chore(runners): drop the orphaned atlas publisher runner #843

Merged

coilysiren merged 1 commit from aos/claude/wt57-atlas-cleanup into main

2026-08-15 17:19:03 +00:00

coilyco-ops commented

2026-08-15 17:00:39 +00:00

Owner

Closes #835.

coilyco-bridge/atlas returns 404 on the forge. Its scoped publisher runner stayed declared and deployed, crashlooping 283 times in 24 hours on unauthenticated: unregistered runner, and its Failed StatefulSet is what held the Flux apps Kustomization at Ready=False.

Removed

deploy/forgejo-runners-scoped/publisher-atlas-repository/
its entry in deploy/forgejo-runners-scoped/kustomization.yaml
its scope line in scripts/provision-forgejo-scoped-runner-tokens.sh
its two roster entries in docs/forgejo-external-account-lockdown-tokens.md
its roster entry in docs/forgejo-publisher-runner.md

Repointed

docs/external-dns.md used services/atlas as its worked example in two places, and that path no longer exists in the deploy repo either. Both now point at services/eco-gnome, which was verified to carry every element the doc describes: the external-dns.coilysiren.me/managed label, the hostname annotation, and an external-dns.alpha.kubernetes.io/target injected at rollout time from /coilysiren/home/public-ip via its own rollout.sh.

Deliberately not touched

deploy/forgejo-runner-deploy-image/Dockerfile has two comments citing atlas as the rationale for bundling curl. Editing them is comment-only but would trigger a runner image rebuild and republish for no functional gain. Left for whenever that image next changes for a real reason.

Live cleanup

Every Flux Kustomization in this cluster sets prune: false, so this merge deletes nothing on its own. The StatefulSet, its PVC, and its ExternalSecret are being deleted separately, and the SSM parameter /forgejo/runner-registration/repo/coilyco-bridge/atlas remains (the guarded SSM surface exposes no deletion).

Validation

pre-commit run --all-files passes, including the repo's own forgejo-runner config guard, Forgejo runner recycle guard, and Forgejo storage lifecycle guard.

Local kustomize render was not available to me: bare kubectl is blocked by policy and the aosguard kubectl allowlist has no kustomize verb. The change is one line removed from a resources: list plus the directory it referenced, which kustomize fails loudly on if wrong.

Closes #835. `coilyco-bridge/atlas` returns 404 on the forge. Its scoped publisher runner stayed declared and deployed, crashlooping 283 times in 24 hours on `unauthenticated: unregistered runner`, and its Failed StatefulSet is what held the Flux `apps` Kustomization at `Ready=False`. ## Removed - `deploy/forgejo-runners-scoped/publisher-atlas-repository/` - its entry in `deploy/forgejo-runners-scoped/kustomization.yaml` - its scope line in `scripts/provision-forgejo-scoped-runner-tokens.sh` - its two roster entries in `docs/forgejo-external-account-lockdown-tokens.md` - its roster entry in `docs/forgejo-publisher-runner.md` ## Repointed `docs/external-dns.md` used `services/atlas` as its worked example in two places, and that path no longer exists in the deploy repo either. Both now point at `services/eco-gnome`, which was verified to carry every element the doc describes: the `external-dns.coilysiren.me/managed` label, the hostname annotation, and an `external-dns.alpha.kubernetes.io/target` injected at rollout time from `/coilysiren/home/public-ip` via its own `rollout.sh`. ## Deliberately not touched `deploy/forgejo-runner-deploy-image/Dockerfile` has two comments citing atlas as the rationale for bundling curl. Editing them is comment-only but would trigger a runner image rebuild and republish for no functional gain. Left for whenever that image next changes for a real reason. ## Live cleanup Every Flux Kustomization in this cluster sets `prune: false`, so this merge deletes nothing on its own. The StatefulSet, its PVC, and its ExternalSecret are being deleted separately, and the SSM parameter `/forgejo/runner-registration/repo/coilyco-bridge/atlas` remains (the guarded SSM surface exposes no deletion). ## Validation `pre-commit run --all-files` passes, including the repo's own `forgejo-runner config guard`, `Forgejo runner recycle guard`, and `Forgejo storage lifecycle guard`. Local `kustomize` render was not available to me: bare `kubectl` is blocked by policy and the aosguard kubectl allowlist has no `kustomize` verb. The change is one line removed from a `resources:` list plus the directory it referenced, which kustomize fails loudly on if wrong.

coilyco-ops added 1 commit

2026-08-15 17:00:39 +00:00

chore(runners): drop the orphaned atlas publisher runner

TruffleHog / Scan for secrets (pull_request) Successful in 5s

Details

CI / lint (pull_request) Successful in 47s

Details

810bf2e6ce

coilyco-bridge/atlas no longer exists on the forge (404). Its scoped
publisher runner stayed declared and deployed, crashlooping 283 times in
24h on "unauthenticated: unregistered runner", and its Failed StatefulSet
held the Flux apps Kustomization at Ready=False.

Removes the overlay, its kustomization entry, its token-provisioning
entry, and its two doc roster entries. Repoints the external-dns worked
example at eco-gnome, which carries the same managed label, hostname
annotation, and SSM-injected target that the doc describes.

The live StatefulSet, PVC, and ExternalSecret need separate deletion
because every Flux Kustomization here sets prune: false.

Refs coilyco-flight-deck/infrastructure#835

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-15 17:00:39 +00:00