This website requires JavaScript.
9f52f195a7
test(conformance): lower chainsaw parallelism 4->2 to avoid dev etcd overload cascades
jakman85 and Claude Opus 4.8
2026-08-25 17:21:48 -05:00
63b87ffe46
test(conformance): update DNS tests to Proxmox Gateway VIP 192.168.1.53 (was 10.73.0.24x)
jakman85 and Claude Opus 4.8
2026-08-25 16:52:09 -05:00
28a34c4477
fix(kyverno): raise admission-controller resources + dev replicas 2 to stop fail-closed crashloop/502s
jakman85 and Claude Opus 4.8
2026-08-25 16:43:43 -05:00
1b0848c224
fix(kyverno): correct default-deny-shape to require both Ingress+Egress via deny.conditions (scalar-array pattern was inverted)
jakman85 and Claude Opus 4.8
2026-08-25 16:00:42 -05:00
08113ccfbb
ci(l0): fix kyverno test expectations for CLI 1.13.4; pin kyverno-json 0.0.3
jakman85 and Claude Opus 4.8
2026-08-25 15:57:29 -05:00
bb48f675ee
ci: bake pinned test toolchain into devcontainer + fix conformance layer/spec-immutability seams
jakman85 and Claude Opus 4.8
2026-08-25 15:43:19 -05:00
0d7495486e
devcontainer: wire dev.sh to the Proxmox k3s cluster
jakman85 and Claude Opus 4.8
2026-08-25 14:59:19 -05:00
21669da075
flux: re-enable KubeVirt + CDI (new 16GB Proxmox nodes with nested virt)
jakman85 and Claude Opus 4.8
2026-08-25 13:21:00 -05:00
e6b3a03ff4
flux: re-enable oauth2-proxy now Keycloak is live and split-horizon DNS points at 192.168.1.53
jakman85 and Claude Opus 4.8
2026-08-25 13:17:04 -05:00
604552e51c
flux(dev): set GATEWAY_VIP to Proxmox Gateway VIP 192.168.1.53 (split-horizon DNS)
jakman85 and Claude Opus 4.8
2026-08-25 13:15:16 -05:00
efd6dbeb3b
flux(platform-config): temp-disable orphaned oauth2-proxy refs (missing ns) to unblock reconcile
jakman85 and Claude Opus 4.8
2026-08-25 13:02:08 -05:00
2fea1e261c
flux(platform): temp-disable oauth2-proxy to break cold-start OIDC deadlock (re-enable after platform-config green)
jakman85 and Claude Opus 4.8
2026-08-25 12:48:05 -05:00
c6301a79c5
fix(bootstrap): subshell the repo_root fallback so trailing pwd doesn't corrupt the path
jakman85 and Claude Opus 4.8
2026-08-25 12:27:34 -05:00
fff44992e7
migrate(proxmox): bootstrap source URL -> 192.168.2.103; Cilium k8sServiceHost -> 192.168.1.50
jakman85 and Claude Opus 4.8
2026-08-25 12:22:08 -05:00
0037fb40fa
ansible(cilium): rewrite controller kubeconfig to SSH-tunnel endpoint (kube-API not NAT-forwarded)
jakman85 and Claude Opus 4.8
2026-08-25 12:15:12 -05:00
1004c8eae6
ansible(node_baseline): don't fail on qemu-guest-agent when no virtio channel (agent disabled in tofu); enable-only
jakman85 and Claude Opus 4.8
2026-08-25 12:04:19 -05:00
1ff25318c9
ansible(proxmox): route Ansible via pfSense NAT; decouple k3s node-ip from ansible_host; mount vault-pass into dev container
jakman85 and Claude Opus 4.8
2026-08-25 11:55:37 -05:00
28d200caf2
tofu(proxmox): use debian generic image + serial console to fix first-boot kernel panic (bpg#1639)
jakman85 and Claude Opus 4.8
2026-08-25 11:45:29 -05:00
fca8d8f800
tofu(proxmox): download base image as import content-type for disk import_from
jakman85 and Claude Opus 4.8
2026-08-25 10:59:01 -05:00
a2392a4a43
tofu(proxmox): API-only native cloud-init; move node baseline to Ansible node_baseline role
jakman85 and Claude Opus 4.8
2026-08-25 10:55:48 -05:00
8a8f28bf80
infra(proxmox): bump node disks to 64GB OS + 128GB Longhorn data (per operator)
jakman85
2026-08-25 10:31:39 -05:00
d57c9cbf12
infra(net): repoint ansible inventory + Cilium VIPs to the Proxmox LAN
jakman85 and Claude Opus 4.8
2026-08-25 10:23:37 -05:00
4bb9c8fcbd
infra(tofu): docs + example for the Proxmox migration
jakman85 and Claude Opus 4.8
2026-08-25 10:23:28 -05:00
39123d7806
infra(cloud-init): deliver baseline via bpg user-data snippet; drop netplan/meta-data templates
jakman85 and Claude Opus 4.8
2026-08-25 10:23:21 -05:00
53ca698edc
infra(tofu): migrate node provisioning from libvirt to bpg/proxmox
jakman85 and Claude Opus 4.8
2026-08-25 10:23:13 -05:00
4f28ba6945
Merge chore/free-memory-disable-kubevirt (relieve OOM)
jakman85
2026-08-25 09:29:30 -05:00
971c730400
chore(memory): temp-disable KubeVirt to relieve node memory pressure
jakman85
2026-08-25 09:29:29 -05:00
c16e0889fd
Merge fix/internet-egress-and-tags (world egress per class + image tags)
jakman85
2026-08-25 09:02:06 -05:00
7e8ae472c9
fix(net): renderer emits world/internet egress allow per egress class + fix jackett/plex tags
jakman85
2026-08-25 09:02:05 -05:00
f9e96402c0
chore(arr): scrub unscaffolded R-STATE-04 token from bulk-storage comments (gate hygiene)
jakman85
2026-08-25 08:46:08 -05:00
c8c862908b
Merge feature/onboard-arr: Sonarr + Radarr (VPN + arr->downloader allows)
jakman85
2026-08-25 08:45:56 -05:00
ca1239c2c1
Merge feature/onboard-vpn-downloaders: qBittorrent + Jackett (VPN egress)
jakman85
2026-08-25 08:45:42 -05:00
aea8fca966
Merge chore/longhorn-capacity-plex-size
jakman85
2026-08-25 08:45:12 -05:00
4f74c8a2f0
chore(storage): Longhorn over-provisioning 100->200% + right-size plex config 20->8Gi
jakman85
2026-08-25 08:45:12 -05:00
8392b52ee8
Onboard VPN downloaders (qBittorrent + Jackett) via ServiceDefinition renderer
jakman85 and Claude Opus 4.8
2026-08-25 08:40:48 -05:00
0f12950831
Onboard arr apps (Sonarr + Radarr) via ServiceDefinition renderer
jakman85 and Claude Opus 4.8
2026-08-25 08:32:39 -05:00
87087e06c7
Merge feature/onboard-plex: onboard Plex (media, public; bulk media deferred on OQ-2)
jakman85
2026-08-25 08:29:35 -05:00
d47c8f91cb
Onboard Plex to the k3s platform via ServiceDefinition (WS-APPS)
jakman85 and Claude Opus 4.8
2026-08-25 08:26:22 -05:00
49229c65cf
Merge feature/onboard-gitea: onboard Gitea (git hosting, DR-critical) via renderer
jakman85
2026-08-25 08:24:21 -05:00
b76fb7bea7
feat(apps): onboard Gitea via ServiceDefinition renderer
jakman85 and Claude Opus 4.8
2026-08-25 08:23:33 -05:00
c70f99afd2
Merge docs/vip-bug-was-transient
jakman85
2026-08-25 08:22:21 -05:00
42fc8c7029
docs(pm): the Cilium VIP reachability bug was TRANSIENT - cleared by reboot, no CNI change needed
jakman85
2026-08-25 08:22:21 -05:00
1eb2cb70d0
Merge fix/trusted-tls-prod-verify (R-TLS-01/03 green on LE-prod)
jakman85
2026-08-25 08:21:58 -05:00
5ba3f9d46d
fix(conformance): trusted-tls verifies LE-prod cert via system trust + split-horizon DNS (R-TLS-01/03)
jakman85
2026-08-25 08:21:55 -05:00
90714cb910
Merge docs/cilium-vip-reachability-finding
jakman85
2026-08-25 01:48:48 -05:00
f977bcbee5
docs(pm): root-caused Cilium pod->Gateway-VIP reachability bug (non-announcer nodes) + gateway-ingress/pihole
jakman85
2026-08-25 01:48:46 -05:00
6522204478
Merge fix/gateway-ingress-default-deny: renderer emits gateway-ingress allow for exposed apps (R-NET-01/02/03)
jakman85
2026-08-25 01:01:03 -05:00
c6a480eed1
test(net): L2 conformance — exposed app reachable through Gateway under default-deny (R-NET-03)
jakman85 and Claude Opus 4.8
2026-08-25 00:10:56 -05:00
c13ef69e71
feat(net): renderer emits gateway-ingress allow for exposed services (R-NET-01/02)
jakman85 and Claude Opus 4.8
2026-08-24 23:40:52 -05:00
e022a2aea4
Merge feature/onboard-pihole (first WS-APPS onboarding)
jakman85
2026-08-24 23:27:22 -05:00
e843db2601
feat(apps): onboard pihole via renderer + --no-image-automation flag (WS-APPS golden path)
jakman85
2026-08-24 23:27:22 -05:00
34e4b191f1
Merge docs/session7-certified
jakman85
2026-08-24 23:23:05 -05:00
1cb8282f62
docs(pm): both deliverables certified — Keycloak SSO + KubeVirt P5 all green on KVM
jakman85
2026-08-24 23:23:03 -05:00
c05fd6702a
Merge fix/kubevirt-vm-boot: real-KVM DataVolume VMs (R-PLAT-03/04 green; useEmulation:false, EFI, DataVolume roots)
jakman85
2026-08-24 23:10:14 -05:00
0fd022c7f0
Merge fix/oidc-grafana-probe-busybox (R-IDP-01 probe)
jakman85
2026-08-24 23:10:14 -05:00
a177d62925
fix(conformance): busybox-compatible wget in oidc-sso-grafana probe (R-IDP-01)
jakman85
2026-08-24 23:09:06 -05:00
3a59ef1918
fix(kubevirt): boot VMs via CDI DataVolume + EFI + real KVM (Phase 5)
jakman85 and Claude Opus 4.8
2026-08-24 23:07:10 -05:00
98b7200830
Merge fix/grafana-oidc-rollout (R-IDP-01)
jakman85
2026-08-24 22:57:00 -05:00
bc0982c213
fix(grafana): roll Grafana to load the OIDC client-secret (R-IDP-01)
jakman85
2026-08-24 22:57:00 -05:00
e78025e54a
Merge docs/session7-deploy-log
jakman85
2026-08-24 22:50:23 -05:00
ff59d2bc6d
docs(pm): Session 7 log — Phase 5/6+4 deployed, Keycloak SSO functional (4-gap fix chain)
jakman85
2026-08-24 22:50:22 -05:00
1338b43926
Merge feature/reenable-oauth2proxy-trusted (SSO forward-auth online)
jakman85
2026-08-24 22:47:08 -05:00
4a6e0d3d37
feat: re-enable oauth2-proxy on the LE-prod-trusted wildcard cert (R-IDP-02)
jakman85
2026-08-24 22:47:07 -05:00
d639cfeaba
Merge chore/defer-oauth2proxy-for-cert (break prod-cert deadlock)
jakman85
2026-08-24 22:42:20 -05:00
fc62345f0d
chore: temp-defer oauth2-proxy to break the prod-cert deadlock (re-enable after)
jakman85
2026-08-24 22:42:19 -05:00
ae3a0d7fd7
Merge fix/dev-tls-production (LE prod certs for in-cluster SSO trust)
jakman85
2026-08-24 22:39:47 -05:00
8a7700e49a
fix(tls): switch dev to LE production issuer so in-cluster clients trust the wildcard cert
jakman85 and Claude Opus 4.8
2026-08-24 22:39:47 -05:00
3b97f5f058
Merge fix/split-horizon-dns: in-cluster split-horizon DNS (R-DNS-01/03) — unblocks SSO
jakman85
2026-08-24 22:29:59 -05:00
8b199a6780
test(dns): internal split-horizon resolution conformance (R-DNS-01/R-DNS-03)
jakman85 and Claude Opus 4.8
2026-08-24 22:28:53 -05:00
3a1e0e6887
feat(dns): split-horizon in-cluster DNS via coredns-custom (R-DNS-01/R-DNS-03)
jakman85 and Claude Opus 4.8
2026-08-24 22:28:46 -05:00
bba67d03ce
feat(dns): add GATEWAY_VIP cluster-var for split-horizon target (R-DNS-03)
jakman85 and Claude Opus 4.8
2026-08-24 22:28:37 -05:00
186ff23098
Merge feature/servicedefinition-renderer: ServiceDefinition renderer T-0.3 (R-GITOPS-02) + L1 render tests green
jakman85
2026-08-24 22:23:25 -05:00
a79f24f75e
Add container-workload-render L1 test (R-PLAT-02)
jakman85 and Claude Opus 4.8
2026-08-24 22:22:04 -05:00
4a017c590e
Wire L1 render conformance tests to the renderer (R-NET-01, R-NET-05/06/07)
jakman85 and Claude Opus 4.8
2026-08-24 22:19:08 -05:00
6b2c04ed5c
Add ServiceDefinition renderer (T-0.3, R-GITOPS-02)
jakman85 and Claude Opus 4.8
2026-08-24 22:18:58 -05:00
01bcb99337
Merge feature/phase4-image-automation: Phase 4 hands-off updates (R-UPD-01/02/03)
jakman85
2026-08-24 22:17:44 -05:00
0fb4ef2baf
Merge fix/oauth2-proxy-cookie-secret (32-byte cookie)
jakman85
2026-08-24 22:17:20 -05:00
951973b74d
fix(oauth2-proxy): cookie-secret must be 32 raw bytes (hex16), not base64-44
jakman85 and Claude Opus 4.8
2026-08-24 22:17:20 -05:00
cbe5fab040
test(updates): complete hands-off-update L3 conformance (R-UPD-01/02/03)
jakman85 and Claude Opus 4.8
2026-08-24 22:15:03 -05:00
bfec9d869e
feat(updates): alert on failed / rolled-back updates (R-UPD-02 + R-OBS)
jakman85 and Claude Opus 4.8
2026-08-24 22:14:54 -05:00
f538f8ff38
feat(updates): per-service update-policy render contract + Renovate config (R-UPD-01/R-UPD-03)
jakman85 and Claude Opus 4.8
2026-08-24 22:14:48 -05:00
37f4fa6767
feat(updates): install Flux image controllers + cluster-wide write-back engine (R-UPD-02)
jakman85 and Claude Opus 4.8
2026-08-24 22:14:39 -05:00
392f458d94
Merge feature/keycloak-sso-secrets (complete Phase 6 SSO: client secrets + oauth2-proxy)
jakman85
2026-08-24 22:08:06 -05:00
ed6a772599
feat(keycloak): provision SSO client secrets + re-enable oauth2-proxy (R-IDP-01/02/04)
jakman85 and Claude Opus 4.8
2026-08-24 22:08:04 -05:00
f49b8c2e02
Merge chore/defer-oauth2proxy-pending-secret (unwedge platform for KubeVirt certification)
jakman85
2026-08-24 21:43:24 -05:00
ef5b7bd57b
chore(phase6): temp-defer oauth2-proxy until its SOPS secret is provisioned
jakman85 and Claude Opus 4.8
2026-08-24 21:43:12 -05:00
fb9ff9e783
Merge docs/pm-phase5-6-integration (PM log: Phase 5/6 integration + deploy blocker)
jakman85
2026-08-24 21:18:03 -05:00
1868a47701
docs(pm): log Phase 5 (KubeVirt) + Phase 6 (Keycloak) integration + deploy blocker
jakman85 and Claude Opus 4.8
2026-08-24 21:17:58 -05:00
b95b540468
Merge feature/keycloak-auth-stack: Phase 6 Keycloak IdP + oauth2-proxy + CNPG (R-IDP-01..06, R-OBS)
jakman85
2026-08-24 21:15:46 -05:00
cb4fdf4a55
keycloak: README — operator+CNPG design, runbook, hand-offs
jakman85
2026-08-24 21:10:39 -05:00
4bebd4b6d2
keycloak: coverage tests + dashboard + reword cross-cutting tags
jakman85
2026-08-24 21:07:27 -05:00
4ba4337c67
Merge feature/kubevirt-iaas: Phase 5 KubeVirt+CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01, R-OBS)
jakman85
2026-08-24 21:02:37 -05:00
9da209c71e
Merge branch 'main' into feature/kubevirt-iaas
jakman85
2026-08-24 21:01:29 -05:00
0cb25c12e3
Merge branch 'main' into feature/keycloak-auth-stack
jakman85
2026-08-24 20:59:51 -05:00
cd4c44874f
Merge chore/harness-baseline-spec-pin-gap-exemptions (green baseline for Phase 5/6)
jakman85
2026-08-24 20:57:38 -05:00
f5f52b0b8c
chore(harness): adopt spec pin b633b7f + exempt R-ENV-02/R-GITOPS-01 coverage gaps
jakman85 and Claude Opus 4.8
2026-08-24 20:57:26 -05:00
ce83c6af3b
WIP keycloak stack (gate probe)
jakman85
2026-08-24 19:52:25 -05:00
dbffb8fab8
Phase 5: KubeVirt + CDI IaaS proof (R-PLAT-03/04, R-STATE-01, R-NET-01)
jakman85 and Claude Opus 4.8
2026-08-24 19:43:56 -05:00
254d50a20c
docs: pia-* cluster secrets retired + host vault committed (Phase 3 cleanup complete)
jakman85 and Claude Opus 4.8
2026-08-24 15:04:31 -05:00
509a421d01
Merge chore/retire-pia-cluster-secrets (ADR-0015 cleanup)
jakman85
2026-08-24 15:03:22 -05:00
jakman85andClaude Opus 4.8