From 5868c848a6d8a9223ca353a13d13895f2da22cd8 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 10 Nov 2026 22:10:20 +0100 Subject: [PATCH 1/4] fix(storage): pin the temporary Longhorn benchmark runtime --- .../infrastructure/controllers/longhorn/helm-release.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml index df6f88c4a4..b0eac81973 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml @@ -30,6 +30,13 @@ spec: timeout: 10m # https://github.com/longhorn/charts/blob/master/charts/longhorn/values.yaml values: + image: + longhorn: + # Temporary V1 runtime for the guarded benchmark retirement operation (#5665). + instanceManager: + registry: ghcr.io + repository: devantler-tech/platform-longhorn-instance-manager + tag: v1.13.0-retirement.1-725bb1d09517c84f8b73ff2c0cf175421df351f1-1@sha256:93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f defaultSettings: defaultDataPath: /var/lib/longhorn # Match the number of workers so every volume is replicated across From 300b006f38d7fe4991f7b8c2b76c9bf13c11d76f Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 10 Nov 2026 23:44:33 +0100 Subject: [PATCH 2/4] test(storage): record the pinned benchmark release surface --- scripts/validate-eks-ci-role-policy/approved-surface.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt index 957ef00f8a..cc5697fc50 100644 --- a/scripts/validate-eks-ci-role-policy/approved-surface.txt +++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt @@ -96,7 +96,7 @@ helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|kubescape cd313c675760792a4acd04 helm.toolkit.fluxcd.io/v2|HelmRelease|kyverno|kyverno cba1d622347666781a22316d3c466cb9df54ea4951809e8efa9917b048032867 -helm.toolkit.fluxcd.io/v2|HelmRelease|longhorn-system|longhorn 3687bc9ddaa8177bc383eb7d25fc8f1bff732a935e2874656fdd8b438aea6e03 +helm.toolkit.fluxcd.io/v2|HelmRelease|longhorn-system|longhorn c1fd12408b15785bb3a75c65cb2bedbd10752f50b5fac96cc623789c04d01d8b helm.toolkit.fluxcd.io/v2|HelmRelease|oauth2-proxy|oauth2-proxy d16150bb9a7d264f002fd3cb8d82d459a368d6428207e23fd0b8479e4194f60d From f331a549486a188e49f3486faf9f651edb9d7ccb Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 19:40:25 +0100 Subject: [PATCH 3/4] fix(storage): prepare admission for the patched migration runtime --- ...ing-admission-policy-longhorn-v1-benchmark-runtime.yaml | 2 +- .../infrastructure/controllers/longhorn/helm-release.yaml | 7 ------- .../retirement-fence-proof/runtime_admission_test.go | 5 ++++- scripts/validate-eks-ci-role-policy/approved-surface.txt | 4 ++-- 4 files changed, 7 insertions(+), 11 deletions(-) diff --git a/k8s/providers/hetzner/infrastructure/cluster-policies/mutating-admission-policy-longhorn-v1-benchmark-runtime.yaml b/k8s/providers/hetzner/infrastructure/cluster-policies/mutating-admission-policy-longhorn-v1-benchmark-runtime.yaml index 25fc425b99..60f75df0ea 100644 --- a/k8s/providers/hetzner/infrastructure/cluster-policies/mutating-admission-policy-longhorn-v1-benchmark-runtime.yaml +++ b/k8s/providers/hetzner/infrastructure/cluster-policies/mutating-admission-policy-longhorn-v1-benchmark-runtime.yaml @@ -50,7 +50,7 @@ spec: size(object.spec.containers) == 1 && object.spec.containers.all(container, container.name == 'instance-manager' && - container.image == 'ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-725bb1d09517c84f8b73ff2c0cf175421df351f1-1@sha256:93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f' && + container.image == 'ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-591ed0ccebd032c4d9705c356c267e724b30e2a9-1@sha256:4f7c2ff5666c6ce1ccab78a5e8c5c108147b12b80729303b9f1d91dfb9ee9cd7' && has(container.securityContext) && has(container.securityContext.privileged) && container.securityContext.privileged && !has(container.securityContext.runAsUser) && !has(container.securityContext.runAsGroup) && diff --git a/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml index b0eac81973..df6f88c4a4 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml @@ -30,13 +30,6 @@ spec: timeout: 10m # https://github.com/longhorn/charts/blob/master/charts/longhorn/values.yaml values: - image: - longhorn: - # Temporary V1 runtime for the guarded benchmark retirement operation (#5665). - instanceManager: - registry: ghcr.io - repository: devantler-tech/platform-longhorn-instance-manager - tag: v1.13.0-retirement.1-725bb1d09517c84f8b73ff2c0cf175421df351f1-1@sha256:93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f defaultSettings: defaultDataPath: /var/lib/longhorn # Match the number of workers so every volume is replicated across diff --git a/scripts/migrate-longhorn-v2/testdata/retirement-fence-proof/runtime_admission_test.go b/scripts/migrate-longhorn-v2/testdata/retirement-fence-proof/runtime_admission_test.go index 2b90f61970..564ddf3043 100644 --- a/scripts/migrate-longhorn-v2/testdata/retirement-fence-proof/runtime_admission_test.go +++ b/scripts/migrate-longhorn-v2/testdata/retirement-fence-proof/runtime_admission_test.go @@ -21,7 +21,7 @@ import ( "sigs.k8s.io/yaml" ) -const retirementImage = "ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-725bb1d09517c84f8b73ff2c0cf175421df351f1-1@sha256:93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f" +const retirementImage = "ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-591ed0ccebd032c4d9705c356c267e724b30e2a9-1@sha256:4f7c2ff5666c6ce1ccab78a5e8c5c108147b12b80729303b9f1d91dfb9ee9cd7" const longhornCreator = "system:serviceaccount:longhorn-system:longhorn-service-account" const retirementPolicyPath = "../../../../k8s/providers/hetzner/infrastructure/cluster-policies/" @@ -87,6 +87,9 @@ func TestNativeRetirementRuntimeAdmission(t *testing.T) { {"different image", func(p *unstructured.Unstructured, _ *user.DefaultInfo) { retirementPodContainers(p)[0].(map[string]any)["image"] = retirementImage[:len(retirementImage)-1] + "b" }, false}, + {"superseded unpatched image", func(p *unstructured.Unstructured, _ *user.DefaultInfo) { + retirementPodContainers(p)[0].(map[string]any)["image"] = "ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-725bb1d09517c84f8b73ff2c0cf175421df351f1-1@sha256:93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f" + }, false}, {"stock image", func(p *unstructured.Unstructured, _ *user.DefaultInfo) { retirementPodContainers(p)[0].(map[string]any)["image"] = "longhornio/longhorn-instance-manager:v1.13.0" }, false}, diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt index 9decd46588..f5fc7f2af5 100644 --- a/scripts/validate-eks-ci-role-policy/approved-surface.txt +++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt @@ -18,7 +18,7 @@ admissionregistration.k8s.io/v1|MutatingAdmissionPolicyBinding||longhorn-v1-benc admissionregistration.k8s.io/v1|MutatingAdmissionPolicy||gateway-receiver 29a4c24f83df36bb1a1cc5880703564b5b853f46e27828aca4493fdc5017d983 -admissionregistration.k8s.io/v1|MutatingAdmissionPolicy||longhorn-v1-benchmark-runtime e2296d89bf4177747418a2ad65850712990fc84a5e9bb4333490038bf73f817d +admissionregistration.k8s.io/v1|MutatingAdmissionPolicy||longhorn-v1-benchmark-runtime 0cc9ea5c1aec7925eb2409b923967ead9b791913ca3740c2bae2ae3b8b1d7868 admissionregistration.k8s.io/v1|ValidatingAdmissionPolicyBinding||gateway-receiver 02e679b3bede26c8ef6793955787d34b266667cafe41636288c87e1fcb83d339 @@ -100,7 +100,7 @@ helm.toolkit.fluxcd.io/v2|HelmRelease|kubescape|kubescape cd313c675760792a4acd04 helm.toolkit.fluxcd.io/v2|HelmRelease|kyverno|kyverno cba1d622347666781a22316d3c466cb9df54ea4951809e8efa9917b048032867 -helm.toolkit.fluxcd.io/v2|HelmRelease|longhorn-system|longhorn c1fd12408b15785bb3a75c65cb2bedbd10752f50b5fac96cc623789c04d01d8b +helm.toolkit.fluxcd.io/v2|HelmRelease|longhorn-system|longhorn 3687bc9ddaa8177bc383eb7d25fc8f1bff732a935e2874656fdd8b438aea6e03 helm.toolkit.fluxcd.io/v2|HelmRelease|oauth2-proxy|oauth2-proxy d16150bb9a7d264f002fd3cb8d82d459a368d6428207e23fd0b8479e4194f60d From 79fa90f42cf13a579bd90b82f27d865aaeab97ce Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 20:01:23 +0100 Subject: [PATCH 4/4] fix(storage): bind consumer discovery to the patched runtime policy --- scripts/guard-consumer-discovery-conservation.sh | 2 +- .../test-guard-consumer-discovery-conservation.sh | 11 ++++++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/scripts/guard-consumer-discovery-conservation.sh b/scripts/guard-consumer-discovery-conservation.sh index ff11f9d6f3..70f971103a 100755 --- a/scripts/guard-consumer-discovery-conservation.sh +++ b/scripts/guard-consumer-discovery-conservation.sh @@ -797,7 +797,7 @@ while IFS=$'\t' read -r file label; do 43b7eaf13a1b754ed0449239ce9e337de6881751fd009c738efb46e367524824 | \ 691bf7d05ed9d87ae261f34d51e7cd062d345a6af8f6bb2dcf1ec1aeb3dade17 | \ 92dc171d2b1e73eec7679ae3f74e806a3fc8472f7ed3445bfca1541c3d27941d | \ - 55d0841bf6699a0cbf7bb40bcf2b154facc2305cae538b9f75b71774651895d3) + 9773c0aa3daf4ad4e8939294f0802aa382cce33d5675f1f3e65e23f8791eb021) reviewed_cel_surfaces="$(jq -ce --argjson candidate "$candidate" '. + [$candidate]' <<<"$reviewed_cel_surfaces")" || refuse 'could not record the complete reviewed mutation policy' ;; diff --git a/scripts/tests/test-guard-consumer-discovery-conservation.sh b/scripts/tests/test-guard-consumer-discovery-conservation.sh index 5f893a5d75..c31dc1beb8 100755 --- a/scripts/tests/test-guard-consumer-discovery-conservation.sh +++ b/scripts/tests/test-guard-consumer-discovery-conservation.sh @@ -1176,13 +1176,22 @@ YAML cp "$benchmark_policies/mutating-admission-policy-binding-longhorn-v1-benchmark-runtime.yaml" "$root/k8s/providers/prod/apps/benchmark-binding.yaml" printf ' - benchmark-runtime.yaml\n - benchmark-binding.yaml\n' >>"$root/k8s/providers/prod/apps/kustomization.yaml" expect_pass 'the native benchmark runtime changes only the exact Pod security context' "$root" '2 consumer(s)' - for variant in resource-scope patch-path; do + for variant in resource-scope patch-path superseded-image unapproved-image; do root="$(fixture "native-longhorn-benchmark-$variant")" cp "$WORK/reviewed-native-longhorn-benchmark/k8s/providers/prod/apps/benchmark-runtime.yaml" "$root/k8s/providers/prod/apps/benchmark-runtime.yaml" policy="$root/k8s/providers/prod/apps/benchmark-runtime.yaml" case "$variant" in resource-scope) yq -i '.spec.matchConstraints.resourceRules[0].resources += ["*"]' "$policy" ;; patch-path) yq -i '.spec.mutations[0].jsonPatch.expression |= sub("securityContext/runAsUser", "image")' "$policy" ;; + superseded-image) + yq -i '.spec.matchConditions[3].expression |= + (sub("591ed0ccebd032c4d9705c356c267e724b30e2a9", "725bb1d09517c84f8b73ff2c0cf175421df351f1") | + sub("4f7c2ff5666c6ce1ccab78a5e8c5c108147b12b80729303b9f1d91dfb9ee9cd7", "93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f"))' "$policy" + ;; + unapproved-image) + yq -i '.spec.matchConditions[3].expression |= + sub("4f7c2ff5666c6ce1ccab78a5e8c5c108147b12b80729303b9f1d91dfb9ee9cd7", "0000000000000000000000000000000000000000000000000000000000000000")' "$policy" + ;; esac if cmp -s "$WORK/reviewed-native-longhorn-benchmark/k8s/providers/prod/apps/benchmark-runtime.yaml" "$policy"; then fail "native benchmark runtime negative control did not change $variant"