Kubernetes Agent synchronizes services, namespaces, host state, and established platform events between a Kubernetes cluster and the compatibility control plane.
PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.
Upstream: rancher/kubernetes-agent. This GitHub fork preserves the upstream Git history, authorship, dates, tags, and license notices; PastureStack maintenance is consolidated into one commit after the preserved upstream boundary.
Published release v0.7.4 uses Go 1.27.3, Go modules, client-go 0.36.4, and logrus 1.10.1 while
retaining the established event and Kubernetes API contracts. Kubernetes 1.36.4
is the supported and tested API line. Its runtime is a
digest-pinned distroless image that runs as UID/GID 65532. Source, runtime, and
Kubernetes 1.36.4 integration tests must all pass before a release or catalog
reference is created.
The v0.7.4 release retains the original producer, publication evidence and registry digest recorded under Full-severity security release. User-facing configuration uses the plain version tag:
ghcr.io/pasturestack/kubernetes-agent:v0.7.4
Preferred settings are PLATFORM_URL, PLATFORM_ACCESS_KEY, and PLATFORM_SECRET_KEY. Historical CATTLE_* names remain accepted as temporary compatibility aliases. KUBERNETES_URL, WORKER_COUNT, and HEALTH_CHECK_PORT keep their established meanings.
PLATFORM_CA_ROOT accepts only /var/lib/pasturestack/etc/ssl/ca.crt or the established /var/lib/rancher/etc/ssl/ca.crt compatibility mount. An explicit SSL_CERT_FILE still takes precedence. Arbitrary environment-provided filesystem paths and symbolic links are rejected.
Set PASTURESTACK_LOCALE=en-US or PASTURESTACK_LOCALE=zh-TW for operator lifecycle messages. Event payloads, Kubernetes objects, labels, and protocol replies are never translated.
Run from a Docker-capable Linux host:
make test
make validate
make build
make package IMAGE_NAME=pasturestack/kubernetes-agent TAG=pocThe package target builds a local image only and does not push, release, or change a catalog. See COMPATIBILITY.md, SECURITY.md, and ORIGIN.md.
The inherited project remains licensed under Apache License 2.0. Copyright and attribution for inherited work and vendored dependencies remain with their respective authors and contributors. PastureStack contributors claim authorship only for their own changes.
Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Ubuntu build/runtime stages apply the checksum-pinned ca-certificates 20260816ubuntu0.26.04.1 security package after their frozen APT baseline; the final trust store and installed version are verified. Release artifacts must pass the repository's existing checks before publication.
The compatible security release v0.7.4 is published. It retains the existing Go binary/API contract and shell-free, non-root runtime, and overlays the official Debian 12 tzdata 2026c-0+deb12u1 and ca-certificates 20250419~deb12u2 payloads. Package metadata is updated from the same verified packages; revoked roots are removed rather than merged back.
The published image records producer 9dda1e0000be7856c1f078903a60d4a3017152fc
and manifest digest
sha256:028960ce47f8ef4b928374569ac2d4638f97071e623a082d0bddbeca4819ed33.
The release tag points to de0fd0a667e7abcfe593f17b4ae2b8931c0a94ab, whose source
tree matches that producer. See the official publication
for artifact evidence; deployment acceptance remains separate.
The full-severity runtime gate rejects every finding with an official fix, including LOW, MEDIUM and UNKNOWN. Only exact reviewed LOW/MEDIUM no-fix entries may pass. Existing v0.7.3 remains published for provenance and is superseded by v0.7.4.
The Dapper scan retains all severities and requires nonempty package analysis for the expected Go binaries. Any available fixed version fails, including Low, Medium and Unknown findings. Other Low/Medium findings require an exact package/version/PURL entry backed by the official vendor tracker. The pinned userspace kernel-header exception additionally requires the reviewed CVE set, actual header payload paths, and absence of kernel images/modules; it never permits an available fix. Unknown module findings require the separately verified exact source package graph, not a generic severity exemption.