miki3421 commented on issue #273: URL: https://github.com/apache/openserverless/issues/273#issuecomment-6166904263
Kind compatibility is implemented and validated in the isolated lab, held for the future 0.9.3 branch as agreed. Personal fork commits (no Apache branch was created): - Node preparation: https://github.com/miki3421/openserverless-task-custom/commit/74d3e32 - Explicitly owned worker state: https://github.com/miki3421/openserverless-admin-api/commit/d712044 Both use branch `fix-0.9.3-kind-builder`. The admin-api branch is currently based on the security backport; the final diff/base must be reconciled when Apache 0.9.3 exists. Compatibility PRs have deliberately not been opened against 0.9.0. Validation on Kind 0.30.0 / Kubernetes 1.33.1 / containerd 2.1.1: - Minimal user-namespace pod succeeds. - Node preparation is repeatable; its service and read-only sysfs mount survive a node restart. - Base-image build and authenticated registry push succeed. - Dependency build installs pyfiglet 1.0.2, pushes its image, and an action using it returns HTTP 200 with the expected library version. Repeated successfully after node restart and service readiness. - Invalid source/target and cross-tenant target requests still return HTTP 400; seven focused unit tests pass. - `hostUsers: false`, token automount disabled, non-privileged worker, bounded UID mappings and BuildKit `process-mode:sandbox` remain in place. No worker hostPath or Docker socket was added. The extra sysfs is read-only/nosuid/nodev/noexec under a root-only directory inside the Kind node. Test qualifications: the lab registry secret required an additional auth endpoint matching its internal service name (authentication was retained). The public Python 3.12 baseline image lacks `/bin/extend`; the dependency test used a test-only derived runtime implementing that existing 0.9.0 contract. No Alpha/Beta source code was changed. These are functional/regression tests, not a claim of an exhaustive independent security audit. Related 0.9.0 security PRs remain https://github.com/apache/openserverless-admin-api/pull/60 and https://github.com/apache/openserverless-task/pull/237. Once 0.9.3 is available, the Kind PRs will be linked here for closure. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
