feat: drop the manual CRD step from the deploy path #53

Merged

ivuorinen merged 4 commits from feat/drop-manual-crd-step into main

2026-09-26 13:16:50 +00:00

ivuorinen commented

2026-09-26 13:13:20 +00:00

Owner

Completes the work started in #49 and fixed in #50: no CRD step before merging a
Renovate chart bump.

Why this is safe now

#50 was verified in-cluster before this PR was written:

all three installer Jobs Completed (76s, 95s, 78s)
prometheuses.monitoring.coreos.com, clustersecretstores.external-secrets.io
and proxyclasses.tailscale.com all carry no
last-applied-configuration annotation — proof they went in server-side,
which is the property 372c452 established ArgoCD's own apply cannot deliver
external-secrets, kube-prometheus-stack and tailscale-operator stayed
Synced/Healthy throughout

So the mechanism replacing the scripts is known to work, not assumed to.

What this removes

scripts/11-install-external-secrets-crds.sh,
scripts/15-install-kube-prometheus-stack-crds.sh and
scripts/18-install-tailscale-crds.sh.

The instructions to run them lived in more places than the scripts themselves:

Where	What it said
`README.md`	three rows in the "not in `run-all.sh`" table
`gitops/argocd-apps/` × 6	`external-secrets`, `kube-prometheus-stack`, `tailscale-operator`, plus `tailscale-config`, `monitoring-targets`, `monitoring-alerts`
`scripts/run-all.sh`	closing summary told the operator to run 11 and 15
`renovate.json`	two `prBodyNotes` instructing a script that would no longer exist
`docs/07`, `docs/10`, `docs/11`, `docs/14`	prose, a table row, and a numbered step

Removing the numbered step in docs/10-secrets.md renumbered the rest, which
broke two in-text cross-references (step 5, step 3) — both repointed.

external-secrets loses its sha256 bundle pin along with the script. The CRDs
are rendered from the chart now, so there is no checksum for a human to
recompute and paste into a branch before merging.

promtool parity

mise.toml pins promtool so a rule it accepts is a rule Prometheus accepts —
docs/07-monitoring.md states that outright, and nothing enforced it.

scripts/ci/check-promtool-parity.sh compares the pin against the Prometheus
image in the already-rendered chart, and render-applications.sh fails when they
disagree. No new network calls: the render is already there.

Renovate keeps promtool disabled deliberately. The version is internal to the
chart, not a dependency Renovate can see, so left enabled it would track the
latest Prometheus release and drift from what the chart deploys. The PR note now
says to set it by hand, and CI prints the value to use.

Note on the first version of that check

It passed all six of its unit tests and found zero Prometheus images in the
real render. The chart emits image: "quay.io/..." quoted; the pattern excluded
a quote in that position, and the hand-written fixture left it bare. Fixture and
code agreed with each other and not with the chart. The fixture now carries the
shape that actually ships, with a separate case for the bare form — and the
check is wired into the real pipeline in the same PR, which is what exposed it.

Verification

39 bats tests, all 24 pre-commit hooks, and render-applications.sh pass.
render-applications.sh prints promtool 3.14.0 matches the rendered Prometheus 3.14.0, and fails with both versions named when mise.toml is edited to drift.

Completes the work started in #49 and fixed in #50: no CRD step before merging a Renovate chart bump. ## Why this is safe now #50 was verified in-cluster before this PR was written: - all three installer Jobs `Completed` (76s, 95s, 78s) - `prometheuses.monitoring.coreos.com`, `clustersecretstores.external-secrets.io` and `proxyclasses.tailscale.com` all carry **no** `last-applied-configuration` annotation — proof they went in server-side, which is the property `372c452` established ArgoCD's own apply cannot deliver - `external-secrets`, `kube-prometheus-stack` and `tailscale-operator` stayed Synced/Healthy throughout So the mechanism replacing the scripts is known to work, not assumed to. ## What this removes `scripts/11-install-external-secrets-crds.sh`, `scripts/15-install-kube-prometheus-stack-crds.sh` and `scripts/18-install-tailscale-crds.sh`. The instructions to run them lived in more places than the scripts themselves: | Where | What it said | |---|---| | `README.md` | three rows in the "not in `run-all.sh`" table | | `gitops/argocd-apps/` × 6 | `external-secrets`, `kube-prometheus-stack`, `tailscale-operator`, plus `tailscale-config`, `monitoring-targets`, `monitoring-alerts` | | `scripts/run-all.sh` | closing summary told the operator to run 11 and 15 | | `renovate.json` | two `prBodyNotes` instructing a script that would no longer exist | | `docs/07`, `docs/10`, `docs/11`, `docs/14` | prose, a table row, and a numbered step | Removing the numbered step in `docs/10-secrets.md` renumbered the rest, which broke two in-text cross-references (`step 5`, `step 3`) — both repointed. **external-secrets loses its sha256 bundle pin** along with the script. The CRDs are rendered from the chart now, so there is no checksum for a human to recompute and paste into a branch before merging. ## promtool parity `mise.toml` pins `promtool` so a rule it accepts is a rule Prometheus accepts — `docs/07-monitoring.md` states that outright, and nothing enforced it. `scripts/ci/check-promtool-parity.sh` compares the pin against the Prometheus image in the already-rendered chart, and `render-applications.sh` fails when they disagree. No new network calls: the render is already there. Renovate keeps `promtool` disabled deliberately. The version is internal to the chart, not a dependency Renovate can see, so left enabled it would track the latest Prometheus release and drift from what the chart deploys. The PR note now says to set it by hand, and CI prints the value to use. ## Note on the first version of that check It passed all six of its unit tests and found **zero** Prometheus images in the real render. The chart emits `image: "quay.io/..."` quoted; the pattern excluded a quote in that position, and the hand-written fixture left it bare. Fixture and code agreed with each other and not with the chart. The fixture now carries the shape that actually ships, with a separate case for the bare form — and the check is wired into the real pipeline in the same PR, which is what exposed it. ## Verification 39 bats tests, all 24 pre-commit hooks, and `render-applications.sh` pass. `render-applications.sh` prints `promtool 3.14.0 matches the rendered Prometheus 3.14.0`, and fails with both versions named when `mise.toml` is edited to drift.

ivuorinen added 4 commits

2026-09-26 13:13:21 +00:00

test: check promtool tracks the Prometheus the chart renders 55925bffd5

ci: fail the render job when promtool and Prometheus disagree 2e74160a70

mise.toml pins promtool so a rule it accepts is a rule Prometheus accepts,
which docs/07-monitoring.md states outright. Renovate tracked the two
through different datasources and could move either alone, so nothing kept
the claim true.

The comparison reads the already-rendered chart, so it needs no network of
its own and lives where the render already happens.

The first version passed all six of its unit tests and found nothing in the
real render: the chart emits image: "quay.io/..." quoted, and the pattern
excluded a quote in that position, while the hand-written fixture left it
bare. Fixture and code agreed with each other and not with the chart. The
fixture now carries the shape that actually ships, with a separate case for
the bare form.

chore: Renovate notes no longer instruct a CRD step that is gone 99aa43c896

feat: drop the manual CRD step from the deploy path

validate / render (pull_request) Successful in 50s

Details

validate / hooks (pull_request) Successful in 1m27s

Details

295045477b

The crds Application installs these CRDs on sync, verified in-cluster in
#50: all three Jobs completed, the oversized CRDs carry no
last-applied-configuration annotation, and the three dependent
Applications stayed Synced and Healthy. So a Renovate chart bump no
longer needs anything run against the cluster before it can be merged.

Removes scripts 11, 15 and 18, and every instruction to run them — which
turned out to live in more places than the deletion itself: four other
Applications, run-all.sh's closing summary, two Renovate prBodyNotes that
told the reviewer to run a script that would no longer exist, and a
numbered step in docs/10-secrets.md whose removal renumbered the two
cross-references pointing past it.

external-secrets loses its sha256 bundle pin along with the script: the
CRDs are rendered from the chart now, so there is no checksum for a human
to recompute and paste into a branch.

ivuorinen merged commit 4a08175bf1 into main

2026-09-26 13:16:50 +00:00

ivuorinen deleted branch feat/drop-manual-crd-step

2026-09-26 13:16:50 +00:00

ivuorinen referenced this pull request from a commit

2026-09-26 13:16:52 +00:00

feat: drop the manual CRD step from the deploy path (#53)