Repository navigation
fix(platform): retire the unused Crossview, Headlamp and Backstage remains - #5384
Conversation
Neither cluster UI is in use, and the KSail web UI is taking over their role (devantler-tech/ksail#5827, devantler-tech/ksail#8011). Remove both apps and everything that existed only for them: SSO routes and Dex callbacks, network allowances, Coroot risk acceptances and alerting, the Crossview login sensor, Kubescape exception entries and the Headlamp-only exceptions mirror with its generator mode, Renovate rules, local hosts, docs and the approved authorization ledger entries. The vault-config Job now deletes Crossview's retired read policy and destroys its generated credentials, which their PushSecrets never remove. The hosted Docker registry-cache setup moves to a shared helper so the Wedding runtime fixture keeps it without the Crossview fixture. The Longhorn client maintenance journal schema still names Crossview: its completed journal is validated against that scope on every deploy, and the completed path reads no Crossview object. Fixes #2496 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ew-headlamp # Conflicts: # scripts/validate-eks-ci-role-policy/approved-surface.txt
Production disables Flux pruning on Namespaces, HelmReleases and claims, so removing the manifests leaves both apps running. Add the explicit second stage as a main-only dispatch workflow under the prod-deploy lock. It refuses to act until the infrastructure-controllers, infrastructure and apps Kustomizations are Ready for their generations and own no object of either app, then uninstalls the two releases, deletes the retained claim and waits for its volume, deletes both namespaces (each checked as owned by apps) and the Kubescape summaries named after them, and proves none of it, nor the retired bindings, remains. Reruns are idempotent and a failed read is UNKNOWN, never "absent". Refs #2496 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Backstage is no longer used, and the maintainer decided on 26 October 2026 to delete its retained database rather than keep a recovery copy (#5122). Remove the retained namespace, network policy and Coroot monitor credential, the storage-protection workflow with its Go tool and the internal/portalstorage package only it used, the retained-instance network test, and the workflow's KSail pin entry. Docs and the AGENTS retention note now describe the deletion. The leftover retirement becomes one generic workflow and script for Crossview, Headlamp and Backstage. After proving the removal deployed, it deletes the backstage-db Cluster before the namespaces, then the Retain volumes once Released and the Longhorn volumes last claimed in a retired namespace once detached, leaving all other storage alone. Both storage loops are bounded on every pass and fail closed on a failed read. The Longhorn client-maintenance journal schema still names backstage-db; its completed journal is validated against that scope on every deploy. Refs #4266 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
devantler
changed the title
CI's ShellCheck rejects SC2015 in the stale-Kustomization and failed-read cases. Assert each status and its message with the shared helper, then assert separately that nothing was deleted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@coderabbitai review 🤖 Generated with Claude Code |
|
Readiness evaluation at What I exercised, as the platform's operator:
Unreachable gate: deleting the protected leftovers needs the production admin credential, which exists only in the 🤖 Generated with Claude Code |
|
|
@codex review for the production retirement workflow script and Vault, Dex and network removals 🤖 Generated with Claude Code |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 454525f4ab
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ment A merge-group deploy is speculative. If it were evicted after the infrastructure layer applied, the vault-config Job would already have destroyed Crossview's credentials, and pruning the generated-password ExternalSecrets would drop their cached values, so healing back to main would regenerate credentials Crossview's retained database was never initialised with. Keep the seed chain and the vault-config Crossview grants declared, and exempt exactly those nine seed objects from the retirement's "removal deployed" check. Their removal and the credential destruction move to a follow-up that runs only after the explicit retirement (#5391). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review 🤖 Generated with Claude Code |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Readiness evaluation at What I exercised, as the platform's operator:
Unreachable gate: deleting the protected leftovers needs the production admin credential, which exists only in the 🤖 Generated with Claude Code |
…ew-headlamp # Conflicts: # .github/workflows/protect-backstage-storage.yaml
|
@codex review 🤖 Generated with Claude Code |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review 🤖 Generated with Claude Code |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Fresh production verification for The retained database remains present after removal of its supporting network policy. The read-only platform health check now fails, and the database reports an incomplete failover. Startup evidence identifies API connectivity timeouts; the other three database clusters report full readiness. Detailed runtime evidence is retained privately. This makes the post-merge Retire Unused App Leftovers workflow and its independent absence/shared-service-health readback the immediate remaining verification step. Application reconciliation reporting Ready does not establish completion of that cleanup. The PR is still queued and has a live maintainer holder, so this observation leaves its source and queue ownership with that session. No production write or deletion was performed. |
Post-merge verification: this PR merged at The remaining acceptance gate is that workflow's verified cleanup followed by independent absence and shared-service-health checks. The read-only health check remains unhealthy, so source merge is not yet a completed retirement. The existing maintainer session still owns the cleanup; this run has made no production mutation. |
Why
Crossview, Headlamp and Backstage are no longer used, and the KSail web UI is taking over the cluster UI job: Headlamp parity is tracked in devantler-tech/ksail#5827, and native Crossplane viewing at Crossview parity in devantler-tech/ksail#8011. Keeping them costs cluster resources, sign-in wiring, stored credentials and security-scan exceptions for tools nobody opens. Backstage's retained database was still running. The maintainer decided to delete it rather than keep a recovery copy.
What
Removes Crossview and Headlamp and everything that existed only for them: their sign-in routes and callbacks, network allowances, secrets, monitoring and alerting, security-scan exceptions (including the Headlamp-only exceptions copy), update rules, local host names and docs. Crossview's stored credentials stay in the vault until the leftovers are retired, so a failed deploy can still heal cleanly; #5391 removes them afterwards. Shared alerting to Slack keeps working.
Removes Backstage's remains: its retained database's namespace setup and monitoring, and the storage-protection workflow and tooling that guarded it.
A new one-off workflow deletes what the platform deliberately keeps after a removal: the three namespaces, the two releases, the Backstage database and the storage volumes still holding their data. It runs only once the removal has deployed, never touches other apps' storage, and proves nothing is left.
Part of #2496
Fixes #4266
Fixes #5122
👉 After merge/promotion: once the deploy finishes, run the "Retire Unused App Leftovers" workflow from main to delete the protected leftovers. The Backstage database has no backup, so this deletion cannot be undone.
🤖 Generated with Claude Code