feat(flux)!: reconcile the cluster from in-cluster Forgejo (ADR-0011 cutover) #347

Merged

ryangr0 merged 6 commits from cutover/flux-source-forgejo into main 2026-07-14 03:59:15 +00:00

Conversation 0 Commits 6 Files changed 15 +118 -644

ryangr0 commented 2026-07-13 18:30:51 +00:00

Owner

Copy link

Cutting the GitOps umbilical (VIK-77)

Flux's source moves from GitHub to the in-cluster Forgejo Service URL — ADR-0011/0012, executed per the RFC's Execution addendum and the approved plan.

Pre-merge state (all proven live today):

• Stage B complete: repo converted (mirror: false), PR/Releases units on, Forgejo→GitHub push-mirror live (last_error: none), remotes re-pointed, relay rehearsed — fc627708 pushed to Forgejo landed on GitHub in seconds and Flux reconciled it from there.
• The probe GitRepository has been Ready from the exact same URL since Stage A.
• Kyverno admits both URLs (widened b46e438b; re-tighten is Stage D, deliberately NOT in this PR — apply-order hazard).
• PR gate proof: run 17 fired on pull_request (this PR's own e2e run is the final gate).

Commits:

1. sync.url → Forgejo Service URL (the one-liner)
2. retire the Stage-A3 probe GitRepository
3. Renovate re-home: repo added to webgrip-forgejo discovery; .renovaterc.json5 presets github> → local>
4. runbooks/flux-source.md — break-glass repoint (patch the FluxInstance, not the GitRepository), mirror-direction recovery, netpol tripwire
5. delete .github/workflows/ + the hello-world ci.yml stub (owner decision; renovate-trigger port deferred — the Forgejo runner deliberately mounts no ServiceAccount token)

Merge relay (gap-free): merge → same-SHA relay to GitHub → Flux (still reading GitHub) applies this change → flux-operator SSA-patches the GitRepository URL → next fetch comes from Forgejo. Rollback = the runbook's break-glass patch; GitHub stays current via the push-mirror.

After merge I will: watch flux get sources git flip + one clean reconcile cycle, run the webhook-instant proof and the break-glass drill (Stage D), then complete #77 on the board with per-AC evidence.

🤖 Generated with Claude Code

## Cutting the GitOps umbilical (VIK-77) Flux's source moves from GitHub to the in-cluster Forgejo Service URL — ADR-0011/0012, executed per the RFC's Execution addendum and the approved plan. **Pre-merge state (all proven live today):** - Stage B complete: repo converted (`mirror: false`), PR/Releases units on, Forgejo→GitHub push-mirror live (`last_error: none`), remotes re-pointed, relay rehearsed — fc627708 pushed to Forgejo landed on GitHub in seconds and Flux reconciled it from there. - The probe GitRepository has been Ready from the exact same URL since Stage A. - Kyverno admits both URLs (widened b46e438b; re-tighten is Stage D, deliberately NOT in this PR — apply-order hazard). - PR gate proof: run 17 fired on `pull_request` (this PR's own e2e run is the final gate). **Commits:** 1. `sync.url` → Forgejo Service URL (the one-liner) 2. retire the Stage-A3 probe GitRepository 3. Renovate re-home: repo added to `webgrip-forgejo` discovery; `.renovaterc.json5` presets `github>` → `local>` 4. `runbooks/flux-source.md` — break-glass repoint (patch the **FluxInstance**, not the GitRepository), mirror-direction recovery, netpol tripwire 5. delete `.github/workflows/` + the hello-world `ci.yml` stub (owner decision; renovate-trigger port deferred — the Forgejo runner deliberately mounts no ServiceAccount token) **Merge relay (gap-free):** merge → same-SHA relay to GitHub → Flux (still reading GitHub) applies this change → flux-operator SSA-patches the GitRepository URL → next fetch comes from Forgejo. Rollback = the runbook's break-glass patch; GitHub stays current via the push-mirror. **After merge I will:** watch `flux get sources git` flip + one clean reconcile cycle, run the webhook-instant proof and the break-glass drill (Stage D), then complete #77 on the board with per-AC evidence. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ryangr0 added 5 commits 2026-07-13 18:30:51 +00:00

feat(flux)!: reconcile the cluster from in-cluster Forgejo (ADR-0011) ... 58a19a94ce

The cutover one-liner: sync.url moves from GitHub to the Forgejo internal
Service URL — byte-identical to the Stage-A probe that has been Ready since
9acd23a6. No pullSecret: the repo is public-read. GitHub stays as the
Forgejo→GitHub push-mirror for cold bootstrap and break-glass (ADR-0012).

VIK-77

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

chore(flux): retire the Stage-A3 probe GitRepository ... 70d717ea39

The real GitRepository/flux-system now owns the Forgejo Service URL; the
probe proved the clone path (Ready since 9acd23a6) and is done.

VIK-77

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

feat(renovate): homelab-cluster moves to the Forgejo Renovate job ... 1a2095ad9d

Adds the repo to webgrip-forgejo's explicit discovery (removed from
webgrip-gitops in a5741bb6, verified dropped after the 18:17 tick) and
flips the repo presets github> → local> so they resolve from the
authoritative Forgejo host, not the downstream GitHub mirror. First Forgejo
Renovate pass lands on the next :47 cron tick after merge.

VIK-77

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs(runbooks): flux-source — break-glass repoint, mirror-direction recovery ... 0113648e80

Written with the cutover per the RFC: patch the FluxInstance (not the
generated GitRepository — flux-operator reverts it), keep the GitHub webhook
(instant break-glass reconciles), never let the force-push-mirror fire while
GitHub is ahead, netpol tripwire for the internal webhook path.

VIK-77

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

chore(ci)!: retire the GitHub Actions tree and the hello-world stub ... c0f29063dd

GitHub is a downstream force-push-mirror now — its workflows either fire
uselessly on every relay (flux-local.yaml) or can never fire again
(PR-triggered: claude-review, labeler, label-sync, renovate-dry-run). Owner
decision 2026-07-13: delete at cutover. renovate-trigger.yml is NOT ported
verbatim: it reads the pod ServiceAccount token, which the Forgejo runner
deliberately does not mount (automountServiceAccountToken: false) — a
Forgejo-side re-trigger workflow is a follow-up ticket (the renovate-trigger
subagent covers the use-case meanwhile). ci.yml was the runner smoke test;
the full e2e gate (green run 9, PR-trigger proven run 17) replaces it.

VIK-77

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ryangr0 force-pushed cutover/flux-source-forgejo from c0f29063dd to e70e2842e3 2026-07-13 18:44:18 +00:00 Compare

ryangr0 added 1 commit 2026-07-13 18:56:06 +00:00

fix(ci): retry the docker.io pull in the yamllint step ... 81b10307a3

Ephemeral DinD re-pulls every image each run; docker.io flaked with a TLS
handshake timeout (run 22) and failed the gate. 3-attempt pull retry;
routing DinD pulls through the Harbor proxy is the durable follow-up
(dockerd registry-mirrors can't carry Harbor's project-path prefix, so it
needs explicit image re-referencing — ticketed).

VIK-77

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ryangr0 force-pushed cutover/flux-source-forgejo from 81b10307a3 to 841188c252 2026-07-13 19:34:26 +00:00 Compare

ryangr0 merged commit 9a3b448aae into main 2026-07-14 03:59:15 +00:00

ryangr0 referenced this pull request from a commit 2026-07-14 03:59:16 +00:00

Merge pull request 'feat(flux)!: reconcile the cluster from in-cluster Forgejo (ADR-0011 cutover)' (#347) from cutover/flux-source-forgejo into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

pull-request

Mirrored from GitHub Pull Request

No labels

pull-request

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

webgrip/homelab-cluster!347

No description provided.