All pull requests

Pull requests

• conformance: name the inventory socket, do not list its directory

  #1100·joaosa opened Oct 26, 2026Collaborator·

  ·

• nri-image-policy: recover running member pods on a plugin restart

  #1096·joaosa opened Oct 26, 2026Collaborator·

  ·

• Validating the apiserver address in get-kubeconfig

  #1095·AnomalRoil opened Oct 26, 2026Collaborator·

  ·

• Classifying attestation-api refusals in armtls.mapVerifyError

  #1094·AnomalRoil opened Oct 26, 2026Collaborator·

  ·

• Binding only an admissible serving leaf in attest-lb

  #1093·AnomalRoil opened Oct 26, 2026Collaborator·

  ·

• node: worker role, a kubelet joined to an outside control plane

  #1092·b0xtch opened Oct 26, 2026Contributor·

  ·

• fix(node-guest-image): pin the local-path provisioner and NVIDIA device plugin launches

  #1090·CluEleSsUK opened Oct 26, 2026Collaborator·4/4·

  ·

• fix(node-guest-image): pin the RKE2 add-ons with static executables

  #1089·CluEleSsUK opened Oct 26, 2026Collaborator·3/4·

  ·

• fix(node-guest-image): pin the RKE2 control plane's launches in the measured base

  #1088·CluEleSsUK opened Oct 26, 2026Collaborator·2/4·

  ·
  1

• fix(node-guest-image): admit only the system images the node runs

  #1087·CluEleSsUK opened Oct 26, 2026Collaborator·1/4·

  ·

• feat(node): kubelet credential plugin for hosted cluster joins

  #1086·b0xtch opened Oct 26, 2026Contributor·

  ·

• feat(cds): issue node tokens for hosted cluster joins

  #1085·b0xtch opened Oct 26, 2026Contributor·

  ·
  4

• allowlist: grant the dropped platform roles only with the injected mount tables

  #1083·joaosa opened Oct 24, 2026Collaborator·

  ·
  9

• ci(tdx): Pod boot, acceptance and runtime diagnostic lanes

  #1079·joaosa opened Oct 24, 2026Collaborator·5/5·

  ·
  2

• feat(pod-role): mesh endpoint, guest-owned credentials and authenticated traffic for a pod CVM

  #1078·joaosa opened Oct 24, 2026Collaborator·4/5·

  ·

• feat(node-image): bake kube-state-metrics as a platform add-on

  #1074·AmeanAsad opened Oct 23, 2026Collaborator·

  ·

• feat(release): publish the allowlist seed of each node-image platform as a signed release asset

  #1070·AmeanAsad opened Oct 23, 2026Collaborator·

  ·
  1

  2

• fix(routing): bind an attested session to the route and router digests it verified

  #1059·AnomalRoil opened Oct 23, 2026Collaborator·

  ·

• fix(routing): bind workload backends to the router's allowlist digest

  #1055·AnomalRoil opened Oct 23, 2026Collaborator·

  ·
  2

• feat(launch-config): managed launches enroll for their RKE2 role (c8s-launch/v2)

  #1050·b0xtch opened Oct 23, 2026Contributor·

  ·
  1

• allowlist: declared egress per workload entry

  #1049·AmeanAsad opened Oct 22, 2026Collaborator·

  ·

• fix(armtls)!: refuse an empty CDS or peer pin set

  #1012·CluEleSsUK opened Oct 22, 2026Collaborator·

  ·
  1

• feat(pod-status): serve a fixed projection of the pod's status

  #995·joaosa opened Oct 21, 2026Collaborator·3/5·

  ·

• refactor(armtls): serve attested HTTPS from pkg/armtls

  #967·joaosa opened Oct 20, 2026Collaborator·2/5·

  ·

• feat(node-guest-image): pod launch role with measured container launches

  #965·joaosa opened Oct 20, 2026Collaborator·1/5·

  ·
  3