fix(kyverno): prepare patched migration runtime by devantler · Pull Request #5544 · devantler-tech/platform

devantler · 2026-10-28T23:29:38Z

🤖 Generated by the Agentic Engineer

Why

The released migration tool carries an outdated compiler and capabilities that the maintenance job does not need. A smaller, patched runtime is needed before safely rolling out migration cleanup.

What

Prepares a tested, signed image containing the released migration behavior and only its required command. Publishing, independent image verification and production adoption remain separate delivery gates.

Part of #5542; unblocks #5491 after verified publication.

…on-runtime-5542

devantler · 2026-10-28T23:33:00Z

🤖 Generated by the Agentic Engineer

@coderabbitai full review

coderabbitai · 2026-10-28T23:33:07Z

⚠️ Action not completed

Review rate limited.

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 25 minutes.

coderabbitai · 2026-10-28T23:33:14Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: devantler-tech/platform
Branch: codex/kyverno-migration-runtime-5542
File: .coderabbit.yaml
Commit: b348dc4
Layers: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Advanced
Run ID: bb2bd6a6-5a38-4c0a-9adf-e9ba4c83c375

Commits

Reviewing files that changed from the base of the PR and between 882e2aa and b348dc4.

Files selected for processing: 5

.github/workflows/ci.yaml
.github/workflows/publish-kyverno-migration-runtime.yaml
k8s/bases/infrastructure/controllers/kyverno/MigrationRuntime.Dockerfile
k8s/bases/infrastructure/controllers/kyverno/migration-v1.19.2-runtime.patch
scripts/tests/test-kyverno-migration-runtime.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Additional context used

Code guidelines: 1

AGENTS.md — auto-discovered

Path-based instructions: 3

Source excerpt: **Put a change in the layer that matches its scope** — edit `k8s/bases/` when it should hold for **every consumer of that resource**; add an overlay `patches/` fragment only for a genuine per-consumer difference.

CodeRabbit inference engine (AGENTS.md)

Files:

k8s/bases/infrastructure/controllers/kyverno/MigrationRuntime.Dockerfile
k8s/bases/infrastructure/controllers/kyverno/migration-v1.19.2-runtime.patch

Source excerpt: **Never commit plaintext secrets** — all secrets must be SOPS-encrypted with the `.enc.yaml` suffix.

CodeRabbit inference engine (AGENTS.md)

Files:

k8s/bases/infrastructure/controllers/kyverno/MigrationRuntime.Dockerfile
k8s/bases/infrastructure/controllers/kyverno/migration-v1.19.2-runtime.patch
scripts/tests/test-kyverno-migration-runtime.sh

Source excerpt: Resources under `k8s/bases/infrastructure/` are **component-folder-first**: a component's HelmRelease/HelmRepository and its own CRs live together in a folder named after the component — `controllers//` in the con...

CodeRabbit inference engine (AGENTS.md)

Files:

k8s/bases/infrastructure/controllers/kyverno/MigrationRuntime.Dockerfile
k8s/bases/infrastructure/controllers/kyverno/migration-v1.19.2-runtime.patch

Learnings: 1

Learning: 2026-08-10T13:01:12.782Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 3057
File: .github/workflows/ci.yaml:622-659
Timestamp: 2026-08-10T13:01:12.782Z
Learning: Repository shell tests and scripts must remain compatible with macOS Bash 3.2. Do not use Bash 4+ features such as `mapfile`; use portable constructs, such as a `while IFS= read -r` loop, instead.

Applied to files:

scripts/tests/test-kyverno-migration-runtime.sh

Hadolint (2.15.1)

k8s/bases/infrastructure/controllers/kyverno/MigrationRuntime.Dockerfile

[info] 34-34: Multiple consecutive RUN instructions. Consider consolidation.

(DL3059)

Additional comments: 5

k8s/bases/infrastructure/controllers/kyverno/migration-v1.19.2-runtime.patch: 1

1-413: LGTM!

.github/workflows/publish-kyverno-migration-runtime.yaml: 1

1-177: LGTM!

k8s/bases/infrastructure/controllers/kyverno/MigrationRuntime.Dockerfile: 1

1-34: LGTM!

scripts/tests/test-kyverno-migration-runtime.sh: 1

1-61: LGTM!

.github/workflows/ci.yaml: 1

942-945: LGTM!

Walkthrough

The pull request adds a patched Kyverno migration executable and tests, a Dockerfile that builds a restricted runtime image, and a GitHub Actions workflow that verifies, publishes, and signs the image. It also adds a repository guard for the publisher contract and runs that guard from CI.

Possibly related issues

Issue 5542: The changes add the patched migration runtime image and its publisher checks described by the issue.

Priority: Normal

Merge Risk: Minimal · up to b348d

No actionable issue was established in the migration runtime, image publication, or CI guard changes. The PR is mergeable after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description check		The description directly explains the need for a smaller, patched migration runtime and the separate publication and adoption gates.
Title check		The title clearly and concisely identifies the Kyverno migration runtime preparation, which is the main change.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (4 skipped: 4 unsupported.)

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devantler · 2026-10-28T23:34:48Z

🤖 Generated by the Agentic Engineer

@codex review

chatgpt-codex-connector · 2026-10-28T23:35:01Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-28T23:34:59.973731Z	`bcd92bf`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

…on-runtime-5542

devantler · 2026-10-29T00:01:58Z

🤖 Generated by the Agentic Engineer

@coderabbitai full review

coderabbitai · 2026-10-29T00:02:06Z

✅ Action performed

Full review finished.

devantler · 2026-10-29T00:23:20Z

🤖 Generated by the Agentic Engineer

Readiness at b348dc4970208577280f3084268f10e7fb7f3448: all 51 reported check-runs are settled successfully or intentionally skipped, current mergeability is CLEAN, and the complete review surfaces contain zero unresolved threads or actionable findings. CodeRabbit's current-head review covers all five changed files.

The native Linux build exercised the real migration command through TLS API success and refusal cases, preserved retained-object data, and checked the actual non-root image's version/help and unsupported-command refusal. Race tests, lint, the compiled Go 1.26.10 assertion, and source/executable vulnerability scans passed. The informational Hadolint suggestion concerns separate exec-form runtime checks; both checks are intentionally retained for the shell-less image.

The required-gate helper reports the configured forge-only code-quality rule as UNVERIFIED because it has no head-readable analysis. Under the reviewed merge policy, CLEAN and the merge API remain authoritative for that rule. Publication, independent image verification, active image policy and production migration acceptance remain separate gates in #5542 and #5491.

devantler added 2 commits October 29, 2026 00:24

fix(kyverno): prepare patched migration runtime

e730a3d

Merge remote-tracking branch 'origin/main' into codex/kyverno-migrati…

bcd92bf

…on-runtime-5542

github-project-automation Bot added this to 🌊 Project Board Oct 28, 2026

github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Oct 28, 2026

devantler added 2 commits October 29, 2026 00:39

fix(ci): track migration runtime guard as executable

2ed4322

Merge remote-tracking branch 'origin/main' into codex/kyverno-migrati…

b348dc4

…on-runtime-5542

devantler marked this pull request as ready for review October 29, 2026 00:23

devantler added this pull request to the merge queue Oct 29, 2026

Merged via the queue into main with commit bcf7296 Oct 29, 2026
51 checks passed

devantler deleted the codex/kyverno-migration-runtime-5542 branch October 29, 2026 04:22

github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Oct 29, 2026

devantler mentioned this pull request Oct 29, 2026

Build a patched Kyverno migration runtime #5542

Closed

Navigation Menu

Repository navigation

fix(kyverno): prepare patched migration runtime - #5544

fix(kyverno): prepare patched migration runtime#5544
devantler merged 4 commits into
mainfrom
codex/kyverno-migration-runtime-5542

devantler commented Oct 28, 2026

Uh oh!

devantler commented Oct 28, 2026

Uh oh!

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

devantler commented Oct 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026

Uh oh!

devantler commented Oct 29, 2026

Uh oh!

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

devantler commented Oct 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

devantler commented Oct 28, 2026

Why

What

Uh oh!

devantler commented Oct 28, 2026

Uh oh!

coderabbitai Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devantler commented Oct 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026

Codex Review Summary

Uh oh!

devantler commented Oct 29, 2026

Uh oh!

coderabbitai Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devantler commented Oct 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

coderabbitai Bot commented Oct 29, 2026 •

edited

Loading