[devantler]

🤖 Generated by the Agentic Engineer

Summary

• remove the OpenCost deployment, UI route, auth proxy wiring, network policies, Flagger canary, usage scraper, and obsolete security exceptions
• keep Coroot custom cloud pricing as the single cost-monitoring surface
• add a rendered regression contract covering both local and production overlays
• update operator documentation and configuration references to point to Coroot only

Authorization conservation

• approved aggregate: 39e2ce5061122eb00b8e2dc800a25333eac457e76aeb9e7b2e7100444a949837
• exact base: bd0b2ad4cc9a07db8c93f437bdefbde44485ea52
• rendered identities narrow from 229 to 215, with 14 removals and no additions
• grant-bearing identities narrow from 27 to 24 by removing only the OpenCost usage-scraper ClusterRole, ClusterRoleBinding, and ServiceAccount
• no role, binding, service account, verb, wildcard, AWS identity, or permission is added

TDD

RED was observed before implementation:

FAIL: production must not render an OpenCost workload, route, policy, or integration

GREEN after implementation:

PASS: Coroot is the only rendered cost-monitoring surface

Validation

• ksail workload validate
• ksail --config ksail.prod.yaml workload validate
• go test ./scripts/validate-eks-ci-role-policy
• go test ./scripts/generate-kubescape-exceptions
• Coroot convergence and pod-security exception shell suites
• shellcheck, embedded JSON validation, and git diff --check

Closes #3810
Closes #1784
Closes #2783

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T21:13:35.496794Z	296f2af	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 296f2af005

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Ready at 296f2af0

• Exact state: head 296f2af005c47a875d45178fc0fea4b70af34cd3 on base bd0b2ad4cc9a07db8c93f437bdefbde44485ea52; the worktree and remote branch agree.
• CI: 29 check runs are terminal with no failures. Naming, production authorization, local/prod manifest validation, the Coroot convergence regression, Kubescape hard gate, CodeQL, dependency review, publication, and supply-chain checks all passed.
• TDD: the new rendered contract first failed with FAIL: production must not render an OpenCost workload, route, policy, or integration; it now passes with PASS: Coroot is the only rendered cost-monitoring surface.
• CI repair: the first head exposed the exact [cr-directory] diagnostic after the OpenCost Canary removal left a homogeneous Flagger MetricTemplate folder. Commit 296f2af0 renamed it to metric-templates; the exact naming check is green at this head.
• Authorization: approved aggregate 39e2ce5061122eb00b8e2dc800a25333eac457e76aeb9e7b2e7100444a949837; 229 rendered identities narrow to 215 with no additions, and grant-bearing identities narrow from 27 to 24 by removing only the OpenCost usage-scraper ClusterRole, ClusterRoleBinding, and ServiceAccount.
• Review: Codex completed a manual review of exact commit 296f2af with no inline findings. There are zero review threads and zero unresolved threads. CodeRabbit was also requested at this head but has not produced a verdict; the completed Codex review is the substantive exact-head gate.
• Runtime boundary: this is static and CI evidence only. The change has not reached production; deployment remains behind maintainer promotion and the production-deploying merge queue.

The PR remains draft because maintainer promotion to ready is the repository go-signal.