catalog: release 0.3.15 with lifecycle-safe network manager

README.md

@@ -8,7 +8,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
 
 ## Project status
 
-This source tree provides Catalog `v0.3.14`; its GitHub tag and Release determine
+This source tree provides Catalog `v0.3.15`; its GitHub tag and Release determine
 when it is published. It exposes one Native project template and twenty-one
 reviewed infrastructure entries. See [SUPPORTED.md](SUPPORTED.md) for the
 current versions and [catalog-provenance.json](catalog-provenance.json) for

SUPPORTED.md

@@ -13,15 +13,15 @@ or out-of-scope templates from being presented as deployable software.
 | PastureStack System Image Preloader | Infrastructure image-cache service | v0.3.2 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Amazon ECR Credential Sync | Infrastructure registry service | v3.1.6 | Public PastureStack GHCR image with an explicit version tag | Published component; full runtime raw scan has zero findings; Catalog integration and environment acceptance remain distinct |
 | Metadata Healthcheck | Infrastructure stack | v0.3.17 | Public PastureStack GHCR image with a non-overwritten version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
-| PastureStack Network Services | Infrastructure system stack | v0.3.9 | Published Network Plugin Manager v0.8.22; Metadata Service v0.9.11 and Internal DNS v0.17.11 unchanged | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack Network Services | Infrastructure system stack | v0.3.10 | Network Plugin Manager v0.8.24; Metadata Service v0.10.5 and Internal DNS v0.17.13 unchanged from revision 11 | Exact publication evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Network Diagnostics | Infrastructure diagnostics service | v0.2.2 | Two public PastureStack GHCR images with explicit version tags | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Network Policy Manager | Infrastructure network-policy agent | v0.3.4 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
-| PastureStack IPsec Overlay | Infrastructure network driver | v0.3.11 | v0.14.27 published and manifest digest locked | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| PastureStack IPsec Overlay | Infrastructure network driver | v0.3.11 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Windows ECR Credential Sync | Windows infrastructure registry service | v3.1.2 | Public PastureStack GHCR Windows image with an explicit version tag | Source tests, cross-compilation, PE, license, anonymous distribution, and vulnerability gates passed; Windows-host runtime pending |
 | PastureStack Windows Network Services | Windows infrastructure Metadata and DNS stack | v0.3.0 | Two public PastureStack GHCR Windows images with explicit version tags | Source tests, cross-compilation, PE, license, anonymous distribution, and vulnerability gates passed; Windows-host runtime pending |
 | PastureStack Windows Container Networking | Windows NAT and transparent network-driver definition | v0.1.1 | Reviewed selector-only placeholder image with an explicit version tag | Catalog rendering and compatibility-boundary review passed; Windows-host network-driver lifecycle pending |
 | PastureStack Layer 2 Flat Network | Optional infrastructure network driver | v0.3.5 | Reviewed network image with a semantic version tag; bridge setup is opt-in | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
-| Resource Scheduler | Infrastructure scheduling agent | v0.8.20 | Published component v0.8.19, manifest digest and verified SBOM provenance recorded | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
+| Resource Scheduler | Infrastructure scheduling agent | v0.8.20 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Route 53 DNS Sync | Infrastructure external-DNS agent | v0.8.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Amazon EBS Storage | Infrastructure block-storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |
 | PastureStack Amazon EFS Storage | Infrastructure shared-storage driver | v0.11.1 | Public PastureStack GHCR image with an explicit version tag | Published component; exact runtime evidence is in catalog-images.json; environment upgrade/rollback remains separate |

catalog-images.json

@@ -1458,6 +1458,42 @@
         "sha256": "a448ff8fcdaf1d124c04a9787552077d3b9b1467548586dcd297d55258e7dc77",
         "url": "https://github.com/PastureStack/ecr-credential-sync/releases/download/v3.1.6/ecr-credential-sync-3.1.6-image.cdx.json"
       }
+    },
+    {
+      "sourceRepository": "https://github.com/PastureStack/network-plugin-manager",
+      "sourcePath": "package/Dockerfile",
+      "registryPage": "https://github.com/orgs/PastureStack/packages/container/package/network-plugin-manager",
+      "licenseBoundary": "Apache-2.0 source and image; bundled Alpine, Docker CLI, and other packages retain their upstream licenses and notices",
+      "platforms": [
+        "linux/amd64"
+      ],
+      "reference": "ghcr.io/pasturestack/network-plugin-manager:v0.8.24",
+      "sourceCommit": "f34bbca219ddd84b94f4b3f833e04d67b9c8ce03",
+      "manifestDigest": "sha256:c588d1ad06b1d756a16fd7f16230803c6dee69809ab4367034706325d0080738",
+      "reviewedAt": "2026-10-24",
+      "vulnerabilityScan": {
+        "scope": "published runtime image; complete severity gate",
+        "high": 0,
+        "critical": 0,
+        "low": 0,
+        "medium": 0,
+        "unknown": 0,
+        "secrets": 0,
+        "fixedAvailable": 0,
+        "actionable": 0,
+        "evidence": "https://github.com/PastureStack/network-plugin-manager/actions/runs/40006260651"
+      },
+      "publicationVerification": {
+        "source": "component owner verified anonymous manifest/config readback",
+        "workflowRun": "https://github.com/PastureStack/network-plugin-manager/actions/runs/40006260651",
+        "sourceCommit": "f34bbca219ddd84b94f4b3f833e04d67b9c8ce03",
+        "anonymousReadback": true
+      },
+      "sbom": {
+        "format": "CycloneDX",
+        "sha256": "64605ff6d32f9f6b7c3bf20185d2cefead78b0e79b8395e3bc4523594e9af88b",
+        "url": "https://github.com/PastureStack/network-plugin-manager/releases/download/v0.8.24/network-plugin-manager-0.8.24-image.cdx.json"
+      }
     }
   ]
 }

infra-templates/network-services/12/README.md

@@ -0,0 +1,60 @@
+<!-- SPDX-License-Identifier: MIT -->
+
+# PastureStack Network Services
+
+Version 12 (visible version `v0.3.10`) uses the published Network Plugin Manager `v0.8.24`, Metadata Service `v0.10.5`, and Internal DNS `v0.17.13`. This dependency update retains version 11's firewall ownership, CNI convergence, Catalog questions, sidekicks and shared volumes. Earlier numeric revisions remain unchanged. Published source, image digests and runtime scan evidence are recorded in `catalog-images.json`.
+
+## CNI configuration convergence
+
+The manager preflights all desired CNI configurations and writes each through an atomic replacement with mode `0600`. Only after every desired configuration has been written successfully may it retire an obsolete platform configuration. The historical `10-rancher.conf` must have the exact name/type/IPAM triplet `rancher-cni-network` / `rancher-bridge` / `rancher-cni-ipam`; the current `10-pasturestack.conf` must have `pasturestack-cni-network` / `pasture-bridge` / `metadata-cni-ipam`. The same ownership check applies when the selected provider requires the historical configuration again.
+
+Retirement renames the obsolete file with a `.pasturestack-retired` suffix, preserving its original bytes outside the CNI `.conf` / `.json` execution set. An existing retirement backup must be byte-identical; a conflicting backup causes an error. Unrelated administrator configurations are preserved. Malformed or partially matching platform configurations, symlinks, and unsafe metadata paths cause an explicit error. The manager never sweeps the configuration directory or removes CNI binary aliases as part of this migration.
+
+Each component is a published security rebuild. Full-severity evidence is recorded separately from deployment acceptance; publication does not establish that an existing infrastructure stack has completed its managed upgrade.
+
+## Provider and lifecycle convergence
+
+The manager selects one eligible CNI provider per binary from the infrastructure-service metadata on the local host. The highest numeric OCI image version wins; an unversioned or nonnumeric development label cannot replace a numeric release, and ties use a deterministic immutable container-ID ordering. The generated wrapper stays bound to that exact provider and does not relist containers by service label at invocation time. It executes the provider's private `/opt/cni/bin` copy with a bounded compatibility fallback for older images. Wrapper replacement uses an exclusive temporary inode and atomic rename; content, file type, and mode drift are repaired without following a replacement symlink.
+
+When platform metadata temporarily reports a host-port container before its primary address, the manager may read the exact running container's network namespace. It accepts only one IPv4 address inside that network's configured managed subnet and revalidates the same Docker container PID after the namespace read. Missing, ambiguous, out-of-subnet, or lifecycle-raced results fail closed and retain the last known-good host-port rules until metadata and CNI converge.
+
+## Firewall backend
+
+`FIREWALL_BACKEND` defaults to `auto`. It reads Docker's actual firewall driver: Docker's native `nftables` driver uses native nft rules, while Docker's `iptables` driver selects the frontend that owns Docker's active NAT chain. That may be `iptables-nft` or `iptables-legacy` on **any supported host**, including Ubuntu 26.04 and later. The OS release, installed executable, or unloaded kernel module alone never selects a backend. To pin one path, choose:
+
+- `nftables`: Docker's native nftables firewall backend. This is **not** the same as the iptables-nft compatibility CLI.
+- `iptables-nft`: xtables compatibility CLI backed by nf_tables, for Docker's iptables firewall driver.
+- `iptables-legacy`: legacy xtables, only when the running Docker daemon actually owns the active rules through that frontend.
+
+The manager refuses a mismatched or ambiguous selection and does not fall back, switch Docker's backend, or load legacy modules. An Ubuntu 26.04+ host already using `iptables-legacy` or `iptables-nft` must keep its live Docker path; do not turn on native nftables merely because the OS is new. A deliberate migration requires a separate host change, rollback point, and network lifecycle test.
+
+This manager alone owns the host NAT and host-port `CATTLE_*` chains. Its
+masquerade rules exclude destinations inside the managed overlay subnet in
+all three backends; the IPsec host-XFRM router must not patch these chains.
+For the per-host-subnet driver, the manager also excludes other active hosts'
+validated subnets from masquerade and adds a bounded forwarding exception.
+Inactive registrations are ignored; missing or overlapping labels on an active
+host fail closed. This is a routed, unencrypted network; protect the host
+transport separately.
+Upgrade Network Services first and verify manager health on every host before
+upgrading the matching IPsec Overlay version.
+
+Shared-subnet ingress is enabled only when CNI metadata explicitly sets
+`allowSharedSubnetIngress: true`, or for the legacy fixed-subnet contract that
+already declares both `bridgeSubnet` and `hostNat: true`. It is rejected for
+host-label-based subnets, where only validated active peer ranges are trusted.
+
+For Docker's native nftables driver, configure Docker itself with `"firewall-backend": "nftables"` and `"bridge-accept-fwmark": "0x1068/0x1068"` before upgrading this stack. Persist `net.ipv4.ip_forward=1` on the host and verify it remains enabled after a reboot: Docker's native nftables backend does not enable IPv4 forwarding for you. The mark allows Docker's bridge forwarding rules to accept the manager's published-host-port traffic; the template cannot configure the host daemon or kernel settings. Check and explicitly migrate any stale `iptables-nft` `FORWARD DROP` policy or previous platform hooks before switching Docker. The manager refuses that mixed state rather than changing the host's global firewall policy. Docker's native nftables backend remains an experimental Docker feature; qualify it against the installed Docker release before production use.
+
+## Other configuration
+
+- `DOCKER_BRIDGE`: host bridge for managed workload traffic.
+- `DNS_RECURSER_TIMEOUT`, `TTL`: upstream DNS timeout and service-discovery cache time.
+- `CPU_PERIOD`, `CPU_QUOTA`: Metadata Service CPU scheduling limits.
+- `RELOAD_INTERVAL_LIMIT`, `ARP_SYNC_INTERVAL`: metadata reload and host ARP reconciliation intervals.
+
+Network Plugin Manager still requires host networking, host PID visibility, the Docker socket, Docker state, kernel-module and runtime mounts, and the shared CNI volume. Metadata Service starts as root only to assign its link-local address, then drops to UID/GID 10001. Internal DNS shares its namespace. The `rancher-compose.yml` filename, `io.rancher.*` labels, `CATTLE_*` fallback variables, `/var/lib/rancher` CA path, and `rancher-cni-driver` volume are compatibility contracts, not a request to use legacy firewall rules.
+
+These template files are MIT-licensed. The manager, metadata service, and internal DNS retain their Apache-2.0 licenses and bundled dependency notices. Verify image source and the recorded manifest digest in `catalog-images.json` before deployment.
+
+Metadata and DNS are managed by the Server lifecycle. The manager no longer removes overlapping instances during upgrades and remains unready while waiting for Metadata recovery. Verify service health before completing an upgrade; image publication alone is not runtime acceptance.