Sveltos CVE patching, the per-cluster matrix
Fleet patch day with evidence instead of hope: one reviewed version bump moves kyverno/kyverno from 3.8.1 to 3.8.2, promoted pilot to staging to production. The final checkpoint requires every cluster at the patched version with none missing, and the reviewed values from chapter three must survive the bump. The observed columns come from the committed live receipt in runs/sveltos-cve-patch-proof/receipt.yaml.
Boundary: this proves governed delivery of a version bump with digest-bound provenance. It does not scan for vulnerabilities and it does not verify any advisory claim.
baseline 3.8.1patched 3.8.2observed live
Baseline, every cluster on 3.8.1| Cluster | Environment | Wave | Expected revision | Expected chart | Background replicas | Observed |
|---|
| hx-sveltos-env-pilot | pilot | 1 | r1-e78c8488ff60 | 3.8.1 | 2 | kyverno-3.8.1 (v1.18.1) with 2 background replicas |
| hx-sveltos-env-staging | staging | 2 | r1-63120e745ae4 | 3.8.1 | 2 | kyverno-3.8.1 (v1.18.1) with 2 background replicas |
| hx-sveltos-env-prod-a | prod | 3 | r1-329feac25fec | 3.8.1 | 2 | kyverno-3.8.1 (v1.18.1) with 2 background replicas |
| hx-sveltos-env-prod-b | prod | 3 | r1-329feac25fec | 3.8.1 | 2 | kyverno-3.8.1 (v1.18.1) with 2 background replicas |
After wave 1, pilot| Cluster | Environment | Wave | Expected revision | Expected chart | Background replicas | Observed |
|---|
| hx-sveltos-env-pilot | pilot | 1 | r2-ed668157730a | 3.8.2 | 2 | kyverno-3.8.2 (v1.18.2) with 2 background replicas |
| hx-sveltos-env-staging | staging | 2 | r1-63120e745ae4 | 3.8.1 | 2 | kyverno-3.8.1 (v1.18.1) with 2 background replicas |
| hx-sveltos-env-prod-a | prod | 3 | r1-329feac25fec | 3.8.1 | 2 | kyverno-3.8.1 (v1.18.1) with 2 background replicas |
| hx-sveltos-env-prod-b | prod | 3 | r1-329feac25fec | 3.8.1 | 2 | kyverno-3.8.1 (v1.18.1) with 2 background replicas |
After wave 2, staging| Cluster | Environment | Wave | Expected revision | Expected chart | Background replicas | Observed |
|---|
| hx-sveltos-env-pilot | pilot | 1 | r2-ed668157730a | 3.8.2 | 2 | kyverno-3.8.2 (v1.18.2) with 2 background replicas |
| hx-sveltos-env-staging | staging | 2 | r2-5c11ffbb9766 | 3.8.2 | 2 | kyverno-3.8.2 (v1.18.2) with 2 background replicas |
| hx-sveltos-env-prod-a | prod | 3 | r1-329feac25fec | 3.8.1 | 2 | kyverno-3.8.1 (v1.18.1) with 2 background replicas |
| hx-sveltos-env-prod-b | prod | 3 | r1-329feac25fec | 3.8.1 | 2 | kyverno-3.8.1 (v1.18.1) with 2 background replicas |
After wave 3, production; no cluster may be missing| Cluster | Environment | Wave | Expected revision | Expected chart | Background replicas | Observed |
|---|
| hx-sveltos-env-pilot | pilot | 1 | r2-ed668157730a | 3.8.2 | 2 | kyverno-3.8.2 (v1.18.2) with 2 background replicas |
| hx-sveltos-env-staging | staging | 2 | r2-5c11ffbb9766 | 3.8.2 | 2 | kyverno-3.8.2 (v1.18.2) with 2 background replicas |
| hx-sveltos-env-prod-a | prod | 3 | r2-da51d22b26c8 | 3.8.2 | 2 | kyverno-3.8.2 (v1.18.2) with 2 background replicas |
| hx-sveltos-env-prod-b | prod | 3 | r2-da51d22b26c8 | 3.8.2 | 2 | kyverno-3.8.2 (v1.18.2) with 2 background replicas |
Sources: the three environment profiles and the patch candidate live in examples/sveltos/cve-patch/; the shared fleet design lives in examples/sveltos/env-rollout/. The matrix is generated by scripts/generate-sveltos-cve-patch.mjs.