[almaslennikov]

Add an experimental native Go sentry-bf4 workflow after DPF discovery. Users can resolve explicit device and tenant bindings, generate a validated immutable bundle, and deploy or validate the selected provisioning and Sentry resources without invoking the Host Network Operator workflow.

Selected devices now require completed administrator-privilege evidence from DPU BMC discovery. Firmware selection accepts a verified BF4 Redfish PSID or serial-bound SSH measurements, requires agreement, and revalidates retained measurements when loading a bundle. Invalid, conflicting, changed or incomplete Redfish verification cannot be hidden by SSH evidence.

Discovery v1alpha3 and legacy v1alpha1/v1alpha2 are decoded without promoting failed identity or missing authorization. New resolved metadata uses typed device fields in its own v1alpha2 envelope; the bundle index remains v1alpha1. Existing valid legacy resolved bundles retain their original bytes and digest during admission. Host-derived PSID measurements require a successfully observed host identity, including legacy input.

This PR is stacked on #348 and targets dev/dpf-discovery. Merge the discovery PR first, then reconcile the base and retarget this PR to main.

The implementation adds release-pinned profiles, chart/schema verification, bundle ownership checks, management/tenant admission and readiness checks, and separate run reports. Physical provisioning is sequential: each DPUSet and host transition must finish before the next create; coupled Sentry services are still submitted together. It consumes existing Kubernetes/DPF infrastructure and enrollment; VM creation, cluster bootstrap, ownership migration, host power/IOMMU changes, and switch/DHCP configuration remain external prerequisites. Core policy enforcement defaults to LLM inspection disabled.

User documentation covers inputs, where each operation runs, prerequisites, deployment/recovery, and functional verification, with diagrams generated from the workflow definitions. CLI references, integration contracts, and phase skills are updated alongside it.

Validation:

• Full local tests, native and cross-platform builds, pinned lint, documentation contracts, workflow generator checks, and strict HTML build passed.
• The isolated full-repository race run passed. An initial run under concurrent compilation hit a timeout in an unchanged discovery SSH test; that test then passed 25 focused race runs. No data race was reported. The first hosted test job hit a separate unchanged Host scope test whose 30 ms deadline expired before its first fake-client read; the final-head local full-repository race run and hosted build, race/coverage tests, and lint all passed.
• Earlier hardware testing verified native bundle admission, DPU provisioning and tenant readiness, tenant DNS, and startup of the Tower/controller/Argus resources. After an externally administered host IOMMU change, the expected running mode, generated Argus kernel profile and listening query socket were observed. Argus host process events matched the current host boot ID, PID and executable path independently read from the host. Request-to-process query correctness and binary attestation remain unverified. Hardware coverage is one selected device; multi-device sequencing is covered by simulated lifecycle regressions, including two cards sharing a host.
• The earlier source revision received a read-only hardware validation passed 23 checks, recorded only unchanged resources, and correctly returned nonzero/TIMEOUT while Tower remained pending.
• The earlier hardware run had no usable DHCP/gateway path for Sentry fabric egress. Switch configuration is deliberately unchanged, so end-to-end HTTP/HTTPS allow/deny and executable-identity enforcement are not qualified by this PR's current runtime evidence. Resource readiness alone is not functional enforcement.

The subsequent clean two-device run completed scoped teardown, fresh management/operator and tenant preparation, and successful administrator-verified Redfish discovery on both devices. One device exposes a stable PSID; the other reports PSID_NOT_EXPOSED and an older Redfish layout requiring a supported firmware transition before enrollment. This clean run has not deployed both Sentry workers or qualified policy enforcement. These operational steps do not add bootstrap or firmware-remediation support to the CLI.

Current local validation: full repository race tests passed before the final bounded firmware correction; final affected DPF/target race suites, build, pinned lint, documentation contracts, workflow generation/drift and strict MkDocs passed. Independent producer/consumer reviews found and corrected optional firmware publication, malformed conflict handling and legacy failed-host measurement acceptance. Reproductions and regression suites passed on the corrected revisions. This schema update was tested locally; it does not add new live Sentry qualification.

Discovery prerequisite gaps remain tracked separately in #379. Hosted checks are reported separately from local validation; previous run results do not establish the status of the updated head.

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge within its documented experimental scope.

Summary

Adds an experimental native sentry-bf4 workflow for existing DPF infrastructure.

• DPF generation turns explicit device settings and pinned chart files into a validated Sentry bundle.
• DPF deploy and validate check existing clusters before applying or inspecting Sentry resources.
• The Sentry BF4 profile defines DPU networking, provisioning, and policy services for selected devices.
• Workflow guides and CLI references explain how operators prepare, run, and check the DPF Sentry workflow.

The earlier multi-device stopping issue is addressed by the per-device wait and transition checks. No new actionable issue was established.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Discovery inventory and explicit site inputs] --> B[Generate and check immutable bundle]
  B --> C[Check retained intent before cluster access]
  C --> D[Check cluster identities and ownership]
  D --> E[Verify cached software]
  E --> F[Create one DPUSet]
  F --> G[Wait for readiness and cleared host transitions]
  G --> H{More devices?}
  H -->|Yes| E
  H -->|No| I[Check selected nodes and DNS]
  I --> J[Submit coupled Sentry services]
  J --> K[Check resources and workload coverage]
  K --> L[Save separate run report]
  L --> M[Run functional policy tests separately]

Loading

_{Reviews (6) · Last reviewed commit: "Merge branch 'dev/dpf-typed-inventory' i..." · Reviewed by Greptile}