feat: retire the Pipelines BuildKit fleet #406

Merged

binjovi-bot merged 1 commit from feat/retire-buildkit-fleet into trunk 2026-09-07 12:52:17 +00:00

Conversation 0 Commits 1 Files changed 12 +273 -66

sean commented 2026-09-07 11:45:43 +00:00

Owner

Copy link

Removes namespace buildkit: a 5-pod DaemonSet running privileged: true on unauthenticated plaintext gRPC :1234, plus five 40 GiB caches.

Why it can go. Its only client was the Pipelines pipeline-build-images template, retired 2026-09-06. On 2026-09-07 buildctl du against a fleet pod reported 0 B total, 0 B reclaimable, and /var/lib/buildkit held 132 KiB of lock and empty database files. It is not declared in this repo — it is ArgoCD Application/buildkit — and its parent app-of-apps is already gone with its Flux seed stubbed, so nothing recreates it and it would not survive make rebuild.

A tombstone Job, not a kubectl delete, matching binjovi/buildkit-cache-v2-tombstone.yaml, so the removal is reviewable and replayable. The Application carries no cascade finalizer, so the Job deletes it first to stop ArgoCD re-syncing, then deletes the namespace, which is what actually takes the workloads and caches.

buildkitd-restrict narrows to the one unauthenticated daemon that remains. A selector matching nothing would render, dry-run and reconcile green while denying nothing, so it was checked against live identity labels (k8s:app=buildkitd, k8s:io.kubernetes.pod.namespace=shipwright-build); the only pods it stops selecting are the five being retired. Binjovi's daemons stay unselected — they require mutual TLS. REMAINING WORK item 2 (hostPort 1237) is closed by the retirement itself.

The sean/buildkit REPO is kept. The fork carries a ZFS snapshotter mount-namespace fix and Binjovi still manages its branch protections. Only the ArgoCD Application goes; the guards pinning the Application allow-list are updated, the ones pinning the repository are not.

Delete kubernetes/flux/infrastructure/pipelines-retirement/, its Kustomization and its roll-gate allow-list entry once kubectl get ns buildkit returns NotFound.

tests/check.sh green.

https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

Removes namespace `buildkit`: a 5-pod DaemonSet running `privileged: true` on unauthenticated plaintext gRPC :1234, plus five 40 GiB caches. **Why it can go.** Its only client was the Pipelines `pipeline-build-images` template, retired 2026-09-06. On 2026-09-07 `buildctl du` against a fleet pod reported **0 B total, 0 B reclaimable**, and `/var/lib/buildkit` held 132 KiB of lock and empty database files. It is not declared in this repo — it is ArgoCD `Application/buildkit` — and its parent app-of-apps is already gone with its Flux seed stubbed, so nothing recreates it and it would not survive `make rebuild`. **A tombstone Job, not a kubectl delete**, matching `binjovi/buildkit-cache-v2-tombstone.yaml`, so the removal is reviewable and replayable. The Application carries no cascade finalizer, so the Job deletes it first to stop ArgoCD re-syncing, then deletes the namespace, which is what actually takes the workloads and caches. **`buildkitd-restrict` narrows** to the one unauthenticated daemon that remains. A selector matching nothing would render, dry-run and reconcile green while denying nothing, so it was checked against live identity labels (`k8s:app=buildkitd`, `k8s:io.kubernetes.pod.namespace=shipwright-build`); the only pods it stops selecting are the five being retired. Binjovi's daemons stay unselected — they require mutual TLS. REMAINING WORK item 2 (hostPort 1237) is closed by the retirement itself. **The `sean/buildkit` REPO is kept.** The fork carries a ZFS snapshotter mount-namespace fix and Binjovi still manages its branch protections. Only the ArgoCD Application goes; the guards pinning the Application allow-list are updated, the ones pinning the repository are not. Delete `kubernetes/flux/infrastructure/pipelines-retirement/`, its Kustomization and its roll-gate allow-list entry once `kubectl get ns buildkit` returns NotFound. `tests/check.sh` green. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit 2026-09-07 11:45:43 +00:00

feat: retire the Pipelines BuildKit fleet ... 732552b080

Namespace `buildkit` runs a 5-pod DaemonSet with `privileged: true` serving
unauthenticated plaintext gRPC on :1234, plus five 40 GiB caches. Its only
client was the Pipelines pipeline-build-images template, retired 2026-09-06.
On 2026-09-07 `buildctl du` against a fleet pod reported 0 B total and 0 B
reclaimable, and /var/lib/buildkit held 132 KiB of lock and empty database
files: it has built nothing since.

It is not declared in this repo -- it is ArgoCD Application `buildkit` synced
from sean/buildkit.git -- and its parent app-of-apps is already gone with its
Flux seed stubbed out, so nothing recreates it and it would not survive
`make rebuild`. A tombstone Job removes it, matching the idiom in
binjovi/buildkit-cache-v2-tombstone.yaml, so the removal is reviewable and
replayable instead of an undocumented kubectl delete. The Application carries
no cascade finalizer, so the Job deletes it first to stop ArgoCD re-syncing,
then deletes the namespace, which is what actually takes the workloads and
caches.

buildkitd-restrict narrows to the one unauthenticated daemon that remains,
shipwright-build/buildkitd. That selector matching nothing would render,
dry-run and reconcile green while denying nothing, so it was checked against
the live identity labels: k8s:app=buildkitd plus
k8s:io.kubernetes.pod.namespace=shipwright-build, and the only pods it stops
selecting are the five being retired. Binjovi's daemons stay unselected --
they require mutual TLS, so they are not the unauthenticated-endpoint problem
this policy exists to contain. REMAINING WORK item 2 (hostPort 1237, unfenceable
by network policy) is closed by the retirement itself.

The `sean/buildkit` REPO is deliberately kept: the fork carries a ZFS
snapshotter mount-namespace fix, the mirror costs nothing, and Binjovi still
manages its branch protections. Only the ArgoCD Application goes. The two
guards that pin the Application allow-list are updated; the ones that pin the
repository are not.

Delete this directory, its Kustomization and its allow-list entry once
`kubectl get ns buildkit` returns NotFound.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit d0f6db37d5 into trunk 2026-09-07 12:52:17 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!406

No description provided.