fix(ci): convert dind to a native sidecar; delete both wait loops #7

2026-09-29T06:56:37Z

gitea-admin commented

2026-09-29 06:56:37 +00:00

Executes the FOLLOW-UP carried in this manifest since the readiness fix, now that k3s is
v1.36 and sidecar containers are GA.

dind moves into initContainers as the first entry with restartPolicy: Always — the
one field that makes an initContainer a sidecar: starts before the regular containers, runs
alongside them, terminated after them. kubelet now enforces the ordering the runner used to
hand-roll, so the runner drops its command: override and runs the image's own entrypoint.

The startupProbe execs a full TLS-verified docker … info, not a tcpSocket probe. A
tcpSocket probe would re-open the exact gap the old Stage 1 existed to close: dockerd writes
the certs and only then starts listening, so the port can accept a connection while the
certs are absent — and act_runner hard-exits on a missing /certs/client/ca.pem.
periodSeconds: 1 × failureThreshold: 60 preserves the previous 60s cap.

It also removes the one-per-start dockerd line http: TLS handshake error from 127.0.0.1: EOF
— that was the old nc -z probe opening a connection and closing it without a TLS handshake.
An error we generated ourselves and then read back in the logs.

Secondary win: deleting the shell deletes an envsubst hazard. apps-wave-1 runs postBuild
substitution over this entire manifest, comments included, and those loops depended on bare
dollar-names surviving untouched — a braced or double-dollar spelling would have silently
unbounded the waits or failed the whole Kustomization. The only dollar left is the intended
${BASE_DOMAIN}.

⚠️ Merge this ALONE, and before enabling the required status check

This Deployment is the merge gate for the entire repository. If the conversion is wrong,
nothing can merge — including the revert. Merge it, then watch a real workflow run green on
the converted pod, and only then turn on enable_status_check.

Gate: PASS, rc 0, 73s.

Co-Authored-By: Claude Opus 5 (1M context) [email protected]

🤖 Generated with Claude Code

Executes the FOLLOW-UP carried in this manifest since the readiness fix, now that k3s is v1.36 and sidecar containers are GA. `dind` moves into `initContainers` as the first entry with **`restartPolicy: Always`** — the one field that makes an initContainer a sidecar: starts before the regular containers, runs alongside them, terminated after them. kubelet now enforces the ordering the runner used to hand-roll, so **the runner drops its `command:` override** and runs the image's own entrypoint. **The startupProbe execs a full TLS-verified `docker … info`, not a `tcpSocket` probe.** A tcpSocket probe would re-open the exact gap the old Stage 1 existed to close: dockerd writes the certs and only *then* starts listening, so the port can accept a connection while the certs are absent — and act_runner hard-exits on a missing `/certs/client/ca.pem`. `periodSeconds: 1 × failureThreshold: 60` preserves the previous 60s cap. It also removes the one-per-start dockerd line `http: TLS handshake error from 127.0.0.1: EOF` — that was the old `nc -z` probe opening a connection and closing it without a TLS handshake. An error we generated ourselves and then read back in the logs. **Secondary win:** deleting the shell deletes an envsubst hazard. apps-wave-1 runs postBuild substitution over this entire manifest, comments included, and those loops depended on bare dollar-names surviving untouched — a braced or double-dollar spelling would have silently unbounded the waits or failed the whole Kustomization. The only dollar left is the intended `${BASE_DOMAIN}`. ### ⚠️ Merge this ALONE, and before enabling the required status check This Deployment **is the merge gate for the entire repository.** If the conversion is wrong, nothing can merge — including the revert. Merge it, then watch a real workflow run green on the converted pod, and only then turn on `enable_status_check`. Gate: **PASS, rc 0, 73s**. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-09-29 06:56:37 +00:00

fix(ci): convert dind to a native sidecar; delete both hand-rolled wait loops

gate / gate (push) Successful in 1m34s

Details

gate / gate (pull_request) Successful in 1m35s

Details

gate / conformance (push) Has been skipped

Details

gate / conformance (pull_request) Has been skipped

Details

e7508931ca

Executes the FOLLOW-UP that has been carried in this manifest since the readiness fix,
now that k3s is v1.36 and sidecar containers are GA.

dind moves into initContainers as the first entry with restartPolicy: Always -- the one
field that makes an initContainer a sidecar: it starts before the regular containers,
runs alongside them, and is terminated after them. kubelet therefore enforces the
ordering that the runner used to hand-roll, so the runner drops its command: override
and runs the image's own entrypoint.

The startupProbe execs a full TLS-verified `docker ... info`, NOT a tcpSocket probe. A
tcpSocket probe would re-open the exact gap the old Stage 1 existed to close: dockerd
writes the TLS certs and only THEN starts listening, so the port can accept a connection
while the certs are absent, and act_runner hard-exits on a missing
/certs/client/ca.pem. `docker info` proves both that the certs are usable and that the
daemon answers. periodSeconds 1 x failureThreshold 60 preserves the previous 60s cap.

It also removes the one-per-start dockerd log line
  http: TLS handshake error from 127.0.0.1: EOF
which was the old `nc -z` probe opening a TCP connection and closing it without a TLS
handshake -- an error we were generating ourselves and then reading in the logs.

SECONDARY WIN: deleting the shell deletes an envsubst hazard. apps-wave-1 runs postBuild
substitution over this ENTIRE manifest, comments included, and those loops depended on
bare dollar-names passing through untouched -- a braced or double-dollar spelling would
have silently unbounded the waits or failed the whole Kustomization. The only dollar left
in the file is the intended ${BASE_DOMAIN}.

LANDS ALONE, DELIBERATELY. This Deployment is the merge gate for the entire repository:
if the conversion is wrong, nothing can merge. Merge this BEFORE enabling the required
status check, and watch a real workflow run green on the converted pod before doing so --
otherwise a bad conversion locks the repo with no way to revert through the gate.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

jakman85 merged commit 00efd4b828 into main

2026-09-29 07:22:50 +00:00

jakman85 referenced this issue from a commit

2026-09-29 07:22:51 +00:00

Merge pull request 'fix(ci): convert dind to a native sidecar; delete both wait loops' (#7) from fix/dind-native-sidecar into main

gitea-admin referenced this issue from a commit

2026-09-29 07:30:14 +00:00

docs(ci): close out the hardening -- land the scripts, correct a claim that shipped wrong

gitea-admin referenced this pull request

2026-09-29 07:30:30 +00:00

docs(ci): close out the hardening; correct a claim that shipped wrong #9

Sign in to join this conversation.