chore: re-vendor the CRD schemas at the current upstream - #59
Merged
Conversation
Moves the `schemas/crd/source.json` pin to nanohype/eks-agent-platform@2f3f29c and rewrites the vendored copies and their digests from it. Two descriptions move. `spec.compliance` on both Platform and Tenant now says what the flags do: they declare which regime a workload is in scope for, and `cloudgov platform audit` checks the rest of the declaration is consistent with that posture. They previously named controls the flags do not reach — Object Lock on the artifacts bucket, cross-region inference suppression, PII detection on Guardrails, invocation logging. `spec.datastores[].deletionPolicy` picks up its per-kind description: what Retain means differs by service, and the field reaches the substrate module's destroy path rather than `kubectl delete platform`, which orphans every store regardless because the operator holds no delete permission. Schema shape is unchanged, so nothing this repo renders or validates differs. `schemas:check` verifies the copies are byte-identical to upstream at the pinned ref, and platform.yaml still validates against them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Moves the
schemas/crd/source.jsonpin tonanohype/eks-agent-platform@2f3f29cand rewrites the vendored copies and digests from it.What moves
spec.complianceon Platform and Tenant. The descriptions named controls the flags do not reach — Object Lock compliance mode on the artifacts bucket, cross-region inference suppression, PII detection on Guardrails, invocation logging. They now say what the flags actually do: declare which regime a workload is in scope for, withcloudgov platform auditchecking the rest of the declaration is consistent with that posture.spec.datastores[].deletionPolicy. Picks up its per-kind description — whatRetainmeans differs by service, and the field reaches the substrate module's destroy path rather thankubectl delete platform, which orphans every store regardless since the operator holds no delete permission on any datastore.Shape is unchanged
Descriptions only. No property was added, removed, or retyped, so nothing this repo renders or validates behaves differently.
Verification
pnpm schemas:check— copies are byte-identical to upstream at the pinned ref, digests matchnode scripts/validate-platform-manifests.mjs—platform.yamlvalidates against the refreshed schemas, and tenant/platform naming stays consistent across the chart values files