docs(runners): plan on-demand Kubernetes workers with bounded capacity #32
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!32
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/ephemeral-runner-plan"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Plan and exercise an on-demand Linux runner migration with five worker slots: four CI and one deployment. The inventory now maps Homelab/global/VOA connections to the existing Docker Compose installation on Media. Sager, OptiPlex and Media are all eligible Kubernetes worker hosts.
The canary design preserves Docker builds with a private DinD engine per pod and separate persistent CI/deploy registrations in runtime Secrets. The manual probe queues six CI jobs plus an independent deployment probe on ci-k8s/deploy-k8s. Platform infrastructure is in Homelab/platform#33 and implementation/live acceptance is tracked by Homelab/platform#32.
Validation: 119 local tests and scaffold checks passed before the documentation-only inventory update; all hosted checks passed on the current head (
4c6866d). No runner was registered or deployed, and existing labels/Compose services remain unchanged.Tracks #2. Windows Hyper-V and external recovery remain part of the migration boundary.
Approved as a planning/compatibility contract and manual canary probe, not as migration acceptance.
Reviewed all four changed files. The probe is dispatch-only, uses only ci-k8s/deploy-k8s, has no secret references, allows six CI slots for observing the lower fleet cap, and keeps the deployment probe independent and non-deploying. Production runner-role checks remain intact. Documentation explicitly distinguishes disposable pods from persistent pool registrations, documents privileged DinD risk, preserves Windows/recovery paths, and leaves live queue/concurrency/build/isolation acceptance outstanding.
All 119 local unit tests pass; scaffold validation passes YAML/Bash plus 16 mocked scanner/control-flow cases. All four exact-head hosted checks pass. Security artifact 337 from run 467 has passed=true, zero blockers and zero scanner errors.
The companion platform #33 has a concrete Istio bootstrap defect and missing continuing CI coverage, reported separately. This approval does not authorize installing that implementation or promoting canary labels. No workflow dispatched, credentials issued, deployment or merge performed.