Skip to content

kaddy v0.1.0 — serve → scrape → fire, all GitOps

Choose a tag to compare

View all tags
@konih konih released this 16 Jul 08:31
v0.1.0
81ad7c3
This commit was signed with the committer’s verified signature.
konih Konrad Heimel
SSH Key Fingerprint: W5PhRWpN1/w24fxpZmFPcvUpcVr6AngrjxZCdTzF4s4
Verified
Learn about vigilant mode.

kaddy v0.1.0 — local-first Website-as-a-Service platform milestone

The gridscale hiring-exercise brief, answered end-to-end and verified live:

Highlights

  • Serve → scrape → fire: the clubhouse sample site is served over verified HTTPS through the
    Cilium Gateway (cert-manager local CA, no -k); a blackbox probe watches it with CA-trusted
    TLS; task demo:fire breaks it → ClubhouseDown fires in Alertmanager → restores → resolves
    (~90 s). 5 marshal alerts, every one promtool fire/silent-tested with a coverage gate.
  • GitOps everything: ArgoCD app-of-apps — 14/14 Applications Synced/Healthy on main
    (spine, observability, monitoring, rollouts, policies, kyverno). Control-plane apps self-heal.
  • Progressive delivery (mulligan): Argo Rollouts + Gateway API plugin mutates live HTTPRoute
    canary weights     (100/0 → 20 → 50 → 100), task demo:chaos proves abort → auto-rollback.
  • Observability as code: kube-prometheus-stack + Loki + Alloy (capacity-trimmed for an 8 GB kind
    node), Grafana dashboard kaddy-marshal (12 panels) provisioned via sidecar,
    data-source-managed alerts verified through the Grafana API.
  • Enforcing security baseline: Kyverno v1.18.2 with 5 Enforce policies (ADR-0301 labels,
    data-classification vocabulary, pod-security trio) + verifyImages (Audit, keyless attestor),
    default-deny NetworkPolicies (incl. the Cilium Gateway hairpin-identity fix), restricted
    ArgoCD AppProjects    , SOPS-age secrets, gitleaks + pinned supply chain in CI.
  • Keyless signing: ghcr.io/platformrelay/kaddy-showcase (the Slidev deck served by Caddy,
    multi-stage, non-root) is built, pushed, cosign-signed via GitHub OIDC and verified in-workflow.
  • Interview deck: recording-ready Slidev deck — 1358-word speaker script, narrative beats with a
    ~10 min time budget, live iframe surfaces, AI cover-art prompt suite + branding prompts — gated in CI.
  • Test pyramid in CI: tofu test (17) · conftest/Rego · kyverno CLI (28) · promtool (13 cases) ·
    chainsaw e2e on kind · deck gates — 5 workflows, all green on the tagged commit.

Known limitations (lab threat model — tracked with targets)

  • No RBAC/OIDC yet (E1d); ArgoCD --insecure in-cluster behind the Gateway; Grafana admin Secret is
    imperative until KSOPS (E1d).
  • verify-signed-images stays Audit until kaddy-signed images are the only
    ghcr.io/platformrelay/* images deployed.
  • 4 Helm grandchild apps still project: default (documented); mulligan namespace not yet under
    default-deny; Loki-ruler log alerts + external Alertmanager receiver deferred (E5 follow-ups).
  • Cilium/Rollouts-dependent chainsaw suites are live-verified but CI-skipped (no Cilium substrate in
    CI); Let's Encrypt prod path is cloud-only.
  • Deferred epics: E6 Crossplane Website XRD, E8 evidence, E9 operator, E10 portal, E13 marketplace,
    e-caddy-mvp tenant variants.

Three replayable audits (baseline → mid-session → final) with 0 regressions across runs:
verdict RELEASE-READY. Full history in CHANGELOG.md.

Assets 2
Loading