chore(deps): Update Helm release kube-prometheus-stack to v93

2026-11-09 08:22:27 +00:00
8 changed files with 12 additions and 75 deletions
@@ -120,14 +120,6 @@ requirements:
    doc: docs/09-dns-and-ingress.md
    safety_critical: false
    summary: "Internal clients resolve to the internal Gateway (split-horizon)."
-  - id: R-DNS-04
-    doc: docs/09-dns-and-ingress.md
-    safety_critical: false
-    summary: "Public HTTP(S) reachable with no inbound 80/443 forward; LAN works whichever resolver answers."
-  - id: R-DNS-05
-    doc: docs/09-dns-and-ingress.md
-    safety_critical: false
-    summary: "Only declared-public names reachable through public ingress; LAN/VPN-only names are refused."

  # --- Automated updates ---
  - id: R-UPD-01
@@ -137,7 +129,7 @@ requirements:
  - id: R-UPD-02
    doc: docs/11-automated-updates.md
    safety_critical: true
-    summary: "Allowed-class updates need no human/AI/hand-authored change; bad update auto-rolls-back."
+    summary: "Updates need no human/AI/hand-authored change; bad update auto-rolls-back."
  - id: R-UPD-03
    doc: docs/11-automated-updates.md
    safety_critical: false
@@ -183,15 +175,15 @@ requirements:
  - id: R-ENV-01
    doc: docs/02-environments-and-provisioning.md
    safety_critical: false
-    summary: "Nodes baselined, cluster-joined and managed as code; bare-metal imaging is checklist-driven."
+    summary: "dev/test provisioned as local KVMs via IaC (create/baseline/rebuild)."
  - id: R-ENV-02
    doc: docs/02-environments-and-provisioning.md
    safety_critical: false
-    summary: "GitOps config authored once as base plus overlay; a future environment needs overrides only."
+    summary: "Same GitOps config promotes dev/test -> prod (authored once)."
  - id: R-ENV-03
    doc: docs/02-environments-and-provisioning.md
    safety_critical: false
-    summary: "Production is 3x mini-PC bare metal; changes reach it only through the PR gate and Flux."
+    summary: "prod is 3x mini-PC bare-metal k3s with local storage."

  # --- GitOps & delivery ---
  - id: R-GITOPS-01
@@ -220,10 +212,6 @@ requirements:
    doc: docs/07-security-and-secrets.md
    safety_critical: false
    summary: "All security properties demonstrable/auditable."
-  - id: R-SEC-04
-    doc: docs/07-security-and-secrets.md
-    safety_critical: false
-    summary: "Kubernetes API not reachable from the public internet by any path; LAN/VPN-only."

  # --- Identity & access ---
  - id: R-IDP-01
@@ -22,11 +22,8 @@ metadata:
  labels:
    conformance.home.k3s/R-NET-01: "true"
    conformance.home.k3s/R-NET-02: "true"
-    conformance.home.k3s/R-DNS-04: "true"
-    conformance.home.k3s/R-DNS-05: "true"
-    conformance.home.k3s/R-SEC-04: "true"
  annotations:
-    conformance.home.k3s/requirements: "R-NET-01, R-NET-02, R-DNS-04, R-DNS-05, R-SEC-04"
+    conformance.home.k3s/requirements: "R-NET-01, R-NET-02"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "true"
@@ -105,9 +105,8 @@ metadata:
  labels:
    conformance.home.k3s/R-DNS-02: "true"
    conformance.home.k3s/R-DNS-03: "true"
-    conformance.home.k3s/R-DNS-05: "true"
  annotations:
-    conformance.home.k3s/requirements: "R-DNS-02, R-DNS-03, R-DNS-05"
+    conformance.home.k3s/requirements: "R-DNS-02, R-DNS-03"
    conformance.home.k3s/layer: "L0"
    # WHOLE-REPO SCOPE — this invariant quantifies over every ServiceDefinition in catalog/, every
    # HTTPRoute in apps/wave-* and platform/* and runbooks/, and every external-dns-annotated
@@ -20,9 +20,8 @@ metadata:
  name: pihole-lan-names
  labels:
    conformance.home.k3s/R-DNS-03: "true"
-    conformance.home.k3s/R-DNS-04: "true"
  annotations:
-    conformance.home.k3s/requirements: "R-DNS-03, R-DNS-04"
+    conformance.home.k3s/requirements: "R-DNS-03"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "true"
@@ -1,46 +0,0 @@
---
-date: 2026-11-08
-branch: chore/adopt-spec-sync
-title: Adopt the spec sync (registry parity, ADR cross-references, spec pin)
---
-
-## What changed
-
-The operator ruled this repo's `main` (`50c8719`) the accepted state and had the System Architect
-bring the spec repo in line with it (spec PR `jakman85/home-network-k3s#2`). This is the
-implementation half of that sync.
-
- `conformance/requirements/registry.yaml`: added R-DNS-04, R-DNS-05 and R-SEC-04, which the spec
-  defined and this mirror lacked. Reworded the R-ENV-01/02/03 and R-UPD-02 summaries to match the
-  amended requirements.
- Tagged existing L0 tests against those IDs, because a registry entry with no tagged test blocks
-  the merge: `cloudflared-ingress-rules` (R-DNS-04, R-DNS-05, R-SEC-04), `pihole-lan-names`
-  (R-DNS-04), and `internal-services-publish-no-public-dns` (R-DNS-05).
- `platform/vpn-egress/README.md` and a comment in `egress-steering.yaml` pointed at a drafted
-  "ADR-0016 supersede". That number went to the Cloudflare Tunnel; the accepted ADR is ADR-0020.
- `ci/SPEC_PIN` must move to the spec merge commit. That SHA does not exist until the spec PR
-  merges, so this PR carries a `WIP:` title until the bump is added.
-
-## What I verified
-
- Read each tagged test's assertions before tagging it. `cloudflared-ingress-rules` asserts every
-  LAN-only hostname maps to a 404, the catch-all exists, no rule targets the API, and the egress
-  policy admits no API or host entity. `pihole-lan-names` asserts LAN names resolve independently
-  of the public path. `internal-services-publish-no-public-dns` asserts internal routes carry the
-  disown annotation and pins the declared L4 set.
- The toolbox gate result for this commit is quoted in the PR description, with the spec branch
-  mounted so that the checks parsing spec text ran against the new spec.
-
-## What I did NOT verify
-
- **These tags are static coverage, not proof.** No L2 test touches the tunnel, and nothing here
-  shows router 80/443 closed or 6443 unforwarded (spec `docs/16-known-gaps.md`).
- R-SEC-04 is registered `safety_critical: false`. Making it `true` needs an L3 fault-injection
-  test that does not exist. UNVERIFIED whether the operator wants that.
- No live cluster, tunnel or DNS state was measured.
- `spec-immutability` did not run against a pinned checkout: the pin is not bumped yet.
- Stale implementation prose found by the audit was deliberately left out of this PR, because the
-  operator ruled this repo the accepted state and none of it changes behaviour. Examples:
-  `catalog/gitea.yaml` still says "+ mirrored"; `platform/longhorn` still promises a backup target;
-  `README.md` says `node-loss` is outstanding; `hands-off-update` exercises Flux image policy rather
-  than Renovate; `dev-nodes-provisioned-as-code` is named for an environment that no longer exists.
@@ -24,7 +24,7 @@ spec:
  chart:
    spec:
      chart: kube-prometheus-stack
-      version: ">=88.0.0 <89.0.0"   # k8s-1.36 catch-up (po v0.93; CRDs pre-applied server-side, Helm won't update them). Renovate maintains
+      version: ">=93.1.0 <94.0.0"   # k8s-1.36 catch-up (po v0.93; CRDs pre-applied server-side, Helm won't update them). Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
@@ -217,9 +217,9 @@ Consequences, stated plainly:

 **Governance:** ADR-0015 and `docs/03` are specifications and are immutable to agents
 (spec `AGENTS.md` §11, R-TEST-06, enforced by `ci/spec-immutability.sh`) — they are **not** edited
-here. The correction, first escalated in `DECISIONS-LOG.md` (entry of 2026-09-06), is recorded in
-spec **ADR-0020**, which supersedes ADR-0015's Kill-switch and Resilience bullets. This file and
-`egress-steering.yaml` state what the implementation does.
+here. The correction is raised as an **escalation with a drafted ADR-0016 supersede** in
+`DECISIONS-LOG.md` (entry of 2026-09-06) for the operator/architect to accept. Until then this file
+and `egress-steering.yaml` are the accurate statement of what the implementation can actually do.

 ## Secrets — host-side now
 PIA credentials + the `.ovpn` live **on the gateway node via Ansible vault** (see spec `docs/07`), **not**
@@ -109,7 +109,7 @@ spec:
  # that shard and re-shards the rest (breaking live connections), and each shard exits from a
  # DIFFERENT public IP. Upstream: cilium/cilium#30157, cilium/cilium#18230.
  # ADR-0015's "Resilience: two egress-gateway nodes + Cilium Egress Gateway HA (gateway failover)"
-  # is therefore NOT IMPLEMENTABLE on Cilium OSS — superseded by spec ADR-0020; see
+  # is therefore NOT IMPLEMENTABLE on Cilium OSS — escalated for an ADR-0016 supersede; see
  # platform/vpn-egress/README.md and the DECISIONS-LOG entry of 2026-09-06.
  #
  # `interface: tun0` IS RESOLVED ONCE — the gateway node has to tell Cilium when tun0 changes.