feat(buildah): add qemu-binfmt daemonset + fix 0.8.0 multi-arch

[ArthurVardevanyan]

User description

qemu-binfmt DaemonSet

• Adds a privileged DaemonSet that registers aarch64 binfmt handlers with the F flag on every node, enabling cross-arch (arm64) Tekton builds from amd64 nodes.
• ServiceAccount + ClusterRole + ClusterRoleBinding for the OpenShift privileged SCC.
• Self-healing entrypoint: registers handler on boot + re-registers every 60s if entry disappears or is disabled.
• Cleanup of non-standard annotations: removed notifications, sync-options (reserved for CRDs), and unverified checkov skips.

buildah 0.8.0 fix

• Restored the MULTI_ARCH detection block that was accidentally removed by a previous edit. The multi-arch path was silently degraded to single-arch (variable referenced but never assigned).

Containerfile

• Mirrors toolbox convention: # syntax=docker/dockerfile-1, microdnf install, ENV version pin with renovate repology comment, cache/doc cleanup.

Pipeline

• Switched from push → pull_request trigger + max-keep-runs: 1 (matches existing image pipelines).

---

PR Type

Enhancement

---

Description

• Add multi-arch support to Buildah Tekton task

• Deploy qemu-binfmt DaemonSet for cross-arch builds

• Register new app in ArgoCD and update CI

• Update documentation and VS Code completions

---

Diagram Walkthrough

flowchart LR
  qemu["qemu-binfmt DaemonSet"] -->|"registers"| binfmt["binfmt handlers"]
  buildah["buildah Task"] -->|"builds"| multi["multi-arch manifests"]
  binfmt -->|"enables"| cross["cross-arch builds"]
  multi -->|"pushes"| reg["container registry"]

Loading

File Walkthrough

	Relevant files
Configuration changes	9 files qemu-binfmt-image.yaml New PipelineRun for building qemu-binfmt image                      +115/-0  kustomization.yaml Register qemu-binfmt ArgoCD application                                    +1/-0      qemu-binfmt.yaml ArgoCD Application manifest for qemu-binfmt                            +28/-0    kustomization.yaml Base Kustomization for qemu-binfmt app                                      +7/-0      namespace.yaml Namespace with privileged PSS labels                                          +13/-0    service-account.yaml ServiceAccount for qemu-binfmt DaemonSet                                  +8/-0      kustomization.yaml OpenShift component for RBAC                                                          +5/-0      rbac.yaml ClusterRole and Binding for privileged SCC                              +31/-0    kustomization.yaml OKD overlay linking base and components                                    +7/-0
Enhancement	4 files daemonset.yaml DaemonSet to register aarch64 binfmt handlers                        +71/-0    buildah.yaml Upgrade Buildah task with multi-arch support                          +316/-0  manage-binfmt.sh Self-healing script for binfmt handler registration            +42/-0    containerfile Containerfile for qemu-binfmt image                                            +16/-0
Documentation	2 files settings.json Add binfmt to VS Code completions                                                +1/-0      README.md Update documentation for multi-arch parameters                      +54/-6

---

---

⚙️ Agent run details

• Model: openai/qwen3.6-35b-a3b
• Tokens: 12,761 in / 6,536 out / 19,297 total
• Time cost: 0.3s
• AI calls: 1

[homelab-okd]

GitOps CI Results

Last Updated: 2026-09-24T12:15:10Z

✅ Expand: PR Checks

      ✅ PR Title

Passed.

      ✅ Signed Commits

Passed.

      ✅ PR Checklist

Passed.

❌ Expand: Linting

      ✅ Markdownlint

Passed.

      ✅ Prettier

Passed.

      ❌ Shellcheck

containers/qemu-binfmt/manage-binfmt.sh:6: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:11: Prefer [[ ]] over [ ] for tests in Bash/Ksh. [SC2292]
containers/qemu-binfmt/manage-binfmt.sh:11: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:13: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:16: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:20: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:24: Prefer [[ ]] over [ ] for tests in Bash/Ksh. [SC2292]
containers/qemu-binfmt/manage-binfmt.sh:24: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:24: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:26: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:27: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:32: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:37: Prefer [[ ]] over [ ] for tests in Bash/Ksh. [SC2292]
containers/qemu-binfmt/manage-binfmt.sh:37: Prefer putting braces around variable references even when not strictly required. [SC2250]
containers/qemu-binfmt/manage-binfmt.sh:38: Prefer [[ ]] over [ ] for tests in Bash/Ksh. [SC2292]
containers/qemu-binfmt/manage-binfmt.sh:38: Consider invoking this command separately to avoid masking its return value (or use '|| true' to ignore). [SC2312]
containers/qemu-binfmt/manage-binfmt.sh:38: Prefer putting braces around variable references even when not strictly required. [SC2250]

      ✅ golangci-lint

No Go files changed.

      ✅ Kubeconform

Passed.

✅ Expand: Static Checks

      ✅ Large File

Passed.

      ✅ YAML Syntax

Passed.

      ✅ Config Sort Order

Passed.

      ✅ Starting CSV

Passed.

      ✅ Scaffold Table

Disabled.

❌ Expand: Kustomize Build

      ❌ Overlay Build

Build Errors:

• 1 overlay(s) failed:

  accumulating components: accumulateDirectory: "couldn't make target for path '/tmp/k8s-gitops-ci-2851439873/kubernetes/qemu-binfmt/components/openshift': Failed to read kustomization file under /tmp/k8s-gitops-ci-2851439873/kubernetes/qemu-binfmt/components/openshift:\napiVersion for Component should be kustomize.config.k8s.io/v1alpha1"
  

  Overlays: okd

      ✅ Hooks

No hooks defined.

      ✅ Kustomize Fix

All kustomization.yaml files are up to date.

      ✅ Ghost Patches

None detected.

✅ Expand: Scaffold Validation

      ✅ Scaffold Drift

No drift detected.

      ✅ Scaffold Exec

All scaffold runs succeeded.

      ✅ Disabled Overlays

No modified overlay is disabled.

      ✅ Pre-Existing Scaffold Drift

None detected.

      ✅ Cluster Coverage

All clusters accounted for.

✅ Expand: Scaffold Drift Protection

All modified overlays with a scaffold template have drift protection enabled.

⚠️ Expand: Resource Compliance

If the affected resource is being modified in this PR, these issues must be corrected.
Otherwise, these are non-blocking warnings for pre-existing issues.

      ⚠️ PodSpec Defaults (2 finding(s))

Pods missing required resource requests/limits or security context fields.

Kind	Name	Container	Missing	Overlays
DaemonSet	qemu-binfmt		enableServiceLinks, schedulerName, dnsPolicy, automountServiceAccountToken	kubernetes/qemu-binfmt/base/daemonset.yaml
DaemonSet	qemu-binfmt	qemu-binfmt	allowPrivilegeEscalation, runAsNonRoot, capabilities, seccompProfile	kubernetes/qemu-binfmt/base/daemonset.yaml

      ℹ️ Accepted Exemptions (pre-existing) (3)

Resource	Value	Scope
PipelineRun qemu-binfmt-image	``	pre-existing
PipelineRun qemu-binfmt-image	``	pre-existing
DaemonSet qemu-binfmt	registry.arthurvardevanyan.com/homelab/qemu-binfmt:not_latest	pre-existing

❌ Expand: Runtime Validation

These are structural/runtime Kubernetes validation rules enforced by the cluster API server. Findings here indicate manifests that the cluster would reject.

      ❌ Core (1 finding(s))

Rule	Resource	File	Field	Message
kubernetes/core/object-meta-namespace-invalid	DaemonSet/qemu-binfmt	kubernetes/qemu-binfmt/base/daemonset.yaml	metadata.namespace	metadata.namespace: invalid value "qemu-bgit add infmt": a lowercase RFC 1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character (e.g. 'my-name', or '123-abc', regex used for validation is 'a-z0-9?')

Upstream Kubernetes validation these rules are ported from:

• kubernetes/core/object-meta-namespace-invalid — staging/src/k8s.io/apimachinery/pkg/api/validation/objectmeta.go:validateObjectMetaAccessorWithOptsCommon

✅ Expand: CI Notes

Pipeline completed.

• Tool version: k8s-gitops-ci version 0.60.0-rc.1

k8s-gitops-ci pipeline --url="https://github.com/ArthurVardevanyan/HomeLab" --pr=740 --assume-openshift

[homelab-pr-agent]

PR Reviewer Guide 🔍

(Review updated until commit 1b4d69d)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Invalid Namespace Name (Typo) Line 6 contains namespace: qemu-bgit add infmt, which appears to be a copy-paste error or accidental terminal command injection. Kubernetes namespaces cannot contain spaces, so this will cause a validation error and prevent the DaemonSet from being created. It should be corrected to qemu-binfmt. namespace: qemu-bgit add infmt Unused Parameter `IMAGE_TAG_SUFFIX` The IMAGE_TAG_SUFFIX parameter is defined at lines 71-72 but is never referenced in the shell script logic (specifically the loop at lines 145-154). The script constructs intermediate image tags using ${IMAGE_NAME}:${ARCH} regardless of the suffix. This means the parameter has no effect, and multi-arch builds will not use the suffix as intended, potentially ignoring user configuration or causing tag collisions. description: "Suffix appended to each per-arch intermediate image name to avoid collisions during multi-arch builds (e.g. ${ARCH}). Ignored in single-arch mode." default: ""

---

⚙️ Agent run details

• Model: openai/qwen3.6-35b-a3b
• Tokens: 15,517 in / 3,782 out / 19,299 total
• Time cost: 0.2s
• AI calls: 1

[homelab-pr-agent]

Persistent review updated to latest commit 1b4d69d