Add fast, disposable UDS dev delivery and cleanup #83

New issue

Open

opened 2026-10-10 18:46:53 -05:00 by kiyi · 1 comment

kiyi commented

2026-10-10 18:46:53 -05:00

Member

Implementation scope:

Add an explicit dev-only bundle/deploy scan profile; retain source secret checks, signatures, hashes, scoped credentials and target/health checks. Keep production gates and same-archive promotion.
Add an owning-repository protected manual cleanup caller with preview by default and exact dev data deletion confirmation. Verify the installed release and namespace/volume ownership before removing the dev package and data.
Support disposable dynamic CSI storage and declared external PostgreSQL targets with restricted dev credentials and verified TLS. Refuse unsupported static/shared storage.
Make cleanup authority a per-app platform opt-in and update the bundle template and instance documentation.

Source preparation and local checks are in progress. Library publication, existing application adoption, platform reconciliation and hosted/live cleanup and empty recreation acceptance remain separate operator steps. This issue stays open until those acceptance steps are recorded.

Owner direction, 2026-10-10: dev is for quick iteration on the shared cluster. Removed dev bundles need no retained data, including persistent storage and external dev databases. No separate node pool is available. Implementation scope: - Add an explicit dev-only bundle/deploy scan profile; retain source secret checks, signatures, hashes, scoped credentials and target/health checks. Keep production gates and same-archive promotion. - Add an owning-repository protected manual cleanup caller with preview by default and exact dev data deletion confirmation. Verify the installed release and namespace/volume ownership before removing the dev package and data. - Support disposable dynamic CSI storage and declared external PostgreSQL targets with restricted dev credentials and verified TLS. Refuse unsupported static/shared storage. - Make cleanup authority a per-app platform opt-in and update the bundle template and instance documentation. Source preparation and local checks are in progress. Library publication, existing application adoption, platform reconciliation and hosted/live cleanup and empty recreation acceptance remain separate operator steps. This issue stays open until those acceptance steps are recorded.

kiyi added this to the Homelab Roadmap project

2026-10-10 18:46:54 -05:00

kiyi referenced this issue

2026-10-10 18:55:58 -05:00

Add fast dev UDS delivery and disposable bundle cleanup #84

kiyi referenced this issue from Homelab/Documentation

2026-10-10 18:59:11 -05:00

Record disposable dev delivery and cleanup policy #37

kiyi commented

2026-10-10 18:59:54 -05:00

Author

Member

Draft reviews:

Local validation: 272 workflow tests passed, 14 conditional/Linux-only tests skipped; 19 platform onboarding tests passed; template validation, workflow YAML/Bash syntax and all 24 canary gate cases passed. Documentation checks and production build passed after the owner clarification. Hosted Linux/CLI and live storage/database acceptance remain pending.

Rollout order: review/merge library and platform source; operator-publish proposed immutable v1.32.0; adopt matching build/deploy/cleanup caller pins and the per-app cleanup opt-in; operator-run platform plan/reconcile. Deploy a disposable fixture through the new workflow, preview cleanup, then verify dev-only removal, CSI backing-data deletion, declared external PostgreSQL deletion and empty recreation. Existing applications need their own caller/storage/database adoption review. Unsupported static/shared storage stops cleanup.

Keep this issue open until rollout and live acceptance are recorded.

Prepared for review; no live deployment or data deletion performed. Reduced scans depend only on the dev bundle target. New repositories keep normal source security scans; the template validator now enforces that separation. Draft reviews: - [Workflow implementation #84](https://git.gitchegumi.com/Homelab/workflows/pulls/84) - [Application template #14](https://git.gitchegumi.com/Homelab/bundles/pulls/14) - [Scoped platform cleanup authority #113](https://git.gitchegumi.com/Homelab/platform/pulls/113) - [Instance policy documentation #37](https://git.gitchegumi.com/Homelab/Documentation/pulls/37) Local validation: 272 workflow tests passed, 14 conditional/Linux-only tests skipped; 19 platform onboarding tests passed; template validation, workflow YAML/Bash syntax and all 24 canary gate cases passed. Documentation checks and production build passed after the owner clarification. Hosted Linux/CLI and live storage/database acceptance remain pending. Rollout order: review/merge library and platform source; operator-publish proposed immutable v1.32.0; adopt matching build/deploy/cleanup caller pins and the per-app cleanup opt-in; operator-run platform plan/reconcile. Deploy a disposable fixture through the new workflow, preview cleanup, then verify dev-only removal, CSI backing-data deletion, declared external PostgreSQL deletion and empty recreation. Existing applications need their own caller/storage/database adoption review. Unsupported static/shared storage stops cleanup. Keep this issue open until rollout and live acceptance are recorded.