Skip to content

refactor: split repo into micromize and sigward products (monorepo)#151

Merged
dorser merged 32 commits into
micromize-dev:mainfrom
dorser:dorser/split-sigward
Jul 5, 2026
Merged

refactor: split repo into micromize and sigward products (monorepo)#151
dorser merged 32 commits into
micromize-dev:mainfrom
dorser:dorser/split-sigward

Conversation

@dorser

@dorser dorser commented Jul 3, 2026

Copy link
Copy Markdown
Collaborator

Summary

Restructures this repository moving out the execution-attestation into a separate binary. The execution-attestation is an interesting idea but it's complementary to the philosophy of micromize and therefore has different assumptions on the boundary it protects. At this point in time, it makes sense to separate them. Now we have:

  • Micromize (cmd/micromize) — the boundary-enforcement agent.
  • Sigward (cmd/sigward) — execution attestation: verifies in the kernel (BPF-LSM + IMA) that only binaries/shared-objects/scripts declared in an image's signed SPDX SBOM may execute.

The two are separate deployables (binaries, images, Helm charts) but share the internal/ framework, so there is one source of truth for the runner, operators, and tooling. In the future we can consider to unify the runtime layer for both, but at this point in time, the separation creates clearer boundaries and allows me to focus on the development of micromize itself.

What changed

  • internal/attest/ — new package holding the IMA operator (moved out of internal/operators).
  • gadgets/sigward/ — renamed from gadgets/binary-attestation (prog/tracer/datasource -> sigward); still uses the shared include/micromize/event_types.h (event types 7–10 unchanged).
  • cmd/sigward/ — new binary wiring the attestation gadget + IMA operator; self-excludes the sigward namespace; sigward.dev/exempt label.
  • cmd/micromize/ — no longer registers the attestation gadget or the IMA operator.
  • charts/sigward/ — new chart (keeps registryAuth for private SBOM pulls); charts/micromize/ drops the now-unneeded registry-auth plumbing.
  • Dockerfile (micromize, 4 gadgets) + Dockerfile.sigward; Makefile builds both binaries; release.yml builds both images and all 5 gadgets.
  • README documents both products.

Validation

  • go build / vet / test, gofmt, addlicense — clean.
  • helm lint on both charts — clean.
  • All 5 gadgets build and export via ig image build (incl. sigward with the shared header).
  • Both release binaries build with embedded gadgets and run.
  • Dependency isolation verified (above).

Note

This supersedes the separate micromize-dev/sigward repo and its PR #1, which can be closed/archived.

dorser added 8 commits July 3, 2026 10:03
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Copilot AI review requested due to automatic review settings July 3, 2026 10:22
Signed-off-by: Dor Serero <dor.serero@gmail.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Refactors the repository into a monorepo that produces two deployables—Micromize (boundary enforcement) and Sigward (execution attestation)—while sharing the existing internal framework and build/release tooling.

Changes:

  • Splits IMA/SBOM attestation into internal/attest and introduces a new cmd/sigward binary wired to the Sigward gadget + IMA operator.
  • Renames the gadget from binary-attestation to sigward and updates build/release pipelines to build/publish it alongside existing gadgets.
  • Adds a new Helm chart for Sigward and removes SBOM/registry-auth plumbing from the Micromize chart.

Reviewed changes

Copilot reviewed 31 out of 32 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
README.md Documents the two-product monorepo and introduces Sigward section/link.
Makefile Builds both micromize and sigward binaries; adjusts embedded gadget tar copies per product.
internal/operators/operators.go Removes IMA/SBOM operator from shared operators (Micromize no longer depends on SBOM).
internal/attest/ima.go New IMA/SBOM operator implementation moved under internal/attest.
include/micromize/event_types.h Renames comment label from binary-attestation to sigward for event types 7–10.
gadgets/sigward/program.bpf.h Adds Sigward gadget header/types.
gadgets/sigward/program.bpf.c Renames tracer/program identifiers and printk prefixes to sigward.
gadgets/sigward/gadget.yaml Renames gadget and datasource from binary-attestation to sigward; updates URLs.
Dockerfile.sigward New Sigward image build including gadget build/export + static Go build.
Dockerfile Stops building/exporting the attestation gadget as part of Micromize image build.
cmd/sigward/root.go New Sigward CLI wiring (IMA operator + gadget registry + namespace exemptions).
cmd/sigward/root_test.go Unit tests for namespace-filter construction.
cmd/sigward/main.go New Sigward entrypoint.
cmd/sigward/embeds.go Embeds sigward.tar under the release build tag.
cmd/sigward/embeds_dev.go Non-release stub for embedded gadget bytes.
cmd/micromize/root.go Removes IMA operator and binary-attestation gadget registration from Micromize.
cmd/micromize/embeds.go Removes embedded binary-attestation gadget tar from Micromize release build.
cmd/micromize/embeds_dev.go Removes binary-attestation embedded-bytes stub from Micromize dev build.
charts/sigward/values.yaml New Sigward chart values (image, filters, exempt label, registryAuth).
charts/sigward/values.schema.json New Sigward values JSON schema.
charts/sigward/templates/serviceaccount.yaml New ServiceAccount template for Sigward chart.
charts/sigward/templates/NOTES.txt New chart notes for Sigward installation.
charts/sigward/templates/daemonset.yaml New Sigward DaemonSet (includes registryAuth mount for SBOM pulls).
charts/sigward/templates/clusterrolebinding.yaml New cluster role binding for Sigward chart.
charts/sigward/templates/clusterrole.yaml New cluster role for Sigward chart.
charts/sigward/templates/_helpers.tpl New Sigward chart helper templates.
charts/sigward/Chart.yaml New Sigward Helm chart definition.
charts/micromize/values.yaml Removes registryAuth values (Micromize no longer needs SBOM pull creds).
charts/micromize/values.schema.json Removes registryAuth schema fields from Micromize chart.
charts/micromize/templates/daemonset.yaml Removes registryAuth env/mount/volume from Micromize DaemonSet.
.github/workflows/release.yml Releases Sigward image and includes sigward + socket-restrict in gadget release matrix.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread internal/attest/ima.go Outdated
Comment thread charts/sigward/templates/NOTES.txt Outdated
Copilot AI review requested due to automatic review settings July 3, 2026 10:26

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 31 out of 32 changed files in this pull request and generated 2 comments.

Comment thread internal/attest/ima.go
Comment thread charts/sigward/templates/NOTES.txt Outdated
dorser added 6 commits July 3, 2026 10:47
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Copilot AI review requested due to automatic review settings July 3, 2026 10:52

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 36 out of 37 changed files in this pull request and generated 3 comments.

Comment thread Dockerfile.sigward Outdated
Comment thread Dockerfile.sigward Outdated
Comment thread Dockerfile.sigward Outdated
dorser added 3 commits July 3, 2026 11:51
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Copilot AI review requested due to automatic review settings July 3, 2026 13:37

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 37 out of 39 changed files in this pull request and generated 4 comments.

Comment thread cmd/sigward/root.go Outdated
Comment thread cmd/micromize/root.go Outdated
Comment thread charts/sigward/templates/daemonset.yaml Outdated
Comment on lines +43 to +45
# Required for ptrace-based gadgets.
- SYS_PTRACE
# Required for setting rlimits (e.g. memlock).
Comment thread charts/sigward/values.schema.json
dorser added 3 commits July 3, 2026 13:51
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Copilot AI review requested due to automatic review settings July 3, 2026 14:08

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 39 out of 41 changed files in this pull request and generated 6 comments.

Comment thread go.mod Outdated
Comment thread cmd/sigward/root.go
Comment thread cmd/sigward/root.go
Comment thread internal/utils/utils.go
Comment on lines +158 to +162
t.Run("falls back when env empty and no service account file", func(t *testing.T) {
t.Setenv(podNamespaceEnvVar, "")
if got := CurrentNamespace("sigward"); got != "sigward" {
t.Errorf("CurrentNamespace() = %q, want %q", got, "sigward")
}
Comment thread internal/attest/ima.go Outdated
dorser added 2 commits July 3, 2026 18:51
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Copilot AI review requested due to automatic review settings July 3, 2026 19:01

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 39 out of 41 changed files in this pull request and generated 3 comments.

Comment thread cmd/sigward/root.go
Comment on lines +141 to +146
} else if len(exemptNS) > 0 {
slog.Info("Exempt namespaces discovered (startup only)", "namespaces", exemptNS, "label", exemptLabel)
for _, ns := range exemptNS {
nsFilter += ",!" + ns
}
}
Comment thread charts/sigward/values.schema.json Outdated
Comment on lines +26 to +27
"required": ["repository", "pullPolicy"]
},
Comment on lines +158 to +163
t.Run("falls back when env empty and no service account file", func(t *testing.T) {
t.Setenv(podNamespaceEnvVar, "")
if got := CurrentNamespace("sigward"); got != "sigward" {
t.Errorf("CurrentNamespace() = %q, want %q", got, "sigward")
}
})
dorser added 3 commits July 3, 2026 19:13
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 39 out of 41 changed files in this pull request and generated 3 comments.

Comment thread cmd/sigward/root.go
Comment on lines +69 to +72
rootCmd.PersistentFlags().BoolVar(&enforce, "enforce", true, "Enforce restrictions")
rootCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "Enable verbose logging")
rootCmd.PersistentFlags().StringVar(&filterNamespaces, "filter-namespaces", "", "Comma-separated list of Kubernetes namespaces to monitor (empty means all except 'sigward'). Supports exclusion with '!' prefix.")
rootCmd.PersistentFlags().StringVar(&filterImageDigest, "filter-image-digest", "", "Filter out containers running this image digest from monitoring (e.g. sha256:abc123...)")
Comment thread cmd/sigward/root.go
Comment on lines +125 to +128
// Sigward attests every namespace, including its own — it follows its own
// attestation rules rather than exempting itself. Operators can still scope
// coverage with --filter-namespaces and --exempt-label.
nsFilter := utils.BuildNamespaceFilter(filterNamespaces, "")
Comment thread go.mod Outdated
dorser added 5 commits July 3, 2026 19:29
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Signed-off-by: Dor Serero <dor.serero@gmail.com>
Copilot AI review requested due to automatic review settings July 4, 2026 04:44

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 39 out of 41 changed files in this pull request and generated 3 comments.

Comment thread cmd/micromize/root.go
Comment on lines 37 to 42
const (
fsRestrictGadgetImageRepo = "ghcr.io/micromize-dev/micromize/fs-restrict"
capRestrictGadgetImageRepo = "ghcr.io/micromize-dev/micromize/cap-restrict"
ptraceRestrictGadgetImageRepo = "ghcr.io/micromize-dev/micromize/ptrace-restrict"
socketRestrictGadgetImageRepo = "ghcr.io/micromize-dev/micromize/socket-restrict"
binaryAttestationGadgetImageRepo = "ghcr.io/micromize-dev/micromize/binary-attestation"
fsRestrictGadgetImageRepo = "ghcr.io/micromize-dev/micromize/fs-restrict"
capRestrictGadgetImageRepo = "ghcr.io/micromize-dev/micromize/cap-restrict"
ptraceRestrictGadgetImageRepo = "ghcr.io/micromize-dev/micromize/ptrace-restrict"
socketRestrictGadgetImageRepo = "ghcr.io/micromize-dev/micromize/socket-restrict"
)
Comment thread cmd/sigward/root.go Outdated
"github.com/micromize-dev/micromize/internal/utils"
)

const sigwardGadgetImageRepo = "ghcr.io/micromize-dev/micromize/sigward"
Comment thread cmd/sigward/root.go
Comment on lines +125 to +129
// Sigward attests every namespace, including its own — it follows its own
// attestation rules rather than exempting itself. Operators can still scope
// coverage with --filter-namespaces and --exempt-label.
nsFilter := utils.BuildNamespaceFilter(filterNamespaces, "")

Signed-off-by: Dor Serero <dor.serero@gmail.com>
@dorser dorser merged commit 2f1fe53 into micromize-dev:main Jul 5, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants