[znerol2]

Summary

scripts/verify-cluster.sh failed on a correct 0.41.0 rollout. The release publishes a two-platform index, so the pod's imageID is the index digest, and the script compared it with the arm64 child digest.

The digest check is now one Python step that checks every running pod the deployment selects. A pod passes when:

• its dmf-cms container is in state running, and
• the node's architecture equals DMF_CMS_IMAGE_ARCH, and
• for an index: the index lists exactly one manifest for the node's os and architecture, and the pod's digest is the index digest (the sha256 of the raw registry bytes) or that child's digest;
• for a single-platform manifest: the pod's digest equals it, and the config's os and architecture, read by digest, match the node.

The Kubernetes API can't show which index child a runtime selected. The header states the assumption: the runtime picks the child for the node's own platform.

Verification

• Live, read-only, against a sandbox running 0.41.0: digest check passes, healthz 200, exit 0. The script on main exits 1 with DIGEST MISMATCH against the same cluster.

• skopeo inspect --raw docker://ghcr.io/dmfdeploy/dmf-cms:0.41.0 | shasum -a 256 gives e797da4c…, the pod's digest.

• Stub runs under macOS /bin/bash 3.2. Each of these fails:

  • node amd64 with DMF_CMS_IMAGE_ARCH=arm64;
  • an index with only windows/arm64;
  • an index with two linux/arm64 children;
  • a second pod with a wrong digest;
  • the other platform's child digest;
  • a terminated container, or running: null;
  • a single manifest for another platform.

  The matching cases pass.

• shellcheck and bash -n pass.

Review

Four rounds of adversarial review. The last one passed.

Closes dmfdeploy/dmfdeploy#859

[lkirc]

Static review of b37d3ba completed. No blocking findings.