release: v0.5.1 — production hardening (liveness, DaemonSet, supply chain)

Collector refreshes a liveness heartbeat (/run/a3s-observer.alive) at startup + every report
tick; DaemonSet gains system-node-critical priority, RollingUpdate, 30s grace, and a heartbeat
livenessProbe; release workflow adds Trivy CVE scan (report-only), keyless cosign signing, and
SLSA provenance + SBOM. 0.5.0 -> 0.5.1.

Author: RoyLin

.github/workflows/image.yml

@@ -1,8 +1,8 @@
 name: image
 
 # Canonical release: on a version tag, build the collector clean-room (the eBPF crate +
-# userspace binary) and push the runtime image to GHCR. The internal A3S registry (what the
-# egress-constrained cluster pulls) is fed by promoting/mirroring this image.
+# userspace binary), push the runtime image to GHCR, scan it for CVEs, and keyless-sign it.
+# The internal A3S registry (what the egress-constrained cluster pulls) is fed by mirroring.
 on:
   push:
     tags: ['v*']
@@ -11,6 +11,7 @@ on:
 permissions:
   contents: read
   packages: write
+  id-token: write # keyless cosign signing via GitHub OIDC
 
 jobs:
   image:
@@ -30,17 +31,33 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - id: img
+        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT" # ghcr needs lowercase
       - id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ghcr.io/${{ github.repository }} # -> ghcr.io/a3s-lab/observer (lowercased)
+          images: ${{ steps.img.outputs.name }}
           tags: |
             type=semver,pattern={{version}}
             type=ref,event=tag
-      - uses: docker/build-push-action@v6
+      - id: build
+        uses: docker/build-push-action@v6
         with:
           context: dist
           file: deploy/Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          provenance: true # SLSA build provenance attestation
+          sbom: true # SBOM attestation
+      # Supply chain: scan for fixable CRITICAL CVEs, then keyless-sign the pushed digest.
+      - name: Trivy image scan (report fixable CRITICAL/HIGH)
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          image-ref: ${{ steps.img.outputs.name }}@${{ steps.build.outputs.digest }}
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: '0' # report-only; set to '1' to block releases once the base is confirmed clean
+      - uses: sigstore/cosign-installer@v3
+      - name: Sign the image (keyless, GitHub OIDC)
+        run: cosign sign --yes ${{ steps.img.outputs.name }}@${{ steps.build.outputs.digest }}

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to a3s-observer will be documented in this file.
 
+## [0.5.1] — production hardening
+
+### Changed
+
+- **Liveness heartbeat**: the collector refreshes `/run/a3s-observer.alive`
+  (`A3S_OBSERVER_HEARTBEAT`) at startup and every 60s report tick, so a k8s `livenessProbe`
+  restarts a collector that has wedged (stopped pumping events).
+- **DaemonSet** is production-grade: `system-node-critical` priority, `RollingUpdate`
+  (maxUnavailable 1), a 30s graceful-shutdown window for the SIGTERM flush, and the heartbeat
+  liveness probe.
+- **Release supply chain**: the image workflow scans the pushed image for CVEs (Trivy,
+  report-only for now), keyless-signs it (cosign / GitHub OIDC), and attaches SLSA build
+  provenance + an SBOM.
+
 ## [0.5.0] — SSL/TLS content capture (opt-in)
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer"
-version = "0.5.0"
+version = "0.5.1"
 edition = "2021"
 license = "MIT"
 description = "General-purpose, language-agnostic eBPF observability for AI agents (LLM calls, tools, files, network egress)."

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-collector"
-version = "0.5.0"
+version = "0.5.1"
 edition = "2021"
 license = "MIT"
 description = "a3s-observer collector: loads the eBPF probes and exports enriched events."

a3s-observer-collector/Cargo.toml

@@ -166,6 +166,12 @@ async fn main() -> anyhow::Result<()> {
          streaming (Ctrl-C to stop)"
     );
 
+    // Liveness heartbeat: refresh a file at startup and on every report tick, so a k8s
+    // livenessProbe can detect a wedged collector (file goes stale → restart the pod).
+    let heartbeat = std::env::var("A3S_OBSERVER_HEARTBEAT")
+        .unwrap_or_else(|_| "/run/a3s-observer.alive".into());
+    let _ = std::fs::write(&heartbeat, b"ok");
+
     let mut sigint = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::interrupt())?;
     let mut sigterm = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())?;
     let mut stats = Stats::default();
@@ -176,6 +182,7 @@ async fn main() -> anyhow::Result<()> {
             _ = sigint.recv() => break,
             _ = sigterm.recv() => break, // k8s sends SIGTERM on pod termination
             _ = report.tick() => {
+                let _ = std::fs::write(&heartbeat, b"ok"); // refresh liveness heartbeat
                 let dropped: u64 = drops
                     .get(&0, 0)
                     .map(|v| v.iter().copied().sum())

a3s-observer-collector/src/main.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-common"
-version = "0.5.0"
+version = "0.5.1"
 edition = "2021"
 license = "MIT"
 description = "Shared no_std types crossing the eBPF <-> userspace boundary for a3s-observer."

a3s-observer-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-ebpf"
-version = "0.5.0"
+version = "0.5.1"
 edition = "2021"
 license = "MIT"
 publish = false

a3s-observer-ebpf/Cargo.toml

@@ -1,7 +1,6 @@
 # Run a3s-observer on every node. It writes NDJSON to stdout; a node-level OpenTelemetry
 # Collector then tails the container log and ships OTLP (see deploy/otel-collector.yaml).
 #
-#   docker build -f deploy/Dockerfile -t <registry>/a3s-observer:0.2.0 . && docker push ...
 #   kubectl apply -f deploy/daemonset.yaml
 #
 # No k8s API access / RBAC is needed: pod-UID + container-id come from /proc/<pid>/cgroup.
@@ -14,14 +13,19 @@ metadata:
 spec:
   selector:
     matchLabels: { app: a3s-observer }
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate: { maxUnavailable: 1 } # controlled node-by-node rollout
   template:
     metadata:
       labels: { app: a3s-observer }
     spec:
       hostPID: true # resolve /proc/<pid> for host processes (identity)
+      priorityClassName: system-node-critical # observability shouldn't be evicted under pressure
+      terminationGracePeriodSeconds: 30 # the collector flushes a final report on SIGTERM
       containers:
         - name: a3s-observer
-          image: 10.12.111.133:49164/a3s/observer:0.2.4 # A3S OCI Registry (built from deploy/Dockerfile)
+          image: 10.12.111.133:49164/a3s/observer:0.5.1 # mirror of ghcr.io/a3s-lab/observer:0.5.1
           securityContext:
             # eBPF load + tracepoint attach requires privileged. (Verified: a non-root
             # process with only CAP_BPF+CAP_PERFMON fails to attach — the tracefs tracepoint
@@ -30,12 +34,23 @@ spec:
           env:
             - { name: A3S_OBSERVER_JSON, value: "1" }
             # - { name: A3S_OBSERVER_FILES, value: "1" }   # opt in to file-write capture
+            # - { name: A3S_OBSERVER_SSL, value: "1" }     # opt in to OpenSSL content (uprobe)
           volumeMounts:
             - { name: sys, mountPath: /sys, readOnly: true } # tracepoint ids under /sys
           resources:
+            # No CPU limit on purpose: a tracing agent should not be CPU-throttled into
+            # dropping events. Memory is bounded; the rings are fixed-size.
             requests: { cpu: 50m, memory: 64Mi }
             limits: { memory: 256Mi }
+          livenessProbe:
+            # Restart a wedged collector: it refreshes /run/a3s-observer.alive at startup and
+            # every 60s report tick, so a stale (>180s) heartbeat means it stopped pumping.
+            exec:
+              command:
+                ["sh", "-c", "test $(( $(date +%s) - $(stat -c %Y /run/a3s-observer.alive) )) -lt 180"]
+            initialDelaySeconds: 20
+            periodSeconds: 60
       volumes:
         - { name: sys, hostPath: { path: /sys } }
       tolerations:
-        - operator: Exists # run on every node, including control-plane
+        - operator: Exists # run on every node, including control-plane / tainted nodes