fix(image-automation): bound the netbird-ingress semver range #222

2026-07-14T10:06:57Z

claude-bot commented

2026-07-14 10:06:57 +00:00

Fixes #204 (partial).

What

netbird-ingress.yaml's ImagePolicy had range: ">=0.73.0" — unbounded
above. Every other one of the 23 enrolled image-automation policies pins
to a major (or major.minor), per the README's stated mitigation:
image-automation pushes bumps direct to master with no PR gate, so
ranges must be tight enough that a breaking bump requires manual policy
widening.

Bounded it to "0.x", matching the existing cnpg-barman-plugin (0.x)
precedent for pre-1.0 images. Verified the currently deployed tag
(v0.74.4-rootless, in kubernetes/infrastructure/netbird-ingress/daemonset.yaml)
stays in range — no rollback. Also added the missing netbird-ingress row
to the README's enrolled-policies table (it was wired into the
kustomization but absent from the table).

Not in this PR — needs an owner decision

The issue also flagged two items I can't act on unilaterally and have
posted about on #204 for a decision:

Dedicated scoped push token for image-automation (currently reuses the
full-scope gitea_admin bootstrap PAT that Flux itself uses to pull —
creating/rotating a new scoped token is an operator action).
Whether to PR-gate image-automation bumps instead of direct-push (a
behavior change, not a bugfix).

The home-assistant.yaml policy (>=2026.0.0) was also flagged as
unbounded in the original finding, but its comment documents a
deliberate rationale (calver year-rollover guard, tag pattern already
restricts to bare numeric triplets) — left as-is; noted on the issue.

Fixes #204 (partial). ## What `netbird-ingress.yaml`'s ImagePolicy had `range: ">=0.73.0"` — unbounded above. Every other one of the 23 enrolled image-automation policies pins to a major (or major.minor), per the README's stated mitigation: image-automation pushes bumps direct to master with no PR gate, so ranges must be tight enough that a breaking bump requires manual policy widening. Bounded it to `"0.x"`, matching the existing `cnpg-barman-plugin` (`0.x`) precedent for pre-1.0 images. Verified the currently deployed tag (`v0.74.4-rootless`, in `kubernetes/infrastructure/netbird-ingress/daemonset.yaml`) stays in range — no rollback. Also added the missing `netbird-ingress` row to the README's enrolled-policies table (it was wired into the kustomization but absent from the table). ## Not in this PR — needs an owner decision The issue also flagged two items I can't act on unilaterally and have posted about on #204 for a decision: - Dedicated scoped push token for image-automation (currently reuses the full-scope `gitea_admin` bootstrap PAT that Flux itself uses to pull — creating/rotating a new scoped token is an operator action). - Whether to PR-gate image-automation bumps instead of direct-push (a behavior change, not a bugfix). The `home-assistant.yaml` policy (`>=2026.0.0`) was also flagged as unbounded in the original finding, but its comment documents a deliberate rationale (calver year-rollover guard, tag pattern already restricts to bare numeric triplets) — left as-is; noted on the issue.

claude-bot added 1 commit 2026-07-14 10:06:57 +00:00

fix(image-automation): bound the netbird-ingress semver range c107e0c00f

netbird-ingress.yaml's ImagePolicy used ">=0.73.0" — unbounded above,
unlike every other of the 23 enrolled policies which pin to a major
(or major.minor). Since image-automation pushes bumps straight to
master with no PR gate, an unbounded range lets any future upstream
release (including a breaking 1.x) land automatically.

Bound it to "0.x", consistent with cnpg-barman-plugin's precedent for
pre-1.0 images: the currently deployed v0.74.4-rootless stays in
range, and a 1.x jump now requires a manual policy widen. Also adds
netbird-ingress to the README's enrolled-policies table, where it was
missing despite being wired into the kustomization.

Fixes #204 (partial — see issue comment for the scoped-token and
PR-gating items, which need an owner decision).

Co-Authored-By: Claude Bot <claude-bot@renner.uno>

claude-bot referenced this pull request

2026-07-14 10:10:59 +00:00

[security][medium] Image-automation auto-pushes to master with the full-scope gitea_admin PAT; unbounded ranges #204

k.renner merged commit 0dc687143a into master

2026-07-14 10:58:27 +00:00

k.renner referenced this issue from a commit

2026-07-14 10:58:28 +00:00

Merge pull request 'fix(image-automation): bound the netbird-ingress semver range' (#222) from fix/issue-204 into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#222