atlas-botandClaude Opus 5.5
54d135c56a
Built static in the go stage with go install (module checked against sum.golang.org); added to the default-PATH check and the README table. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
71 lines
3.3 KiB
Markdown
71 lines
3.3 KiB
Markdown
# homelab
|
||
|
||
GitOps source for the Renner homelab cluster. Flux applies `master` to
|
||
production, so every merge is a production change. Changes go in by pull
|
||
request only; see [CONTRIBUTING.md](CONTRIBUTING.md) for YAML conventions.
|
||
|
||
## Change rules that protect Home Assistant
|
||
|
||
Owner decision (REN-240, REN-243). Home Assistant runs the house, so it
|
||
gets two rules on top of normal review.
|
||
|
||
### 1. Disruptive work runs only 02:00–05:00 Europe/Berlin
|
||
|
||
Planned work that can restart Home Assistant or disrupt the cluster is
|
||
merged and applied only between **02:00 and 05:00 Europe/Berlin**. That
|
||
covers:
|
||
|
||
- node drain, node reboot, Talos upgrade
|
||
- CNI (Cilium, Multus) and cluster-wide network policy
|
||
- storage (Rook/Ceph, CSI, snapshot controller, CNPG operator)
|
||
- Flux core (`kubernetes/clusters/*/flux-system/`, Flux controllers)
|
||
- Authentik
|
||
- OpenBao, including secret rotation that restarts consumers
|
||
- anything in `kubernetes/apps/home-assistant/`
|
||
|
||
A PR in this list states in its description that it waits for the window.
|
||
Flux applies on merge, so "wait for the window" means **merge** in the
|
||
window, not just apply. If unsure whether a change is disruptive, treat it
|
||
as disruptive.
|
||
|
||
Not covered: Home Assistant image bumps by Flux image automation. They stay
|
||
fully automatic by owner decision. If one breaks Home Assistant, roll it
|
||
back with [RUNBOOK-home-assistant-image-rollback.md](kubernetes/RUNBOOK-home-assistant-image-rollback.md).
|
||
An incident rollback is not planned work; the owner decides its timing.
|
||
|
||
### 2. HA-impact review before merge
|
||
|
||
Every PR that touches `kubernetes/apps/home-assistant/`, or makes a
|
||
cluster-wide disruptive change from the list above, needs an **HA-impact
|
||
review** before merge: a named reviewer states in the PR what Home
|
||
Assistant will notice (restart, lost integration, lost history, none) and
|
||
approves.
|
||
|
||
- Reviewer: Hestia, the Home Assistant maintainer.
|
||
- Until Hestia exists: the owner does the HA-impact review.
|
||
|
||
This is in addition to the normal review and merge by Argus. Argus does
|
||
not merge such a PR without the HA-impact approval.
|
||
|
||
## Agent runtime images
|
||
|
||
Pod images for the Paperclip Kubernetes sandbox (REN-284). Each is the stock
|
||
`ghcr.io/paperclipai/agent-runtime-claude` (pinned by digest) plus a tool
|
||
set. Base user (1000, non-root), entrypoint and cmd are unchanged; the
|
||
images run with a read-only root FS. Source in `ci/images/agent-runtime-*`,
|
||
built by `.woodpecker/build-agent-runtime.yml` (re-run alone: deployment to
|
||
target `build-agent-runtime`), versions bumped by Renovate. Both also
|
||
carry `claude-agent-acp` for the ACP engine, pinned and patched like
|
||
Paperclip ships it, SDK override included
|
||
(`ci/images/agent-runtime-common/`); bump it by hand
|
||
together with Paperclip. All tools are on the default `PATH`.
|
||
|
||
| Image | `imageRegistry` | Adds |
|
||
|---|---|---|
|
||
| `gitea.renner.uno/konairius/agent-runtime-go/agent-runtime-claude:v1` | `gitea.renner.uno/konairius/agent-runtime-go` | Go toolchain, golangci-lint, govulncheck |
|
||
| `gitea.renner.uno/konairius/agent-runtime-ops/agent-runtime-claude:v1` | `gitea.renner.uno/konairius/agent-runtime-ops` | kubectl, flux, kustomize, helm |
|
||
|
||
The plugin keeps the name `agent-runtime-claude:v1` and swaps only host and
|
||
org, hence the nested path. Every build also pushes a date tag
|
||
(`:YYYY-MM-DD`) as the rollback point. `konairius` is public: no pull secret.
|