chore(argo): retire the Argo engine and archive sean/pipelines

sean commented

2026-09-08 18:19:56 +00:00

Owner

Three commits. (1) Argo Events reconciles nothing -- no EventBus, EventSource or Sensor exists cluster-wide -- and the cluster Flux Kustomization is prune: false, so a tombstone Job deletes the live Kustomization object, which being prune: true garbage-collects the controller and its namespace. (2) The Argo Workflows Application has no finalizer and runs selfHeal, so a plain delete orphans 70 running objects; the Job ADDS resources-finalizer.argocd.argoproj.io first so ArgoCD cascades and its own resource list decides what goes. Namespace workflows survives -- it holds the five live Binjovi agents -- and the Job asserts them before and after with a read-only grant there. (3) sean/pipelines is archived: nothing deploys from it, all five ArgoCD Applications and all four image Deployments it named are NotFound, and both gitmirror CRs are deletionPolicy Retain so the code is untouched. Backup confirmed first: no ref exists only on Forgejo. Supersedes PR #461, which targeted main; Binjovi intake watches trunk. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 3 commits

2026-09-08 18:19:56 +00:00

chore(argo): retire the Argo Events controller 5fe3d2c63e

Argo Events reconciles nothing. `kubectl get sensors,eventsources,eventbus -A`
returns no resources anywhere in the cluster: the Pipelines EventSource that
used to trigger builds went with Pipelines, and Binjovi never used Argo Events.
One `controller-manager` Deployment has been idling in ns `argo-events` since.

Removing the wrapper is not enough on its own. The `cluster` Flux Kustomization
that delivers it is `prune: false`, so deleting the file stops Flux MANAGING
the live `argo-events` Kustomization without deleting it, and the controller
would keep running with nothing in the tree declaring it. That is exactly what
happened to the four observability agents in 2026-08, whose Kustomization
objects had to be deleted separately afterwards.

So this is two halves that must land together: the tree stops declaring
argo-events, and a tombstone Job deletes the live Kustomization object. That
one delete is enough, because the `argo-events` Kustomization is itself
`prune: true` -- Flux garbage-collects the controller, its RBAC and the
namespace around them. The Job's namespace grant is READ ONLY on purpose: Flux
performs the delete and the Job only waits for the namespace to disappear, so a
prune that never ran cannot hide behind a namespace the Job removed itself.

The CRDs stay for a later release. Deleting a CRD while its controller still
runs leaves a finalizer wedge, so `crds/argo-events-*.yaml` goes only after
this Job has run and the controller is confirmed gone.

`tests/argo-events-retired.sh` pins both halves and gives every assertion a
negative control: a widened RBAC grant, a missing prune proof and a namespace
delete grant each turn it red on their own.

The upstream inventory loses the `argo-events` row and the `natsio/` allow
line, whose only subject was the vendored manifest this deletes; no image under
that prefix is left in the tree.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

chore(argo): retire the Argo Workflows engine cccc523d4e

ArgoCD Application `argo-workflows` syncs the engine into namespace
`workflows`: two `workflows-argo-workflows-server` replicas, two
`workflows-argo-workflows-workflow-controller` replicas, the
`argo-otlp-exporter`, the workflows.sean.farm HTTPRoutes and twelve
Pipelines-era ExternalSecrets -- 70 objects.

Nothing creates a Workflow any more. `builder-images` went native, the
`zot-src` shadow entry never created a Workflow object at all, and the
`argo-workflows` project left `sean/binjovi-plans` in the release before this
one, so Binjovi has already stopped tending the Application. In ArgoCD's own
terms it was orphaned long ago: its tracking-id names `pipelines-argocd`, an
app-of-apps deleted with Pipelines.

THE FINALIZER IS THE POINT. The Application carries no
`resources-finalizer.argocd.argoproj.io` and runs `syncPolicy.automated` with
`selfHeal`, so deleting it as it stands orphans all 70 objects and leaves them
running, and deleting them first just makes ArgoCD put them back. Adding the
finalizer before the delete makes ArgoCD cascade, which also means the
Application's own resource list decides what goes -- safer than this Job
enumerating seventy names and getting one wrong, and it keeps the RBAC to a
single object.

THE NAMESPACE SURVIVES. `workflows` also holds the five live Binjovi agents
and the registry-package-prune CronJob, none of them owned by this
Application. `CreateNamespace=true` made the namespace without tracking it, so
the cascade cannot reach it -- verified against the live Application, whose
resource list names no Namespace at all. The Job asserts that before it patches
anything and refuses if it ever stops being true, asserts the five agents are
running before, and asserts they are still running after. Its grant in ns
`workflows` is read-only: a botched run must not be able to remove the very
agents the post-condition protects. Retiring Pipelines broke a ServiceAccount
and two Forgejo tokens in this same namespace, which is the failure these
pre- and post-conditions exist to catch.

The CRDs stay for a later release. A CRD deleted while its controller still
runs leaves a finalizer wedge, so `crds/argo-workflows-*.yaml` and the 64
finished Workflow records go only after this Job has run.

`tests/argo-workflows-retired.sh` pins the cascade, the read-only namespace
grant, the survivor list and the before-and-after check, parses the inline
script under `sh`, and gives each of them a negative control: a lost finalizer,
a delete grant in ns `workflows` and a dropped survivor each turn it red alone.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

chore(pipelines): archive sean/pipelines

binjovi/ci Binjovi completed the frozen plan

Details

d6639f8a35

Nothing deploys from it. It sources 0 ArgoCD Applications and 0 Flux
GitRepositories, and every target its Binjovi entry named is already gone --
all five Applications (pipeline-base, pipelines, pipelines-operator,
pipelines-project-registry, workflows-infra-bare) and all four image
Deployments (pipelines-operator-controller-manager, pipelines,
pipelines-release-api, pipelines-mcp), verified NotFound against the live
cluster. Its ~25 pipeline templates, ~17 golden fixtures and 6 guards that name
MinIO are dead code; archiving the repo removes every one of those MinIO
references at once, with no endpoint edit.

BACKUP CONFIRMED FIRST, per gitmirrors/README.md. Forgejo and codeberg agree
exactly on main and trunk (3f02028f) and NO ref exists only on Forgejo. 261
refs exist only on codeberg: the mirror pushes main and trunk with no delete
refspec, so codeberg keeps branches Forgejo has since removed. The README's
`diff ... || STOP` therefore reports a difference for this repo no matter what
-- read the DIRECTION, not the exit code. A codeberg superset is the safe one;
a ref only on Forgejo is the failure that check exists for.

`gitmirrors` is prune: false on purpose -- a bad render under prune: true would
delete every backup mirror in the fleet and stop the codeberg backups silently
-- so removing the file only stops Flux managing the two CRs. A tombstone Job
releases them, push mirror first, because that is the one still writing to
codeberg while the repository CR exists.

THE CODE IS NOT DELETED. Both CRs carry deletionPolicy: Retain, so releasing
them is a no-op on the Forgejo side. The Job re-reads that from the LIVE object
and refuses if either says Delete, rather than trusting the manifest that used
to declare it: before forgejo-operator v0.6.34 the ForgejoRepository finalizer
called DeleteRepo() and destroyed all code, refs and history. What does change
is a cold rebuild -- with no ForgejoRepository there is no importSource, so
`make rebuild` will not re-seed sean/pipelines. That is what archiving it
means, and codeberg keeps the code.

`tests/pipelines-archived.sh` pins the Retain check, the live read, the pinned
RBAC and the release order, parses the inline script under `sh`, and turns red
on a removed policy check or a widened grant.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean referenced this pull request

2026-09-08 18:20:09 +00:00

chore(argo): delete the Argo CRDs and the RBAC that only Workflows used #464

binjovi-bot merged commit d6639f8a35 into trunk

2026-09-08 20:42:25 +00:00

Rows
Columns

chore(argo): retire the Argo engine and archive sean/pipelines #463