feat: airgaps - #105

Merged

butler54 merged 171 commits into

validatedpatterns:mainfrom

butler54:dev/airgap-testing

Aug 17, 2026

Commits on Jul 21, 2026

feat(airgap): add ImageSetConfiguration for disconnected mirroring

butler54
and
claude
committed
a0c26cc
fix(airgap): use fast-4.21 channel (4.21.24 not in stable yet)

butler54
and
claude
committed
89297a6
fix(airgap): ACM default channel, kyverno as additionalImages

butler54
and
claude
committed
e4281f5

Commits on Jul 22, 2026

feat(20a-01): add VP Helm OCI charts + missing images to ImageSetConfiguration
butler54
committed
c59eae0
feat(airgap): configure disconnected deployment values
butler54
committed
182028d
feat(airgap): add bootstrap secrets for SSH key injection
butler54
committed
ef8cec0
fix(airgap): use SCP-style SSH URL format for patterns-operator

butler54
and
claude
committed
b5522d2
fix(airgap): switch to HTTP git transport for patterns-operator

butler54
and
claude
committed
cd605be
feat(airgap): add community-operators catalog for patterns-operator

butler54
and
claude
committed
0b75b17
feat(airgap): add post-install bootstrap script and Makefile targets

butler54
and
claude
committed
9e92acc
feat(airgap): add airgap-mirror Makefile target for oc-mirror

butler54
and
claude
committed
118dbf4
fix(airgap): oc-mirror uses XDG_RUNTIME_DIR auth, not CLI flag

butler54
and
claude
committed
8679784
fix(airgap): make skopeo optional in post-install bootstrap

butler54
and
claude
committed
eac0cf7
fix(airgap): correct patternsOperator catalog source

butler54
and
claude
committed
b91d3f4
feat(airgap): comprehensive disconnected deployment overhaul

butler54
and
claude
committed
f571717
feat(airgap): add ArgoCD Helm OCI registry auth to bootstrap

butler54
and
claude
committed
1635f2c
fix(airgap): switch from OCI to traditional HTTP Helm repo

butler54
and
claude
committed
ec30866

Commits on Jul 23, 2026

fix(airgap): restore OCI helmRepoUrl now that Quay repos are public

butler54
and
claude
committed
a3accfd
docs(airgap): add comprehensive disconnected deployment guide

butler54
and
claude
committed
2cb34ac
fix(airgap): move singleArgoCD to global scope

butler54
and
claude
committed
8ddc3aa
fix(airgap): add Vault UBI image to mirroring config

butler54
and
claude
committed
f7c9169
feat: add argocd-login Makefile target

butler54
and
claude
committed
1d1a6c6
feat: add argocd-install target to extract CLI from cluster

butler54
and
claude
committed
9ebf235
fix: show errors in argocd-install instead of hiding them

butler54
and
claude
committed
5507bb0
fix: use component=server label for ArgoCD deployment lookup

butler54
and
claude
committed
1d75e79
fix: drop --grpc-web from argocd login

butler54
and
claude
committed
4f0b665
fix: use argocd --core mode (bypasses route/gRPC issues)

butler54
and
claude
committed
ae3c8a5
fix: argocd login --core takes no --namespace flag

butler54
and
claude
committed
6f6fd86
fix: set kubectl context namespace to ArgoCD ns for --core mode

butler54
and
claude
committed
53eba66
fix(airgap): move kyverno chart to validatedpatterns OCI path

butler54
and
claude
committed
ba28219
fix(airgap): move intel-device-plugins to certified catalog section

butler54
and
claude
committed
0eb67b0
feat(20c-01): replace PCCS/QGS with DCAP operator CR (D-02, D-03, D-04)
butler54
committed
42652c7
feat(20c-01): add DCAP operator subscription and imageset-config entry (D-01, D-07)
butler54
committed
b7343ce
feat(20c-03): add collect-dcap-collateral.sh and Makefile targets (D-05, D-08)
butler54
committed
ab0331a
feat(20c-03): add tdxCollateral to vault template and trustee overrides (D-08, D-10)
butler54
committed
e329c6a
fix(20c): nodeSelector must be array of strings, not map

butler54
and
claude
committed
571de86
fix(trustee): target bare repo git branch instead of OCI chart

butler54
and
claude
committed
43a05cb
fix(trustee): add path: . for git-based chart source

butler54
and
claude
committed
5e94cec

Commits on Jul 24, 2026

Commits on Jul 25, 2026

fix(eso): use internal vault service URL for ClusterSecretStore

butler54
and
claude
committed
38713fe
fix(eso): add NetworkPolicy for vault port 8200 egress

butler54
and
claude
committed
5b021d2
fix(eso): use vault route URL with apps prefix

butler54
and
claude
committed
fd5ef85
fix: stop stripping apps. prefix from hubClusterDomain

butler54
and
claude
committed
26461c5
fix: align collect-dcap-collateral.sh with pcsclient.py CLI

butler54
and
claude
committed
dc99a7f
feat: embed kyverno chart v3.7.2 into pattern repo

Chris Butler
and
claude
committed
4cdd5bb
Merge remote-tracking branch 'jumphost/dev/airgap-testing' into dev/airgap-testing
butler54
committed
0767de6
fix(kyverno): set image registry to Quay mirror for airgap

Chris Butler
and
claude
committed
3476100
fix(kyverno): correct image registry path (remove extra nesting)

Chris Butler
and
claude
committed
4804f5d
fix(kyverno): set image registry in chart values.yaml

Chris Butler
and
claude
committed
716cd26
Merge remote-tracking branch 'jumphost/dev/airgap-testing' into dev/airgap-testing
butler54
committed
c2a5d01
fix(airgap): parameterize workload images and point to Quay mirror

butler54
and
claude
committed
c802167
feat: inject private registry CA into CoCo initdata

butler54
and
claude
committed
03f80da
fix: rewrite firmware refvals extraction for new veritas format

butler54
and
claude
committed
8b758f9
fix(acm): override MCE subscription source for mirrored catalog

butler54
and
claude
committed
349e29b
fix(acm): add multicluster-engine to mirrored catalog

butler54
and
claude
committed
ca65589
fix(sync): add sync-wave 10 to GPU subscription

butler54
and
claude
committed
c48ce57

Commits on Jul 26, 2026

fix(airgap): workaround VP operator hybrid manifest format

butler54
and
claude
committed
721609a
fix(airgap): remove non-existent OSC :latest tag refs from imageset

butler54
and
claude
committed
17ad116
fix(airgap): remove Helm OCI auth (causes 401 on public Quay repos)

butler54
and
claude
committed
054269a
fix(airgap): add Intel operator images to step 6b mirror workaround

butler54
and
claude
committed
a3da3ab
fix(airgap): disable GPU operator — NVIDIA bundle mirror issue

butler54
and
claude
committed
79c9121
fix(airgap): apply oc-mirror IDMS/ITMS in step 3b

butler54
and
claude
committed
953b0a5
fix(airgap): add all signature-failed images to step 6b fixup list

butler54
and
claude
committed
177a440
fix(intel-dcap): add privileged SCC for QGS DaemonSet

butler54
and
claude
committed
72791a6
fix(intel-dcap): grant SCC to intel-tdx-dcap SA, not default

butler54
and
claude
committed
da7d9ac
feat: add pck-register Makefile target for Intel PCK cert registration

butler54
and
claude
committed
c72d2b3
fix(sync): move ALL subscriptions to wave 10

butler54
and
claude
committed
8711704
fix(sync): keep ESO + LVM at wave 0 — vault depends on them

butler54
and
claude
committed
2d2e272
fix(sync): keep CNV at wave 0 — provides hostpath provisioner for vault PVC

butler54
and
claude
committed
ae40b9f
fix(sync): increase vault hook deadline to 1800s (30 min)

butler54
and
claude
committed
3d72cb0
fix: remove serviceAccountName override that duplicates admin SA

butler54
and
claude
committed
d04b032
fix: grant imperative-sa full admin via clusterRoleYaml override

butler54
and
claude
committed
bb6fc94
fix(airgap): add community-operator-pipeline-prod to ITMS

butler54
and
claude
committed
be44ef9
refactor(airgap): split VP hybrid images to mirror-registry, certified to Quay

butler54
and
claude
committed
f5f1bcc

Commits on Jul 27, 2026

fix(kbs-access-curl): run init and main containers as privileged

butler54
and
claude
committed
f29927b
fix(kbs-access-curl): write to /tmp then cp to shared volume

butler54
and
claude
committed
7d21daf
fix(kbs-access-curl): mount emptyDir at /tmp/shared for kata-cc compatibility

butler54
and
claude
committed
9121817
fix(kbs-access-curl): dedicated SA with privileged SCC for kata-cc emptyDir writes

butler54
and
claude
committed
60cd464

Commits on Jul 28, 2026

feat: AMD SEV-SNP VCEK offline provisioning scripts

butler54
and
claude
committed
1420b3a
feat: install Intel DCAP operator in intel-dcap-operator-system namespace

butler54
and
claude
committed
c9ba33c

Commits on Aug 6, 2026

feat(23-01): add offline verify harness and DER fixture generator

butler54
and
claude
committed
5eb6ff4
feat(23-01): add live APAC-lab verify harness

butler54
and
claude
committed
e0bcd37

Commits on Aug 10, 2026

Commits on Aug 11, 2026

fix: update catalogSource to v4-22 (oc-mirror generates v4.22 now)
Chris Butler
committed
f81e38c
fix: update all CatalogSource references from v4-21 to v4-22
Chris Butler
committed
49c773d
refactor: use clustergroup 0.9.58 global.catalogSource default
Chris Butler
committed
892b459
fix(airgap): multiSourceRepoUrl → mirror-registry, not Quay
Chris Butler
committed
881416c
revert: multiSourceRepoUrl stays Quay — VP OCI charts not in mirror-registry
Chris Butler
committed
e6ffe95
fix(airgap): mirror-registry as chart source; oc-mirror-driven CatalogSources
Chris Butler
committed
ff7f88f
fix(airgap): kyverno image registry — mirror-registry not Quay
Chris Butler
committed
9118da1
fix(airgap): pin kyverno image tags to v1.13.4 (mirrored version)
Chris Butler
committed
08a59c0
fix(airgap): correct kyverno image tag paths for v1.13.4 pin
Chris Butler
committed
358dc6e
fix(airgap): workload image refs — mirror-registry not Quay, latest not airgap tag
Chris Butler
committed
20a78df
fix(airgap): kyverno v1.17.2 mirrored — remove tag pin, keep registry override
Chris Butler
committed
7ef2ed6
fix(airgap): update mirror config gaps found in Phase 25 deploy run
Chris Butler
committed
a9abe57
fix(airgap): add NFD operand image to additionalImages (tag preservation)
Chris Butler
committed
902a6c5
fix(airgap): helmRepoUrl → mirror-registry (VP OCI charts in mirror-registry via oc-mirror)

butler54
and
claude
committed
8c41a7d
fix(airgap): apply ALL oc-mirror cluster-resources (IDMS, ITMS, CatalogSource, signatures, ClusterCatalog)

butler54
and
claude
committed
9972115
fix(airgap): NeverContactSource on IDMS — prevent internet fallback on mirror miss

butler54
and
claude
committed
251ba60

Commits on Aug 12, 2026

fix(airgap): remove community-operator-pipeline-prod from manual ITMS
butler54
committed
ed8c8be
fix(storage): switch storageProvider from hpp to lvm

butler54
and
claude
committed
3020d01
fix(airgap): (( applied++ )) exits under set -e when applied=0

butler54
and
claude
committed
59b5707
fix(airgap): add kyverno-cli and ensure vault to imageset-config

butler54
and
claude
committed
11ae716
feat: load-bootstrap pre-creates target namespaces

butler54
and
claude
committed
80c0628
fix: load-bootstrap reads correct values-secret file (pattern-specific)

butler54
and
claude
committed
0c19f32
fix: normalise NeverContactSource on all IDMS/ITMS in airgap-post-install

butler54
and
claude
committed
f0f6b42
fix(baremetal): set QGS socket_port=0 via MachineConfig drop-in

butler54
and
claude
committed
87967d3
fix(dcap): use -p E5 and apply jq QeIdentity fixup in collect-dcap-collateral

butler54
and
claude
committed
615f379
fix(dcap): add qveidentity variants to jq fixup and fix verification

butler54
and
claude
committed
ab35fe8
fix(dcap): delete raw file before fetch to avoid interactive overwrite prompt

butler54
and
claude
committed
b788afd
fix(airgap): pin workload images to mirror registry digests

butler54
and
claude
committed
df8265e
fix(bootstrap): patch ArgoCD labels after load_bootstrap_secrets

butler54
and
claude
committed
c3e4009
Revert "fix(bootstrap): patch ArgoCD labels after load_bootstrap_secrets"
butler54
committed
74f587a

Commits on Aug 13, 2026

fix: use printf not echo when writing mirror-registry-password file

butler54
and
claude
committed
963990c
fix(coco): use Recreate strategy for all kata confidential deployments

butler54
and
claude
committed
c67a7a1
fix: cache-registry-ca must use mirror-registry CA not quay-ca-chain

butler54
and
claude
committed
6fe0b73
cleanup: remove dead PCCS code and quay.apac-tech-lab verify refs

butler54
and
claude
committed
0d3eedb
docs(airgap): add permanent deploy runbook with Phase 0 pre-requisites

butler54
and
claude
committed
b186b8a
feat(26): add CNV guest image additionalImages to imageset-config-4.22.yaml
butler54
committed
80b0436
fix(airgap): add :latest tags to CNV guest images in imageset-config

butler54
and
claude
committed
931deb6
feat(26): add kubevirtconfidential chart — HyperConverged CR + SELinux MCO
butler54
committed
6a0f429
feat(26): add compile-selinux-policy Makefile target
butler54
committed
d7cfb80
feat(26): add kubevirtconfidential ArgoCD Application to values-baremetal.yaml
butler54
committed
c3f0912
feat(26): embed compiled kubevirt-qgs SELinux policy .pp

butler54
and
claude
committed
ca04980
fix(26): enable kubevirtconfidential chart (global.kubevirt.confidential.enabled=true)
butler54
committed
3ccb4f8
fix(26): switch SELinux policy to CIL format (RHCOS lacks pp HLL converter)

butler54
and
claude
committed
61f23b1
fix(26): compile SELinux .te → CIL on node via oneshot service

butler54
and
claude
committed
56aa536
feat(26): enable DataImportCron — guest images present in mirror registry
butler54
committed
7055468
feat(26): raise node maxPods to 500 via KubeletConfig

butler54
and
claude
committed
8984a2b
feat(26): PostSync Job to create rhel9-guest ImageStream for DataImportCron

butler54
and
claude
committed
210e858
fix(storage): set volumeBindingMode=Immediate on LVMCluster for SNO

butler54
and
claude
committed
65f1602
fix(storage): volumeBindingMode under storageClassOptions (correct LVMS field)
butler54
committed
01cbe70
feat(storage): PostSync Job to set lvms-vg1 as default StorageClass

butler54
and
claude
committed
98969c5
feat(27): add kubevirtvm chart — simplest RHEL9 baseline VM
butler54
committed
37e597e
feat(27): wire kubevirtvm ArgoCD Application (wave 35, kubevirt-vms)
butler54
committed
ec9e76c
fix(27): remove namespace.yaml from kubevirtvm chart — VP parent manages namespaces
butler54
committed
7d9b7b8
feat(28): add rhel9-tdx TDX VM variant to kubevirtvm chart
butler54
committed
814d7ef
feat(28): enable TDX VM variant in values-baremetal.yaml
butler54
committed
933883f

Commits on Aug 14, 2026

fix(28): fix HCO jsonpatch — create developerConfiguration object not array-append

butler54
and
claude
committed
cdb8978
fix(28): secureBoot=true + remove smm=false for rhel9-tdx VM

butler54
and
claude
committed
3282264
fix(28): jsonpatch — 3-op append for WorkloadEncryptionTDX featureGate

butler54
and
claude
committed
639051e
revert(28): restore original featureGates append jsonpatch

butler54
and
claude
committed
81b90cd
fix(28): enable SMM explicitly for rhel9-tdx — required by SecureBoot+EFI

butler54
and
claude
committed
94f65d7
fix(28): revert smm/secureBoot + add TDX OVMF MachineConfig for no-secboot descriptor

butler54
and
claude
committed
0cb7a24
fix(28): place TDX OVMF descriptor in /usr/share/qemu/firmware/ not /etc/qemu/

butler54
and
claude
committed
6ff59f8
fix(28): overlay /etc/qemu/firmware onto /usr/share/qemu/firmware at boot

butler54
and
claude
committed
0dbc4c7
fix(28): set ovmfPath=/usr/share/edk2/ovmf via jsonpatch + remove OVMF MCO

butler54
and
claude
committed
874cd03
cleanup(29-01): restore upstream URLs in values-global.yaml
butler54
committed
e56f218
cleanup(29-01): remove lab overrides and airgap sources from values-baremetal.yaml
butler54
committed
69e2fd0
cleanup(29-01): reset kyverno registry to upstream default, move airgap override
butler54
committed
17b010e
cleanup(29-01): rename quay artifacts to mirror-registry
butler54
committed
5f5e385
docs(29-01): add experimental READMEs for kubevirt charts
butler54
committed
fafe1e3
cleanup(29-01): delete deprecated scripts
butler54
committed
e98d964
cleanup(29-01): abstract lab references in airgap docs and configs
butler54
committed
3957496
cleanup(29-01): fix remaining lab IP and quay artifact references found in sweep
butler54
committed
6cbf507

Commits on Aug 17, 2026

feat(29): switch trustee to OCI Helm chart v0.10.0

butler54
and
claude
committed
8bdb636
fix: resolve PR lint failures — schema and vendored chart exclusion

butler54
and
claude
committed
6f4806b
refactor: move vendored kyverno chart to charts/vendor/

butler54
and
claude
committed
54742dc
fix: add clusterGroup to values-baremetal-airgap for schema validation

butler54
and
claude
committed
c2c66f4
fix: exclude airgap overlay from ClusterGroup schema validation

butler54
and
claude
committed
5d8eadd
fix: restore clusterGroupName to azure (upstream CI default)
butler54
committed
473b3a9
docs: update README for v8.0 release

butler54
and
claude
committed
4ae688f
fix: address PR #105 review comments

butler54
and
claude
committed
4325ccc