fix(binjovi): scope the package-read guard to binjovi pods #224

Merged

binjovi-bot merged 1 commit from fix/binjovi-guard-scope-package-read into trunk

2026-09-03 16:11:16 +00:00

sean commented

2026-09-03 16:08:13 +00:00

Owner

Every kernel deploy has failed since 2026-09-02. Reproduced today on linux-deploy-6.18.44-seanfarm46-seanfarm-master-qdhxz: the resolve-target pod is refused with binjovi guard: a package read credential requires a package test init container or a trusted package publisher.

The package-read rule matches any secret name ending read-s3. Pipelines provisions one <project>read-s3 MinIO key per project (23 of them exist), so it caught linuxread-s3, which the kernel deploy uses to read its release MANIFEST. Four pipelines templates mount such a key, so exempting one service account would only move the problem.

That rule was also the only validation in this policy not gated on a binjovi label, so it policed the entire workflows namespace instead of the pods binjovi creates. Binjovi labels its own pods app.kubernetes.io/managed-by=binjovi; pipelines pods carry no such label. Gating on it makes this rule consistent with every other validation in the file. Binjovi both paths, the untrusted package-test init container and the trusted package publisher, are unchanged.

Introduced by 3df37406 on 2026-09-02, one day after the last successful kernel deploy, which is why nothing caught it.

bash tests/check.sh passes, tests/vap-cel-balance.sh passes, and kubectl apply --dry-run=server accepts the CEL.

https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

Every kernel deploy has failed since 2026-09-02. Reproduced today on `linux-deploy-6.18.44-seanfarm46-seanfarm-master-qdhxz`: the `resolve-target` pod is refused with `binjovi guard: a package read credential requires a package test init container or a trusted package publisher`. The package-read rule matches any secret name ending `read-s3`. Pipelines provisions one `<project>read-s3` MinIO key per project (23 of them exist), so it caught `linuxread-s3`, which the kernel deploy uses to read its release MANIFEST. Four pipelines templates mount such a key, so exempting one service account would only move the problem. That rule was also the only validation in this policy not gated on a binjovi label, so it policed the entire `workflows` namespace instead of the pods binjovi creates. Binjovi labels its own pods `app.kubernetes.io/managed-by=binjovi`; pipelines pods carry no such label. Gating on it makes this rule consistent with every other validation in the file. Binjovi both paths, the untrusted package-test init container and the trusted package publisher, are unchanged. Introduced by 3df37406 on 2026-09-02, one day after the last successful kernel deploy, which is why nothing caught it. `bash tests/check.sh` passes, `tests/vap-cel-balance.sh` passes, and `kubectl apply --dry-run=server` accepts the CEL. https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

sean added 1 commit

2026-09-03 16:08:13 +00:00

fix(binjovi): scope the package-read guard to binjovi pods

binjovi/ci Binjovi completed the frozen plan

Details

3f39db2820

Every kernel deploy has failed since 2026-09-02. The resolve-target pod
of pipeline-deploy-kernel is refused with "binjovi guard: a package read
credential requires a package test init container or a trusted package
publisher".

The package-read rule matches any secret whose name ends in read-s3.
Pipelines provisions one <project>read-s3 MinIO key per project, so the
match caught linuxread-s3, which the kernel deploy reads its release
MANIFEST with. Four pipelines templates mount such a key, so an
exemption for one service account would only move the problem.

This rule was also the only validation in the policy not gated on a
binjovi label, so it policed the whole workflows namespace rather than
the pods binjovi creates. Binjovi labels its own pods
app.kubernetes.io/managed-by=binjovi and has no authority over the
pipelines control plane's pods. Gate the rule on that label, which makes
it consistent with every other validation here. Binjovi's own two paths,
the untrusted package-test init container and the trusted package
publisher, are unchanged.

Claude-Session: https://claude.ai/code/session_01MdSbMhzabSbpG8TtP9Ur3H

binjovi-bot merged commit 3f39db2820 into trunk

2026-09-03 16:11:16 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!224

No description provided.

Rows
Columns