Skip to content

fix(apps): express the cosign transition as one identity — Flux rejects multiple - #2406

Closed
devantler wants to merge 1 commit into
mainfrom
claude/cosign-single-identity-hotfix
Closed

fix(apps): express the cosign transition as one identity — Flux rejects multiple#2406
devantler wants to merge 1 commit into
mainfrom
claude/cosign-single-identity-hotfix

Conversation

@devantler

@devantler devantler commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

🤖 Generated by the Daily AI Assistant

Why

All three tenant artifact sources (wedding-app, ascoachingogvaner, github-config) stopped verifying on prod right after #2399: Flux's cosign verifier accepts exactly one signing identity, so the transitional second entry broke verification outright (unsupported: multiple identities are not supported at this time). The apps layer can no longer pull tenant updates, and this is failing merge-queue deploys (evicted #2400's first run).

What

Collapses each pair of identities into one entry whose subject pattern accepts both the old and the new signing workflow — the same trust set #2399 intended, in a form Flux supports. The narrowing step (drop the old path once actions-signed artifacts verify) stays as planned; tightening the ref matcher stays tracked in #2402.

Merge-order note: land ASAP — the merge queue keeps evicting PRs on the failed apps health check until this applies.

@devantler @claude
fix(apps): express the cosign transition as one identity — Flux rejec…
10e8f0b 
…ts multiple

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-project-automation github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Jul 3, 2026
@coderabbitai

coderabbitai Bot commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e5ee569c-37e6-44a2-a538-c62f82aab306

📥 Commits

Reviewing files that changed from the base of the PR and between efa0e84 and 10e8f0b.

📒 Files selected for processing (3)
  • k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
  • k8s/bases/apps/github-config/oci-repository.yaml
  • k8s/bases/apps/wedding-app/oci-repository.yaml
📜 Recent review details
🧰 Additional context used
📓 Path-based instructions (3)
k8s/bases/**/*.yaml

📄 CodeRabbit inference engine (AGENTS.md)

Do not modify resources under k8s/bases/ directly from overlays; use Kustomize patches: in overlays instead.

Files:

  • k8s/bases/apps/github-config/oci-repository.yaml
  • k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
  • k8s/bases/apps/wedding-app/oci-repository.yaml
k8s/**/*.yaml

📄 CodeRabbit inference engine (AGENTS.md)

Use one Kubernetes resource per file, except for the explicitly whitelisted vendored operator bundles.

Files:

  • k8s/bases/apps/github-config/oci-repository.yaml
  • k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
  • k8s/bases/apps/wedding-app/oci-repository.yaml
k8s/**/*.{yaml,yml}

📄 CodeRabbit inference engine (AGENTS.md)

Name component-folder files after the resource Kind in kebab-case, and use ‹kind›-‹purpose›.yaml when a folder contains more than one resource of the same Kind.

Files:

  • k8s/bases/apps/github-config/oci-repository.yaml
  • k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
  • k8s/bases/apps/wedding-app/oci-repository.yaml
🧠 Learnings (2)
📚 Learning: 2026-07-01T21:13:36.950Z 
Learnt from: devantler
Repo: devantler-tech/platform PR: 2359
File: k8s/bases/apps/actual-budget/helm-release.yaml:62-111
Timestamp: 2026-07-01T21:13:36.950Z
Learning: When reviewing Kustomize/Helm YAML in this repo, keep the base vs provider overlay split: `k8s/bases/apps/**` and `k8s/bases/infrastructure/**` should contain each app’s full, environment-agnostic configuration (including base-level postRenderer Kustomize patches such as deployment strategy, topology spread, probes, and env injection). `k8s/providers/{docker,hetzner}/**` should only add small provider-specific deltas (e.g., `interval`, `persistence.size`) via patch files (like `k8s/providers/<provider>/apps/<app>/patches/helm-release-patch.yaml`). If configuration is identical across providers (e.g., OIDC/OAuth env vars where `${domain}` is resolved per cluster via envsubst), it belongs in the base and must not be duplicated into provider overlays.

Applied to files:

  • k8s/bases/apps/github-config/oci-repository.yaml
  • k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
  • k8s/bases/apps/wedding-app/oci-repository.yaml
📚 Learning: 2026-07-03T03:44:11.507Z 
Learnt from: devantler
Repo: devantler-tech/platform PR: 2399
File: k8s/bases/apps/ascoachingogvaner/oci-repository.yaml:25-26
Timestamp: 2026-07-03T03:44:11.507Z
Learning: In Flux `OCIRepository` manifests under `k8s/bases/**/oci-repository.yaml`, keep the existing house convention for `spec.serviceAccountRef.verify.matchOIDCIdentity` subject regexes to use an `@.+` ref suffix (i.e., match any ref) rather than tightening it to a specific SHA/tag pattern.

If a PR adds a transitional dual-subject entry for an ongoing migration (e.g., moving from `devantler-tech/reusable-workflows` to `devantler-tech/actions`), do not request tightening the ref matcher in that PR. Defer any ref-matcher tightening to a separate, focused follow-up PR that consistently tightens `matchOIDCIdentity` subject rules once each file returns to a single subject after migration cleanup.

Applied to files:

  • k8s/bases/apps/github-config/oci-repository.yaml
  • k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
  • k8s/bases/apps/wedding-app/oci-repository.yaml
🔇 Additional comments (3)
k8s/bases/apps/ascoachingogvaner/oci-repository.yaml (1)

19-26: LGTM!

k8s/bases/apps/github-config/oci-repository.yaml (1)

31-38: LGTM!

k8s/bases/apps/wedding-app/oci-repository.yaml (1)

19-26: LGTM!

📝 Walkthrough

Walkthrough

Three Flux OCIRepository manifests had their cosign matchOIDCIdentity configuration changed from two separate subject entries (reusable-workflows and actions paths) to a single entry using an alternation regex matching either path, with comments updated accordingly.

Changes

Cosign OIDC identity consolidation

Layer / File(s) Summary
Consolidate matchOIDCIdentity subject regex
k8s/bases/apps/ascoachingogvaner/oci-repository.yaml, k8s/bases/apps/github-config/oci-repository.yaml, k8s/bases/apps/wedding-app/oci-repository.yaml		 Two separate subject entries for reusable-workflows and actions paths are replaced with a single subject regex alternation, keeping the same issuer, and comments are updated to document the single-identity limitation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

Possibly related PRs

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: collapsing multiple cosign identities into a single Flux-compatible identity.
Description check ✅ Passed The description directly matches the changeset and explains the Flux cosign identity transition and its impact.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch claude/cosign-single-identity-hotfix

Comment @coderabbitai help to get the list of available commands.

@devantler

devantler commented Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Daily AI Assistant

Closing as a duplicate of #2404 — a parallel session root-caused the same breakage and shipped the identical fix (one alternation-regex identity per tenant OCIRepository) minutes earlier; #2404 is already CR-approved, promoted, and queued. Parallel-race rule: the first PR wins, the duplicate closes.

@devantler devantler closed this Jul 3, 2026
@devantler
devantler deleted the claude/cosign-single-identity-hotfix branch July 3, 2026 05:59
@github-project-automation github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Jul 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

🌊 Project Board
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@devantler