add ServiceRadar remote-access enrollment collection #1

Merged

gitea_admin merged 29 commits from feat/serviceradar-remote-access-enrollment into main 2026-07-14 23:19:58 +00:00

Conversation 1 Commits 29 Files changed 122 +10053 -2

mfreeman451 commented 2026-07-13 02:26:11 +00:00

Owner

Copy link

Adds reusable, public Ansible content for ServiceRadar remote-access enrollment without publishing deployment-specific CA material or credentials.

• staged Linux OpenSSH user-CA preflight, install, verification, commit, overlap/retirement, removal, and rollback flows
• private ServiceRadar API/callback contract for obtaining per-execution trust material through attenuated short-lived authority
• reviewed AWX wrapper/catalog metadata that keeps direct wrappers and unverified content production-gated
• Windows QEMU guest-agent preflight and installation over PSRP/WinRM
• Proxmox inventory and relay-credential integration content
• hash-locked CI dependencies, repository/private-material checks, syntax gates, ansible-lint production profile, collection build provenance, and Molecule scenarios

Local verification is green: 8 repository tests, YAML/Ansible lint with zero failures or warnings, every wrapper syntax check, collection dependency install/build, and Windows QGA Molecule syntax.

Remaining before this leaves draft: provision and validate the approved dedicated repository-scoped ephemeral public runner (the current versioned label has no registered runner); complete ServiceRadar callback/AWX rollout; run ServiceRadar-originated Linux and Windows canaries; and record pull-request review. Production import remains explicitly disabled until those gates pass.

Adds reusable, public Ansible content for ServiceRadar remote-access enrollment without publishing deployment-specific CA material or credentials. - staged Linux OpenSSH user-CA preflight, install, verification, commit, overlap/retirement, removal, and rollback flows - private ServiceRadar API/callback contract for obtaining per-execution trust material through attenuated short-lived authority - reviewed AWX wrapper/catalog metadata that keeps direct wrappers and unverified content production-gated - Windows QEMU guest-agent preflight and installation over PSRP/WinRM - Proxmox inventory and relay-credential integration content - hash-locked CI dependencies, repository/private-material checks, syntax gates, ansible-lint production profile, collection build provenance, and Molecule scenarios Local verification is green: 8 repository tests, YAML/Ansible lint with zero failures or warnings, every wrapper syntax check, collection dependency install/build, and Windows QGA Molecule syntax. Remaining before this leaves draft: provision and validate the approved dedicated repository-scoped ephemeral public runner (the current versioned label has no registered runner); complete ServiceRadar callback/AWX rollout; run ServiceRadar-originated Linux and Windows canaries; and record pull-request review. Production import remains explicitly disabled until those gates pass.

mfreeman451 added 2 commits 2026-07-13 02:26:11 +00:00

feat: add gated SSH CA enrollment collection c445c2990b

test: enforce reproducible Ansible quality gates 05d931ce7a

mfreeman451 added 1 commit 2026-07-13 02:35:16 +00:00

ci: use available disposable runner pool dafbbb3f96

mfreeman451 added 1 commit 2026-07-13 02:38:23 +00:00

ci: run quality jobs in provisioned worker image 991647699d

mfreeman451 added 1 commit 2026-07-13 02:40:18 +00:00

ci: isolate locked Python dependencies 3c4bd7f625

mfreeman451 added 2 commits 2026-07-13 02:46:27 +00:00

ci: keep environment out of collection content 3fda8105ed

fix(ci): resolve lock for Python 3.12 6cd60a737a

mfreeman451 added 1 commit 2026-07-13 02:47:26 +00:00

feat(callback): bind retries to idempotency key d9771fd4be

mfreeman451 added 2 commits 2026-07-13 03:02:56 +00:00

fix(callback): retry pending grant safely ed1319def5

ci: isolate real SSH fixture matrix 5311c8618a

mfreeman451 added 1 commit 2026-07-13 05:27:23 +00:00

fix(callback): allow bounded AWX activation retries 9d3f5f85e5

mfreeman451 added 1 commit 2026-07-13 05:49:42 +00:00

fix(callback): bind CA response to AWX runtime job 178353dcf0

mfreeman451 added 1 commit 2026-07-13 05:59:41 +00:00

fix(callback): materialize exact AWX host scope 648d3f24f4

mfreeman451 added 3 commits 2026-07-13 06:59:55 +00:00

fix(callback): align public response schema contract 660875a8d5

feat(ansible): manage Windows QEMU guest agent 1670b0f998

fix(ansible): pin mounted QGA installer digest 3875e686d0

mfreeman451 added 1 commit 2026-07-13 07:08:30 +00:00

fix(ansible): support pinned unsigned VirtIO QGA MSI 5c0534b79b

mfreeman451 added 1 commit 2026-07-13 07:11:47 +00:00

feat(ansible): pin Windows AWX execution environment 92bbe074ab

mfreeman451 added 1 commit 2026-07-13 07:20:54 +00:00

fix(ansible): validate Windows MSI paths at runtime 2b16a98f94

mfreeman451 added 1 commit 2026-07-13 07:32:17 +00:00

fix(ansible): align Windows role with AWX runtime bfc0991c66

mfreeman451 added 2 commits 2026-07-13 11:48:34 +00:00

feat(ansible): publish AWX callback credential contract 355dadf7f4

fix(ansible): make callback contract bytes canonical ba8e0631d6

mfreeman451 added 1 commit 2026-07-13 15:26:51 +00:00

feat(ansible): add pinned Linux CA trust role 73941a8117

mfreeman451 added 1 commit 2026-07-13 17:47:59 +00:00

feat(ansible): add verified Proxmox inventory contract cb28311639

mfreeman451 added 1 commit 2026-07-13 18:02:45 +00:00

build(ansible): pin Proxmox inventory collection a79ba499d5

mfreeman451 added 1 commit 2026-07-13 18:13:44 +00:00

feat(ansible): add verified Proxmox relay credential b5e60caad2

mfreeman451 added 1 commit 2026-07-13 18:33:42 +00:00

docs(ansible): clarify trusted callback prompts 5cacaf7186

gitea_admin changed title from WIP: add gated ServiceRadar SSH CA enrollment collection to WIP: add ServiceRadar remote-access enrollment collection 2026-07-14 05:36:03 +00:00

mfreeman451 added 1 commit 2026-07-14 15:32:17 +00:00

ci: bind quality jobs to isolated public runner 0875202719

mfreeman451 commented 2026-07-14 15:32:33 +00:00

Author

Owner

Copy link

Runner-contract update (0875202): both lint and Molecule now request only serviceradar-public-ephemeral-ubuntu-24.04-20260701. Each job fail-closes on the repo-85 boundary identity supplied by the one-job LXC supervisor, rejects Kubernetes/host-DinD/signing credential exposure, keeps checkout credentials disabled and repository permissions read-only, and records non-secret source/dependency/runner provenance (plus the four pinned Molecule image digests).

Local locked verification is green: 8 tests, repository contract checks, yamllint, production-profile ansible-lint (0 failures/warnings), all wrapper syntax checks, Windows path contract, and Windows QGA Molecule syntax.

This PR intentionally remains draft. The new jobs may remain queued until the separate GitOps implementation provisions and validates the repository-85-scoped ephemeral runner; no generic or trusted runner fallback should be added.

Runner-contract update (`0875202`): both lint and Molecule now request only `serviceradar-public-ephemeral-ubuntu-24.04-20260701`. Each job fail-closes on the repo-85 boundary identity supplied by the one-job LXC supervisor, rejects Kubernetes/host-DinD/signing credential exposure, keeps checkout credentials disabled and repository permissions read-only, and records non-secret source/dependency/runner provenance (plus the four pinned Molecule image digests). Local locked verification is green: 8 tests, repository contract checks, yamllint, production-profile ansible-lint (0 failures/warnings), all wrapper syntax checks, Windows path contract, and Windows QGA Molecule syntax. This PR intentionally remains draft. The new jobs may remain queued until the separate GitOps implementation provisions and validates the repository-85-scoped ephemeral runner; no generic or trusted runner fallback should be added.

mfreeman451 added 1 commit 2026-07-14 23:00:32 +00:00

ci: add controlled public runner diagnostics ba50091aec

gitea_admin changed title from WIP: add ServiceRadar remote-access enrollment collection to add ServiceRadar remote-access enrollment collection 2026-07-14 23:19:57 +00:00

gitea_admin merged commit d540d6afaf into main 2026-07-14 23:19:58 +00:00

gitea_admin referenced this pull request from a commit 2026-07-14 23:19:58 +00:00

Merge pull request 'add ServiceRadar remote-access enrollment collection' (#1) from feat/serviceradar-remote-access-enrollment into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

carverauto/serviceradar-ansible!1

No description provided.