coilyco-flight-deck/agentic-os

Watch

Mount an operator-selected kubeconfig through the AOS full-image launcher #512

New issue

Closed

opened 2026-07-13 22:50:11 +00:00 by coilysiren · 2 comments

coilysiren commented

2026-07-13 22:50:11 +00:00

Owner

workflow: pull-request-and-merge

Goal

The AOS launcher can mount an operator-selected host kubeconfig into the consumed full compatibility container for an authorized live-access role.

Boundary

Language images own no host mounts and remain build artifacts. The AOS launcher owns runtime composition. The launcher must not project cluster access into sealed engineer or QA roles.

Scope

AOS accepts an explicit operator-local kubeconfig source rather than assuming one host path.
The launcher mounts the selected file read-only at a deterministic container path and sets KUBECONFIG for the child process.
AOS fails clearly when an authorized role requests a missing or malformed source.
AOS omits the mount and environment variable for roles without cluster authority.
Tests cover spaces in host paths, absent files, read-only mounting, role denial, and coexistence with private-network composition.
Documentation separates a kubectl binary in the image from live credentials and transport at container bring-up.

Done

An authorized role can use the selected host kubeconfig from the full AOS container.
Engineer and QA launches receive no kubeconfig mount.
Language Dockerfiles contain no host-specific mount logic.
Repository validation passes.

workflow: pull-request-and-merge ## Goal The AOS launcher can mount an operator-selected host kubeconfig into the consumed `full` compatibility container for an authorized live-access role. ## Boundary Language images own no host mounts and remain build artifacts. The AOS launcher owns runtime composition. The launcher must not project cluster access into sealed engineer or QA roles. ## Scope * AOS accepts an explicit operator-local kubeconfig source rather than assuming one host path. * The launcher mounts the selected file read-only at a deterministic container path and sets `KUBECONFIG` for the child process. * AOS fails clearly when an authorized role requests a missing or malformed source. * AOS omits the mount and environment variable for roles without cluster authority. * Tests cover spaces in host paths, absent files, read-only mounting, role denial, and coexistence with private-network composition. * Documentation separates a kubectl binary in the image from live credentials and transport at container bring-up. ## Done * An authorized role can use the selected host kubeconfig from the full AOS container. * Engineer and QA launches receive no kubeconfig mount. * Language Dockerfiles contain no host-specific mount logic. * Repository validation passes.

coilyco-ops added the

autonomy

headless

priority

labels

2026-07-14 07:44:04 +00:00

coilysiren referenced this issue from coilyco-flight-deck/ward

2026-07-14 15:27:09 +00:00

director should emit colorized, space buffered, visually distinct messages about the categories of actions its performing on startup #1283

coilyco-ops changed title from ~~aos images need to mount host local kubeconf~~ to Mount an operator-selected kubeconfig through the AOS full-image launcher

2026-07-24 06:47:18 +00:00

coilyco-ops added

priority

and removed

priority

labels

2026-07-29 06:19:36 +00:00

coilyco-ops referenced this issue from a commit

2026-07-29 16:22:44 +00:00

feat(aos): mount operator-selected kubeconfig

coilyco-ops closed this issue

2026-07-29 16:25:11 +00:00

coilyco-ops commented

2026-07-29 16:27:53 +00:00

Owner

WARD-WORKFLOW: failed ❌

reap details

ward container reap found no residual work to salvage, but this launched run exited without a WARD-WORKFLOW comment.

Container: engineer-codex-agentic-os-512
Workflow: merge-remote-main
Recovery: inspect the container log, fix the engineer seed or launch mode, and redispatch.

— Codex, via ward agent

WARD-WORKFLOW: failed ❌ <details><summary>reap details</summary> `ward container reap` found no residual work to salvage, but this launched run exited without a `WARD-WORKFLOW` comment. - **Container:** `engineer-codex-agentic-os-512` - **Workflow:** `merge-remote-main` - **Recovery:** inspect the container log, fix the engineer seed or launch mode, and redispatch. </details>  — Codex, via `ward agent`

coilyco-ops commented

2026-07-29 16:27:53 +00:00

Owner

WARD-WORKFLOW: reservation-released

release details

Run finished with WARD-WORKFLOW: failed ❌.

ward container reap released container engineer-codex-agentic-os-512 (--harness codex): the terminal outcome supersedes the reservation, so a later redispatch no longer needs --override-reservation.

— Codex, via ward agent

WARD-WORKFLOW: reservation-released <details><summary>release details</summary> Run finished with `WARD-WORKFLOW: failed ❌`. `ward container reap` released container `engineer-codex-agentic-os-512` (`--harness codex`): the terminal outcome supersedes the reservation, so a later redispatch no longer needs `--override-reservation`. </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue

2026-08-04 07:38:42 +00:00

Make dev-base language images cached build-only payloads #863

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#512

No description provided.

Rows
Columns