sean/binjovi-plans
Watch
1
0
Fork
You've already forked binjovi-plans
 0
Code Issues Pull requests 1 Projects Releases 156 Packages Wiki Activity

fix: follow the renamed Binjovi credential guard #134

Merged
binjovi-bot merged 1 commit from sean/guard-catalog-rename into trunk 2026-09-08 21:14:03 +00:00 AGit
Conversation 0 Commits 1 Files changed 2 +2 -2
sean commented 2026-09-08 21:12:19 +00:00
Owner
Copy link

seanfarm #464 splits tests/binjovi-argo-execution.sh; the surviving Kyverno half is tests/binjovi-untrusted-credential-guard.sh. The binjovi-control-plane guard group names its checks by exact filename, so the rename must be recorded here or the gitops validator fails with 'selected check does not exist'. This lands FIRST: #464 is safe because the validator runs against the pull request's own revision, which creates the file. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

seanfarm #464 splits tests/binjovi-argo-execution.sh; the surviving Kyverno half is tests/binjovi-untrusted-credential-guard.sh. The binjovi-control-plane guard group names its checks by exact filename, so the rename must be recorded here or the gitops validator fails with 'selected check does not exist'. This lands FIRST: #464 is safe because the validator runs against the pull request's own revision, which creates the file. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76
fix: follow the renamed Binjovi credential guard
All checks were successful
binjovi/ci Binjovi completed the frozen plan
Details
2015dacb26
 
`seanfarm` PR #464 splits `tests/binjovi-argo-execution.sh`. It was two guards
in one: the identities and network profiles that ran Binjovi work inside an
Argo Workflow pod, now retired, and the Kyverno policy that stops project code
mounting a credential, which still protects the package and RPG lanes. The
surviving half is `tests/binjovi-untrusted-credential-guard.sh`.

The `binjovi-control-plane` guard group names its checks by exact filename, so
the rename has to be recorded here or the gitops validator selects a file that
is not there:

  binjovi-gitops-validate: selected check does not exist:
  tests/binjovi-argo-execution.sh

THIS LANDS FIRST, and the window is narrow on purpose. Between this release and
#464, any `seanfarm` pull request touching
`kubernetes/flux/infrastructure/binjovi/**` or `tests/binjovi*.sh` selects a
guard that does not exist on that revision yet and fails. #464 itself is safe:
the validator runs against the pull request's own revision, which creates the
file.

The list is kept sorted, and the literal in `scripts/check` is regenerated from
the bundle rather than edited by hand -- the rename moves the entry from second
to last in sort order, and hand-editing it in place is what made the first
attempt at this fail.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/binjovi-plans!134
No description provided.