Create staging builds to validate Flux deploys #54

Merged

tepichord merged 12 commits from feat/49-staging-builds into main

2026-09-11 19:40:55 -07:00

tepichord commented

2026-09-11 18:35:00 -07:00

Owner

Closes #49

Automated PR created by forgejo-done adapter.

Closes #49 Automated PR created by forgejo-done adapter.

tepichord added 11 commits

2026-09-11 18:35:00 -07:00

build(nix): add conftest to the dev shell a999efbbb6

Makes the L1 policy gate (policy/k8s.rego) runnable locally, so a rule
change can be checked without a pipeline round-trip.

Refs: #49

feat(woodpecker): let pipeline steps select a service account fc05e7601d

Sets WOODPECKER_BACKEND_K8S_SERVICE_ACCOUNT_NAME_ALLOW_FROM_STEP so the
L2/L3 gates can run as preview-deployer instead of shipping a cluster
credential into a repo secret.

Refs: #49

feat(preview-system): add preview RBAC, TTL reaper, and priority class c0dbce413a

CI creates intent (Namespace, values ConfigMap, GitRepository,
Kustomization) and Flux applies workloads, so preview-deployer gets
namespaces get/list/create/delete cluster-wide and CRUD on those three
kinds in preview-system only. The reaper is the teardown path that does
not depend on a PR-close webhook arriving from the off-tailnet forge.

Refs: #49

feat(apps): add base, prod, and preview overlays 901b558123

apps/base is environment-agnostic: no namespace, and each env variant is a
placeholder. apps/prod fills them from cluster-config-prod; apps/preview
pins the PVC to the ephemeral tier, deletes the Tailscale Ingress, caps
replicas at 1, and applies a ResourceQuota/LimitRange.

Refs: #49

feat(policy): add baseline conftest rules for rendered manifests 7e7c67593c

Three rules — no moving image tags, CPU and memory limits required, no
privileged containers. Deliberately small: a policy framework is bypassed
within a month at this scale.

Refs: #49

fix(secrets): declare skipTLSVerify on the VaultConnection c9bd8251cb

VSO 1.5's field has no omitempty, so the generated CRD marks it required.
The new CRD-catalog schema check in L1 rejects the manifest without it.

Refs: #49

ci(woodpecker): add L0-L3 manifest validation gates 023fcafdaf

L0 renders every Flux layer (including preview-system) and both app
overlays offline; L1 runs kubeconform with the CRD catalog plus the
conftest policy; L2 diffs the preview overlay against the API server as
preview-deployer; L3 creates a preview namespace and waits for Flux to
reach Kustomization Ready. The CRD-catalog schema location is what stops
L1 silently skipping every Flux/KEDA/VSO custom resource.

Refs: #49

test: guard preview storage tier, PSA labels, and CI gates 474584376d

Adds static guards for the ephemeral storage patch, the Tailscale Ingress
deletion, preview-namespace PSA labels, the reaper annotation and its
three deletes, preview-deployer's RBAC scope, and the four pipeline
gates. Also renders both overlays (when kustomize is available) and
exercises policy/k8s.rego's four failure modes with conftest.

Refs: #49

docs(agents): add preview-system layer, app overlays, and CI pipeline to AGENTS.md 4bf9af38a8

Refs: #49

fix(policy): only treat a colon in the last image segment as a tag 3e9373cd6e

The untagged-image rule used `not contains(image, ":")`, so a registry
with a port (`registry.local:5000/nginx`) read as tagged and an untagged
image passed L1. Check the last path segment for the tag instead, and keep
`@` as the digest form. Add a regression test for both the port-only and
port-plus-tag cases.

fix(ci): reap the preview values ConfigMap and drop the unreachable log dump

ci/woodpecker/pr/woodpecker Pipeline failed

Details

6aca657dab

The L3 step creates `preview-<n>-values` in preview-system, where no
preview-namespace delete reaches it, and it carried no expiry annotation
and no reaper grant — one leaked ConfigMap per pull request forever. Stamp
it with `milner.dev/preview-expires` like the other preview objects and
let the reaper's existing annotation sweep collect it (Role gains
configmaps).

Also correct the L3 failure path: it read events, Deployment and pod logs
from preview-<n>, but preview-deployer is only bound in preview-system, so
every one of those calls was Forbidden behind `|| true`. The workloads
move with the Kustomization's targetNamespace, and a per-preview binding is
not something CI can create without widening its RBAC for logs alone, so
the dump now reports the Kustomization status (which carries the
health-check failure) and the unused pods/events grant is removed.