Let CI's Docker daemon run on Ubuntu 24.04, and tenants get certificates #1

Merged

slyons merged 1 commit from slyons/monorepo:fix-ci-apparmor-and-acme-solver into main

2026-11-04 05:10:53 +00:00

slyons commented

2026-11-04 05:10:07 +00:00

Owner

No description provided.

slyons added 1 commit

2026-11-04 05:10:07 +00:00

Let CI's Docker daemon run on Ubuntu 24.04, and tenants get certificates

presubmit / test (pull_request) Successful in 19m19s

Details

6e6166ff04

Ubuntu 24.04 lets a process create user namespaces only when its AppArmor
profile allows it, so the rootless Docker daemon in the CI runner pod
crash-looped with "fork/exec /proc/self/exe: operation not permitted".
cloud-init now installs a named profile, ci-rootless-docker, shaped like
Ubuntu's own rootlesskit profile, and the dind container requests it. The
host keeps the restriction for every other process.

cert-manager's HTTP-01 solver created a NodePort Service by default, which
the tenant admission policy rejects, so hello.<domain> never got a
certificate. The solver now uses ClusterIP; the challenge is answered
through the ingress either way.

The smoke test cannot cover either (k3d shares the host kernel, and has no
real certificates), so it drops the profile request and lists both gaps.
The runbook gains a section on applying cloud-init changes to a running
node.

Tested: on the live node, a rootless dind pod with the profile started and
ran a container as an unprivileged host user; both changed layers pass a
server-side dry run on the live cluster. shellcheck, tofu fmt and validate
in both envs, kustomize | flux envsubst | kubeconform on ci and configs.
The k3d smoke test has not been run on this change yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

slyons merged commit e90815caa7 into main

2026-11-04 05:10:53 +00:00

slyons deleted branch fix-ci-apparmor-and-acme-solver

2026-11-04 05:10:53 +00:00

slyons referenced this pull request from a commit

2026-11-04 05:10:53 +00:00

Let CI's Docker daemon run on Ubuntu 24.04, and tenants get certificates (#1)