feat(flux)!: reconcile the cluster from in-cluster Forgejo (ADR-0011 cutover) #347

Merged

ryangr0 merged 6 commits from cutover/flux-source-forgejo into main

2026-07-14 03:59:15 +00:00

ryangr0 commented

2026-07-13 18:30:51 +00:00

Owner

Cutting the GitOps umbilical (VIK-77)

Flux's source moves from GitHub to the in-cluster Forgejo Service URL — ADR-0011/0012, executed per the RFC's Execution addendum and the approved plan.

Pre-merge state (all proven live today):

Stage B complete: repo converted (mirror: false), PR/Releases units on, Forgejo→GitHub push-mirror live (last_error: none), remotes re-pointed, relay rehearsed — fc627708 pushed to Forgejo landed on GitHub in seconds and Flux reconciled it from there.
The probe GitRepository has been Ready from the exact same URL since Stage A.
Kyverno admits both URLs (widened b46e438b; re-tighten is Stage D, deliberately NOT in this PR — apply-order hazard).
PR gate proof: run 17 fired on pull_request (this PR's own e2e run is the final gate).

Commits:

sync.url → Forgejo Service URL (the one-liner)
retire the Stage-A3 probe GitRepository
Renovate re-home: repo added to webgrip-forgejo discovery; .renovaterc.json5 presets github> → local>
runbooks/flux-source.md — break-glass repoint (patch the FluxInstance, not the GitRepository), mirror-direction recovery, netpol tripwire
delete .github/workflows/ + the hello-world ci.yml stub (owner decision; renovate-trigger port deferred — the Forgejo runner deliberately mounts no ServiceAccount token)

Merge relay (gap-free): merge → same-SHA relay to GitHub → Flux (still reading GitHub) applies this change → flux-operator SSA-patches the GitRepository URL → next fetch comes from Forgejo. Rollback = the runbook's break-glass patch; GitHub stays current via the push-mirror.

After merge I will: watch flux get sources git flip + one clean reconcile cycle, run the webhook-instant proof and the break-glass drill (Stage D), then complete #77 on the board with per-AC evidence.

🤖 Generated with Claude Code

## Cutting the GitOps umbilical (VIK-77) Flux's source moves from GitHub to the in-cluster Forgejo Service URL — ADR-0011/0012, executed per the RFC's Execution addendum and the approved plan. **Pre-merge state (all proven live today):** - Stage B complete: repo converted (`mirror: false`), PR/Releases units on, Forgejo→GitHub push-mirror live (`last_error: none`), remotes re-pointed, relay rehearsed — fc627708 pushed to Forgejo landed on GitHub in seconds and Flux reconciled it from there. - The probe GitRepository has been Ready from the exact same URL since Stage A. - Kyverno admits both URLs (widened b46e438b; re-tighten is Stage D, deliberately NOT in this PR — apply-order hazard). - PR gate proof: run 17 fired on `pull_request` (this PR's own e2e run is the final gate). **Commits:** 1. `sync.url` → Forgejo Service URL (the one-liner) 2. retire the Stage-A3 probe GitRepository 3. Renovate re-home: repo added to `webgrip-forgejo` discovery; `.renovaterc.json5` presets `github>` → `local>` 4. `runbooks/flux-source.md` — break-glass repoint (patch the **FluxInstance**, not the GitRepository), mirror-direction recovery, netpol tripwire 5. delete `.github/workflows/` + the hello-world `ci.yml` stub (owner decision; renovate-trigger port deferred — the Forgejo runner deliberately mounts no ServiceAccount token) **Merge relay (gap-free):** merge → same-SHA relay to GitHub → Flux (still reading GitHub) applies this change → flux-operator SSA-patches the GitRepository URL → next fetch comes from Forgejo. Rollback = the runbook's break-glass patch; GitHub stays current via the push-mirror. **After merge I will:** watch `flux get sources git` flip + one clean reconcile cycle, run the webhook-instant proof and the break-glass drill (Stage D), then complete #77 on the board with per-AC evidence. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ryangr0 force-pushed cutover/flux-source-forgejo from c0f29063dd

e2e / Validate rendered cluster config (pull_request) Failing after 2m10s

Details

to e70e2842e3

e2e / Validate rendered cluster config (pull_request) Failing after 5m36s

Details

2026-07-13 18:44:18 +00:00

Compare

ryangr0 force-pushed cutover/flux-source-forgejo from 81b10307a3

e2e / Validate rendered cluster config (pull_request) Failing after 27m46s

Details

to 841188c252