Repository navigation
fix(kubescape): adopt the published summary metadata repair - #5420
Conversation
This proposes the adoption step for the repair published by #5402. The image signature verifies against the exact main publisher identity, GitHub issuer and producer revision The immutable-image contract demonstrated RED against the old pin and GREEN against this pin. Both local and production KSail validation passed and explicitly evaluated the Kubescape base and HelmRelease. Unrelated OCI chart renders remain limited locally by an unavailable Docker credential helper; hosted validation is still required. Whitespace checks pass. The two-file self-review preserves the previous image as a rollback target, the retained store and the single-writer rollout. Fresh repeated API reads reproduce stable summary version splits. A recent scoped scan-storage backup upload completed; this does not prove a full-platform restore. Production readiness remains held. After protected deployment, verify the running image, reconciliation receipt, LIST/GET identity/version agreement, a successful scanner update and current paired coverage. This draft claims no deployed repair and keeps #5419 and #4263 open for that evidence. |
Part of #5419. The complete production render changes exactly the Kubescape HelmRelease fingerprint for the signed image pin. Approve that one reviewed entry and retain the closed authorization checks and negative controls.
The two failed checks at the initial head had the same cause: the authorization ledger fingerprints the complete rendered HelmRelease, including its image pin. Commit
Its source delta is the signed revision 8 storage image pin already described above. Grant-bearing configuration and validator checks retain their existing scope. The actual production authorization validator and its complete targeted regression suite pass with the approved Kubernetes client. Current-head hosted validation now reports 37 successes and 12 intended skips. The frozen historical approval file is unchanged; this comment records the scoped approval evidence. Review and live deployment verification remain required. The existing production recovery hold still applies. |
@coderabbitai review |
✅ Action performed
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly identifies the main change: adopting the published Kubescape summary metadata repair. |
| Description check | |
The description explains why the repair is needed and states that it preserves scan records and rollout protections. |
| Docstring Coverage | |
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within survi… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Readiness refreshed for The immutable-image positive/negative signature controls, provenance chain, retained-data boundary, both rendered environments and authorization-entry validation remain the user-evaluation evidence. All readable required gates pass; native code-quality remains UNVERIFIED through the API and is left to protected enforcement. The full platform health helper passes. Deployment, repaired stored-summary comparison and coverage verification remain open in #5419; publication and merge alone cannot resolve the scanner findings. |
Why
Scan summaries can remain stuck after incomplete updates, preventing findings from refreshing.
What
Selects the reviewed, published repair while preserving existing scan records and rollout protections. Live verification remains tracked in #5419.
Part of #5419