From 5397952b9fadff0aecb5ac129c1c5fd97ae50325 Mon Sep 17 00:00:00 2001 From: Smana Date: Mon, 21 Sep 2026 22:58:36 +0200 Subject: [PATCH 1/2] chore(tooling): remove the Dagger engine and its runner scale set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #1595. Dagger's CI usage was already removed in #1810 (ADR-0039); this removes what was left: the in-cluster dagger-engine deployment, the dedicated dagger-gha-runner-scale-set HelmRelease, and every reference to them in Polaris exemptions, network policies, the render-bundle overrides, the secrets baseline, the CI-pipeline diagram and its export, and the docs site. Both components were already disabled (commented out of tooling/aws-0/kustomization.yaml), so merging this deletes nothing from a live cluster beyond what Flux prune already excludes from the rendered bundle validated in CI — the 10 resources they still contributed to that validation-only render (ConfigMap, Service, Deployment, PodDisruptionBudget, CiliumNetworkPolicy, HelmRelease, ServiceAccount, Role, RoleBinding, AutoscalingRunnerSet) drop out of it. --- .polaris.yaml | 21 ---- .secrets.baseline | 9 -- docs/architecture/ci-pipeline.drawio | 2 +- scripts/flux-schema/render-bundle.py | 12 +- tooling/aws-0/kustomization.yaml | 1 - tooling/base/dagger-engine/configmap.yaml | 10 -- tooling/base/dagger-engine/deployment.yaml | 104 ------------------ tooling/base/dagger-engine/kustomization.yaml | 10 -- .../base/dagger-engine/network-policy.yaml | 39 ------- tooling/base/dagger-engine/pdb.yaml | 9 -- tooling/base/dagger-engine/service.yaml | 13 --- .../dagger-scale-set-helmrelease.yaml | 43 -------- tooling/base/gha-runners/kustomization.yaml | 1 - tooling/base/gha-runners/network-policy.yaml | 8 -- .../docs/platform/gitops/validation.md | 6 +- .../content/docs/reference/ci-workflows.md | 3 +- .../content/docs/reference/further-reading.md | 1 - website/data/repo-tree.yaml | 2 +- website/data/stack.yaml | 11 +- .../static/images/diagrams/ci-pipeline.svg | 2 +- website/static/images/logos/LICENSES.md | 1 - website/static/images/logos/dagger.svg | 1 - 22 files changed, 13 insertions(+), 296 deletions(-) delete mode 100644 tooling/base/dagger-engine/configmap.yaml delete mode 100644 tooling/base/dagger-engine/deployment.yaml delete mode 100644 tooling/base/dagger-engine/kustomization.yaml delete mode 100644 tooling/base/dagger-engine/network-policy.yaml delete mode 100644 tooling/base/dagger-engine/pdb.yaml delete mode 100644 tooling/base/dagger-engine/service.yaml delete mode 100644 tooling/base/gha-runners/dagger-scale-set-helmrelease.yaml delete mode 100644 website/static/images/logos/dagger.svg diff --git a/.polaris.yaml b/.polaris.yaml index e44b03928..e7b6b9288 100644 --- a/.polaris.yaml +++ b/.polaris.yaml @@ -111,27 +111,6 @@ exemptions: - hostPIDSet - privilegeEscalationAllowed - # Container build engine (BuildKit). Building OCI images requires creating - # mount/user namespaces and running nested containers, hence a privileged - # container with dangerous capabilities. - - controllerNames: - - dagger-engine - rules: - - privilegeEscalationAllowed - - runAsPrivileged - - dangerousCapabilities - - # GitHub Actions runner in docker-in-docker mode. The `dind` sidecar is - # hardcoded privileged by the upstream chart (gha-runner-scale-set - # _helpers.tpl "dind-container" — not overridable from values), and the runner - # executes arbitrary workflow code that legitimately escalates (sudo, apt). - # NOTE: tagNotSpecified is NOT exempted — the runner image is pinned below. - - controllerNames: - - dagger-gha-runner-scale-set - rules: - - privilegeEscalationAllowed - - runAsPrivileged - # GitHub Actions runner (kubernetes mode). Executes arbitrary workflow code # that legitimately escalates privileges (sudo/apt in workflow steps). # NOTE: tagNotSpecified is NOT exempted — the runner image is pinned below. diff --git a/.secrets.baseline b/.secrets.baseline index 5baae4138..83ded012a 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -240,15 +240,6 @@ "line_number": 167 } ], - "tooling/base/gha-runners/dagger-scale-set-helmrelease.yaml": [ - { - "type": "Secret Keyword", - "filename": "tooling/base/gha-runners/dagger-scale-set-helmrelease.yaml", - "hashed_secret": "42c7be96d0274b7f8ffbe652f3c529f257bde46e", - "is_verified": false, - "line_number": 23 - } - ], "tooling/base/gha-runners/default-scale-set-helmrelease.yaml": [ { "type": "Secret Keyword", diff --git a/docs/architecture/ci-pipeline.drawio b/docs/architecture/ci-pipeline.drawio index e194dbdcf..3f5cb524b 100644 --- a/docs/architecture/ci-pipeline.drawio +++ b/docs/architecture/ci-pipeline.drawio @@ -20,7 +20,7 @@ - + diff --git a/scripts/flux-schema/render-bundle.py b/scripts/flux-schema/render-bundle.py index 2b5ea8b95..1ae97f721 100755 --- a/scripts/flux-schema/render-bundle.py +++ b/scripts/flux-schema/render-bundle.py @@ -187,12 +187,6 @@ def _repo_lock(url): "namespace": "tooling", } }, - ("tooling", "dagger-gha-runner-scale-set"): { - "controllerServiceAccount": { - "name": "gha-runner-scale-set-controller-gha-rs-controller", - "namespace": "tooling", - } - }, } @@ -351,9 +345,9 @@ def normalize_quantities(node): The Kubernetes API server's resource.Quantity.UnmarshalJSON accepts a bare JSON number (`cpu: 1`) exactly like a string (`cpu: "1"`) - upstream chart - defaults (KEDA, Harbor's bundled Trivy subchart) and this repo's own - dagger-engine overlay rely on that leniency, and these workloads run in - the live cluster today with these exact values. flux-schema's generated + defaults (KEDA, Harbor's bundled Trivy subchart) rely on that leniency, + and these workloads run in the live cluster today with these exact + values. flux-schema's generated JSON-Schema catalog types Quantity as `string` only, stricter than the API server actually is, so a numeric value here is a validator false positive, not a real defect. Narrowly scoped to resources.limits/requests diff --git a/tooling/aws-0/kustomization.yaml b/tooling/aws-0/kustomization.yaml index fbe868ab3..9523d4972 100644 --- a/tooling/aws-0/kustomization.yaml +++ b/tooling/aws-0/kustomization.yaml @@ -11,5 +11,4 @@ resources: # when the LLM stack is enabled). Wired via # clusters/aws-0-llm-platform/tooling-promptfoo.yaml. # Enabling only when needed for cost reasons - # - ../base/dagger-engine # - ../base/gha-runners diff --git a/tooling/base/dagger-engine/configmap.yaml b/tooling/base/dagger-engine/configmap.yaml deleted file mode 100644 index b1cdcef60..000000000 --- a/tooling/base/dagger-engine/configmap.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: dagger-engine - labels: - app.kubernetes.io/name: dagger-engine - app.kubernetes.io/version: "v0.11.9" -data: - engine.toml: | - debug = true diff --git a/tooling/base/dagger-engine/deployment.yaml b/tooling/base/dagger-engine/deployment.yaml deleted file mode 100644 index 8c6c7c073..000000000 --- a/tooling/base/dagger-engine/deployment.yaml +++ /dev/null @@ -1,104 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: dagger-engine - annotations: - karpenter.sh/do-not-disrupt: "true" - labels: - app.kubernetes.io/name: dagger-engine -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: dagger-engine - template: - metadata: - labels: - app.kubernetes.io/name: dagger-engine - spec: - securityContext: - runAsUser: 0 - runAsGroup: 1001 - fsGroup: 1001 - fsGroupChangePolicy: "OnRootMismatch" - serviceAccountName: default - containers: - - name: dagger-engine - image: registry.dagger.io/engine:v0.21.9 - imagePullPolicy: IfNotPresent - args: - - --addr - - tcp://0.0.0.0:8080 - - --oci-max-parallelism - - num-cpu - ports: - - containerPort: 8080 - securityContext: - privileged: true - capabilities: - add: - - ALL - resources: - limits: - memory: 8Gi - ephemeral-storage: 100Gi - requests: - cpu: 4 - memory: 8Gi - ephemeral-storage: 100Gi - readinessProbe: - tcpSocket: - port: 8080 - initialDelaySeconds: 5 - periodSeconds: 10 - failureThreshold: 3 - volumeMounts: - - name: dagger-engine-config - mountPath: /etc/dagger/engine.toml - subPath: engine.toml - - name: varlibdagger - mountPath: /var/lib/dagger - - name: varrundagger - mountPath: /var/run/buildkit - terminationGracePeriodSeconds: 300 - volumes: - - name: dagger-engine-config - configMap: - name: dagger-engine - items: - - key: engine.toml - path: engine.toml - - name: varlibdagger - ephemeral: - volumeClaimTemplate: - spec: - accessModes: ["ReadWriteOnce"] - resources: - requests: - storage: 50Gi - - name: varrundagger - ephemeral: - volumeClaimTemplate: - spec: - accessModes: ["ReadWriteOnce"] - resources: - requests: - storage: 50Gi - tolerations: - - effect: NoSchedule - key: ogenki/io - operator: Exists - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: karpenter.sh/nodepool - operator: In - values: - - io - # - matchExpressions: - # - key: karpenter.sh/capacity-type - # operator: In - # values: - # - on-demand diff --git a/tooling/base/dagger-engine/kustomization.yaml b/tooling/base/dagger-engine/kustomization.yaml deleted file mode 100644 index 4a4000634..000000000 --- a/tooling/base/dagger-engine/kustomization.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: tooling - -resources: - - configmap.yaml - - deployment.yaml - - pdb.yaml - - service.yaml - - network-policy.yaml diff --git a/tooling/base/dagger-engine/network-policy.yaml b/tooling/base/dagger-engine/network-policy.yaml deleted file mode 100644 index 54f11ffa5..000000000 --- a/tooling/base/dagger-engine/network-policy.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: cilium.io/v2 -kind: CiliumNetworkPolicy -metadata: - name: dagger-engine -spec: - description: "Allow internal traffic to the Dagger Engine service." - endpointSelector: - matchLabels: - k8s:app.kubernetes.io/name: dagger-engine - egress: - - toEndpoints: - - matchLabels: - k8s:io.kubernetes.pod.namespace: kube-system - k8s:k8s-app: kube-dns - toPorts: - - ports: - - port: "53" - protocol: UDP - - port: "53" - protocol: TCP - - toEntities: - - world - toPorts: - - ports: - - port: "80" - protocol: TCP - - port: "443" - protocol: TCP - ingress: - - fromEndpoints: - - matchLabels: - k8s:actions.github.com/scale-set-name: default-gha-runner-scale-set - - fromEndpoints: - - matchLabels: - k8s:actions.github.com/scale-set-name: dagger-gha-runner-scale-set - toPorts: - - ports: - - port: "8080" - protocol: TCP diff --git a/tooling/base/dagger-engine/pdb.yaml b/tooling/base/dagger-engine/pdb.yaml deleted file mode 100644 index 59f16446a..000000000 --- a/tooling/base/dagger-engine/pdb.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: dagger-engine -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: dagger-engine diff --git a/tooling/base/dagger-engine/service.yaml b/tooling/base/dagger-engine/service.yaml deleted file mode 100644 index cce577268..000000000 --- a/tooling/base/dagger-engine/service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: dagger-engine - labels: - app.kubernetes.io/name: dagger-engine -spec: - selector: - app.kubernetes.io/name: dagger-engine - ports: - - protocol: TCP - port: 8080 - targetPort: 8080 diff --git a/tooling/base/gha-runners/dagger-scale-set-helmrelease.yaml b/tooling/base/gha-runners/dagger-scale-set-helmrelease.yaml deleted file mode 100644 index 90457ce1c..000000000 --- a/tooling/base/gha-runners/dagger-scale-set-helmrelease.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: dagger-gha-runner-scale-set -spec: - releaseName: dagger-gha-runner-scale-set - driftDetection: - mode: enabled - chart: - spec: - chart: gha-runner-scale-set - version: "0.9.3" - sourceRef: - kind: HelmRepository - name: gha-runner-scale-set - interval: 10m0s - install: - remediation: - retries: 3 - values: - runnerGroup: "default" - githubConfigUrl: "https://github.com/Smana/cloud-native-ref" - githubConfigSecret: gha-runner-scale-set - maxRunners: 5 - - containerMode: - type: "dind" - - template: - spec: - # Pin the runner image — see default-scale-set-helmrelease.yaml for the - # full rationale. In dind mode this tag also feeds the generated - # `init-dind-externals` initContainer, which copies the runner externals - # out of this same image (_helpers.tpl "dind-init-container"), so pinning - # here clears tagNotSpecified on both containers. - # - # The `dind` sidecar keeps its chart-hardcoded `docker:dind` + - # privileged: true — not overridable from values, hence the Polaris - # exemption in .polaris.yaml. - containers: - - name: runner - image: ghcr.io/actions/actions-runner:2.337.0 - command: ["/home/runner/run.sh"] diff --git a/tooling/base/gha-runners/kustomization.yaml b/tooling/base/gha-runners/kustomization.yaml index 644514c8f..7c815249d 100644 --- a/tooling/base/gha-runners/kustomization.yaml +++ b/tooling/base/gha-runners/kustomization.yaml @@ -4,7 +4,6 @@ namespace: tooling resources: - controller-helmrelease.yaml - - dagger-scale-set-helmrelease.yaml - default-scale-set-helmrelease.yaml - externalsecret.yaml - network-policy.yaml diff --git a/tooling/base/gha-runners/network-policy.yaml b/tooling/base/gha-runners/network-policy.yaml index 577aeb47b..d969a5f33 100644 --- a/tooling/base/gha-runners/network-policy.yaml +++ b/tooling/base/gha-runners/network-policy.yaml @@ -10,7 +10,6 @@ spec: operator: In values: - default-gha-runner-scale-set - - dagger-gha-runner-scale-set egress: - toEndpoints: - matchLabels: @@ -22,13 +21,6 @@ spec: protocol: UDP - port: "53" protocol: TCP - - toEndpoints: - - matchLabels: - k8s:app.kubernetes.io/name: dagger-engine - toPorts: - - ports: - - port: "8080" - protocol: TCP - toEntities: - world toPorts: diff --git a/website/content/docs/platform/gitops/validation.md b/website/content/docs/platform/gitops/validation.md index d826ca43e..8002179c6 100644 --- a/website/content/docs/platform/gitops/validation.md +++ b/website/content/docs/platform/gitops/validation.md @@ -64,9 +64,9 @@ what a passing run means here, not incidental detail. **Polaris audits the rendered bundle, not the source tree.** Re-verified on this branch by rendering the repository and counting both sides directly: the tree has **one** raw `Deployment` manifest -(`tooling/base/dagger-engine/deployment.yaml`); the rendered bundle has -**156 controllers** — 109 `Deployment`, 25 `Job`, 10 `StatefulSet`, 8 -`DaemonSet`, 4 `CronJob` — everything else arrives as a `HelmRelease` and +(`tooling/gcp-0/headlamp/token-exchange.yaml`); the rendered bundle has +**160 controllers** — 110 `Deployment`, 25 `Job`, 10 `StatefulSet`, 8 +`DaemonSet`, 7 `CronJob` — everything else arrives as a `HelmRelease` and only becomes a controller after `helm template` runs. A best-practices audit pointed at the source tree would check one workload; pointed at the rendered bundle, it checks what's actually scheduled. diff --git a/website/content/docs/reference/ci-workflows.md b/website/content/docs/reference/ci-workflows.md index 868f99283..6d6d22903 100644 --- a/website/content/docs/reference/ci-workflows.md +++ b/website/content/docs/reference/ci-workflows.md @@ -245,5 +245,4 @@ Runner scale sets run in-cluster (`tooling/base/gha-runners/`) and are **off by default** — commented out of `tooling/aws-0/kustomization.yaml`. When enabled they give private-endpoint access, lower latency, no egress charges for heavy builds, and secrets via External Secrets rather than -long-lived tokens in a workflow. A second scale set is dedicated to Dagger -builds and shares the in-cluster `dagger-engine`. +long-lived tokens in a workflow. diff --git a/website/content/docs/reference/further-reading.md b/website/content/docs/reference/further-reading.md index 285f49359..0dea03f94 100644 --- a/website/content/docs/reference/further-reading.md +++ b/website/content/docs/reference/further-reading.md @@ -20,7 +20,6 @@ personal blog — a separate property from this site. - [Tailscale: Simplifying Cloud Access](https://blog.ogenki.io/post/tailscale/) — using Tailscale as a zero-trust VPN for private access to cluster services, instead of bastion hosts. - [VictoriaMetrics and Grafana Operators](https://blog.ogenki.io/post/series/observability/metrics) — standing up the metrics stack with the VictoriaMetrics and Grafana operators. - [Effective Alerting with VictoriaMetrics](https://blog.ogenki.io/post/series/observability/alerts/) — designing alert rules and routing on top of VictoriaMetrics. -- [Dagger: The Missing Piece of Developer Experience](https://blog.ogenki.io/post/dagger-intro/) — running the same CI pipeline locally and in GitHub Actions with Dagger. ## Upstream documentation diff --git a/website/data/repo-tree.yaml b/website/data/repo-tree.yaml index 1cf8be3a1..4ec1dcb15 100644 --- a/website/data/repo-tree.yaml +++ b/website/data/repo-tree.yaml @@ -134,7 +134,7 @@ entries: - path: tooling/ kind: dir - desc: Harbor, Headlamp, Homepage, the Dagger engine, self-hosted runners (off by default) + desc: Harbor, Headlamp, Homepage, self-hosted runners (off by default) owner: tooling - path: apps/ diff --git a/website/data/stack.yaml b/website/data/stack.yaml index 55f7ce4e2..cace297b8 100644 --- a/website/data/stack.yaml +++ b/website/data/stack.yaml @@ -338,22 +338,17 @@ groups: role: Landing-page dashboard linking every service this platform runs url: https://gethomepage.dev pin: "`tooling/base/homepage/helmrelease.yaml`" - - name: Dagger engine - role: Shared build engine for self-hosted runners — provisioned, not yet wired live - logo: dagger - url: https://dagger.io - pin: "`tooling/base/dagger-engine/deployment.yaml` — image tag" - name: GitHub Actions Runner Controller role: Reconciles self-hosted GitHub Actions runners — off by default logo: github-actions url: https://github.com/actions/actions-runner-controller pin: "`tooling/base/gha-runners/controller-helmrelease.yaml`" note: Off by default. - - name: GHA runner scale sets - role: Two runner pools — plain Kubernetes jobs, and Docker-in-Docker for Dagger + - name: GHA runner scale set + role: Runner pool for plain Kubernetes jobs logo: github-actions url: https://github.com/actions/actions-runner-controller - pin: "`tooling/base/gha-runners/default-scale-set-helmrelease.yaml`, `dagger-scale-set-helmrelease.yaml`" + pin: "`tooling/base/gha-runners/default-scale-set-helmrelease.yaml`" note: Off by default. - name: Valkey role: Per-tenant cache — kvStore claims for Harbor and this platform's demo apps diff --git a/website/static/images/diagrams/ci-pipeline.svg b/website/static/images/diagrams/ci-pipeline.svg index b7a5fb769..5cbf179e0 100644 --- a/website/static/images/diagrams/ci-pipeline.svg +++ b/website/static/images/diagrams/ci-pipeline.svg @@ -1,3 +1,3 @@ -
What CI gates, and what it never does
What CI gates, and what it never does
CI validates, scans and publishes. It never applies anything to a cluster — Flux does that, from main, after the merge.
CI validates, scans and publishes. It never applies anything to a cluster — Flux does that, from main, after the merge.
Pull request
targeting main
Pull request...
ci.yaml — six jobs, every pull request, no path filter
ci.yaml — six jobs, every pull request, no path filter
Pre-commit checks
Dagger → daggerverse/pre-commit-tf
terraform fmt · validate · tflint
Pre-commit checks...
Security scanning
Trivy · Checkov · TruffleHog
SARIF → GitHub Security tab
Security scanning...
Kubernetes validation
validate-manifests.sh — renders the repo
flux schema validate + polaris audit
Kubernetes validation...
Rendered manifest diff
head vs merge-base, posted as a
PR comment — content never fails it
Rendered manifest diff...
Check the shell scripts
shellcheck -x -S warning
Check the shell scripts...
Check the documentation links
validate-links.sh
Check the documentation links...
Path-filtered workflows — none of them is a required check
Path-filtered workflows — none of them is a required check
Docs site (docs-check.yml)
website/** · docs/architecture/** · mise.toml
hugo --minify + verify-doc-paths.sh
Docs site (docs-check.yml)...
Vector config validation
victoria-logs helmrelease-*.yaml
VRL parsing rules
Vector config validation...
Build container images — container-images/** · on a pull request it builds and scans but does not push
Build container images — container-images/** · on a pull request it builds and scans but does not...
Six required status checks

every job in ci.yaml, and only those

enforce_admins — no --admin bypass,
for anyone

patch + minor deps automerge on green;
majors wait for a human
Six required status checks...
Merge to main
Merge to main
After the merge — three independent consumers of main
After the merge — three independent consumers of main
Flux reconciles the cluster
the GitRepository observes the new commit,
the ArtifactGenerator re-slices it, and every
affected Kustomization applies in dependency order.
No CI job ever runs kubectl apply.
Flux reconciles the cluster...
docs.yml → GitHub Pages
same path filter as docs-check,
builds the site and publishes it
to cnref.ogenki.io
docs.yml → GitHub Pages...
build-container-images → ghcr.io
pushes <branch>-<sha> plus latest.
Deployments pin the immutable
<branch>-<sha> tag, never latest.
build-container-images → ghcr.io...
all six must pass
all six must pass
Legend
Legend
required status check
required status check
security scanning
security scanning
path-filtered, not required
path-filtered, not required
the merge gate
the merge gateText is not SVG - cannot display +
What CI gates, and what it never does
What CI gates, and what it never does
CI validates, scans and publishes. It never applies anything to a cluster — Flux does that, from main, after the merge.
CI validates, scans and publishes. It never applies anything to a cluster — Flux does that, from main, after the merge.
Pull request
targeting main
Pull request...
ci.yaml — six jobs, every pull request, no path filter
ci.yaml — six jobs, every pull request, no path filter
Pre-commit checks
terraform fmt · validate · tflint
Pre-commit checks...
Security scanning
Trivy · Checkov · TruffleHog
SARIF → GitHub Security tab
Security scanning...
Kubernetes validation
validate-manifests.sh — renders the repo
flux schema validate + polaris audit
Kubernetes validation...
Rendered manifest diff
head vs merge-base, posted as a
PR comment — content never fails it
Rendered manifest diff...
Check the shell scripts
shellcheck -x -S warning
Check the shell scripts...
Check the documentation links
validate-links.sh
Check the documentation links...
Path-filtered workflows — none of them is a required check
Path-filtered workflows — none of them is a required check
Docs site (docs-check.yml)
website/** · docs/architecture/** · mise.toml
hugo --minify + verify-doc-paths.sh
Docs site (docs-check.yml)...
Vector config validation
victoria-logs helmrelease-*.yaml
VRL parsing rules
Vector config validation...
Build container images — container-images/** · on a pull request it builds and scans but does not push
Build container images — container-images/** · on a pull request it builds and scans but does not...
Six required status checks

every job in ci.yaml, and only those

enforce_admins — no --admin bypass,
for anyone

patch + minor deps automerge on green;
majors wait for a human
Six required status checks...
Merge to main
Merge to main
After the merge — three independent consumers of main
After the merge — three independent consumers of main
Flux reconciles the cluster
the GitRepository observes the new commit,
the ArtifactGenerator re-slices it, and every
affected Kustomization applies in dependency order.
No CI job ever runs kubectl apply.
Flux reconciles the cluster...
docs.yml → GitHub Pages
same path filter as docs-check,
builds the site and publishes it
to cnref.ogenki.io
docs.yml → GitHub Pages...
build-container-images → ghcr.io
pushes <branch>-<sha> plus latest.
Deployments pin the immutable
<branch>-<sha> tag, never latest.
build-container-images → ghcr.io...
all six must pass
all six must pass
Legend
Legend
required status check
required status check
security scanning
security scanning
path-filtered, not required
path-filtered, not required
the merge gate
the merge gateText is not SVG - cannot display diff --git a/website/static/images/logos/LICENSES.md b/website/static/images/logos/LICENSES.md index caa60f720..91b169bee 100644 --- a/website/static/images/logos/LICENSES.md +++ b/website/static/images/logos/LICENSES.md @@ -27,7 +27,6 @@ permit unmodified use to refer to the project. Path pattern: | File | Source | Terms | |---|---|---| -| `dagger.svg` | `dagger/dagger` — `docs/static/img/favicon.svg` | Apache-2.0 project; brand assets for nominative use | | `go.svg` | `golang/website` — `_content/images/go-logo-blue.svg` | [Go brand guidelines](https://go.dev/brand) — unmodified use permitted | | `grafana.svg` | `grafana/grafana` — `public/img/grafana_icon.svg` | [Grafana Labs trademark policy](https://grafana.com/legal/trademark-policy/) | | `hugo.svg` | `gohugoio/hugoDocs` — `static/images/hugo-logo-wide.svg` | Apache-2.0 project | diff --git a/website/static/images/logos/dagger.svg b/website/static/images/logos/dagger.svg deleted file mode 100644 index 6b3e8f776..000000000 --- a/website/static/images/logos/dagger.svg +++ /dev/null @@ -1 +0,0 @@ - From 942e823d239f2f3386a5805eec7a78e153c336fb Mon Sep 17 00:00:00 2001 From: Smana Date: Mon, 21 Sep 2026 23:05:35 +0200 Subject: [PATCH 2/2] docs: agree on 160 rendered controllers Removing dagger-engine and its runner scale set (3c08b250) dropped the rendered bundle's controller count from 156 to the now-measured 160. AGENTS.md and its scripts/AGENTS.md counterpart still said 156; validation.md already said 160. Point both at the same number. --- AGENTS.md | 2 +- scripts/AGENTS.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index f769e9ec5..240e3470a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -99,7 +99,7 @@ tofu validate && trivy config --exit-code=1 --ignorefile=./.trivyignore.yaml . `validate-manifests.sh` is the single entry point CI runs and the one to cite as evidence. Two properties are load-bearing and easy to break: `skipMissingSchemas: false` means an unknown Kind -**fails** the build rather than being skipped, and Polaris audits the *rendered* bundle (156 +**fails** the build rather than being skipped, and Polaris audits the *rendered* bundle (160 controllers) rather than the source tree (1). `scripts/AGENTS.md` explains what each gate catches and, more usefully, what none of them can. diff --git a/scripts/AGENTS.md b/scripts/AGENTS.md index 6d7a2f208..f6d76550f 100644 --- a/scripts/AGENTS.md +++ b/scripts/AGENTS.md @@ -17,7 +17,7 @@ Two properties are load-bearing: not skipped. The previous kubeconform setup ran with `-ignore-missing-schemas`, so every `cloud.ogenki.io` claim went unvalidated for the life of the repo. - **Polaris audits rendered charts, not raw files.** The repo has 1 raw Deployment; the rendered - bundle has 156 controllers. Pointing a best-practices gate at the source tree checks almost + bundle has 160 controllers. Pointing a best-practices gate at the source tree checks almost nothing. `.schemas/` and `.bundle/` are generated on every run and gitignored — a committed catalog drifts