fix(runtime): close bootstrap gaps for clean micro1 validation

Author: syscod3

Dockerfile.agent

@@ -24,9 +24,10 @@ RUN --mount=type=cache,id=guest-gomod,target=/root/go/pkg/mod \
     --mount=type=cache,id=guest-gobuild,target=/root/.cache/go-build \
     CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -o guest-agent ./cmd/guest-agent
 
-FROM gcr.io/distroless/static:nonroot AS runtime
+FROM alpine:3.21 AS runtime
 WORKDIR /
-COPY --from=agent-builder /workspace/agent .
+RUN apk add --no-cache e2fsprogs
+COPY --from=agent-builder /workspace/agent /agent
 COPY --from=guest-agent-builder /workspace/guest-agent /opt/imp/guest-agent
 USER 65532:65532
 ENTRYPOINT ["/agent"]

charts/imp-crds/templates/impvms.yaml

@@ -748,6 +748,12 @@ spec:
                   a node.
                 format: date-time
                 type: string
+              startedAt:
+                description: |-
+                  StartedAt is the time the VM last transitioned to phase Starting.
+                  Used to detect and time out stuck start attempts.
+                format: date-time
+                type: string
             type: object
         type: object
     served: true

charts/imp-crds/tests/impvms-crd_test.yaml

@@ -0,0 +1,12 @@
+suite: impvms CRD schema
+templates:
+  - templates/impvms.yaml
+tests:
+  - it: includes startedAt in ImpVM status schema
+    template: templates/impvms.yaml
+    asserts:
+      - isKind:
+          of: CustomResourceDefinition
+      - equal:
+          path: spec.versions[0].schema.openAPIV3Schema.properties.status.properties.startedAt.type
+          value: string

charts/imp/templates/agent/clusterrole.yaml

@@ -16,7 +16,19 @@ rules:
 - apiGroups: ["imp.dev"]
   resources:
     - impvmclasses
-  verbs: [get]
+  verbs: [get, list, watch]
+- apiGroups: ["imp.dev"]
+  resources:
+    - clusterimpnodeprofiles
+  verbs: [get, list, watch]
+- apiGroups: ["imp.dev"]
+  resources:
+    - impvmsnapshots
+  verbs: [get, list, watch, update, patch]
+- apiGroups: ["imp.dev"]
+  resources:
+    - impvmsnapshots/status
+  verbs: [get, update, patch]
 - apiGroups: ["imp.dev"]
   resources:
     - impnetworks

charts/imp/templates/operator/deployment.yaml

@@ -1,4 +1,5 @@
-{{- $webhooksEnabled := and .Values.webhook.enabled .Values.webhook.certManager.enabled }}
+{{- $webhookEnabled := default true .Values.webhook.enabled }}
+{{- $webhooksEnabled := and $webhookEnabled .Values.webhook.certManager.enabled }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:

charts/imp/templates/operator/service.yaml

@@ -1,4 +1,5 @@
-{{- $webhooksEnabled := and .Values.webhook.enabled .Values.webhook.certManager.enabled }}
+{{- $webhookEnabled := default true .Values.webhook.enabled }}
+{{- $webhooksEnabled := and $webhookEnabled .Values.webhook.certManager.enabled }}
 apiVersion: v1
 kind: Service
 metadata:

charts/imp/templates/webhook/certificate.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.webhook.enabled .Values.webhook.certManager.enabled }}
+{{- if and (default true .Values.webhook.enabled) .Values.webhook.certManager.enabled }}
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:

charts/imp/templates/webhook/issuer.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.webhook.enabled .Values.webhook.certManager.enabled (not .Values.webhook.certManager.issuerRef.name) }}
+{{- if and (default true .Values.webhook.enabled) .Values.webhook.certManager.enabled (not .Values.webhook.certManager.issuerRef.name) }}
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:

charts/imp/templates/webhook/mutatingwebhook.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.webhook.enabled .Values.webhook.certManager.enabled }}
+{{- if and (default true .Values.webhook.enabled) .Values.webhook.certManager.enabled }}
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration
 metadata:

charts/imp/templates/webhook/validatingwebhook.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.webhook.enabled .Values.webhook.certManager.enabled }}
+{{- if and (default true .Values.webhook.enabled) .Values.webhook.certManager.enabled }}
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata: