chore(tooling): remove the Dagger engine and its runner scale set

.polaris.yaml

@@ -111,27 +111,6 @@ exemptions:
       - hostPIDSet
       - privilegeEscalationAllowed
 
-  # Container build engine (BuildKit). Building OCI images requires creating
-  # mount/user namespaces and running nested containers, hence a privileged
-  # container with dangerous capabilities.
-  - controllerNames:
-      - dagger-engine
-    rules:
-      - privilegeEscalationAllowed
-      - runAsPrivileged
-      - dangerousCapabilities
-
-  # GitHub Actions runner in docker-in-docker mode. The `dind` sidecar is
-  # hardcoded privileged by the upstream chart (gha-runner-scale-set
-  # _helpers.tpl "dind-container" — not overridable from values), and the runner
-  # executes arbitrary workflow code that legitimately escalates (sudo, apt).
-  # NOTE: tagNotSpecified is NOT exempted — the runner image is pinned below.
-  - controllerNames:
-      - dagger-gha-runner-scale-set
-    rules:
-      - privilegeEscalationAllowed
-      - runAsPrivileged
-
   # GitHub Actions runner (kubernetes mode). Executes arbitrary workflow code
   # that legitimately escalates privileges (sudo/apt in workflow steps).
   # NOTE: tagNotSpecified is NOT exempted — the runner image is pinned below.

AGENTS.md

@@ -99,7 +99,7 @@ tofu validate && trivy config --exit-code=1 --ignorefile=./.trivyignore.yaml .
 
 `validate-manifests.sh` is the single entry point CI runs and the one to cite as evidence. Two
 properties are load-bearing and easy to break: `skipMissingSchemas: false` means an unknown Kind
-**fails** the build rather than being skipped, and Polaris audits the *rendered* bundle (156
+**fails** the build rather than being skipped, and Polaris audits the *rendered* bundle (160
 controllers) rather than the source tree (1). `scripts/AGENTS.md` explains what each gate catches
 and, more usefully, what none of them can.
 

docs/architecture/ci-pipeline.drawio

@@ -20,7 +20,7 @@
         <mxCell id="cbox" value="&lt;b&gt;ci.yaml&lt;/b&gt; — six jobs, every pull request, no path filter" style="rounded=1;absoluteArcSize=1;arcSize=16;shadow=1;verticalAlign=top;whiteSpace=wrap;html=1;fillColor=#FFFFFF;strokeColor=#6366F1;strokeWidth=1.5;fontColor=#1E293B;fontFamily=Helvetica;fontSize=13;fontStyle=1;spacingTop=6;" vertex="1" parent="1">
           <mxGeometry x="290" y="110" width="570" height="300" as="geometry" />
         </mxCell>
-        <mxCell id="j1" value="&lt;b&gt;Pre-commit checks&lt;/b&gt;&#xa;Dagger → daggerverse/pre-commit-tf&#xa;terraform fmt · validate · tflint" style="rounded=1;absoluteArcSize=1;arcSize=10;shadow=1;whiteSpace=wrap;html=1;fillColor=#EEF2FF;strokeColor=#6366F1;strokeWidth=1.5;fontColor=#1E293B;fontFamily=Helvetica;fontSize=11;" vertex="1" parent="1">
+        <mxCell id="j1" value="&lt;b&gt;Pre-commit checks&lt;/b&gt;&#xa;terraform fmt · validate · tflint" style="rounded=1;absoluteArcSize=1;arcSize=10;shadow=1;whiteSpace=wrap;html=1;fillColor=#EEF2FF;strokeColor=#6366F1;strokeWidth=1.5;fontColor=#1E293B;fontFamily=Helvetica;fontSize=11;" vertex="1" parent="1">
           <mxGeometry x="310" y="150" width="260" height="74" as="geometry" />
         </mxCell>
         <mxCell id="j2" value="&lt;b&gt;Security scanning&lt;/b&gt;&#xa;Trivy · Checkov · TruffleHog&#xa;SARIF → GitHub Security tab" style="rounded=1;absoluteArcSize=1;arcSize=10;shadow=1;whiteSpace=wrap;html=1;fillColor=#EDE9FE;strokeColor=#7C3AED;strokeWidth=1.5;fontColor=#1E293B;fontFamily=Helvetica;fontSize=11;" vertex="1" parent="1">

scripts/AGENTS.md

@@ -17,7 +17,7 @@ Two properties are load-bearing:
   not skipped. The previous kubeconform setup ran with `-ignore-missing-schemas`, so every
   `cloud.ogenki.io` claim went unvalidated for the life of the repo.
 - **Polaris audits rendered charts, not raw files.** The repo has 1 raw Deployment; the rendered
-  bundle has 156 controllers. Pointing a best-practices gate at the source tree checks almost
+  bundle has 160 controllers. Pointing a best-practices gate at the source tree checks almost
   nothing.
 
 `.schemas/` and `.bundle/` are generated on every run and gitignored — a committed catalog drifts

scripts/flux-schema/render-bundle.py

@@ -187,12 +187,6 @@ def _repo_lock(url):
             "namespace": "tooling",
         }
     },
-    ("tooling", "dagger-gha-runner-scale-set"): {
-        "controllerServiceAccount": {
-            "name": "gha-runner-scale-set-controller-gha-rs-controller",
-            "namespace": "tooling",
-        }
-    },
 }
 
 
@@ -351,9 +345,9 @@ def normalize_quantities(node):
 
     The Kubernetes API server's resource.Quantity.UnmarshalJSON accepts a bare
     JSON number (`cpu: 1`) exactly like a string (`cpu: "1"`) - upstream chart
-    defaults (KEDA, Harbor's bundled Trivy subchart) and this repo's own
-    dagger-engine overlay rely on that leniency, and these workloads run in
-    the live cluster today with these exact values. flux-schema's generated
+    defaults (KEDA, Harbor's bundled Trivy subchart) rely on that leniency,
+    and these workloads run in the live cluster today with these exact
+    values. flux-schema's generated
     JSON-Schema catalog types Quantity as `string` only, stricter than the
     API server actually is, so a numeric value here is a validator false
     positive, not a real defect. Narrowly scoped to resources.limits/requests

tooling/aws-0/kustomization.yaml

@@ -11,5 +11,4 @@ resources:
   # when the LLM stack is enabled). Wired via
   # clusters/aws-0-llm-platform/tooling-promptfoo.yaml.
   # Enabling only when needed for cost reasons
-  # - ../base/dagger-engine
   # - ../base/gha-runners

tooling/base/gha-runners/kustomization.yaml

@@ -4,7 +4,6 @@ namespace: tooling
 
 resources:
   - controller-helmrelease.yaml
-  - dagger-scale-set-helmrelease.yaml
   - default-scale-set-helmrelease.yaml
   - externalsecret.yaml
   - network-policy.yaml

tooling/base/gha-runners/network-policy.yaml

@@ -10,7 +10,6 @@ spec:
         operator: In
         values:
           - default-gha-runner-scale-set
-          - dagger-gha-runner-scale-set
   egress:
     - toEndpoints:
         - matchLabels:
@@ -22,13 +21,6 @@ spec:
               protocol: UDP
             - port: "53"
               protocol: TCP
-    - toEndpoints:
-        - matchLabels:
-            k8s:app.kubernetes.io/name: dagger-engine
-      toPorts:
-        - ports:
-            - port: "8080"
-              protocol: TCP
     - toEntities:
         - world
       toPorts:

website/content/docs/platform/gitops/validation.md

@@ -64,9 +64,9 @@ what a passing run means here, not incidental detail.
 **Polaris audits the rendered bundle, not the source tree.** Re-verified on
 this branch by rendering the repository and counting both sides directly:
 the tree has **one** raw `Deployment` manifest
-(`tooling/base/dagger-engine/deployment.yaml`); the rendered bundle has
-**156 controllers** — 109 `Deployment`, 25 `Job`, 10 `StatefulSet`, 8
-`DaemonSet`, 4 `CronJob` — everything else arrives as a `HelmRelease` and
+(`tooling/gcp-0/headlamp/token-exchange.yaml`); the rendered bundle has
+**160 controllers** — 110 `Deployment`, 25 `Job`, 10 `StatefulSet`, 8
+`DaemonSet`, 7 `CronJob` — everything else arrives as a `HelmRelease` and
 only becomes a controller after `helm template` runs. A best-practices audit
 pointed at the source tree would check one workload; pointed at the
 rendered bundle, it checks what's actually scheduled.

website/content/docs/reference/ci-workflows.md

@@ -245,5 +245,4 @@ Runner scale sets run in-cluster (`tooling/base/gha-runners/`) and are **off
 by default** — commented out of `tooling/aws-0/kustomization.yaml`.
 When enabled they give private-endpoint access, lower latency, no egress
 charges for heavy builds, and secrets via External Secrets rather than
-long-lived tokens in a workflow. A second scale set is dedicated to Dagger
-builds and shares the in-cluster `dagger-engine`.
+long-lived tokens in a workflow.

website/content/docs/reference/further-reading.md

@@ -20,7 +20,6 @@ personal blog — a separate property from this site.
 - [Tailscale: Simplifying Cloud Access](https://blog.ogenki.io/post/tailscale/) — using Tailscale as a zero-trust VPN for private access to cluster services, instead of bastion hosts.
 - [VictoriaMetrics and Grafana Operators](https://blog.ogenki.io/post/series/observability/metrics) — standing up the metrics stack with the VictoriaMetrics and Grafana operators.
 - [Effective Alerting with VictoriaMetrics](https://blog.ogenki.io/post/series/observability/alerts/) — designing alert rules and routing on top of VictoriaMetrics.
-- [Dagger: The Missing Piece of Developer Experience](https://blog.ogenki.io/post/dagger-intro/) — running the same CI pipeline locally and in GitHub Actions with Dagger.
 
 ## Upstream documentation