roadmap: platform-template direction & themes (2026 H2) #175

🤖 Generated by the Agentic Engineer

Roadmap: platform-template — direction & themes (2026 H2)

This follows #24, the 2026 H1 roadmap, which was closed on 2026-09-10 when that half-year ended. It carries forward the work that is still open and gives it a parent again.

Evidence

Checked against main on 2026-09-13:

• The observability move to Coroot isn't finished. All six child issues of Sync observability stack to Coroot (+ audit-log-forwarder) like the reference platform #65 are closed, but the production (Hetzner) overlay still installs Alloy, kube-prometheus-stack, Loki and OpenCost by default. Coroot and the audit-log forwarder exist only as an option to switch to. The reference platform runs Coroot as its only stack.
• The security baseline is half done. Every network policy is now a CiliumNetworkPolicy (33 files, no plain NetworkPolicy left), which covers half of Raise scaffolded security posture to the platform's current baseline (CiliumNetworkPolicy + policy set) #67. But the replica floor/ceiling and PDB drain-safety cluster policies the reference platform uses are still missing, and recommended workload labels come only as an opt-in component.
• Four open issues had no parent: Factor HelmRelease defaults and drift detection into k8s/bases/components/ like the platform #68 (shared HelmRelease defaults), fix(bootstrap): use valid SSO credential names and fail closed #87 (a bootstrap bug in credential naming), and two Cilium workaround removals waiting on upstream fixes (Remove the auth-proxy component when Cilium supports native forward auth (cilium/cilium#23797) #8, Remove the ownership workaround when Cilium fixes #149).
• The only merges since 2026-09-01 are dependency updates plus one CI fix, so nothing here is moving on its own.

Who this serves

People who start a new platform from this template. Today they get an observability stack the reference platform has dropped, and a thinner security baseline than it runs.

Hypothesis

If new platforms get the same defaults the reference platform runs today, a platform started from the template needs no follow-up migration in its first months.

Themes

1. Match the reference platform's defaults
   • Sync observability stack to Coroot (+ audit-log-forwarder) like the reference platform #65: make Coroot and the audit-log forwarder the default and remove the retired bases.
   • Raise scaffolded security posture to the platform's current baseline (CiliumNetworkPolicy + policy set) #67: add the missing replica and PDB drain-safety policies.
   • Factor HelmRelease defaults and drift detection into k8s/bases/components/ like the platform #68: share HelmRelease defaults and drift detection.
2. Make the first bootstrap work
   • fix(bootstrap): use valid SSO credential names and fail closed #87: use valid credential names and fail closed.
3. Drop workarounds once upstream fixes ship (blocked on Cilium)
   • Remove the auth-proxy component when Cilium supports native forward auth (cilium/cilium#23797) #8: remove the auth-proxy component.
   • Remove the ownership workaround when Cilium fixes #149: remove the ownership workaround.

Success signal

A fresh instance created from main uses Coroot and the reference platform's cluster-policy set without opting in, and bootstraps cleanly on the first try. Measure it when each theme's last child closes, re-checking against main as done here, not from how many child issues are closed.