectivity-check: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + command: + - ipsec-vxlan-connectivity-check + - --connectivity-check-interval + - '${CONNECTIVITY_CHECK_INTERVAL}' + - --peer-connection-timeout + - '${PEER_CONNECTION_TIMEOUT}' + network_mode: container:overlay-network + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + PASTURESTACK_METADATA_ADDRESS: 169.254.169.250 + labels: + io.pasturestack.component: ipsec-overlay-connectivity + + cni-driver: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + command: start-cni-driver.sh + privileged: true + network_mode: host + pid: host + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + labels: + io.pasturestack.component: ipsec-overlay-cni + io.rancher.scheduler.global: 'true' + io.rancher.network.cni.binary: pasture-bridge + io.rancher.container.dns: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - rancher-cni-driver:/opt/cni-driver + network_driver: + name: PastureStack IPsec Overlay + default_network: + name: ipsec + host_ports: {{ .Values.HOST_PORTS }} + subnets: + - network_address: 10.42.0.0/16 + dns: + - 169.254.169.250 + dns_search: + - pasture.internal + cni_config: + '10-pasturestack.conf': + name: pasturestack-cni-network + type: pasture-bridge + bridge: $DOCKER_BRIDGE + bridgeSubnet: 10.42.0.0/16 + allowSharedSubnetIngress: true + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + isDefaultGateway: true + hostNat: true + hairpinMode: {{ .Values.PASTURESTACK_HAIRPIN_MODE }} + promiscMode: {{ .Values.PASTURESTACK_PROMISCUOUS_MODE }} + mtu: ${MTU} + linkMTUOverhead: 98 + ipam: + type: metadata-cni-ipam + subnetPrefixSize: /16 + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' diff --git a/infra-templates/ipsec-overlay/15/rancher-compose.yml b/infra-templates/ipsec-overlay/15/rancher-compose.yml new file mode 100644 index 000000000..dca19035f --- /dev/null +++ b/infra-templates/ipsec-overlay/15/rancher-compose.yml @@ -0,0 +1,97 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack IPsec Overlay + version: v0.3.13 + description: Provide an encrypted host-to-host network for managed workloads. + minimum_rancher_version: v1.6.19-rc1 + labels: + io.pasturestack.catalog.question.docker_bridge.label.zh-tw: 'Docker 網橋' + io.pasturestack.catalog.question.docker_bridge.description.zh-tw: '受管工作負載流量使用的主機網橋。' + io.pasturestack.catalog.question.firewall_backend.label.zh-tw: '主機防火牆後端' + io.pasturestack.catalog.question.firewall_backend.description.zh-tw: '依 Docker 現役後端自動選擇；不論 Ubuntu 版本，原生 nftables、iptables-nft 與 iptables-legacy 分開使用。指定不符時安全停止，不會自動切換後端。' + io.pasturestack.catalog.question.mtu.label.zh-tw: '網路 MTU' + io.pasturestack.catalog.question.mtu.description.zh-tw: '請與主機網路 MTU 一致；GCE 常用 1460，一般乙太網路常用 1500。' + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的加密網路元件診斷資訊。' + io.pasturestack.catalog.question.host_ports.label.zh-tw: '啟用主機連接埠' + io.pasturestack.catalog.question.host_ports.description.zh-tw: '允許受管工作負載在主機上公開連接埠。' + io.pasturestack.catalog.question.pasturestack_hairpin_mode.label.zh-tw: '啟用 Hairpin 模式' + io.pasturestack.catalog.question.pasturestack_hairpin_mode.description.zh-tw: 'Hairpin 模式與混雜模式不可同時啟用。' + io.pasturestack.catalog.question.pasturestack_promiscuous_mode.label.zh-tw: '啟用混雜模式' + io.pasturestack.catalog.question.pasturestack_promiscuous_mode.description.zh-tw: '混雜模式與 Hairpin 模式不可同時啟用。' + io.pasturestack.catalog.question.connectivity_check_interval.label.zh-tw: '對等主機檢查間隔' + io.pasturestack.catalog.question.connectivity_check_interval.description.zh-tw: '兩次加密對等主機連線檢查之間的毫秒數。' + io.pasturestack.catalog.question.peer_connection_timeout.label.zh-tw: '對等主機連線逾時' + io.pasturestack.catalog.question.peer_connection_timeout.description.zh-tw: '每次嘗試連線對等主機可使用的毫秒數。' + questions: + - variable: DOCKER_BRIDGE + label: Docker bridge + description: Host bridge used for managed workload traffic. + type: string + default: docker0 + required: true + - variable: FIREWALL_BACKEND + label: Host firewall backend + description: Follow Docker's active firewall backend on any supported Ubuntu version, or explicitly select native nftables, iptables-nft, or iptables-legacy. An explicit mismatch fails safely; legacy is never a fallback. + type: enum + default: auto + required: true + options: + - auto + - nftables + - iptables-nft + - iptables-legacy + - variable: MTU + label: Network MTU + description: Match the host network MTU; common values are 1460 for GCE and 1500 for Ethernet. + type: int + default: 1500 + required: true + - variable: PASTURESTACK_DEBUG + label: Enable debug logs + description: Enable verbose diagnostic logging for the overlay components. + type: boolean + default: 'false' + required: true + - variable: HOST_PORTS + label: Enable host ports + description: Allow managed workloads to publish ports on their hosts. + type: boolean + default: 'true' + required: true + - variable: PASTURESTACK_HAIRPIN_MODE + label: Enable hairpin mode + description: Hairpin mode and promiscuous mode must not both be enabled. + type: boolean + default: 'false' + required: true + - variable: PASTURESTACK_PROMISCUOUS_MODE + label: Enable promiscuous mode + description: Promiscuous mode and hairpin mode must not both be enabled. + type: boolean + default: 'true' + required: true + - variable: CONNECTIVITY_CHECK_INTERVAL + label: Peer check interval + description: Milliseconds between encrypted peer-connectivity checks. + type: int + default: 10000 + required: true + - variable: PEER_CONNECTION_TIMEOUT + label: Peer connection timeout + description: Milliseconds allowed for each peer connection attempt. + type: int + default: 60000 + required: true + +overlay-network: + health_check: + request_line: GET "/connectivity" "HTTP/1.0" + port: 80 + interval: 5000 + initializing_timeout: 60000 + reinitializing_timeout: 60000 + response_timeout: 2000 + healthy_threshold: 2 + unhealthy_threshold: 3 + strategy: none diff --git a/infra-templates/ipsec-overlay/config.yml b/infra-templates/ipsec-overlay/config.yml index fb1aaa03b..627681d44 100644 --- a/infra-templates/ipsec-overlay/config.yml +++ b/infra-templates/ipsec-overlay/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: IPsec Overlay description: Provide an encrypted host-to-host network for managed workloads. -version: v0.3.12 +version: v0.3.13 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and third-party package licenses apply diff --git a/infra-templates/layer-2-flat-network/9/README.md b/infra-templates/layer-2-flat-network/9/README.md new file mode 100644 index 000000000..501c96d3c --- /dev/null +++ b/infra-templates/layer-2-flat-network/9/README.md @@ -0,0 +1,11 @@ + + +# Layer 2 Flat Network + +This driver connects managed workloads to a shared Layer 2 subnet through a host bridge. It does not provide encryption. + +Numeric revision 9 (display version `v0.3.7`) uses the published image `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`. +Previous revision 8 and `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` remain available. +Questions, environment, resource parameters, volumes, permissions and plugin ownership are unchanged. +Exact publication records are in `catalog-images.json`; environment acceptance remains separate. + diff --git a/infra-templates/layer-2-flat-network/9/README.zh-TW.md b/infra-templates/layer-2-flat-network/9/README.zh-TW.md new file mode 100644 index 000000000..c2a9afad7 --- /dev/null +++ b/infra-templates/layer-2-flat-network/9/README.zh-TW.md @@ -0,0 +1,11 @@ + + +# 第 2 層平面網路 + +此 driver 透過主機網橋把受管工作負載連接到共用第 2 層子網路，不提供加密。 + +數字修訂 9（顯示版本 `v0.3.7`）使用已發布的 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`。 +舊修訂 8 及 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` 保留可用。 +問題、環境、資源參數、磁碟區、權限與 plugin 職責不變。 +精準發布記錄見 `catalog-images.json`，環境驗收仍須分開確認。 + diff --git a/infra-templates/layer-2-flat-network/9/docker-compose.yml.tpl b/infra-templates/layer-2-flat-network/9/docker-compose.yml.tpl new file mode 100644 index 000000000..c4002ba11 --- /dev/null +++ b/infra-templates/layer-2-flat-network/9/docker-compose.yml.tpl @@ -0,0 +1,70 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + layer-2-flat-cni: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + privileged: true + network_mode: host + pid: host +{{- if eq .Values.AUTO_SETUP_LAYER_2_BRIDGE "true" }} + command: + - /bin/bash + - -ceu + - start-flat.sh && exec start-cni-driver.sh +{{- else }} + command: start-cni-driver.sh +{{- end }} + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + PASTURESTACK_METADATA_ADDRESS: '${PASTURESTACK_METADATA_ADDRESS}' + FLAT_IF: '${FLAT_INTERFACE}' + FLAT_BRIDGE: '${LAYER_2_BRIDGE}' + MTU: '${MTU}' + labels: + io.pasturestack.component: layer-2-flat-cni + io.rancher.network.cni.binary: pasture-bridge + io.rancher.container.dns: 'true' + io.rancher.scheduler.global: 'true' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - rancher-cni-driver:/opt/cni-driver + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + network_driver: + name: PastureStack Layer 2 Flat Network + default_network: + name: layer-2-flat + host_ports: {{ .Values.HOST_PORTS }} + subnets: + - network_address: ${SUBNET} + start_address: ${START_ADDRESS} + end_address: ${END_ADDRESS} + dns: + - 169.254.169.250 + dns_search: + - pasture.internal + cni_config: + '10-pasturestack-layer-2-flat.conf': + name: pasturestack-layer-2-flat-network + type: pasture-bridge + bridge: ${LAYER_2_BRIDGE} + bridgeSubnet: ${SUBNET} + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + hostNat: false + mtu: ${MTU} + skipBridgeConfigureIP: true + skipFastPath: true + ipam: + type: flat-cni-ipam + metadataURL: http://169.254.169.250/2015-12-19 + metadataAddress: 169.254.169.250 + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + routes: + - dst: 0.0.0.0/0 + gw: ${GATEWAY} diff --git a/infra-templates/layer-2-flat-network/9/rancher-compose.yml b/infra-templates/layer-2-flat-network/9/rancher-compose.yml new file mode 100644 index 000000000..62aecfd0d --- /dev/null +++ b/infra-templates/layer-2-flat-network/9/rancher-compose.yml @@ -0,0 +1,96 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Layer 2 Flat Network + version: v0.3.7 + description: Connect managed workloads directly to a shared Layer 2 subnet through a host bridge. + minimum_rancher_version: v1.6.26-rc1 + labels: + io.pasturestack.catalog.question.layer_2_bridge.label.zh-tw: '第 2 層網橋' + io.pasturestack.catalog.question.layer_2_bridge.description.zh-tw: '共用第 2 層網路使用的既有或自動設定主機網橋。' + io.pasturestack.catalog.question.flat_interface.label.zh-tw: '實體網路介面' + io.pasturestack.catalog.question.flat_interface.description.zh-tw: '只有啟用自動網橋設定時，才會把此主機實體介面加入網橋。' + io.pasturestack.catalog.question.auto_setup_layer_2_bridge.label.zh-tw: '自動設定網橋' + io.pasturestack.catalog.question.auto_setup_layer_2_bridge.description.zh-tw: '把實體介面的位址移到第 2 層網橋；啟用前請先確認可使用主控台連線。' + io.pasturestack.catalog.question.subnet.label.zh-tw: '共用子網路' + io.pasturestack.catalog.question.subnet.description.zh-tw: '主機、網橋、閘道與受管工作負載共用的 IPv4 子網路。' + io.pasturestack.catalog.question.start_address.label.zh-tw: '第一個工作負載位址' + io.pasturestack.catalog.question.start_address.description.zh-tw: '控制平面可分配給受管工作負載的第一個 IPv4 位址。' + io.pasturestack.catalog.question.end_address.label.zh-tw: '最後一個工作負載位址' + io.pasturestack.catalog.question.end_address.description.zh-tw: '控制平面可分配給受管工作負載的最後一個 IPv4 位址。' + io.pasturestack.catalog.question.gateway.label.zh-tw: '預設閘道' + io.pasturestack.catalog.question.gateway.description.zh-tw: '共用子網路中受管工作負載使用的 IPv4 閘道。' + io.pasturestack.catalog.question.mtu.label.zh-tw: '網路 MTU' + io.pasturestack.catalog.question.mtu.description.zh-tw: '實體第 2 層網路端對端支援的 MTU。' + io.pasturestack.catalog.question.host_ports.label.zh-tw: '啟用主機連接埠' + io.pasturestack.catalog.question.host_ports.description.zh-tw: '允許受管工作負載在主機上公開連接埠。' + io.pasturestack.catalog.question.pasturestack_metadata_address.label.zh-tw: '中繼資料服務位址' + io.pasturestack.catalog.question.pasturestack_metadata_address.description.zh-tw: '相容中繼資料服務使用的連結本機 IPv4 位址。' + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的網橋設定與 CNI 操作診斷資訊。' + questions: + - variable: LAYER_2_BRIDGE + label: Layer 2 bridge + description: Existing or automatically configured host bridge used by the shared Layer 2 network. + type: string + default: flatbr0 + required: true + - variable: FLAT_INTERFACE + label: Physical interface + description: Physical host interface to attach to the bridge only when automatic bridge setup is enabled. + type: string + default: eth0 + required: true + - variable: AUTO_SETUP_LAYER_2_BRIDGE + label: Configure the bridge automatically + description: Move the physical interface address onto the Layer 2 bridge. Verify console access before enabling this option. + type: boolean + default: 'false' + required: true + - variable: SUBNET + label: Shared subnet + description: IPv4 subnet shared by the hosts, bridge, gateway, and managed workloads. + type: string + default: 192.0.2.0/24 + required: true + - variable: START_ADDRESS + label: First workload address + description: First IPv4 address that the control plane may assign to a managed workload. + type: string + default: 192.0.2.100 + required: true + - variable: END_ADDRESS + label: Last workload address + description: Last IPv4 address that the control plane may assign to a managed workload. + type: string + default: 192.0.2.199 + required: true + - variable: GATEWAY + label: Default gateway + description: IPv4 gateway for managed workloads on the shared subnet. + type: string + default: 192.0.2.1 + required: true + - variable: MTU + label: Network MTU + description: MTU supported end to end by the physical Layer 2 network. + type: int + default: 1500 + required: true + - variable: HOST_PORTS + label: Enable host ports + description: Allow managed workloads to publish ports on their hosts. + type: boolean + default: 'true' + required: true + - variable: PASTURESTACK_METADATA_ADDRESS + label: Metadata address + description: Link-local IPv4 address of the compatible metadata service. + type: string + default: 169.254.169.250 + required: true + - variable: PASTURESTACK_DEBUG + label: Enable debug logs + description: Enable verbose diagnostics for bridge setup and CNI operations. + type: boolean + default: 'false' + required: true diff --git a/infra-templates/layer-2-flat-network/config.yml b/infra-templates/layer-2-flat-network/config.yml index 52ed69f70..dfe8662c5 100644 --- a/infra-templates/layer-2-flat-network/config.yml +++ b/infra-templates/layer-2-flat-network/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Layer 2 Flat Network description: Connect managed workloads directly to a shared Layer 2 subnet through a host bridge. -version: v0.3.6 +version: v0.3.7 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and bundled component licenses apply diff --git a/infra-templates/network-services/15/README.md b/infra-templates/network-services/15/README.md new file mode 100644 index 000000000..b73e01c8f --- /dev/null +++ b/infra-templates/network-services/15/README.md @@ -0,0 +1,67 @@ + + +# PastureStack Network Services + +Numeric revision 15 (display version `v0.3.13`) uses Network Plugin +Manager `v0.8.25`, Metadata `v0.10.7`, and the published Internal DNS image `ghcr.io/pasturestack/internal-dns:v0.17.15`. +Previous revision 14 and `ghcr.io/pasturestack/internal-dns:v0.17.14` remain available. +Existing questions, environment settings, sidekicks, volumes and plugin ownership are unchanged. +Exact image identities, runtime SBOMs and raw/effective findings are in `catalog-images.json`. +Published components do not establish deployment acceptance for an existing environment. + +### CNI configuration convergence + +The manager preflights all desired CNI configurations and writes each through an atomic replacement with mode `0600`. Only after every desired configuration has been written successfully may it retire an obsolete platform configuration. The historical `10-rancher.conf` must have the exact name/type/IPAM triplet `rancher-cni-network` / `rancher-bridge` / `rancher-cni-ipam`; the current `10-pasturestack.conf` must have `pasturestack-cni-network` / `pasture-bridge` / `metadata-cni-ipam`. The same ownership check applies when the selected provider requires the historical configuration again. + +Retirement renames the obsolete file with a `.pasturestack-retired` suffix, preserving its original bytes outside the CNI `.conf` / `.json` execution set. An existing retirement backup must be byte-identical; a conflicting backup causes an error. Unrelated administrator configurations are preserved. Malformed or partially matching platform configurations, symlinks, and unsafe metadata paths cause an explicit error. The manager never sweeps the configuration directory or removes CNI binary aliases as part of this migration. + +Each component is a published security rebuild. Full-severity evidence is recorded separately from deployment acceptance; publication does not establish that an existing infrastructure stack has completed its managed upgrade. + +### Provider and lifecycle convergence + +The manager selects one eligible CNI provider per binary from the infrastructure-service metadata on the local host. The highest numeric OCI image version wins; an unversioned or nonnumeric development label cannot replace a numeric release, and ties use a deterministic immutable container-ID ordering. The generated wrapper stays bound to that exact provider and does not relist containers by service label at invocation time. It executes the provider's private `/opt/cni/bin` copy with a bounded compatibility fallback for older images. Wrapper replacement uses an exclusive temporary inode and atomic rename; content, file type, and mode drift are repaired without following a replacement symlink. + +When platform metadata temporarily reports a host-port container before its primary address, the manager may read the exact running container's network namespace. It accepts only one IPv4 address inside that network's configured managed subnet and revalidates the same Docker container PID after the namespace read. Missing, ambiguous, out-of-subnet, or lifecycle-raced results fail closed and retain the last known-good host-port rules until metadata and CNI converge. + +### Firewall backend + +`FIREWALL_BACKEND` defaults to `auto`. It reads Docker's actual firewall driver: Docker's native `nftables` driver uses native nft rules, while Docker's `iptables` driver selects the frontend that owns Docker's active NAT chain. That may be `iptables-nft` or `iptables-legacy` on **any supported host**, including Ubuntu 26.04 and later. The OS release, installed executable, or unloaded kernel module alone never selects a backend. To pin one path, choose: + +- `nftables`: Docker's native nftables firewall backend. This is **not** the same as the iptables-nft compatibility CLI. +- `iptables-nft`: xtables compatibility CLI backed by nf_tables, for Docker's iptables firewall driver. +- `iptables-legacy`: legacy xtables, only when the running Docker daemon actually owns the active rules through that frontend. + +The manager refuses a mismatched or ambiguous selection and does not fall back, switch Docker's backend, or load legacy modules. An Ubuntu 26.04+ host already using `iptables-legacy` or `iptables-nft` must keep its live Docker path; do not turn on native nftables merely because the OS is new. A deliberate migration requires a separate host change, rollback point, and network lifecycle test. + +This manager alone owns the host NAT and host-port `CATTLE_*` chains. Its +masquerade rules exclude destinations inside the managed overlay subnet in +all three backends; the IPsec host-XFRM router must not patch these chains. +For the per-host-subnet driver, the manager also excludes other active hosts' +validated subnets from masquerade and adds a bounded forwarding exception. +Inactive registrations are ignored; missing or overlapping labels on an active +host fail closed. This is a routed, unencrypted network; protect the host +transport separately. +Upgrade Network Services first and verify manager health on every host before +upgrading the matching IPsec Overlay version. + +Shared-subnet ingress is enabled only when CNI metadata explicitly sets +`allowSharedSubnetIngress: true`, or for the legacy fixed-subnet contract that +already declares both `bridgeSubnet` and `hostNat: true`. It is rejected for +host-label-based subnets, where only validated active peer ranges are trusted. + +For Docker's native nftables driver, configure Docker itself with `"firewall-backend": "nftables"` and `"bridge-accept-fwmark": "0x1068/0x1068"` before upgrading this stack. Persist `net.ipv4.ip_forward=1` on the host and verify it remains enabled after a reboot: Docker's native nftables backend does not enable IPv4 forwarding for you. The mark allows Docker's bridge forwarding rules to accept the manager's published-host-port traffic; the template cannot configure the host daemon or kernel settings. Check and explicitly migrate any stale `iptables-nft` `FORWARD DROP` policy or previous platform hooks before switching Docker. The manager refuses that mixed state rather than changing the host's global firewall policy. Docker's native nftables backend remains an experimental Docker feature; qualify it against the installed Docker release before production use. + +### Other configuration + +- `DOCKER_BRIDGE`: host bridge for managed workload traffic. +- `DNS_RECURSER_TIMEOUT`, `TTL`: upstream DNS timeout and service-discovery cache time. +- `CPU_PERIOD`, `CPU_QUOTA`: Metadata Service CPU scheduling limits. +- `RELOAD_INTERVAL_LIMIT`, `ARP_SYNC_INTERVAL`: metadata reload and host ARP reconciliation intervals. + +Network Plugin Manager still requires host networking, host PID visibility, the Docker socket, Docker state, kernel-module and runtime mounts, and the shared CNI volume. Metadata Service starts as root only to assign its link-local address, then drops to UID/GID 10001. Internal DNS shares its namespace. The `rancher-compose.yml` filename, `io.rancher.*` labels, `CATTLE_*` fallback variables, `/var/lib/rancher` CA path, and `rancher-cni-driver` volume are compatibility contracts, not a request to use legacy firewall rules. + +These template files are MIT-licensed. The manager, metadata service, and internal DNS retain their Apache-2.0 licenses and bundled dependency notices. Verify image source and the recorded manifest digest in `catalog-images.json` before deployment. + +Metadata and DNS are managed by the Server lifecycle. The manager no longer removes overlapping instances during upgrades and remains unready while waiting for Metadata recovery. Verify service health before completing an upgrade; image publication alone is not runtime acceptance. + +Driver stop/start events and periodic reconciliation refresh the selected provider. Only eligible running local providers with a live process ID can be selected. Temporary metadata or Docker inspection failures remain visible and are retried; an unrelated unavailable driver does not block a healthy provider for another binary. No host firewall mode or administrator configuration is changed by provider selection. diff --git a/infra-templates/network-services/15/README.zh-TW.md b/infra-templates/network-services/15/README.zh-TW.md new file mode 100644 index 000000000..54a87d5f7 --- /dev/null +++ b/infra-templates/network-services/15/README.zh-TW.md @@ -0,0 +1,55 @@ + + +# PastureStack 網路服務 + +數字修訂 15（顯示版本 `v0.3.13`）使用網路外掛管理器 `v0.8.25`、 +中繼資料服務 `v0.10.7` 與已發布的內部 DNS 映像 `ghcr.io/pasturestack/internal-dns:v0.17.15`。 +舊修訂 14 及 `ghcr.io/pasturestack/internal-dns:v0.17.14` 保留可用。 +既有問題、環境參數、相關容器、磁碟區與 plugin 職責不變。 +精準映像身分、runtime SBOM 與原始／有效發現記錄於 `catalog-images.json`。 +元件發布不代表既有環境已完成部署驗收。 + +### CNI 設定收斂 + +管理器會先檢查所有預期 CNI 設定，再以原子置換逐檔寫入，權限為 `0600`。只有全部預期設定都寫入成功後，才可退役已不再使用的平台設定。歷史 `10-rancher.conf` 的 name/type/IPAM 必須完整符合 `rancher-cni-network` / `rancher-bridge` / `rancher-cni-ipam`；現行 `10-pasturestack.conf` 則必須完整符合 `pasturestack-cni-network` / `pasture-bridge` / `metadata-cni-ipam`。選定的 provider 再次需要歷史設定時，也會套用相同的身分判定。 + +退役時會將舊檔更名為加上 `.pasturestack-retired` 後綴的備份，保留原始位元組，並移出 CNI `.conf` / `.json` 執行集合。若備份已存在，其內容必須完全一致；內容衝突則明確報錯。管理者的其他設定會保留；格式損壞、只符合部分平台身分、符號連結及不安全的中繼資料路徑都會明確報錯。此次遷移不會掃除整個設定目錄，也不會移除 CNI 執行檔別名。 + +各元件均為正式發布的安全重建。完整嚴重度證據與部署驗收分開記錄；元件發布不代表既有基礎架構堆疊已完成受管升級。 + +### Provider 與生命週期收斂 + +管理器會依本機主機上的基礎架構服務中繼資料，為每個 CNI 執行檔選出唯一合格的 provider。數字型 OCI 映像版本以最高版為準；未標示版本或非數字的開發標籤不得取代正式數字版本，版本相同時再以不可變的容器 ID 做固定排序。產生的 wrapper 只綁定這個精確 provider，呼叫時不會再以服務標籤重新列舉容器。它優先執行 provider 私有的 `/opt/cni/bin` 程式，並只為舊映像保留有限的相容路徑。wrapper 以排他暫存 inode 與原子更名更新；內容、檔案型態或權限漂移時會安全修復，不會沿著遭置換的符號連結寫入。 + +若平台中繼資料暫時先出現主機連接埠容器、尚未填入主要位址，管理器可讀取該精確執行中容器的網路命名空間。只有該網路設定之受管子網路內恰好一個 IPv4 位址可被接受，讀取後還會再次確認同一 Docker 容器 PID。缺少、歧義、超出子網路或生命週期競態都會安全失敗，並保留上一份可用的主機連接埠規則，直到中繼資料與 CNI 完成收斂。 + +### 防火牆後端 + +`FIREWALL_BACKEND` 預設為 `auto`，依 Docker 實際防火牆驅動程式選擇單一路徑：Docker 原生 `nftables` 使用原生 nft 規則；Docker `iptables` 驅動程式則辨識哪一套前端擁有 Docker 現役 NAT 鏈。任何受支援主機（包括 Ubuntu 26.04 及更新版）都可能使用 `iptables-nft` 或 `iptables-legacy`；作業系統版本、執行檔存在或尚未載入的核心模組，均不足以決定後端。需要固定路徑時可選： + +- `nftables`：Docker 原生 nftables 防火牆後端，**不是** iptables-nft 相容命令。 +- `iptables-nft`：由 nf_tables 支援的 xtables 相容命令，搭配 Docker 的 iptables 防火牆驅動程式。 +- `iptables-legacy`：只在現役 Docker 確實透過這套前端持有規則時選用。 + +選擇與 Docker 實際後端不符或無法判定時，管理器會拒絕啟動，不會自動降級、切換 Docker 後端或載入 legacy 模組。Ubuntu 26.04 及更新版若已使用 `iptables-legacy` 或 `iptables-nft`，就應維持現役 Docker 路徑；不能只因系統較新便替它切成原生 nftables。刻意遷移須另外準備主機變更、回復點及網路生命週期驗收。 + +主機 NAT 與主機連接埠的 `CATTLE_*` 規則鏈只由此管理器維護；三種後端的來源位址轉換規則都排除受管 overlay 子網路內的目的位址。每主機子網路還會排除其他有效主機的已驗證子網路，並加入限定來源與目的子網路的轉送例外；非現役主機不列入，現役主機若缺少標籤或子網路重疊則安全地拒絕套用。此網路只提供路由、不加密，須另行保護主機間傳輸。IPsec 主機 XFRM 路由器不得再插入補丁規則。升級時應先升級網路服務，逐台確認管理器健康，再升級相符的 IPsec 加密網路版本。 + +只有 CNI 中繼資料明確設定 `allowSharedSubnetIngress: true` 時才啟用共用子網路輸入轉送；為維持既有固定子網路契約相容性，同時具有 `bridgeSubnet` 與 `hostNat: true` 的舊設定也會採用相同行為。使用主機標籤決定子網路時會拒絕此選項，只信任已驗證的現役對端範圍。 + +使用 Docker 原生 nftables 前，必須先在主機 Docker 設定加入 `"firewall-backend": "nftables"` 及 `"bridge-accept-fwmark": "0x1068/0x1068"`，再升級此堆疊。還須在主機持久設定 `net.ipv4.ip_forward=1`，並於重開機後確認仍啟用；Docker 原生 nftables 後端不會代為啟用 IPv4 轉送。此標記讓 Docker 網橋轉送規則接受管理器發布的主機連接埠流量；範本無法替主機設定 Docker daemon 或核心參數。切換前還須檢查並明確遷移殘留的 `iptables-nft FORWARD DROP` 全域政策與舊平台掛鉤。管理器遇到混用狀態會拒絕啟動，不會自行修改主機全域防火牆政策。Docker 原生 nftables 目前仍屬實驗性功能，正式環境使用前應針對安裝的 Docker 版本完成驗收。 + +### 其他設定 + +- `DOCKER_BRIDGE`：受管工作負載使用的主機網橋。 +- `DNS_RECURSER_TIMEOUT`、`TTL`：上游 DNS 逾時與服務探索快取時間。 +- `CPU_PERIOD`、`CPU_QUOTA`：中繼資料服務的 CPU 排程限制。 +- `RELOAD_INTERVAL_LIMIT`、`ARP_SYNC_INTERVAL`：中繼資料重新載入與主機 ARP 協調間隔。 + +網路外掛管理器仍需主機網路、主機 PID、Docker Socket、Docker 狀態、核心模組與執行環境掛載，以及共用 CNI 磁碟區。中繼資料服務僅在指派連結本機位址時以 root 啟動，之後切換為 UID/GID 10001；內部 DNS 與其共用網路命名空間。`rancher-compose.yml`、`io.rancher.*`、`CATTLE_*` 備援變數、`/var/lib/rancher` CA 路徑及 `rancher-cni-driver` 磁碟區是既有協定的相容契約，不代表必須使用 legacy 防火牆規則。 + +範本檔案採 MIT 授權；管理器、中繼資料服務與內部 DNS 保留 Apache-2.0 授權及隨附相依套件聲明。部署前應以 `catalog-images.json` 核對映像來源與記錄的 manifest digest。 + +中繼資料與 DNS 容器由 Server 生命週期管理。網路管理器不再刪除升級期間並存的執行個體，並在中繼資料恢復前保持未就緒狀態。完成升級前仍須確認服務健康；映像發布不代表實機驗收已完成。 + +Driver 停止／啟動事件與定期協調都會重新選擇 provider；只有本機合法、執行中且具有效程序 ID 的 provider 能被選用。暫時的中繼資料或 Docker 檢查錯誤會明確回報並重試；其他 driver 暫時不可用，不得阻擋不同執行檔的健康 provider。選擇 provider 不會變更主機防火牆模式或管理者設定。 diff --git a/infra-templates/network-services/15/docker-compose.yml.tpl b/infra-templates/network-services/15/docker-compose.yml.tpl new file mode 100644 index 000000000..30fa7fd81 --- /dev/null +++ b/infra-templates/network-services/15/docker-compose.yml.tpl @@ -0,0 +1,95 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + network-plugin-manager: + image: ghcr.io/pasturestack/network-plugin-manager:v0.8.25 + privileged: true + network_mode: host + pid: host + command: + - network-plugin-manager + - --metadata-url + - http://169.254.169.250/2016-07-29 + - --arpsync-interval + - '${ARP_SYNC_INTERVAL}' + - --firewall-backend + - '${FIREWALL_BACKEND}' + environment: + DOCKER_BRIDGE: '${DOCKER_BRIDGE}' + METADATA_IP: 169.254.169.250 + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - /var/lib/docker:/var/lib/docker + - /lib/modules:/lib/modules:ro + - /run:/run + - /var/run:/var/run + - rancher-cni-driver:/etc/cni + - rancher-cni-driver:/opt/cni + labels: + io.pasturestack.component: network-plugin-manager + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + + metadata: + image: ghcr.io/pasturestack/metadata-service:v0.10.7 + user: root + cap_add: + - NET_ADMIN + network_mode: bridge + command: + - /bin/bash + - -ec + - | + export PLATFORM_URL="$${PLATFORM_URL:-$${CATTLE_URL:-}}" + export PLATFORM_ACCESS_KEY="$${PLATFORM_ACCESS_KEY:-$${CATTLE_ACCESS_KEY:-}}" + export PLATFORM_SECRET_KEY="$${PLATFORM_SECRET_KEY:-$${CATTLE_SECRET_KEY:-}}" + exec metadata-service --reload-interval-limit="${RELOAD_INTERVAL_LIMIT}" --subscribe + environment: + PLATFORM_CA_ROOT: /var/lib/rancher/etc/ssl/ca.crt + labels: + io.pasturestack.component: metadata-service + io.rancher.sidekicks: dns + io.rancher.container.create_agent: 'true' + io.rancher.scheduler.global: 'true' + io.rancher.container.agent_service.metadata: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + sysctls: + net.ipv4.conf.all.send_redirects: '0' + net.ipv4.conf.default.send_redirects: '0' + cpu_period: ${CPU_PERIOD} + cpu_quota: ${CPU_QUOTA} + + dns: + image: ghcr.io/pasturestack/internal-dns:v0.17.15 + network_mode: container:metadata + command: + - internal-dns + - --listen + - 169.254.169.250:53 + - --recurser-timeout + - '${DNS_RECURSER_TIMEOUT}' + - --ttl + - '${TTL}' + environment: + PLATFORM_METADATA_ENABLED: 'true' + PLATFORM_METADATA_URL: http://localhost/2016-07-29 + PLATFORM_METADATA_ANSWER: 169.254.169.250 + NEVER_RECURSE_TO: 169.254.169.250 + PLATFORM_DNS_ANSWERS_FILE: /etc/internal-dns/answers.json + labels: + io.pasturestack.component: internal-dns + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' diff --git a/infra-templates/network-services/15/rancher-compose.yml b/infra-templates/network-services/15/rancher-compose.yml new file mode 100644 index 000000000..601b3dddd --- /dev/null +++ b/infra-templates/network-services/15/rancher-compose.yml @@ -0,0 +1,77 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Network Services + version: v0.3.13 + description: Install host networking, metadata, and internal DNS services required by managed workloads. + minimum_rancher_version: v1.6.26-rc1 + labels: + io.pasturestack.catalog.question.docker_bridge.label.zh-tw: 'Docker 網橋' + io.pasturestack.catalog.question.docker_bridge.description.zh-tw: '受管工作負載流量使用的主機網橋。' + io.pasturestack.catalog.question.firewall_backend.label.zh-tw: '主機防火牆後端' + io.pasturestack.catalog.question.firewall_backend.description.zh-tw: '依 Docker 現役後端自動選擇；不論 Ubuntu 版本，原生 nftables、iptables-nft 與 iptables-legacy 互不混用。切換原生 nftables 前須先設定 Docker bridge-accept-fwmark。' + io.pasturestack.catalog.question.dns_recurser_timeout.label.zh-tw: 'DNS 遞迴查詢逾時' + io.pasturestack.catalog.question.dns_recurser_timeout.description.zh-tw: '等待上游 DNS 查詢回應的秒數。' + io.pasturestack.catalog.question.ttl.label.zh-tw: '服務探索 DNS 紀錄存留時間' + io.pasturestack.catalog.question.ttl.description.zh-tw: '內部服務探索 DNS 回應可保留的秒數。' + io.pasturestack.catalog.question.cpu_period.label.zh-tw: '中繼資料服務 CPU 週期' + io.pasturestack.catalog.question.cpu_period.description.zh-tw: '分配給每個中繼資料服務執行個體的 CPU 排程週期。' + io.pasturestack.catalog.question.cpu_quota.label.zh-tw: '中繼資料服務 CPU 配額' + io.pasturestack.catalog.question.cpu_quota.description.zh-tw: '分配給每個中繼資料服務執行個體的 CPU 配額。' + io.pasturestack.catalog.question.reload_interval_limit.label.zh-tw: '中繼資料重新載入間隔' + io.pasturestack.catalog.question.reload_interval_limit.description.zh-tw: '兩次中繼資料設定重新載入之間的最短毫秒數。' + io.pasturestack.catalog.question.arp_sync_interval.label.zh-tw: 'ARP 同步間隔' + io.pasturestack.catalog.question.arp_sync_interval.description.zh-tw: '兩次主機 ARP 協調作業之間的秒數。' + questions: + - variable: DOCKER_BRIDGE + label: Docker bridge + description: Host bridge used for managed workload traffic. + type: string + default: docker0 + required: true + - variable: FIREWALL_BACKEND + label: Host firewall backend + description: Follow Docker's active firewall backend on any supported Ubuntu version, or explicitly select native nftables, iptables-nft, or iptables-legacy. A mismatch fails safely; native nftables requires Docker bridge-accept-fwmark on the host. + type: enum + default: auto + required: true + options: + - auto + - nftables + - iptables-nft + - iptables-legacy + - variable: DNS_RECURSER_TIMEOUT + label: DNS recursion timeout + description: Seconds allowed for an upstream DNS query. + type: int + default: 2 + required: true + - variable: TTL + label: Service discovery TTL + description: Seconds that internal service-discovery answers remain valid. + type: int + default: 1 + required: true + - variable: CPU_PERIOD + label: Metadata CPU period + description: CPU scheduler period assigned to each metadata service instance. + type: int + default: 400000 + required: true + - variable: CPU_QUOTA + label: Metadata CPU quota + description: CPU quota assigned to each metadata service instance. + type: int + default: 200000 + required: true + - variable: RELOAD_INTERVAL_LIMIT + label: Metadata reload interval + description: Minimum milliseconds between metadata configuration reloads. + type: int + default: 1000 + required: true + - variable: ARP_SYNC_INTERVAL + label: ARP synchronization interval + description: Seconds between host ARP reconciliation passes. + type: int + default: 5 + required: true diff --git a/infra-templates/network-services/config.yml b/infra-templates/network-services/config.yml index ebd938618..9832e0c7f 100644 --- a/infra-templates/network-services/config.yml +++ b/infra-templates/network-services/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Network Services description: Install host networking, metadata, and internal DNS services required by managed workloads. -version: v0.3.12 +version: v0.3.13 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 images and third-party package licenses apply diff --git a/infra-templates/per-host-subnet-network/7/README.md b/infra-templates/per-host-subnet-network/7/README.md new file mode 100644 index 000000000..4782cda77 --- /dev/null +++ b/infra-templates/per-host-subnet-network/7/README.md @@ -0,0 +1,11 @@ + + +# Per-Host Subnet Network + +This driver routes managed host subnets without encryption. Network Plugin Manager retains host NAT and host-port ownership. + +Numeric revision 7 (display version `v0.3.5`) uses the published image `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`. +Previous revision 6 and `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` remain available. +Questions, environment, resource parameters, volumes, permissions and plugin ownership are unchanged. +Exact publication records are in `catalog-images.json`; environment acceptance remains separate. + diff --git a/infra-templates/per-host-subnet-network/7/README.zh-TW.md b/infra-templates/per-host-subnet-network/7/README.zh-TW.md new file mode 100644 index 000000000..cc95460b7 --- /dev/null +++ b/infra-templates/per-host-subnet-network/7/README.zh-TW.md @@ -0,0 +1,11 @@ + + +# 每主機子網路 + +此 driver 路由受管主機子網路，不提供加密；主機 NAT 與主機連接埠仍由網路外掛管理器維護。 + +數字修訂 7（顯示版本 `v0.3.5`）使用已發布的 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`。 +舊修訂 6 及 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` 保留可用。 +問題、環境、資源參數、磁碟區、權限與 plugin 職責不變。 +精準發布記錄見 `catalog-images.json`，環境驗收仍須分開確認。 + diff --git a/infra-templates/per-host-subnet-network/7/docker-compose.yml.tpl b/infra-templates/per-host-subnet-network/7/docker-compose.yml.tpl new file mode 100644 index 000000000..f2903280f --- /dev/null +++ b/infra-templates/per-host-subnet-network/7/docker-compose.yml.tpl @@ -0,0 +1,78 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + per-host-subnet-controller: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + command: per-host-subnet + privileged: true + network_mode: host + pid: host + environment: + PLATFORM_DEBUG: '${PASTURESTACK_DEBUG}' + PLATFORM_METADATA_URL: http://169.254.169.250/2016-07-29 + PLATFORM_METADATA_STARTUP_TIMEOUT: '${METADATA_STARTUP_TIMEOUT}' + PLATFORM_WATCH_INTERVAL: '${WATCH_INTERVAL}' + PLATFORM_ENABLE_ROUTE_UPDATE: '${ENABLE_ROUTE_UPDATE}' + PLATFORM_ROUTE_UPDATE_PROVIDER: host-gateway + labels: + io.pasturestack.component: per-host-subnet-controller + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + + per-host-subnet-cni: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + command: start-cni-driver.sh + privileged: true + network_mode: host + pid: host + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + labels: + io.pasturestack.component: per-host-subnet-cni + io.rancher.network.cni.binary: pasture-bridge + io.rancher.container.dns: 'true' + io.rancher.scheduler.global: 'true' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - rancher-cni-driver:/opt/cni-driver + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + network_driver: + name: PastureStack Per-Host Subnet Network + default_network: + name: per-host-subnet + host_ports: {{ .Values.HOST_PORTS }} + dns: + - 169.254.169.250 + dns_search: + - pasture.internal + cni_config: + '10-pasturestack-per-host-subnet.conf': + name: pasturestack-per-host-subnet-network + type: pasture-bridge + bridge: ${BRIDGE} + bridgeSubnet: '__host_label__: io.pasturestack.network.per-host-subnet.subnet' + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + isDefaultGateway: true + hostNat: {{ .Values.HOST_NAT }} + hairpinMode: {{ .Values.HAIRPIN_MODE }} + promiscMode: {{ .Values.PROMISCUOUS_MODE }} + mtu: ${MTU} + ipam: + type: host-local-cni-ipam + subnet: '__host_label__: io.pasturestack.network.per-host-subnet.subnet' + rangeStart: '__host_label__: io.pasturestack.network.per-host-subnet.range-start' + rangeEnd: '__host_label__: io.pasturestack.network.per-host-subnet.range-end' + dataDir: /opt/cni/state + metadataURL: http://169.254.169.250/2016-07-29 + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' diff --git a/infra-templates/per-host-subnet-network/7/rancher-compose.yml b/infra-templates/per-host-subnet-network/7/rancher-compose.yml new file mode 100644 index 000000000..7e3b90acc --- /dev/null +++ b/infra-templates/per-host-subnet-network/7/rancher-compose.yml @@ -0,0 +1,88 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack Per-Host Subnet Network + version: v0.3.5 + description: Assign a distinct workload subnet to each host and maintain host-gateway routes between hosts. + minimum_rancher_version: v1.6.26-rc1 + labels: + io.pasturestack.catalog.question.bridge.label.zh-tw: '工作負載網橋' + io.pasturestack.catalog.question.bridge.description.zh-tw: '每台主機的受管工作負載子網路使用的主機網橋。' + io.pasturestack.catalog.question.mtu.label.zh-tw: '網路 MTU' + io.pasturestack.catalog.question.mtu.description.zh-tw: '所有參與主機之間端對端支援的 MTU。' + io.pasturestack.catalog.question.enable_route_update.label.zh-tw: '維護主機路由' + io.pasturestack.catalog.question.enable_route_update.description.zh-tw: '維護前往其他主機工作負載子網路且帶有專用標記的主機閘道路由。' + io.pasturestack.catalog.question.host_nat.label.zh-tw: '啟用主機 NAT' + io.pasturestack.catalog.question.host_nat.description.zh-tw: '對離開各主機專用工作負載子網路的流量套用主機 NAT。' + io.pasturestack.catalog.question.host_ports.label.zh-tw: '啟用主機連接埠' + io.pasturestack.catalog.question.host_ports.description.zh-tw: '允許受管工作負載在主機上公開連接埠。' + io.pasturestack.catalog.question.hairpin_mode.label.zh-tw: '啟用 Hairpin 模式' + io.pasturestack.catalog.question.hairpin_mode.description.zh-tw: 'Hairpin 模式與混雜模式不可同時啟用。' + io.pasturestack.catalog.question.promiscuous_mode.label.zh-tw: '啟用混雜模式' + io.pasturestack.catalog.question.promiscuous_mode.description.zh-tw: '混雜模式與 Hairpin 模式不可同時啟用。' + io.pasturestack.catalog.question.metadata_startup_timeout.label.zh-tw: '中繼資料服務啟動逾時' + io.pasturestack.catalog.question.metadata_startup_timeout.description.zh-tw: '控制器結束前，等待中繼資料服務可用的最長時間。' + io.pasturestack.catalog.question.watch_interval.label.zh-tw: '中繼資料監看間隔' + io.pasturestack.catalog.question.watch_interval.description.zh-tw: '協調主機路由時使用的重試及長輪詢間隔。' + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的子網路、路由與 CNI 操作診斷資訊。' + questions: + - variable: BRIDGE + label: Workload bridge + description: Host bridge used for each host's managed workload subnet. + type: string + default: docker0 + required: true + - variable: MTU + label: Network MTU + description: MTU supported end to end between all participating hosts. + type: int + default: 1500 + required: true + - variable: ENABLE_ROUTE_UPDATE + label: Maintain host routes + description: Maintain marked host-gateway routes for the other hosts' workload subnets. + type: boolean + default: 'true' + required: true + - variable: HOST_NAT + label: Enable host NAT + description: Apply host NAT to traffic leaving each host-specific workload subnet. + type: boolean + default: 'true' + required: true + - variable: HOST_PORTS + label: Enable host ports + description: Allow managed workloads to publish ports on their hosts. + type: boolean + default: 'true' + required: true + - variable: HAIRPIN_MODE + label: Enable hairpin mode + description: Hairpin mode and promiscuous mode must not both be enabled. + type: boolean + default: 'false' + required: true + - variable: PROMISCUOUS_MODE + label: Enable promiscuous mode + description: Promiscuous mode and hairpin mode must not both be enabled. + type: boolean + default: 'true' + required: true + - variable: METADATA_STARTUP_TIMEOUT + label: Metadata startup timeout + description: Maximum time to wait for the metadata service before the controller exits. + type: string + default: 2m + required: true + - variable: WATCH_INTERVAL + label: Metadata watch interval + description: Retry and long-poll interval used while reconciling host routes. + type: string + default: 5s + required: true + - variable: PASTURESTACK_DEBUG + label: Enable debug logs + description: Enable verbose diagnostics for subnet, route, and CNI operations. + type: boolean + default: 'false' + required: true diff --git a/infra-templates/per-host-subnet-network/config.yml b/infra-templates/per-host-subnet-network/config.yml index 6a8ee8f56..9f19c8403 100644 --- a/infra-templates/per-host-subnet-network/config.yml +++ b/infra-templates/per-host-subnet-network/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: Per-Host Subnet Network description: Assign a distinct workload subnet to each host and maintain host-gateway routes between hosts. -version: v0.3.4 +version: v0.3.5 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and bundled component licenses apply diff --git a/infra-templates/resource-scheduler/8/README.md b/infra-templates/resource-scheduler/8/README.md new file mode 100644 index 000000000..a9e746bde --- /dev/null +++ b/infra-templates/resource-scheduler/8/README.md @@ -0,0 +1,11 @@ + + +# Resource Scheduler + +This infrastructure agent schedules native workloads from control-plane events and current Metadata state. + +Numeric revision 8 (display version `v0.8.22`) uses the published image `ghcr.io/pasturestack/resource-scheduler:v0.8.22`. +Previous revision 7 and `ghcr.io/pasturestack/resource-scheduler:v0.8.21` remain available. +Questions, environment, resource parameters, volumes, permissions and plugin ownership are unchanged. +Exact publication records are in `catalog-images.json`; environment acceptance remains separate. + diff --git a/infra-templates/resource-scheduler/8/README.zh-TW.md b/infra-templates/resource-scheduler/8/README.zh-TW.md new file mode 100644 index 000000000..f86501dec --- /dev/null +++ b/infra-templates/resource-scheduler/8/README.zh-TW.md @@ -0,0 +1,11 @@ + + +# 資源排程器 + +此基礎架構代理程式依控制平面事件與目前中繼資料狀態排程原生工作負載。 + +數字修訂 8（顯示版本 `v0.8.22`）使用已發布的 `ghcr.io/pasturestack/resource-scheduler:v0.8.22`。 +舊修訂 7 及 `ghcr.io/pasturestack/resource-scheduler:v0.8.21` 保留可用。 +問題、環境、資源參數、磁碟區、權限與 plugin 職責不變。 +精準發布記錄見 `catalog-images.json`，環境驗收仍須分開確認。 + diff --git a/infra-templates/resource-scheduler/8/docker-compose.yml b/infra-templates/resource-scheduler/8/docker-compose.yml new file mode 100644 index 000000000..e9bb7a574 --- /dev/null +++ b/infra-templates/resource-scheduler/8/docker-compose.yml @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: MIT +version: '2' +services: + resource-scheduler: + image: ghcr.io/pasturestack/resource-scheduler:v0.8.22 + command: resource-scheduler --metadata-address 169.254.169.250 + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + labels: + io.rancher.container.create_agent: 'true' + io.rancher.container.agent_service.scheduling: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' diff --git a/infra-templates/resource-scheduler/8/rancher-compose.yml b/infra-templates/resource-scheduler/8/rancher-compose.yml new file mode 100644 index 000000000..b33d47d49 --- /dev/null +++ b/infra-templates/resource-scheduler/8/rancher-compose.yml @@ -0,0 +1,75 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: Resource Scheduler + description: Schedule native workloads from control-plane events and current Metadata state. + version: v0.8.22 + minimum_rancher_version: v1.6.26-rc1 + labels: + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的排程器診斷資訊。' + io.pasturestack.catalog.question.healthcheck_interval.label.zh-tw: '健康檢查間隔' + io.pasturestack.catalog.question.healthcheck_interval.description.zh-tw: '兩次健康檢查之間的毫秒數。' + io.pasturestack.catalog.question.healthcheck_init_timeout.label.zh-tw: '初始化逾時' + io.pasturestack.catalog.question.healthcheck_init_timeout.description.zh-tw: '等待排程器初次就緒的毫秒數上限。' + io.pasturestack.catalog.question.healthcheck_reinit_timeout.label.zh-tw: '重新初始化逾時' + io.pasturestack.catalog.question.healthcheck_reinit_timeout.description.zh-tw: '等待排程器重新初始化的毫秒數上限。' + io.pasturestack.catalog.question.healthcheck_response_timeout.label.zh-tw: '回應逾時' + io.pasturestack.catalog.question.healthcheck_response_timeout.description.zh-tw: '等待單次健康檢查回應的毫秒數上限。' + io.pasturestack.catalog.question.healthcheck_unhealthy_threshold.label.zh-tw: '判定為不健康的失敗次數' + io.pasturestack.catalog.question.healthcheck_unhealthy_threshold.description.zh-tw: '連續失敗達到此次數時，將服務標示為不健康。' + io.pasturestack.catalog.question.healthcheck_healthy_threshold.label.zh-tw: '判定為健康的成功次數' + io.pasturestack.catalog.question.healthcheck_healthy_threshold.description.zh-tw: '連續成功達到此次數時，將服務標示為健康。' + questions: + - variable: PASTURESTACK_DEBUG + label: Enable debug logging + description: Enable verbose scheduler diagnostics. + type: boolean + default: false + required: true + - variable: HEALTHCHECK_INTERVAL + label: Health-check interval + description: Milliseconds between health checks. + type: int + default: 2000 + required: true + - variable: HEALTHCHECK_INIT_TIMEOUT + label: Initialization timeout + description: Milliseconds allowed for initial scheduler readiness. + type: int + default: 10000 + required: true + - variable: HEALTHCHECK_REINIT_TIMEOUT + label: Reinitialization timeout + description: Milliseconds allowed for scheduler reinitialization. + type: int + default: 10000 + required: true + - variable: HEALTHCHECK_RESPONSE_TIMEOUT + label: Response timeout + description: Milliseconds allowed for an individual health-check response. + type: int + default: 30000 + required: true + - variable: HEALTHCHECK_UNHEALTHY_THRESHOLD + label: Unhealthy threshold + description: Consecutive failed checks required to mark the service unhealthy. + type: int + default: 3 + required: true + - variable: HEALTHCHECK_HEALTHY_THRESHOLD + label: Healthy threshold + description: Consecutive successful checks required to mark the service healthy. + type: int + default: 2 + required: true + +resource-scheduler: + health_check: + request_line: GET /healthcheck HTTP/1.0 + port: 80 + interval: ${HEALTHCHECK_INTERVAL} + initializing_timeout: ${HEALTHCHECK_INIT_TIMEOUT} + reinitializing_timeout: ${HEALTHCHECK_REINIT_TIMEOUT} + response_timeout: ${HEALTHCHECK_RESPONSE_TIMEOUT} + unhealthy_threshold: ${HEALTHCHECK_UNHEALTHY_THRESHOLD} + healthy_threshold: ${HEALTHCHECK_HEALTHY_THRESHOLD} diff --git a/infra-templates/resource-scheduler/config.yml b/infra-templates/resource-scheduler/config.yml index 66a023b22..f89512511 100644 --- a/infra-templates/resource-scheduler/config.yml +++ b/infra-templates/resource-scheduler/config.yml @@ -1,6 +1,6 @@ # SPDX-License-Identifier: MIT name: Resource Scheduler -version: v0.8.21 +version: v0.8.22 category: System description: Schedule native workloads from control-plane events and current Metadata state. projectURL: https://github.com/PastureStack/resource-scheduler diff --git a/infra-templates/system-image-preloader/5/README.md b/infra-templates/system-image-preloader/5/README.md new file mode 100644 index 000000000..98a0e907f --- /dev/null +++ b/infra-templates/system-image-preloader/5/README.md @@ -0,0 +1,43 @@ + + +# System Image Preloader + +This global start-once service discovers system-stack image references and asks each host Docker daemon to cache absent images. + +Numeric revision 5 (display version `v0.3.4`) uses the published image `ghcr.io/pasturestack/system-image-preloader:v0.3.4`. +Previous revision 4 and `ghcr.io/pasturestack/system-image-preloader:v0.3.3` remain available. +Questions, environment, resource parameters, volumes, permissions and plugin ownership are unchanged. +Exact publication records are in `catalog-images.json`; environment acceptance remains separate. + +### Reviewed image + +- Image: `ghcr.io/pasturestack/system-image-preloader:v0.3.4` +- Source: [`PastureStack/system-image-preloader@624a45cd001a92cdf5132f487ba14e161dff40d2`](https://github.com/PastureStack/system-image-preloader/tree/624a45cd001a92cdf5132f487ba14e161dff40d2) +- Source license: Apache-2.0; Ubuntu, Docker CLI, `yq`, `gomplate`, and their + dependencies retain their upstream licenses and notices +- Security gate: full-severity scan, no available fix, no unreviewed finding or secret +- Distribution gate: public GHCR and anonymous version-tag manifest access + passed + +### Security boundary + +The service mounts `/var/run/docker.sock` read-write. Docker socket access is +equivalent to host administrator access, so deploy only the reviewed image and +restrict who can edit this stack. The service receives scoped compatibility API +credentials automatically and never enables credential-bearing shell tracing. + +Private-registry credentials are optional. When enabled, the selected host +Docker `config.json` is mounted read-only. Privileged mode remains off by +default and should be enabled only when required by the host security policy. +Image-pull retries and CPU-pressure waits are bounded. + +The compatible control plane requires the literal `rancher-compose.yml` +filename and `io.rancher.*` agent and scheduling labels in this template. They +are protocol identifiers, not PastureStack branding. + +### Validation + +Published image identity, runtime SBOM, raw and effective findings, and package +installation verification are recorded in `catalog-images.json`. Catalog source +and API contracts verify the new default and retained revisions. Managed-host +image caching, upgrade and rollback acceptance remain environment-specific. diff --git a/infra-templates/system-image-preloader/5/README.zh-TW.md b/infra-templates/system-image-preloader/5/README.zh-TW.md new file mode 100644 index 000000000..fb03af5d5 --- /dev/null +++ b/infra-templates/system-image-preloader/5/README.zh-TW.md @@ -0,0 +1,42 @@ + + +# 系統映像預先下載 + +此全域且啟動一次的服務會讀取系統堆疊映像參照，並請各主機 Docker daemon 快取尚未存在的映像。 + +數字修訂 5（顯示版本 `v0.3.4`）使用已發布的 `ghcr.io/pasturestack/system-image-preloader:v0.3.4`。 +舊修訂 4 及 `ghcr.io/pasturestack/system-image-preloader:v0.3.3` 保留可用。 +問題、環境、資源參數、磁碟區、權限與 plugin 職責不變。 +精準發布記錄見 `catalog-images.json`，環境驗收仍須分開確認。 + +### 已審核映像 + +- 映像：`ghcr.io/pasturestack/system-image-preloader:v0.3.4` +- 原始碼： + [`PastureStack/system-image-preloader@624a45cd001a92cdf5132f487ba14e161dff40d2`](https://github.com/PastureStack/system-image-preloader/tree/624a45cd001a92cdf5132f487ba14e161dff40d2) +- 原始碼採 Apache-2.0 授權；Ubuntu、Docker CLI、`yq`、`gomplate` + 及相依套件保留各自的上游授權及聲明。 +- 完整嚴重度掃描沒有可用修補、未審核項目或機密資料；官方尚無修補的 Low/Medium 持續追蹤。 +- 公開 GHCR 與未登入存取版本標籤的驗證已通過。 + +### 安全性界線 + +此服務需要以讀寫方式掛載 `/var/run/docker.sock`。Docker Socket +權限等同主機管理者權限，因此只能部署經審核的映像，並限制可編輯此 +堆疊的使用者。服務會自動取得範圍受限的相容 API 登入資訊，且不會 +啟用可能顯示登入資訊的 Shell 追蹤。 + +私有登錄登入資訊為選用功能。啟用後，選取的主機 Docker +`config.json` 會以唯讀方式掛載。特權模式預設關閉，只能在主機 +安全性政策確實要求時啟用。映像拉取重試與 CPU 使用量等待都有明確 +上限。 + +相容控制平面仍需要名為 `rancher-compose.yml` 的檔案及 +`io.rancher.*` 代理程式與排程標籤。這些是協定識別名稱，不是目前 +的產品品牌。 + +### 驗證 + +已發布映像身分、執行期 SBOM、原始與有效發現，以及套件安裝驗證均記錄於 +`catalog-images.json`。Catalog 來源與 API 契約驗證新版預設值及保留修訂。 +受管主機上的映像快取、升級與回復驗收，仍須依實際環境另外確認。 diff --git a/infra-templates/system-image-preloader/5/docker-compose.yml.tpl b/infra-templates/system-image-preloader/5/docker-compose.yml.tpl new file mode 100644 index 000000000..a1ec0ba3d --- /dev/null +++ b/infra-templates/system-image-preloader/5/docker-compose.yml.tpl @@ -0,0 +1,34 @@ +# SPDX-License-Identifier: MIT +version: '2' +services: + system-image-preloader: + image: ghcr.io/pasturestack/system-image-preloader:v0.3.4 + {{ if eq .Values.PRIVILEGED "true"}} + privileged: true + {{ end}} + environment: + CHECK_CPU_USAGE: '${CHECK_CPU_USAGE}' + CPU_USAGE_MAX: '${CPU_USAGE_MAX}' + CPU_USAGE_SLEEP: '${CPU_USAGE_SLEEP}' + CPU_WAIT_MAX_ATTEMPTS: '${CPU_WAIT_MAX_ATTEMPTS}' + IMAGE_PULL_MAX_ATTEMPTS: '${IMAGE_PULL_MAX_ATTEMPTS}' + IMAGE_PULL_RETRY_DELAY_SECONDS: '${IMAGE_PULL_RETRY_DELAY_SECONDS}' + PLATFORM_AGENT_IMAGE: '${PLATFORM_AGENT_IMAGE}' + PLATFORM_TLS_VERIFY: '${PLATFORM_TLS_VERIFY}' + PLATFORM_VERSION: '${PLATFORM_VERSION}' + RANDOM_SLEEP: '${RANDOM_SLEEP}' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + {{ if eq .Values.MOUNT_DOCKER_CONFIG "true"}} + - ${DOCKER_CONFIG_LOCATION}:/root/.docker/config.json:ro + {{ end}} + labels: + io.rancher.container.agent.role: environment + io.rancher.container.start_once: 'true' + io.rancher.container.create_agent: 'true' + io.rancher.scheduler.global: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' diff --git a/infra-templates/system-image-preloader/5/rancher-compose.yml b/infra-templates/system-image-preloader/5/rancher-compose.yml new file mode 100644 index 000000000..3bf64c334 --- /dev/null +++ b/infra-templates/system-image-preloader/5/rancher-compose.yml @@ -0,0 +1,116 @@ +# SPDX-License-Identifier: MIT +version: '2' +.catalog: + name: PastureStack System Image Preloader + version: v0.3.4 + description: Preload the container images required by compatible infrastructure stacks. + minimum_rancher_version: v1.6.15-rc1 + labels: + io.pasturestack.catalog.question.check_cpu_usage.label.zh-tw: '拉取前檢查 CPU 使用率' + io.pasturestack.catalog.question.check_cpu_usage.description.zh-tw: '主機 CPU 使用率高於設定上限時暫停等待。' + io.pasturestack.catalog.question.cpu_usage_max.label.zh-tw: 'CPU 使用率上限' + io.pasturestack.catalog.question.cpu_usage_max.description.zh-tw: '開始拉取映像前可接受的最高主機 CPU 使用率百分比。' + io.pasturestack.catalog.question.cpu_usage_sleep.label.zh-tw: 'CPU 檢查重試間隔' + io.pasturestack.catalog.question.cpu_usage_sleep.description.zh-tw: '兩次 CPU 使用率檢查之間等待的秒數。' + io.pasturestack.catalog.question.cpu_wait_max_attempts.label.zh-tw: 'CPU 檢查次數上限' + io.pasturestack.catalog.question.cpu_wait_max_attempts.description.zh-tw: '達到此檢查次數仍無法拉取時，以錯誤結束。' + io.pasturestack.catalog.question.image_pull_max_attempts.label.zh-tw: '映像拉取次數上限' + io.pasturestack.catalog.question.image_pull_max_attempts.description.zh-tw: '每個映像拉取失敗達到此次數時，以錯誤結束。' + io.pasturestack.catalog.question.image_pull_retry_delay_seconds.label.zh-tw: '映像拉取重試間隔' + io.pasturestack.catalog.question.image_pull_retry_delay_seconds.description.zh-tw: '映像拉取失敗後等待的秒數。' + io.pasturestack.catalog.question.mount_docker_config.label.zh-tw: '掛載 Docker 用戶端設定' + io.pasturestack.catalog.question.mount_docker_config.description.zh-tw: '從選取的主機檔案讀取私有登錄登入資訊。' + io.pasturestack.catalog.question.docker_config_location.label.zh-tw: 'Docker 用戶端設定路徑' + io.pasturestack.catalog.question.docker_config_location.description.zh-tw: 'Docker 用戶端 config.json 檔案的主機絕對路徑。' + io.pasturestack.catalog.question.privileged.label.zh-tw: '以特權模式執行' + io.pasturestack.catalog.question.privileged.description.zh-tw: '只有主機安全性政策確實要求時才能啟用。' + io.pasturestack.catalog.question.random_sleep.label.zh-tw: '分散各主機的映像拉取時間' + io.pasturestack.catalog.question.random_sleep.description.zh-tw: '依中繼資料為各主機加入不同的隨機延遲。' + io.pasturestack.catalog.question.platform_agent_image.label.zh-tw: '其他代理程式映像' + io.pasturestack.catalog.question.platform_agent_image.description.zh-tw: '基礎架構映像完成後要額外預先下載的選用語意化映像標籤。' + io.pasturestack.catalog.question.platform_version.label.zh-tw: '相容平台版本' + io.pasturestack.catalog.question.platform_version.description.zh-tw: '選取相容商店範本修訂版時使用的平台版本。' + io.pasturestack.catalog.question.platform_tls_verify.label.zh-tw: '驗證平台 TLS 憑證' + io.pasturestack.catalog.question.platform_tls_verify.description.zh-tw: '要求相容 API 使用受信任的 TLS 憑證。' + questions: + - variable: CHECK_CPU_USAGE + label: Check CPU usage before pulling + description: Wait while host CPU usage is above the configured limit. + type: boolean + default: true + required: true + - variable: CPU_USAGE_MAX + label: Maximum CPU usage + description: Highest host CPU usage percentage accepted before a pull. + type: int + default: 75 + required: true + - variable: CPU_USAGE_SLEEP + label: CPU retry delay + description: Seconds to wait between CPU usage checks. + type: int + default: 30 + required: true + - variable: CPU_WAIT_MAX_ATTEMPTS + label: Maximum CPU checks + description: Stop with an error after this many CPU usage checks. + type: int + default: 60 + required: true + - variable: IMAGE_PULL_MAX_ATTEMPTS + label: Maximum image pull attempts + description: Stop with an error after this many failed pulls per image. + type: int + default: 5 + required: true + - variable: IMAGE_PULL_RETRY_DELAY_SECONDS + label: Image pull retry delay + description: Seconds to wait after a failed image pull. + type: int + default: 10 + required: true + - variable: MOUNT_DOCKER_CONFIG + label: Mount a Docker client configuration + description: Read private-registry credentials from the selected host file. + type: boolean + default: false + required: true + - variable: DOCKER_CONFIG_LOCATION + label: Docker client configuration path + description: Absolute host path of the Docker client config.json file. + type: string + default: /root/.docker/config.json + required: true + - variable: PRIVILEGED + label: Run in privileged mode + description: Enable only when the host security policy requires it. + type: boolean + default: false + required: true + - variable: RANDOM_SLEEP + label: Stagger image pulls between hosts + description: Add a metadata-derived random delay between image pulls. + type: boolean + default: false + required: true + - variable: PLATFORM_AGENT_IMAGE + label: Additional agent image + description: Optional semantic image tag to preload after infrastructure images. + type: string + default: '' + required: false + - variable: PLATFORM_VERSION + label: Compatible platform version + description: Version used when selecting compatible Catalog template revisions. + type: string + default: v1.6.282 + required: true + - variable: PLATFORM_TLS_VERIFY + label: Verify platform TLS certificates + description: Require a trusted certificate for compatibility API requests. + type: boolean + default: false + required: true + +system-image-preloader: + start_on_create: true diff --git a/infra-templates/system-image-preloader/config.yml b/infra-templates/system-image-preloader/config.yml index 40a4d78cb..7e2129d11 100644 --- a/infra-templates/system-image-preloader/config.yml +++ b/infra-templates/system-image-preloader/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: System Image Preloader description: Preload the container images required by compatible infrastructure stacks. -version: v0.3.3 +version: v0.3.4 category: System maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and bundled dependency licenses apply diff --git a/infra-templates/vxlan-overlay-network/8/README.md b/infra-templates/vxlan-overlay-network/8/README.md new file mode 100644 index 000000000..178cc5293 --- /dev/null +++ b/infra-templates/vxlan-overlay-network/8/README.md @@ -0,0 +1,46 @@ + + +# VXLAN Overlay Network + +This driver provides an unencrypted UDP 4789 overlay while preserving the existing CNI and firewall boundaries. + +Numeric revision 8 (display version `v0.3.6`) uses the published image `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`. +Previous revision 7 and `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` remain available. +Questions, environment, resource parameters, volumes, permissions and plugin ownership are unchanged. +Exact publication records are in `catalog-images.json`; environment acceptance remains separate. + +### Reviewed image + +- Image: `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42` +- Template version `5` explicitly declares `allowSharedSubnetIngress: true` for the fixed `10.42.0.0/16` CNI network. Network Plugin Manager `v0.8.20` uses this bounded contract for cross-host workload forwarding; version `4` remains available for existing stacks. +- Source: [`PastureStack/ipsec-vxlan-overlay-network@9500770cb74817666aba2ce198ab1b4e064b3c88`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/9500770cb74817666aba2ce198ab1b4e064b3c88) +- Source license: Apache-2.0; Ubuntu, CNI, Weave, and bundled dependencies retain their upstream licenses and notices +- Security gate: Trivy HIGH 0, CRITICAL 0, image secrets 0, and personal-marker scan passed +- Runtime gate: the earlier version passed isolated two-node VXLAN forwarding; repeat the managed lifecycle gate for this new image before treating it as production-ready + +### Security and network boundary + +VXLAN encapsulates traffic but does not encrypt or authenticate it. Use this +driver only on a trusted host network. Every participating host must allow +inbound and outbound UDP port `4789`. Select the IPsec template when encrypted +host-to-host traffic is required. + +The router receives `NET_ADMIN` in the network-holder namespace. The CNI +sidecar is privileged, joins the host network and PID namespaces, and accesses +the Docker socket so it can install and operate the compatibility CNI path. +These permissions must not be copied to ordinary workloads. + +The managed network is `10.42.0.0/16`. This release intentionally does not +expose a subnet selector because the reviewed startup path does not safely +honor arbitrary subnets. Network Plugin Manager alone consumes the explicit +shared-subnet ingress contract and owns the corresponding host forwarding +rule; the VXLAN router remains confined to its data-plane namespace. + +### Compatibility boundary + +The literal `rancher-compose.yml` filename, `minimum_rancher_version` key, +required `io.rancher.*` orchestration labels, and `rancher-cni-driver` shared +volume are consumed by the compatible control plane. They are protocol +identifiers, not PastureStack branding. User-facing names, image coordinates, +environment variables, CNI names, log paths, and the `pasture.internal` search +suffix use current PastureStack identifiers. diff --git a/infra-templates/vxlan-overlay-network/8/README.zh-TW.md b/infra-templates/vxlan-overlay-network/8/README.zh-TW.md new file mode 100644 index 000000000..8ff5c97ee --- /dev/null +++ b/infra-templates/vxlan-overlay-network/8/README.zh-TW.md @@ -0,0 +1,47 @@ + + +# VXLAN 覆疊網路 + +此 driver 提供未加密的 UDP 4789 覆疊網路，並保留既有 CNI 與防火牆界線。 + +數字修訂 8（顯示版本 `v0.3.6`）使用已發布的 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42`。 +舊修訂 7 及 `ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41` 保留可用。 +問題、環境、資源參數、磁碟區、權限與 plugin 職責不變。 +精準發布記錄見 `catalog-images.json`，環境驗收仍須分開確認。 + +### 已審核映像 + +- 映像：`ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42` +- 第 `5` 版為固定的 `10.42.0.0/16` CNI 網路明確設定 + `allowSharedSubnetIngress: true`。網路外掛管理器 `v0.8.20` 依此有限 + 契約處理跨主機工作負載轉送；第 `4` 版仍供既有堆疊使用。 +- 原始碼： + [`PastureStack/ipsec-vxlan-overlay-network@9500770cb74817666aba2ce198ab1b4e064b3c88`](https://github.com/PastureStack/ipsec-vxlan-overlay-network/tree/9500770cb74817666aba2ce198ab1b4e064b3c88) +- 原始碼採 Apache-2.0 授權；Ubuntu、CNI、Weave 及隨附相依套件 + 保留各自的上游授權及聲明。 +- Trivy 結果為 HIGH 0、CRITICAL 0，映像機密資料與個人識別標記 + 掃描均已通過。 +- 舊版已通過隔離雙節點 VXLAN 轉送；此新版映像仍須重新完成受管生命週期驗收，才能宣稱適合正式環境。 + +### 安全性與網路界線 + +VXLAN 只封裝流量，不提供加密或身分驗證。此驅動程式只能用於受信任 +的主機網路，每台參與主機都必須允許 UDP `4789` 的輸入及輸出流量。 +需要主機間加密時，請改用 IPsec 加密網路範本。 + +路由器在網路持有服務的命名空間中使用 `NET_ADMIN`。CNI 相關容器 +使用特權模式、加入主機網路與 PID 命名空間，並存取 Docker Socket +以安裝及操作相容 CNI 路徑。這些權限不得套用到一般工作負載。 + +受管網路為 `10.42.0.0/16`。經審核的啟動流程無法安全套用任意 +子網路，因此此版本不提供無效的子網路選項。只有網路外掛管理器會 +處理明確的共用子網路輸入契約及相對應的主機轉送規則；VXLAN 路由器 +仍只在自己的資料平面命名空間內運作。 + +### 相容性界線 + +`rancher-compose.yml`、`minimum_rancher_version`、必要的 +`io.rancher.*` 編排標籤及 `rancher-cni-driver` 共用磁碟區是相容 +控制平面使用的協定識別名稱，不是目前的產品品牌。使用者可見名稱、 +映像位置、環境變數、CNI 名稱、日誌路徑及 `pasture.internal` +搜尋後綴均採 PastureStack 名稱。 diff --git a/infra-templates/vxlan-overlay-network/8/docker-compose.yml.tpl b/infra-templates/vxlan-overlay-network/8/docker-compose.yml.tpl new file mode 100644 index 000000000..636725f89 --- /dev/null +++ b/infra-templates/vxlan-overlay-network/8/docker-compose.yml.tpl @@ -0,0 +1,97 @@ +# SPDX-License-Identifier: MIT +version: '2' + +services: + vxlan-network: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + command: + - /bin/bash + - -c + - 'mkfifo /tmp/overlay-log; exec cat /tmp/overlay-log' + network_mode: vxlan + ports: + - 4789:4789/udp + labels: + io.pasturestack.component: vxlan-overlay + io.rancher.sidekicks: vxlan-router + io.rancher.scheduler.global: 'true' + io.rancher.cni.link_mtu_overhead: '0' + io.rancher.internal.service.vxlan: 'true' + io.rancher.service.selector.link: io.rancher.internal.service.vxlan=true + io.rancher.network.macsync: 'true' + io.rancher.network.arpsync: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + + vxlan-router: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + command: start-vxlan.sh + cap_add: + - NET_ADMIN + network_mode: container:vxlan-network + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + sysctls: + net.ipv4.conf.all.send_redirects: '0' + net.ipv4.conf.default.send_redirects: '0' + + cni-driver: + image: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42 + command: start-cni-driver.sh + privileged: true + network_mode: host + pid: host + environment: + PASTURESTACK_DEBUG: '${PASTURESTACK_DEBUG}' + labels: + io.pasturestack.component: vxlan-overlay-cni + io.rancher.scheduler.global: 'true' + io.rancher.network.cni.binary: pasture-bridge + io.rancher.container.dns: 'true' + logging: + driver: json-file + options: + max-size: 25m + max-file: '2' + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - rancher-cni-driver:/opt/cni-driver + network_driver: + name: PastureStack VXLAN Overlay Network + default_network: + name: vxlan + host_ports: {{ .Values.HOST_PORTS }} + subnets: + - network_address: 10.42.0.0/16 + dns: + - 169.254.169.250 + dns_search: + - pasture.internal + cni_config: + '10-pasturestack-vxlan.conf': + name: pasturestack-cni-network + type: pasture-bridge + bridge: $DOCKER_BRIDGE + bridgeSubnet: 10.42.0.0/16 + allowSharedSubnetIngress: true + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' + isDefaultGateway: true + hostNat: true + hairpinMode: {{ .Values.PASTURESTACK_HAIRPIN_MODE }} + promiscMode: {{ .Values.PASTURESTACK_PROMISCUOUS_MODE }} + mtu: ${MTU} + linkMTUOverhead: 50 + ipam: + type: metadata-cni-ipam + subnetPrefixSize: /16 + logToFile: /var/log/pasturestack-cni.log + isDebugLevel: '${PASTURESTACK_DEBUG}' diff --git a/infra-templates/vxlan-overlay-network/8/rancher-compose.yml b/infra-templates/vxlan-overlay-network/8/rancher-compose.yml new file mode 100644 index 000000000..40bb38649 --- /dev/null +++ b/infra-templates/vxlan-overlay-network/8/rancher-compose.yml @@ -0,0 +1,56 @@ +# SPDX-License-Identifier: MIT +.catalog: + name: PastureStack VXLAN Overlay Network + version: v0.3.6 + description: Provide an unencrypted UDP VXLAN network across managed hosts. + minimum_rancher_version: v1.6.11-rc1 + labels: + io.pasturestack.catalog.question.docker_bridge.label.zh-tw: 'Docker 網橋' + io.pasturestack.catalog.question.docker_bridge.description.zh-tw: '受管工作負載流量使用的主機網橋。' + io.pasturestack.catalog.question.mtu.label.zh-tw: '網路 MTU' + io.pasturestack.catalog.question.mtu.description.zh-tw: '請與主機網路 MTU 一致；GCE 常用 1460，一般乙太網路常用 1500。' + io.pasturestack.catalog.question.pasturestack_debug.label.zh-tw: '啟用除錯日誌' + io.pasturestack.catalog.question.pasturestack_debug.description.zh-tw: '記錄較詳細的 VXLAN 元件診斷資訊。' + io.pasturestack.catalog.question.host_ports.label.zh-tw: '啟用主機連接埠' + io.pasturestack.catalog.question.host_ports.description.zh-tw: '允許受管工作負載在主機上公開連接埠。' + io.pasturestack.catalog.question.pasturestack_hairpin_mode.label.zh-tw: '啟用 Hairpin 模式' + io.pasturestack.catalog.question.pasturestack_hairpin_mode.description.zh-tw: 'Hairpin 模式與混雜模式不可同時啟用。' + io.pasturestack.catalog.question.pasturestack_promiscuous_mode.label.zh-tw: '啟用混雜模式' + io.pasturestack.catalog.question.pasturestack_promiscuous_mode.description.zh-tw: '混雜模式與 Hairpin 模式不可同時啟用。' + questions: + - variable: DOCKER_BRIDGE + label: Docker bridge + description: Host bridge used for managed workload traffic. + type: string + default: docker0 + required: true + - variable: MTU + label: Network MTU + description: Match the host network MTU; common values are 1460 for GCE and 1500 for Ethernet. + type: int + default: 1500 + required: true + - variable: PASTURESTACK_DEBUG + label: Enable debug logs + description: Enable verbose diagnostic logging for the VXLAN components. + type: boolean + default: 'false' + required: true + - variable: HOST_PORTS + label: Enable host ports + description: Allow managed workloads to publish ports on their hosts. + type: boolean + default: 'true' + required: true + - variable: PASTURESTACK_HAIRPIN_MODE + label: Enable hairpin mode + description: Hairpin mode and promiscuous mode must not both be enabled. + type: boolean + default: 'false' + required: true + - variable: PASTURESTACK_PROMISCUOUS_MODE + label: Enable promiscuous mode + description: Promiscuous mode and hairpin mode must not both be enabled. + type: boolean + default: 'true' + required: true diff --git a/infra-templates/vxlan-overlay-network/config.yml b/infra-templates/vxlan-overlay-network/config.yml index 2020e89ff..316068f10 100644 --- a/infra-templates/vxlan-overlay-network/config.yml +++ b/infra-templates/vxlan-overlay-network/config.yml @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT name: VXLAN Overlay Network description: Provide an unencrypted UDP VXLAN network across managed hosts. -version: v0.3.5 +version: v0.3.6 category: Networking maintainer: PastureStack contributors license: MIT template; Apache-2.0 image and third-party package licenses apply diff --git a/integration/core/test_catalog.py b/integration/core/test_catalog.py index 0d68662fe..9e8697aec 100644 --- a/integration/core/test_catalog.py +++ b/integration/core/test_catalog.py @@ -197,24 +197,24 @@ def test_catalog_list(): assert by_folder[('infra', 'healthcheck')][ 'name'] == 'Metadata Healthcheck' assert by_folder[('infra', 'healthcheck')][ - 'defaultVersion'] == 'v0.3.18' + 'defaultVersion'] == 'v0.3.19' assert by_folder[('infra', 'healthcheck')][ 'links']['defaultVersion'].endswith( - ':3') + ':4') assert by_folder[('infra', 'ipsec-overlay')]['name'] == ( 'IPsec Overlay') assert by_folder[('infra', 'ipsec-overlay')][ - 'defaultVersion'] == 'v0.3.12' + 'defaultVersion'] == 'v0.3.13' assert by_folder[('infra', 'ipsec-overlay')][ 'links']['defaultVersion'].endswith( - ':14') + ':15') assert by_folder[('infra', 'layer-2-flat-network')]['name'] == ( 'Layer 2 Flat Network') assert by_folder[('infra', 'layer-2-flat-network')][ - 'defaultVersion'] == 'v0.3.6' + 'defaultVersion'] == 'v0.3.7' assert by_folder[('infra', 'layer-2-flat-network')][ 'links']['defaultVersion'].endswith( - ':8') + ':9') assert by_folder[('infra', 'network-diagnostics')]['name'] == ( 'Network Diagnostics') assert by_folder[('infra', 'network-diagnostics')][ @@ -232,10 +232,10 @@ def test_catalog_list(): assert by_folder[('infra', 'network-services')]['name'] == ( 'Network Services') assert by_folder[('infra', 'network-services')][ - 'defaultVersion'] == 'v0.3.12' + 'defaultVersion'] == 'v0.3.13' assert by_folder[('infra', 'network-services')][ 'links']['defaultVersion'].endswith( - ':14') + ':15') assert by_folder[('infra', 'nfs-storage')][ 'name'] == 'NFS Storage' assert by_folder[('infra', 'nfs-storage')][ @@ -260,16 +260,16 @@ def test_catalog_list(): assert by_folder[('infra', 'per-host-subnet-network')]['name'] == ( 'Per-Host Subnet Network') assert by_folder[('infra', 'per-host-subnet-network')][ - 'defaultVersion'] == 'v0.3.4' + 'defaultVersion'] == 'v0.3.5' assert by_folder[('infra', 'per-host-subnet-network')][ - 'links']['defaultVersion'].endswith(':6') + 'links']['defaultVersion'].endswith(':7') assert by_folder[('infra', 'resource-scheduler')][ 'name'] == 'Resource Scheduler' assert by_folder[('infra', 'resource-scheduler')][ - 'defaultVersion'] == 'v0.8.21' + 'defaultVersion'] == 'v0.8.22' assert by_folder[('infra', 'resource-scheduler')][ 'links']['defaultVersion'].endswith( - ':7') + ':8') assert by_folder[('infra', 'route53-dns-sync')][ 'name'] == 'Route 53 DNS Sync' assert by_folder[('infra', 'route53-dns-sync')][ @@ -280,17 +280,17 @@ def test_catalog_list(): assert by_folder[('infra', 'system-image-preloader')]['name'] == ( 'System Image Preloader') assert by_folder[('infra', 'system-image-preloader')][ - 'defaultVersion'] == 'v0.3.3' + 'defaultVersion'] == 'v0.3.4' assert by_folder[('infra', 'system-image-preloader')][ 'links']['defaultVersion'].endswith( - ':4') + ':5') assert by_folder[('infra', 'vxlan-overlay-network')]['name'] == ( 'VXLAN Overlay Network') assert by_folder[('infra', 'vxlan-overlay-network')][ - 'defaultVersion'] == 'v0.3.5' + 'defaultVersion'] == 'v0.3.6' assert by_folder[('infra', 'vxlan-overlay-network')][ 'links']['defaultVersion'].endswith( - ':7') + ':8') assert by_folder[('infra', 'windows-container-networking')][ 'name'] == 'Windows Container Networking' assert by_folder[('infra', 'windows-container-networking')][ @@ -547,7 +547,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): health_files = health_version['files'] health_docker = health_files['docker-compose.yml'] health_platform = health_files['rancher-compose.yml'] - health_image = 'ghcr.io/pasturestack/metadata-healthcheck:v0.3.18' + health_image = 'ghcr.io/pasturestack/metadata-healthcheck:v0.3.19' assert "version: '2'\nservices:\n healthcheck:" in health_docker assert health_docker.count('image: {}'.format(health_image)) == 1 assert ( @@ -565,7 +565,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): overlay_docker = overlay_files['docker-compose.yml.tpl'] overlay_platform = overlay_files['rancher-compose.yml'] overlay_image = ( - 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41') + 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42') assert overlay_docker.count('image: {}'.format(overlay_image)) == 4 assert overlay_docker.count( "PASTURESTACK_FIREWALL_BACKEND: '${FIREWALL_BACKEND}'") == 1 @@ -607,7 +607,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): vxlan_docker = vxlan_files['docker-compose.yml.tpl'] vxlan_platform = vxlan_files['rancher-compose.yml'] alternative_network_image = ( - 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41') + 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42') assert vxlan_docker.count( 'image: {}'.format(alternative_network_image)) == 3 assert '\n vxlan-network:\n' in vxlan_docker @@ -632,7 +632,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): layer_2_docker = layer_2_files['docker-compose.yml.tpl'] layer_2_platform = layer_2_files['rancher-compose.yml'] flat_network_image = ( - 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.41') + 'ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.42') assert layer_2_docker.count( 'image: {}'.format(flat_network_image)) == 1 assert '\n layer-2-flat-cni:\n' in layer_2_docker @@ -727,7 +727,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): network_manager_image = ( 'ghcr.io/pasturestack/network-plugin-manager:v0.8.25') metadata_image = 'ghcr.io/pasturestack/metadata-service:v0.10.7' - dns_image = 'ghcr.io/pasturestack/internal-dns:v0.17.14' + dns_image = 'ghcr.io/pasturestack/internal-dns:v0.17.15' assert network_docker.count( 'image: {}'.format(network_manager_image)) == 1 assert network_docker.count('image: {}'.format(metadata_image)) == 1 @@ -920,7 +920,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): scheduler_files = scheduler_version['files'] scheduler_docker = scheduler_files['docker-compose.yml'] scheduler_platform = scheduler_files['rancher-compose.yml'] - scheduler_image = 'ghcr.io/pasturestack/resource-scheduler:v0.8.21' + scheduler_image = 'ghcr.io/pasturestack/resource-scheduler:v0.8.22' assert scheduler_docker.count( 'image: {}'.format(scheduler_image)) == 1 assert '\n resource-scheduler:\n' in scheduler_docker @@ -968,7 +968,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): preloader_docker = preloader_files['docker-compose.yml.tpl'] preloader_platform = preloader_files['rancher-compose.yml'] preloader_image = ( - 'ghcr.io/pasturestack/system-image-preloader:v0.3.3') + 'ghcr.io/pasturestack/system-image-preloader:v0.3.4') assert preloader_docker.count( 'image: {}'.format(preloader_image)) == 1 assert '\n system-image-preloader:\n' in preloader_docker @@ -982,7 +982,7 @@ def test_catalog_compose_shapes_are_runtime_compatible(): assert '{{- if' not in preloader_docker assert '{{- end' not in preloader_docker assert '@sha256:' not in preloader_docker - assert 'ghcr.io/pasturestack/system-image-preloader:v0.3.3' in ( + assert 'ghcr.io/pasturestack/system-image-preloader:v0.3.4' in ( preloader_docker) assert 'default: v1.6.282' in preloader_platform assert 'default: false' in preloader_platform @@ -1737,7 +1737,29 @@ def test_scheduler_upgrade_versions_remain_available(number, image_tag): '4', 'v0.1.1', 'v0.1.2', - [('pod-pause-image:v3.0.5', 'pod-pause-image:v3.0.6')])] + [('pod-pause-image:v3.0.5', 'pod-pause-image:v3.0.6')]), + ('healthcheck', '3', '4', 'v0.3.18', 'v0.3.19', + [('metadata-healthcheck:v0.3.18', 'metadata-healthcheck:v0.3.19')]), + ('network-services', '14', '15', 'v0.3.12', 'v0.3.13', + [('internal-dns:v0.17.14', 'internal-dns:v0.17.15')]), + ('system-image-preloader', '4', '5', 'v0.3.3', 'v0.3.4', + [('system-image-preloader:v0.3.3', + 'system-image-preloader:v0.3.4')]), + ('resource-scheduler', '7', '8', 'v0.8.21', 'v0.8.22', + [('resource-scheduler:v0.8.21', + 'resource-scheduler:v0.8.22')]), + ('ipsec-overlay', '14', '15', 'v0.3.12', 'v0.3.13', + [('ipsec-vxlan-overlay-network:v0.14.41', + 'ipsec-vxlan-overlay-network:v0.14.42')]), + ('layer-2-flat-network', '8', '9', 'v0.3.6', 'v0.3.7', + [('ipsec-vxlan-overlay-network:v0.14.41', + 'ipsec-vxlan-overlay-network:v0.14.42')]), + ('per-host-subnet-network', '6', '7', 'v0.3.4', 'v0.3.5', + [('ipsec-vxlan-overlay-network:v0.14.41', + 'ipsec-vxlan-overlay-network:v0.14.42')]), + ('vxlan-overlay-network', '7', '8', 'v0.3.5', 'v0.3.6', + [('ipsec-vxlan-overlay-network:v0.14.41', + 'ipsec-vxlan-overlay-network:v0.14.42')])] ) def test_qualified_backport_source_contract( template, old_number, new_number, old_version, new_version, @@ -1763,8 +1785,18 @@ def test_qualified_backport_source_contract( with open(_file(prefix + new_number + "/rancher-compose.yml"), encoding="utf-8") as source: assert source.read() == expected + # An archived transition remains valid after a later numeric revision is + # added. The default must follow the newest revision, whose exact version + # is independently checked by its transition case and version-label gate. + latest = max(int(name) for name in os.listdir(_file(prefix)) + if name.isdecimal() and os.path.isfile( + _file(prefix + name + "/rancher-compose.yml"))) + with open(_file(prefix + str(latest) + "/rancher-compose.yml"), + encoding="utf-8") as source: + current_version = re.search( + r"(?m)^ version: (v\d+\.\d+\.\d+)$", source.read()).group(1) with open(_file(prefix + "config.yml"), encoding="utf-8") as source: - assert "\nversion: " + new_version + "\n" in source.read() + assert "\nversion: " + current_version + "\n" in source.read() for filename in ("README.md", "README.zh-TW.md"): with open(_file(prefix + new_number + "/" + filename), encoding="utf-8") as source: diff --git a/scripts/audit_deployable_images.py b/scripts/audit_deployable_images.py index fa26104a8..53a5ad89f 100644 --- a/scripts/audit_deployable_images.py +++ b/scripts/audit_deployable_images.py @@ -56,20 +56,20 @@ "amazon-ebs-storage": ("2", "3"), "container-schedule": ("2", "3", "4"), "ecr-credential-sync": ("2", "3", "4"), - "healthcheck": ("0", "1", "2", "3"), - "ipsec-overlay": ("1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14"), - "layer-2-flat-network": ("2", "3", "4", "5", "6", "7", "8"), + "healthcheck": ("0", "1", "2", "3", "4"), + "ipsec-overlay": ("1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15"), + "layer-2-flat-network": ("2", "3", "4", "5", "6", "7", "8", "9"), "network-diagnostics": ("1", "2", "3"), "network-policy-manager": ("1", "2", "3", "4", "5"), - "network-services": ("1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14"), + "network-services": ("1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15"), "nfs-storage": ("1", "2", "3"), - "per-host-subnet-network": ("2", "3", "4", "5", "6"), + "per-host-subnet-network": ("2", "3", "4", "5", "6", "7"), "route53-dns-sync": ("2", "3"), - "resource-scheduler": ("1", "2", "3", "4", "5", "6", "7"), + "resource-scheduler": ("1", "2", "3", "4", "5", "6", "7", "8"), "secret-volume-driver": ("1", "2", "3", "4"), - "system-image-preloader": ("2", "3", "4"), + "system-image-preloader": ("2", "3", "4", "5"), "vault-volume-driver": ("3", "4", "5"), - "vxlan-overlay-network": ("2", "3", "4", "5", "6", "7"), + "vxlan-overlay-network": ("2", "3", "4", "5", "6", "7", "8"), "windows-container-networking": ("2", "3", "4"), } RETAINED_VERSION_HASHES = {