Repository navigation
Sweep raw-manifest infrastructure for components that should be HelmReleases #205
Description
🤖 Generated by the Agentic Engineer
Evidence
#68 asked for two things: factor the HelmRelease defaults and drift detection into shared components (delivered by #204), and sweep the template's remaining raw-manifest and vendored infrastructure for pieces that could be a HelmRelease instead. The sweep was not part of #204, so it is tracked here.
Audience and problem
Operators of platforms built from this template. A component installed from raw or vendored manifests gets none of the HelmRelease protections: no retry on a failed upgrade, no drift detection, and no chart-version bump from Renovate. It also has to be re-vendored by hand for every upgrade.
Hypothesis
Moving each raw-manifest component that has a maintained upstream chart to a HelmRelease gives it the same retry, drift and update behaviour as everything else, with no change in what runs.
Acceptance criteria
- A list of every raw-manifest or vendored component in the bases and provider layers, each marked "has a maintained chart" or "stays raw" with the reason.
- Each "has a maintained chart" entry is either migrated in its own PR or filed as its own issue.
- Both provider renders and both
workload validateruns stay green after each migration.
Size
S for the inventory; each migration is its own slice.
Activity
chore: agent-claim #205 nonce=51ba979da92d59f8cbc167ab2f24a8c6
devantler commentedon Oct 24, 2026
Verdict: done. Inventory of every raw-manifest or vendored component in the bases and provider layers, against
mainat679fe8b. Configuration resources for controllers that already run from a HelmRelease (cluster policies, issuers, the Gateway, the Coroot and FluxInstance custom resources, secrets plumbing) are not installs, so they are out of scope.auth-proxycdikubevirttestkube/custom-resource-definitionscorednsminiokubelet-serving-cert-approvermainbranch unpinned, unlike the platform's pinned copy: #264.cluster-heartbeat,vault-backup,vault-config,vault-seedThe one "has a maintained chart" entry is filed as its own issue (#263), which satisfies the second criterion; the third (renders and validation stay green after each migration) moves with it. #264 is a separate pinning gap the sweep turned up. Both are under #175.