The root OCI source's cosign trust config is delivered through the source it guards

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

Prod GitOps delivery has been frozen since 2026-08-07T00:49Z. The root flux-system
OCIRepository reports:

Ready=False           reason=VerificationError
SourceVerified=False  reason=VerificationError
  failed to verify the signature using provider 'cosign keyless':
  no matching attestations: unsupported: multiple identities are not supported at this time

The live resource carries a three-entry spec.verify.matchOIDCIdentity. cosign's keyless
verification rejects a multi-entry list outright and fails closed for the whole set, so the
source refuses every artifact.

Consequence: every merge_group deploy times out waiting for the pushed artifact to be served,
fails, and the PR is evicted from the merge queue. Nothing has merged to main since
2026-08-07T00:36Z. Observed on #3004 (evicted twice) and #3011 (evicted twice).

The cluster itself is healthy and still serving the last good revision — this is a delivery
freeze, not an outage.

The actual problem

main is already correct. Both halves carry the single-entry alternation form:

• k8s/providers/hetzner/infrastructure/controllers/flux-instance/flux-instance.yaml (the
  kustomize patch, since fix(security): enforce cosign verify on the live root OCIRepository #3001)
• ksail.prod.yaml (spec.workload.flux.verify, the bootstrap path)

The corrected config cannot reach the cluster, because the trust configuration for the root
delivery source is itself delivered through that source:

ksail.prod.yaml / flux-instance.yaml  →  Kustomization infrastructure-controllers
                                      →  rendered by flux-operator
                                      →  onto OCIRepository flux-system
                                      →  which must verify the artifact carrying that very fix

infrastructure-controllers is stuck Progressing, so the fix is pinned in Git. Field-manager
inspection confirms spec.verify is owned by flux-operator (Apply) and not by the routine
deploy path, so a redeploy cannot rewrite it either. It is a closed loop: the delivery channel
cannot carry its own trust config.

Clearing the current freeze needs a one-shot out-of-band write of the corrected single-entry
verify block onto the live root OCIRepository. That is a manual maintainer action and is being
handled separately; this issue is about making the loop structurally impossible.

Proposed fix

The deploy already solves exactly this class of problem for the pull credential: a
🔑 Reassert Flux and consumer GHCR pull credential step writes it out-of-band, before the
reconcile that depends on it. The root source's verify block has the same
bootstrap-circularity and no such step.

Reassert spec.verify on the root OCIRepository from ksail.prod.yaml out-of-band in the deploy,
ahead of the reconcile step, using the same pattern and the same field manager as the operator so
there is no second writer.

Acceptance criteria

• The deploy reasserts the root OCIRepository's spec.verify before the reconcile step.
• Reverting the live verify block to a multi-entry list is repaired by the next deploy without
  manual intervention (the decisive test — it must fail before the change and pass after).
• The reassert writes under the field manager that already owns the resource; no field
  contention with flux-operator.
• A green deploy with the step skipped is not mistaken for a pass.

Rough size: S–M. Related: #3007 (CI does not check that a cosign matcher actually verifies the
artifact it guards) — this incident is exactly the failure #3007 predicted.

[coderabbitai]

🔗 Related PRs

#2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [merged]
#2404 - fix: tenant artifact verification rejects the dual signing identities from #2399 [merged]
#2919 - fix(security): move Flux cosign verify to the path KSail reads [merged]
#2930 - feat(ci): verify published evidence before promoting the prod digest [merged]
#3001 - fix(security): enforce cosign verify on the live root OCIRepository [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Agentic Engineer

Manual unwedge (maintainer) — this only makes the cluster match what main already says, so it
is not a policy change. Verification is currently failing closed, so the frozen state accepts
nothing; this restores acceptance of the three legitimate signers.

kubectl --context admin@prod -n flux-system patch ocirepository flux-system --type=json -p '[
  {"op":"replace","path":"/spec/verify/matchOIDCIdentity","value":[
    {"issuer":"^https://token\\.actions\\.githubusercontent\\.com$",
     "subject":"^https://github\\.com/devantler-tech/platform/\\.github/workflows/(ci\\.yaml@refs/heads/gh-readonly-queue/main/.+|(cd|dr-rebuild)\\.yaml@refs/heads/main)$"}
  ]}
]'

Then confirm the source recovers before re-queuing anything:

kubectl --context admin@prod -n flux-system get ocirepository flux-system \
  -o jsonpath='{range .status.conditions[*]}{.type}={.status} {.reason}{"\n"}{end}'

SourceVerified=True and Ready=True is the signal. Once infrastructure-controllers reconciles,
flux-operator re-applies the same single-entry block from Git, so the patch converges rather than
drifting.

I have read-only cluster access, so I cannot apply this myself — that is the whole reason this is a
manual step, and #3013 above is the fix that removes the need for it next time.

[devantler]

🤖 Generated by the Agentic Engineer

Duplicate of #3006, which already carries this diagnosis and predates it. I filed this before finding #3006 — my issue search filtered on title keywords that #3006's wording does not match, and only the unfiltered read surfaced it.

All unique content here (current live evidence, the merge-queue blast radius, and the reassert-step remediation) is ported to #3006. The manual unwedge command in the comment above still applies; keeping this issue readable for that reason rather than deleting the context.