From 22174186ff240f74bddcb23c5acc37a5c052882e Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Tue, 1 Sep 2026 18:39:20 -0500 Subject: [PATCH] =?UTF-8?q?chore(flux):=20restore=20platform=20prune:true?= =?UTF-8?q?=20=E2=80=94=20MERGE=202=20of=202=20(Cilium=20split=20cleanup)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the transition opened in merge 1 (63f98aa). `prune: true` is restored on the `platform` Kustomization now that the ownership transfer is VERIFIED on the live cluster, not merely expected: 13/13 Kustomizations Ready, `cilium` among them, at main@sha1:23aa2854 Namespace/kube-system label kustomize.toolkit.fluxcd.io/name = cilium HelmRelease/cilium label ... = cilium HelmRepository/cilium label ... = cilium platform inventory: 0 entries matching kube-system__Namespace | kube-system_cilium_* cilium inventory: exactly those three objects Cilium pods UNCHANGED from the pre-merge baseline — cilium-2f8h8 r=0 2026-09-01T05:55:27Z cilium-425m8 r=1 2026-08-30T13:25:10Z cilium-54cww r=0 2026-09-01T05:55:26Z HelmRelease still v11 So the relabel deterministically preceded any prune, exactly as the revision-gated dependsOn edge predicted, and the ownership move cost zero pod restarts. The in-file comment now records the lesson rather than the temporary state: before moving ANY platform/* component in future, check whether it is the sole declarer of a shared Namespace. platform/cilium/namespace.yaml was the only declaration of Namespace/kube-system under ./platform, which would have turned a component-scoped prune into `delete namespace kube-system` — taking coredns, metrics-server, local-path and Cilium. L0 substitution gate: 103 assertions, 0 hazards. Serves: R-PLAT-01, R-GITOPS-01. Co-Authored-By: Claude Opus 5 (1M context) --- clusters/base/platform.yaml | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/clusters/base/platform.yaml b/clusters/base/platform.yaml index 394f0cd..f921649 100644 --- a/clusters/base/platform.yaml +++ b/clusters/base/platform.yaml @@ -11,27 +11,18 @@ spec: interval: 10m retryInterval: 2m timeout: 5m - # ======================= TEMPORARY — prune:false TRANSITION STATE ======================= - # RESTORE TO `prune: true` IN THE VERY NEXT MERGE. This is step 1 of the documented Flux - # procedure for MOVING RESOURCES BETWEEN KUSTOMIZATIONS (fluxcd.io/flux/faq: "set spec.prune to - # false, sync, move the manifests, then re-enable pruning"), used here to move ./platform/cilium - # out of this tier and into its own `cilium` Kustomization (clusters/base/cilium.yaml). + # Cilium was moved OUT of this tier into its own Kustomization (clusters/base/cilium.yaml) + # on 2026-09-01. `prune: true` is restored here now that the ownership transfer is VERIFIED + # live: Namespace/kube-system, the Cilium HelmRelease and the HelmRepository all carry + # `kustomize.toolkit.fluxcd.io/name=cilium`, this Kustomization's inventory no longer lists + # any of the three, and the `cilium` Kustomization's inventory holds exactly those three. # - # WHY IT IS NOT OPTIONAL: `platform/cilium/namespace.yaml` is the ONLY declaration of - # Namespace/kube-system anywhere under ./platform, and the live object carries - # `kustomize.toolkit.fluxcd.io/name=platform`. The moment ./platform/cilium leaves this - # Kustomization's rendered path, Namespace/kube-system + the Cilium HelmRepository/HelmRelease - # become STALE in this Kustomization's inventory. With prune:true that is not "uninstall the - # CNI" — it is `kubectl delete namespace kube-system`, which takes the whole cluster. - # - # A SECOND, INDEPENDENT PROTECTION IS ALSO IN PLACE (belt and braces, deliberately): - # kustomize-controller's pruner passes `Inclusions: GetOwnerLabels(platform, flux-system)`, so it - # only deletes objects whose LIVE labels still say they belong to `platform`. The new `cilium` - # Kustomization relabels all three objects to `name=cilium` when it applies them, and the - # `dependsOn: [cilium]` edge below is REVISION-gated — `platform` cannot reconcile revision N - # until `cilium` has APPLIED revision N. So the relabel provably precedes the prune. Neither - # mechanism is trusted alone for an object of this blast radius. - prune: false # <-- TEMPORARY; see block above. Normal value: true (R-GITOPS-03) + # LESSON WORTH KEEPING: `platform/cilium/namespace.yaml` was the ONLY declaration of + # Namespace/kube-system under ./platform. Moving that path out of a prune:true Kustomization + # made the stale set `delete namespace kube-system` — coredns, metrics-server, local-path AND + # Cilium. Before moving ANY platform/* component in future, check whether it is the sole + # declarer of a shared Namespace; that turns a component-scoped prune into a cluster-scoped one. + prune: true wait: true # block `apps` until platform is healthy # ORDERING FIX (2026-09-01 incident: a substitution race that failed OPEN broke Cilium). #