From d5d517a1fef929134dc7f171bab0ef95462b38e6 Mon Sep 17 00:00:00 2001 From: Bartek Kus <7887446+bartekus@users.noreply.github.com> Date: Thu, 23 Jul 2026 16:46:24 -0600 Subject: [PATCH] feat(009): pin the Deployment to the fleet placement-enablers image Digest f9fa57c9 (tag 676b642, the PR #65 merge): the deploy-chosen container port and the FLEET_IMAGE_PULL_SECRET consumer enter production. The fleet_app port ALTER was applied to the live database before this pin; the digest change rolls the pod by itself. --- .../by-spec/009-control-plane-deploy.json | 2 +- .../by-spec/009-control-plane-deploy.json | 5 +++-- .../statecraft/deployment.yaml | 16 ++++++++-------- specs/009-control-plane-deploy/spec.md | 12 ++++++++++++ 4 files changed, 24 insertions(+), 11 deletions(-) diff --git a/.derived/codebase-index/by-spec/009-control-plane-deploy.json b/.derived/codebase-index/by-spec/009-control-plane-deploy.json index e358747..8c00301 100644 --- a/.derived/codebase-index/by-spec/009-control-plane-deploy.json +++ b/.derived/codebase-index/by-spec/009-control-plane-deploy.json @@ -115,5 +115,5 @@ "specStatus": "approved" }, "schemaVersion": "1.1.0", - "shardHash": "921b56b33fbbc47ab67416fec2c146adf2bc1cf1813d9ee48b153b21f6812354" + "shardHash": "9bec63df43711127b108b79d94618c0aa093c55316c9366a2e386a13c01e458f" } diff --git a/.derived/spec-registry/by-spec/009-control-plane-deploy.json b/.derived/spec-registry/by-spec/009-control-plane-deploy.json index 1bad17e..6409d76 100644 --- a/.derived/spec-registry/by-spec/009-control-plane-deploy.json +++ b/.derived/spec-registry/by-spec/009-control-plane-deploy.json @@ -61,13 +61,14 @@ "Amendment (2026-07-22): re-pin to the spec 012 image", "Amendment (2026-07-22): spec 012 frontend-admin adoption, deploy env", "Amendment (2026-07-22, second pin): the spec 011 walk-fix image", - "Amendment (2026-07-22): fleet placement RBAC" + "Amendment (2026-07-22): fleet placement RBAC", + "Amendment (2026-07-23, third pin): the fleet placement enablers" ], "specPath": "specs/009-control-plane-deploy/spec.md", "status": "approved", "summary": "Stand the control plane up on the spec 010 cluster as a platform-grade K8s deployment at app.statecraft.ing. Rewritten ground-up 2026-07-19 to the two-plane thesis (001 section 3), which unpauses it. The rewrite inverts the deploy's job: the published image is embedded-rauthy and self-seeds its own identity on first boot, so the shared-rauthy secret set is void, five of the eleven Encore secrets are discarded by the entrypoint if injected, and the /data volume becomes the identity anchor of the platform. What the deploy still owes the container: nine real secrets, the non-secret env, a Postgres URL, an ingress, and one seeder pass for the only thing first boot cannot seed (the upstream GitHub provider, which rauthy has no declarative bootstrap for). Operator surfaces gate on the custom statecraft_operator role, seeded here; rauthy_admin stays break-glass. Live bring-up is a human checkpoint.\n", "title": "The control-plane deploy: one governed container on the statecraft cluster" }, - "shardHash": "5becd8699f22edf419ce219bc450f8db5626707821e7073ea8785a2af538c78d", + "shardHash": "4bcd52b92635c9f86e3d049aae829eae39ef21ba4a683e0395299707c0b89cf0", "specVersion": "1.1.0" } diff --git a/infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml b/infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml index 396a582..9ca5b9b 100644 --- a/infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml +++ b/infra/gitops/clusters/statecraft-hetzner/statecraft/deployment.yaml @@ -53,14 +53,14 @@ spec: - name: statecraft # Pinned by digest, never `:latest`. The tag is recorded alongside # for human legibility only; the digest is what is deployed. - # tag: dfe27c1 (012-frontend-admin-adoption merge, 2026-07-22) - the - # operator dashboard adoption (spec 012): backend/obs/ (/metrics + - # the trace plane), backend/admin/ + the frontend-admin bundle gated - # on statecraft_operator, app-model.json in the image, and the spec - # 011 tenant-lifecycle code's first deploy (its user_account ALTER - # was applied to the live database before this pin). The prior - # digest (e4cc8b90, built from 4d0a392) is the Sec-Fetch proxy fix. - image: ghcr.io/statecrafting/statecraft@sha256:aeefe20382eb47fb85a9de077cb41f5ac0341e1fbdecba025381fa1c87c573d1 + # tag: 676b642 (006-fleet-port-pullsecret merge, 2026-07-23) - the + # fleet placement enablers (spec 006 amendment): the deploy-chosen + # container port (persisted on fleet_app; its BIGINT ALTER was + # applied to the live database before this pin) and the code that + # reads the FLEET_IMAGE_PULL_SECRET env set below. The prior + # digest (aeefe203, built from dfe27c1) is the spec 012 operator + # dashboard adoption. + image: ghcr.io/statecrafting/statecraft@sha256:f9fa57c924d8f579c982bf792bc8e9d5575f74e6a351c7a9ffa4288a4cfdeb4f imagePullPolicy: IfNotPresent # Fail-loud (spec 009 section 4.2, built 2026-07-23). Encore's # $env-bound secrets resolve absent-as-empty and are read lazily, so diff --git a/specs/009-control-plane-deploy/spec.md b/specs/009-control-plane-deploy/spec.md index e8d56f4..020c810 100644 --- a/specs/009-control-plane-deploy/spec.md +++ b/specs/009-control-plane-deploy/spec.md @@ -1271,3 +1271,15 @@ get/list/create; deployments, services, PVCs, jobs, ingresses, networkpolicies full lifecycle), and its ClusterRoleBinding; the Deployment's pod template adopts the ServiceAccount. A ClusterRole because tenant namespaces (`t-`) are dynamic. + +## Amendment (2026-07-23, third pin): the fleet placement enablers + +The Deployment moves to digest `f9fa57c9` (tag `676b642`, the PR #65 +merge). It carries the spec 006 amendment's deploy-chosen container port +(persisted on `fleet_app`; the `BIGINT` ALTER was applied to the live +database before this pin, so no ordering window existed) and the code +that reads `FLEET_IMAGE_PULL_SECRET`, which the same PR added to this +Deployment's env (section 4.4 note). One secret-shaped delta rides the +manifest rather than the pod Secret: `FLEET_IMAGE_PULL_SECRET` is a +resource name and travels as plain env. The digest change rolls the pod +by itself (Recreate); no pod delete is needed.