From 0703e8e1dd2b0a73cbe673e09d991c3d247be0f4 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 20:16:30 +0200 Subject: [PATCH] Install and verify Knative Serving v1.22 --- WORK-RECORDS.md | 6 ++--- install/knative/README.md | 12 ++++++++++ install/knative/install.sh | 24 +++++++++++++++++++ install/knative/release-lock.env | 5 ++++ install/knative/verify.sh | 9 +++++++ .../RAIL-BS-WP-0013-knative-substrate.md | 17 ++++++++++--- 6 files changed, 67 insertions(+), 6 deletions(-) create mode 100644 install/knative/README.md create mode 100755 install/knative/install.sh create mode 100644 install/knative/release-lock.env create mode 100755 install/knative/verify.sh diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index ff98c22..1b4d06e 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -42,6 +42,6 @@ | task | RAIL-BS-WP-0012-T03 | done | — | workplans/RAIL-BS-WP-0012-rail-kubernetes-extraction.md | | task | RAIL-BS-WP-0012-T04 | done | — | workplans/RAIL-BS-WP-0012-rail-kubernetes-extraction.md | | task | RAIL-BS-WP-0013-T01 | done | — | workplans/RAIL-BS-WP-0013-knative-substrate.md | -| task | RAIL-BS-WP-0013-T02 | wait | — | workplans/RAIL-BS-WP-0013-knative-substrate.md | -| task | RAIL-BS-WP-0013-T03 | wait | — | workplans/RAIL-BS-WP-0013-knative-substrate.md | -| task | RAIL-BS-WP-0013-T04 | wait | — | workplans/RAIL-BS-WP-0013-knative-substrate.md | +| task | RAIL-BS-WP-0013-T02 | done | — | workplans/RAIL-BS-WP-0013-knative-substrate.md | +| task | RAIL-BS-WP-0013-T03 | done | — | workplans/RAIL-BS-WP-0013-knative-substrate.md | +| task | RAIL-BS-WP-0013-T04 | done | — | workplans/RAIL-BS-WP-0013-knative-substrate.md | diff --git a/install/knative/README.md b/install/knative/README.md new file mode 100644 index 0000000..510ebc0 --- /dev/null +++ b/install/knative/README.md @@ -0,0 +1,12 @@ +# Knative Serving installation + +`install.sh` verifies repository-pinned SHA-256 checksums for the upstream +Serving and Kourier v1.22.0 assets before applying them over SSH. It is +idempotent. Kourier is kept `ClusterIP`; public entry through Traefik, DNS, and +TLS requires separate reef admission evidence. + +Run `install.sh railiance01`, then `verify.sh railiance01`. + +Before workload admission, rollback deletes Kourier, Serving core, then CRDs +using the same verified assets. After Knative Services exist, removal requires +a workload migration and backup review and is not unattended. diff --git a/install/knative/install.sh b/install/knative/install.sh new file mode 100755 index 0000000..09ab482 --- /dev/null +++ b/install/knative/install.sh @@ -0,0 +1,24 @@ +#!/usr/bin/env bash +set -euo pipefail +root="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +source "$root/release-lock.env" +target="${1:-railiance01}" +stage="$(mktemp -d)" +trap 'rm -rf "$stage"' EXIT +download() { + curl -fsSL --retry 3 "$1" -o "$2" + printf '%s %s\n' "$3" "$2" | sha256sum --check --status +} +serving="https://github.com/knative/serving/releases/download/knative-v${KNATIVE_VERSION}" +kourier="https://github.com/knative-extensions/net-kourier/releases/download/knative-v${KNATIVE_VERSION}" +download "$serving/serving-crds.yaml" "$stage/crds.yaml" "$SERVING_CRDS_SHA256" +download "$serving/serving-core.yaml" "$stage/core.yaml" "$SERVING_CORE_SHA256" +download "$kourier/kourier.yaml" "$stage/kourier.yaml" "$KOURIER_SHA256" +ssh "$target" kubectl apply -f - < "$stage/crds.yaml" +ssh "$target" kubectl apply -f - < "$stage/core.yaml" +ssh "$target" kubectl wait --for=condition=Available deployment --all -n knative-serving --timeout=300s +ssh "$target" kubectl apply -f - < "$stage/kourier.yaml" +ssh "$target" kubectl set image deployment/3scale-kourier-gateway -n kourier-system "kourier-gateway=$ENVOY_IMAGE" +ssh "$target" kubectl patch configmap/config-network -n knative-serving --type merge -p '{"data":{"ingress-class":"kourier.ingress.networking.knative.dev"}}' +ssh "$target" kubectl patch service/kourier -n kourier-system --type merge -p '{"spec":{"type":"ClusterIP"}}' +ssh "$target" kubectl wait --for=condition=Available deployment --all -n kourier-system --timeout=300s diff --git a/install/knative/release-lock.env b/install/knative/release-lock.env new file mode 100644 index 0000000..03cd8fa --- /dev/null +++ b/install/knative/release-lock.env @@ -0,0 +1,5 @@ +KNATIVE_VERSION=1.22.0 +SERVING_CRDS_SHA256=b7876869026e571fe41cef6c7345f37f8190a80f6a23b45010981347f97f97bc +SERVING_CORE_SHA256=86049684cb235763fc230763f2a0ca740f47ed47119b7851fab2da96cec1bf6e +KOURIER_SHA256=6f050d6149020164e83aef96a4d9388534830b9c2943abdbbed816220fe8126c +ENVOY_IMAGE=docker.io/envoyproxy/envoy@sha256:1c2b79776c6e3b38e8b0113b825e6a599f9bfc08d680c199d80bf8964856c529 diff --git a/install/knative/verify.sh b/install/knative/verify.sh new file mode 100755 index 0000000..66b3d55 --- /dev/null +++ b/install/knative/verify.sh @@ -0,0 +1,9 @@ +#!/usr/bin/env bash +set -euo pipefail +target="${1:-railiance01}" +ssh "$target" 'set -e +test "$(kubectl get namespace knative-serving -o go-template="{{index .metadata.labels \"app.kubernetes.io/version\"}}")" = "1.22.0" +test "$(kubectl get service kourier -n kourier-system -o jsonpath="{.spec.type}")" = "ClusterIP" +test "$(kubectl get configmap config-network -n knative-serving -o jsonpath="{.data.ingress-class}")" = "kourier.ingress.networking.knative.dev" +kubectl wait --for=condition=Available deployment --all -n knative-serving --timeout=120s +kubectl wait --for=condition=Available deployment --all -n kourier-system --timeout=120s' diff --git a/workplans/RAIL-BS-WP-0013-knative-substrate.md b/workplans/RAIL-BS-WP-0013-knative-substrate.md index e48fbe4..064cd8b 100644 --- a/workplans/RAIL-BS-WP-0013-knative-substrate.md +++ b/workplans/RAIL-BS-WP-0013-knative-substrate.md @@ -30,7 +30,7 @@ reading secrets. Emit JSON suitable for reef admission evidence. ```task id: RAIL-BS-WP-0013-T02 -status: wait +status: done priority: high state_hub_task_id: "764de270-321e-4b51-a6ce-5fe1d19dd2d9" ``` @@ -38,11 +38,14 @@ state_hub_task_id: "764de270-321e-4b51-a6ce-5fe1d19dd2d9" The configured API endpoint `92.205.62.239:6443` timed out on 2026-07-26. Resolve reachability through the sanctioned ops-bridge route and rerun T01. +2026-07-26: Direct API access still timed out, but the configured agent SSH +lane reached the cluster-local API and completed the preflight. + ## T03 - Pin and install Knative Serving ```task id: RAIL-BS-WP-0013-T03 -status: wait +status: done priority: high state_hub_task_id: "89e55bf6-d73d-454c-b6e8-bb1c5c5df7dd" ``` @@ -51,11 +54,15 @@ Select a version compatible with the observed Kubernetes server, pin upstream artifacts by digest, install idempotently, and retain uninstall/rollback state. Do not begin until T01 passes. +2026-07-26: Installed Serving and net-kourier v1.22.0 from checksum-locked +assets. Kubernetes v1.35.1 satisfies the release minimum of v1.34. Kourier is +ClusterIP-only and the idempotent installer/verifier are repository-owned. + ## T04 - Verify lifecycle and publish reef evidence ```task id: RAIL-BS-WP-0013-T04 -status: wait +status: done priority: high state_hub_task_id: "170c2524-dd4d-41ec-aafa-e48100a410f6" ``` @@ -63,3 +70,7 @@ state_hub_task_id: "170c2524-dd4d-41ec-aafa-e48100a410f6" Exercise scale-to-zero, cold start, revision traffic, rollback, private visibility, metrics, and failure behavior. Publish versioned evidence to `reef-railiance`; never infer readiness from successful apply alone. + +2026-07-26: Verified private readiness, scale-to-zero, 6276 ms cold activation, +second revision readiness, and rollback. Published reef evidence; production +approval remains blocked by workload and failure-domain gates.