Repository navigation
Build a patched Kyverno migration runtime #5542
Description
🤖 Generated by the Agentic Engineer
Problem and impact
The migration lifecycle repair needs reviewed maintenance tooling with current security fixes. The public Kyverno v1.19.2 CLI image is built with Go 1.26.9, which predates the Go 1.26.10 certificate-verification fix. Reusing it for a new maintenance rollout would leave that prerequisite unresolved.
Public source evidence
The published reg.kyverno.io/kyverno/kyverno-cli:v1.19.2 image and the v1.19.2 release source establish the baseline. Inspection of its Linux executable identifies Go 1.26.9; the Go vulnerability record identifies the patched compiler version. Detailed assessment and runtime observations remain private.
Required outcome
- Build a narrowly scoped migration runtime from the exact released migration implementation, preserving the hook's command arguments, resource handling, runtime identity and permissions.
- Use a reviewed patched compiler and compatible dependency repairs. Analyze source and compiled-binary findings; preserve all validation gates and retain evidence for affected packages proven absent.
- Exercise the real Linux executable and released migration tests, with positive and refusal controls for its supported command boundary.
- Publish an immutable image with source provenance, SBOM and the exact protected-workflow signature; independently verify its digest and executable before adoption.
- Keep runtime verification policy, protected adoption, successful migration cleanup and an attributable fresh posture scan as separate acceptance in Clean up successful Kyverno migration jobs after upgrades #5491.
Metadata
Metadata
Assignees
Labels
No labels
Type
Fields
No fields configured for Security.
Projects
- Status
Activity
chore: agent-claim #5542 nonce=1a940be6458d378a7847e253f1cd05b5
devantler commentedon Oct 29, 2026
#5544 merged and its native publisher succeeded. The signed image is
ghcr.io/devantler-tech/platform-kyverno-migrate@sha256:fecf0fecdd90cfd5475868d02df325984d93600ff8813c2e1c0410aae8010a4d; independent signature verification passed for the exact main-workflow identity. Its packaged executable uses the reviewed patched compiler and the intended migration-only entrypoint.Blocker: executable release identity is incomplete. The published main-module version is a pseudo-version rather than the reviewed release tag, and symbols are stripped. The binary scan returns no symbol finding but retains module findings; that is not complete security acceptance. Bind and verify the real release tag and retain executable audit precision before accepting this candidate. #5491 remains blocked on verified tooling and the separate verification-policy activation; no image adoption or lifecycle cleanup has been requested here.
chore: agent-claim #5542 nonce=e8840fef909f1b8a5fcf7ab6805400e0
fix(kyverno): judge the migration runtime scan by exact advisory
devantler commentedon Oct 31, 2026
#5626 corrects the producer, and its no-publish verify job passed. The build now stamps the executable with v1.19.2 on an unmodified source tree and keeps its symbols, and it fails unless it can read both back.
With symbols kept, the scan runs at symbol level and reports three whole-module Go records for Kyverno v1.19.2. These exact IDs were already adjudicated in the repository allow-list, tracked on #5154; any other advisory now fails the build. Adoption stays out of scope until a signed candidate is published and accepted. The same correction applies to the held images in #5527 and #5522 once this merges.
fix(kyverno): prove the scanner extracted symbols from the runtime
fix(kyverno): require the exact advisory list from the runtime scan
devantler commentedon Oct 31, 2026
#5626 merged and its publisher succeeded. The signed candidate is
ghcr.io/devantler-tech/platform-kyverno-migrate@sha256:ee142d6feae09ff8970286261a17ce6f6e9eb0c848a601db31c78933a189ef42. A separate signature check from the agent host passed for the exact main-workflow identity.In the build, the executable reports
v1.19.2from an unmodified tree, keeps its symbols, passes a symbol-level scan with only the three adjudicated records from #5154, and runs its version and migrate help commands and the refusal check.Still open: reading that executable back from the published image, outside the build. The agent host has no image tool for that. No image was adopted and no workload changed; adoption stays with #5491.
devantler commentedon Oct 31, 2026
The published image's executable is now read back outside the build, which was the last open check here. I pulled
ghcr.io/devantler-tech/platform-kyverno-migrate@sha256:ee142d6feae09ff8970286261a17ce6f6e9eb0c848a601db31c78933a189ef42from the registry and extracted thelinux/amd64executable. It was inspected, not run; the build runs it.go1.26.10mod github.com/kyverno/kyverno v1.19.2,vcs.modified=falsev1.19.2-migration.1-eed5caab082e10a1ee7c02ac636b66f257c4cfb3, matching the image's revision label and the merged #5626 commit its publisher builtmain.mainGO-2025-3615 GO-2026-5337 GO-2026-5594, the records adjudicated in #515465534:65534, entrypoint/ko-app/kubectl-kyvernoThe executable's SHA-256 is
e15339c16861d983f627cfdf25b5019dde7c5ec80ffa5e8b3f1bb9e2f538436f. The signature was verified in the comment above.This completes the runtime. No image was adopted and no workload changed: adoption, migration cleanup and the fresh posture scan stay with #5491.