ci(06): verify kubectl-native CD — WG handshake + SA-auth + server-side dry-run - #1

Merged

Afgan0r merged 7 commits into

ci/verify-phase6-cd

Jun 13, 2026

Commits on Jun 13, 2026

ci(06): pin CI WireGuard peer to dedicated 10.8.0.3 (avoid laptop 10.8.0.2 collision)

Pavlov Alexandr
and
claude
committed
fix(06): WG handshake — pass private-key via /dev/stdin, not process substitution

Pavlov Alexandr
and
claude
committed
fix(06): WG handshake — initiate it (keepalive + prime packet), don't just wait

Pavlov Alexandr
and
claude
committed
fix(06): WG tunnel — add kernel route to allowed-ips (raw wg set adds none)

Pavlov Alexandr
and
claude
committed
fix(06): CD apply — give each manifest its own -f (xargs appended bare files)

Pavlov Alexandr
and
claude
committed
fix(06): kubeconfig — embed CA data so it survives temp-file cleanup

Pavlov Alexandr
and
claude
committed
fix(06): CD glob — also exclude 00-namespace.yaml (operator-bootstrapped)

Pavlov Alexandr
and
claude
committed