jakman85andClaude Opus 4.8
cbc2301b30
Text-only cleanup after the upgrade campaign. Updates stale version strings, prose, and comments to the verified current facts; no Kubernetes behavior or version pins changed except the kubectl toolchain bump (below). Verified facts applied: k3s v1.36.4+k3s1, Debian 13 trixie, Cilium 1.20.1 / Gateway API v1.6.1, Longhorn 1.12.1, node RAM 24 GiB, dedicated virtio2 SSD etcd disk per node, Velero chart 12.x / v1.18, Grafana 13.2.0. - Version strings across infra/ and platform/ READMEs + comments - kubectl toolchain 1.31.4 -> 1.36.4 (devcontainer/ci/conformance versions.env; 1.31 vs a 1.36 cluster exceeded the +-1 skew) - Retired-single-apps-Kustomization refs -> apps-wave-0/1/2 + apps-vms with per-wave SOPS decryption (flux/clusters docs + bootstrap.sh) - COMPLETED/historical banners on the three executed plan docs - Resolved TODO(WS-SEC) markers -> Renovate-maintained ranges - Appended dated DECISIONS-LOG entry (2026-08-30) superseding the 2026-08-26 LIVE STATE line Left as revalidation items (not blind-edited): external-snapshotter v8.2.0 vs 1.36, Cilium ext_authz/forward-auth relevance under 1.20.1, conformance ImageVolume feature-gate assertions under 1.36. Co-Authored-By: Claude Opus 4.8 <[email protected]>
27 lines
1.1 KiB
Bash
27 lines
1.1 KiB
Bash
# ci/versions.env — pinned tool versions (R-TEST-02: reproducible, version-pinned)
|
|
#
|
|
# Single source of truth for every tool the gate invokes. The Gitea Actions
|
|
# workflow and the local scripts both source this file so CI and a laptop run
|
|
# the exact same versions. Bump deliberately; a version change is a code change
|
|
# that must go through the normal feature-branch -> main gate.
|
|
#
|
|
# Owner: WS-GITOSS (CI). The Kyverno/Chainsaw versions MUST stay in lockstep with
|
|
# whatever platform/kyverno and conformance/ pin — see integration notes in README.
|
|
|
|
# L0 policy gate (Kyverno CLI) + ServiceDefinition validation (kyverno-json)
|
|
KYVERNO_VERSION="1.13.4"
|
|
KYVERNO_JSON_VERSION="0.0.3"
|
|
|
|
# L1/L2/L3 declarative runner (Chainsaw) — invoked via conformance/ entrypoint,
|
|
# pinned here so a local run matches CI even before the in-cluster Job exists.
|
|
CHAINSAW_VERSION="0.2.12"
|
|
|
|
# Lint / manifest tooling
|
|
YAMLLINT_VERSION="1.35.1"
|
|
KUBECTL_VERSION="1.36.4"
|
|
YQ_VERSION="4.44.6"
|
|
|
|
# ServiceDefinition JSON-Schema validation (schemas/validate.sh). Pip-installed;
|
|
# pinned here so CI and a laptop validate against the exact same validator.
|
|
CHECK_JSONSCHEMA_VERSION="0.29.4"
|