fix(storage): prepare admission for the patched migration runtime

k8s/providers/hetzner/infrastructure/cluster-policies/mutating-admission-policy-longhorn-v1-benchmark-runtime.yaml

@@ -50,7 +50,7 @@ spec:
         size(object.spec.containers) == 1 &&
         object.spec.containers.all(container,
           container.name == 'instance-manager' &&
-          container.image == 'ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-725bb1d09517c84f8b73ff2c0cf175421df351f1-1@sha256:93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f' &&
+          container.image == 'ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-591ed0ccebd032c4d9705c356c267e724b30e2a9-1@sha256:4f7c2ff5666c6ce1ccab78a5e8c5c108147b12b80729303b9f1d91dfb9ee9cd7' &&
           has(container.securityContext) &&
           has(container.securityContext.privileged) && container.securityContext.privileged &&
           !has(container.securityContext.runAsUser) && !has(container.securityContext.runAsGroup) &&

scripts/guard-consumer-discovery-conservation.sh

@@ -797,7 +797,7 @@ while IFS=$'\t' read -r file label; do
       43b7eaf13a1b754ed0449239ce9e337de6881751fd009c738efb46e367524824 | \
         691bf7d05ed9d87ae261f34d51e7cd062d345a6af8f6bb2dcf1ec1aeb3dade17 | \
         92dc171d2b1e73eec7679ae3f74e806a3fc8472f7ed3445bfca1541c3d27941d | \
-        55d0841bf6699a0cbf7bb40bcf2b154facc2305cae538b9f75b71774651895d3)
+        9773c0aa3daf4ad4e8939294f0802aa382cce33d5675f1f3e65e23f8791eb021)
         reviewed_cel_surfaces="$(jq -ce --argjson candidate "$candidate" '. + [$candidate]' <<<"$reviewed_cel_surfaces")" ||
           refuse 'could not record the complete reviewed mutation policy'
         ;;

scripts/migrate-longhorn-v2/testdata/retirement-fence-proof/runtime_admission_test.go

@@ -21,7 +21,7 @@ import (
 	"sigs.k8s.io/yaml"
 )
 
-const retirementImage = "ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-725bb1d09517c84f8b73ff2c0cf175421df351f1-1@sha256:93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f"
+const retirementImage = "ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-591ed0ccebd032c4d9705c356c267e724b30e2a9-1@sha256:4f7c2ff5666c6ce1ccab78a5e8c5c108147b12b80729303b9f1d91dfb9ee9cd7"
 const longhornCreator = "system:serviceaccount:longhorn-system:longhorn-service-account"
 const retirementPolicyPath = "../../../../k8s/providers/hetzner/infrastructure/cluster-policies/"
 
@@ -87,6 +87,9 @@ func TestNativeRetirementRuntimeAdmission(t *testing.T) {
 		{"different image", func(p *unstructured.Unstructured, _ *user.DefaultInfo) {
 			retirementPodContainers(p)[0].(map[string]any)["image"] = retirementImage[:len(retirementImage)-1] + "b"
 		}, false},
+		{"superseded unpatched image", func(p *unstructured.Unstructured, _ *user.DefaultInfo) {
+			retirementPodContainers(p)[0].(map[string]any)["image"] = "ghcr.io/devantler-tech/platform-longhorn-instance-manager:v1.13.0-retirement.1-725bb1d09517c84f8b73ff2c0cf175421df351f1-1@sha256:93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f"
+		}, false},
 		{"stock image", func(p *unstructured.Unstructured, _ *user.DefaultInfo) {
 			retirementPodContainers(p)[0].(map[string]any)["image"] = "longhornio/longhorn-instance-manager:v1.13.0"
 		}, false},

scripts/tests/test-guard-consumer-discovery-conservation.sh

@@ -1176,13 +1176,22 @@ YAML
   cp "$benchmark_policies/mutating-admission-policy-binding-longhorn-v1-benchmark-runtime.yaml" "$root/k8s/providers/prod/apps/benchmark-binding.yaml"
   printf '  - benchmark-runtime.yaml\n  - benchmark-binding.yaml\n' >>"$root/k8s/providers/prod/apps/kustomization.yaml"
   expect_pass 'the native benchmark runtime changes only the exact Pod security context' "$root" '2 consumer(s)'
-  for variant in resource-scope patch-path; do
+  for variant in resource-scope patch-path superseded-image unapproved-image; do
     root="$(fixture "native-longhorn-benchmark-$variant")"
     cp "$WORK/reviewed-native-longhorn-benchmark/k8s/providers/prod/apps/benchmark-runtime.yaml" "$root/k8s/providers/prod/apps/benchmark-runtime.yaml"
     policy="$root/k8s/providers/prod/apps/benchmark-runtime.yaml"
     case "$variant" in
       resource-scope) yq -i '.spec.matchConstraints.resourceRules[0].resources += ["*"]' "$policy" ;;
       patch-path) yq -i '.spec.mutations[0].jsonPatch.expression |= sub("securityContext/runAsUser", "image")' "$policy" ;;
+      superseded-image)
+        yq -i '.spec.matchConditions[3].expression |=
+          (sub("591ed0ccebd032c4d9705c356c267e724b30e2a9", "725bb1d09517c84f8b73ff2c0cf175421df351f1") |
+           sub("4f7c2ff5666c6ce1ccab78a5e8c5c108147b12b80729303b9f1d91dfb9ee9cd7", "93cfc83d8bab91f9b6fbffe20bf9bdaca28e877d91d7b740cae003bf6853059f"))' "$policy"
+        ;;
+      unapproved-image)
+        yq -i '.spec.matchConditions[3].expression |=
+          sub("4f7c2ff5666c6ce1ccab78a5e8c5c108147b12b80729303b9f1d91dfb9ee9cd7", "0000000000000000000000000000000000000000000000000000000000000000")' "$policy"
+        ;;
     esac
     if cmp -s "$WORK/reviewed-native-longhorn-benchmark/k8s/providers/prod/apps/benchmark-runtime.yaml" "$policy"; then
       fail "native benchmark runtime negative control did not change $variant"

scripts/validate-eks-ci-role-policy/approved-surface.txt

@@ -18,7 +18,7 @@ admissionregistration.k8s.io/v1|MutatingAdmissionPolicyBinding||longhorn-v1-benc
 
 admissionregistration.k8s.io/v1|MutatingAdmissionPolicy||gateway-receiver 29a4c24f83df36bb1a1cc5880703564b5b853f46e27828aca4493fdc5017d983
 
-admissionregistration.k8s.io/v1|MutatingAdmissionPolicy||longhorn-v1-benchmark-runtime e2296d89bf4177747418a2ad65850712990fc84a5e9bb4333490038bf73f817d
+admissionregistration.k8s.io/v1|MutatingAdmissionPolicy||longhorn-v1-benchmark-runtime 0cc9ea5c1aec7925eb2409b923967ead9b791913ca3740c2bae2ae3b8b1d7868
 
 admissionregistration.k8s.io/v1|ValidatingAdmissionPolicyBinding||gateway-receiver 02e679b3bede26c8ef6793955787d34b266667cafe41636288c87e1fcb83d339