October release readiness ledger
Historical preparation snapshot:
v2026.10.0was published on 1 October 2026. The statuses and authorization steps below describe its preparation at that time. For November and subsequent releases, follow the current release approval policy: a normal PR approval is sufficient; the separate exact-commit/draft-ID authorization recorded here is superseded.
Reviewed: 1 October 2026. Target: v2026.10.0, chart 2026.10.0. Status: release preparation — do not tag or publish yet.
Preparation base: 15c14d7d662661b53f76c457a8b0606b7b97481e on main.
Previous published release: v2026.9.2. This ledger describes local release
preparation, not passing CI for an immutable final candidate. Record the
final reviewed/merged SHA and evidence links below before publication.
Preparation branch: pr/johalley/october-release.
Scope and version alignment
- Chart source
appVersion, install/upgrade examples, website and maintainer runbook targetv2026.10.0. The source chart retainsversion: 0.1.0; tag automation stamps packaged chart2026.10.0. - The curated release notes cover the September-to-October delta, including secure gNOI provisioning, topology projection, combined rollouts, source selection and opt-in development-preview drain.
- Existing installations apply the complete reviewed chart CRD directory:
new
IOSXESoftwareRollout, changedCiscoDevice,IOSXESoftwareUpgradeandIOSXEOperationalAction, plus the unchanged shipped CRDs. Back up schemas and data; validate migration and admission before enabling gates. - November's staged activation, network-policy/observation, graph, scale and
wider topology work stays on
pr/johalley/tas-extentions. No branch merge or cherry-pick is part of this preparation. - Examples explicitly require publication; use the published September
artifacts until then. Do not create another September tag or publish its
rejected drafts. Recovery after an October tag requires
v2026.10.1.
End-user documentation coverage
| Surface | October updates |
|---|---|
| README | Feature summary, operator task/boundary table, native scheduling versus rollout admission, release and migration links |
| MkDocs | Welcome/maturity tables, managed-mode architecture responsibilities, release notes and readiness navigation, install/CLI/CRD upgrade examples |
| Dynamic website | Hero and metadata, topology placement/rollout/secure gNOI/preview drain cards, functional identity boundary, app-hosting diagram scope and release links |
All three overviews distinguish implemented October capabilities from deferred November work, experimental TAS and preview drain. Declared topology is not proof of healthy forwarding paths, spare capacity or uninterrupted service.
Local checks on the preparation worktree
These results are preflight evidence only and must be repeated/linked from
the protected release PR and final candidate. Go tests include cached results.
Local toolchain: Go 1.26.7, Python 3.10.13 for script tests, Helm 4.1.3,
MkDocs 1.6.1. Final docs/license validation used an isolated Python 3.13.2
environment with hash-verified requirements.txt; the ambient Python failed
the locked-version check and was not used as license evidence. Python 3.13.15
was unavailable through the local interpreter manager. Release-pinned Helm
3.21.4/4.2.4 and CI Python 3.13.15 must still be qualified.
| Check | Local result | Release boundary |
|---|---|---|
go test -race ./... |
PASS | Root runtime suite; not real-API or hardware acceptance |
go vet ./..., go mod verify, build controller/plugin |
PASS | Does not build/sign both release image architectures |
make crd-gen deepcopy-gen rbac-gen helm-sync-crds, twice; make parity-matrix config-docs |
PASS, no generated diff | Existing controller-gen v0.16.5 works on this main baseline; November tooling observations must not be transferred blindly |
helm lint and charts/cisco-virtual-kubelet/tests/topology-render-test.sh |
PASS | Ambient Helm 4.1.3; repeat pinned Helm lanes and actual install/upgrade |
make test-envtest with Kubernetes 1.35 assets |
PASS: provider and controller real-apiserver suites | Local API/admission evidence; hosted CI must repeat on the final merged SHA |
charts/cisco-virtual-kubelet/tests/topology-kind-test.sh on disposable Kubernetes 1.35 kind |
PASS | Native topology admission/default-scheduler evidence; no physical forwarding qualification |
charts/cisco-virtual-kubelet/tests/managed-shared-worker-kind-test.sh --cluster-name cvk-october-shared |
PASS | Shared app-hosting/network-management identity, stale-token, drain and deletion-boundary evidence |
| Release contract / plugin packaging / Krew rendering unit tests | PASS: 16 / 15 / 9 tests | New regressions verify October metadata, CRD upgrade scope, tag-pinned note rendering and feature/limitation coverage across all three overviews |
Root govulncheck@v1.7.0 |
Exit 0, no reachable vulnerable symbols | Two imported-package and one required-module findings remain for image/security review; see below |
Terraform module govulncheck@v1.7.0 |
PASS, no vulnerabilities reported | Repeat on final candidate |
| Website lint/build and license checks | PASS after patch-level dependency remediation; rendered feature cards inspected in browser | Static build is not a signature or publication check |
npm audit --audit-level=high |
PASS, zero findings after remediation | Recheck advisory database at release time |
| Strict MkDocs, deployed-runtime licenses and workflow lint | PASS with locked Python dependencies; actionlint v1.7.12 passed | GitHub release notes also rendered successfully with tag-pinned local links |
Security findings and disposition
The initial website audit failed. Preparation updates next and
eslint-config-next from 16.3.4 to 16.3.8, and locks brace-expansion to
5.0.12 and dompurify to 3.4.16; the website license inventory was regenerated.
Relevant advisories:
Next.js,
brace-expansion,
DOMPurify.
These dependency findings are not a claim that the static site exposed every
affected execution path. The pinned Mermaid browser bundle was not replaced;
its audited vendored DOMPurify version remains separately inventoried.
Root Go scan findings not on reported reachable symbol paths:
| Advisory | Found / scanner-reported fix | Required disposition |
|---|---|---|
| GO-2026-6107 | etcd client/pkg v3.6.5 / v3.6.14 | Review release-binary/image inventory and fix or document non-applicability; hard fixed HIGH/CRITICAL image gate cannot be waived by a source reachability result |
| GO-2026-6094 | cel-go v0.29.0 / v0.30.0 | Same review; retain CEL/API compatibility tests if updated |
| GO-2026-5932 | x/crypto v0.56.0, openpgp; no fix listed | Confirm unused openpgp is absent from shipped executable paths; record security disposition |
This preparation does not silently update Kubernetes/etcd/CEL runtime dependencies or mark image scanning complete. An unresolved applicable finding remains a no-go.
Outstanding go/no-go gates
| Gate | Required evidence / action | Status |
|---|---|---|
| Reviewed preparation commit | Protected PR from pr/johalley/october-release into main; record final merged SHA, reviews and all required checks from RELEASE.md |
PR #195 checks PASS; review/merge and final SHA still pending |
| Baseline real API and admission | Kubernetes 1.35 envtest/kind, default scheduler, native admission, functional-account permissions, wrong/stale worker denials, migration from September | PASS locally on this candidate: envtest, topology/default-scheduler integration and shared-worker admission suites; repeat/attach protected evidence after any PR change |
| Independent optional TAS lane | Version/feature-gate-pinned experimental scheduler conformance; accurately describe fixture vs physical coverage | PASS: protected native-tas-conformance on PR #195; fixture conformance is not full physical CVK group lifecycle |
| Hardware qualification | Cat8kv/Cat9k protected checks on final revision; .100, .101, .103 combined upgrade and downgrade with complete manifests, worker/device logs and final ownership/guard/Lease/ledger state |
Pending: approval-driven hosted lab contexts have not run on PR #195; do not rerun destructively from this checklist without confirming current lab ownership/window |
| Preview drain disposition | Reproduce delayed callback/stale Running status/evidence-abort behavior on the October candidate; review minimal fix or explicit release-scope decision; verify supported automatic relocation with probes | Open publication hold: proposed scope is disabled-by-default development preview only; requires maintainer decision and no production-continuity claim |
| Remaining security/artifact checks | Both Linux image scans, SBOMs, license inventory, pinned tool verification, actual plugin execution on each platform | Pre-merge smoke image scans, govulncheck, website/MkDocs licenses and dependency audit PASS; release-stage SBOM/signature/plugin artifact verification remains pending |
| Install/upgrade/rollback | Fresh install and September migration, stored CR compatibility, retained-operation recovery and guard restoration | Pending exact candidate |
| Release authorization | Approved signing identity and a second maintainer's exact-commit/draft-ID authorization, as specified in RELEASE.md | Pending |
| Staging/publish verification | Exactly 16 signed/verified draft assets, chart/image digests, alias promotion, post-stage checks, then manual publish | Not started; no draft or tag created |
Later dirty development builds are archived in the separate November checkpoint. Their successful device transitions and stopped collectors are useful for triage, not qualification of this main candidate. Do not import its broad unfinished runtime changes into October just to claim a green result.
Next actions, in order
- Review the locally validated preparation diff on
pr/johalley/october-releasethrough the protected release PR process; do not push directly to main or tag the preparation branch. - Resolve the security/image and preview-drain dispositions in bounded, reviewed changes. If code changes, rerun local and relevant API tests.
- Run all protected checks and physical qualification on the candidate; attach durable sanitized evidence. Resolve failures; do not reuse checks from another SHA or dirty image.
- Merge the preparation PR and freeze the exact main commit. Fill in the
record below. Render the curated notes with
.github/scripts/render_github_release_notes.pyforv2026.10.0. - Follow the release runbook: draft first, second maintainer authorization, signed immutable tag, artifact verification, then manual publication. Never conflate preparing notes with publishing.
Final release record — maintainer fills before tagging/publishing
| Field | Value |
|---|---|
| Preparation PR / approvals | Pending |
| Final main SHA / clean source | Pending |
| Protected CI / API / hardware evidence | Pending |
| Security and drain disposition | Pending |
| Draft ID / reviewed rendered notes | Pending |
| Independent maintainer authorization | Pending |
| Signed tag / signing identity | Pending |
| OCI image/chart digests, scans, SBOM/signature verification | Pending |
| 16-asset verification and publication | Pending |