coulomb/railiance-cluster
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-cluster/install/knative
History
Exact
codex b084150906
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Label the Knative overlays with the knative release unit. 
Serving-core and Kourier each carry the Deployments that exist in that upstream file. The render test expects the label and still rejects any other drift.

RELREG-WP-0002-T01

Assistant: grok
Assistant-Session: 01a15f9f-3d77-7d21-911b-d93c86f9d14f
2026-10-21 22:23:51 +02:00
..
overlays Label the Knative overlays with the knative release unit. 2026-10-21 22:23:51 +02:00
install.sh Apply rail-knative's declared Knative CPU requests in the installer (RAIL-BS-WP-0015). 2026-09-21 18:45:47 +02:00
README.md Render rail-knative's HPA caps and 10m CPU requests in the Knative installer (RCLUSTER-WP-0020). 2026-10-21 08:43:27 +02:00
release-lock.env Install and verify Knative Serving v1.22 2026-07-26 20:16:30 +02:00
render.sh Apply rail-knative's declared Knative CPU requests in the installer (RAIL-BS-WP-0015). 2026-09-21 18:45:47 +02:00
verify.sh Render rail-knative's HPA caps and 10m CPU requests in the Knative installer (RCLUSTER-WP-0020). 2026-10-21 08:43:27 +02:00

README.md

Knative Serving installation

install.sh verifies repository-pinned SHA-256 checksums for the upstream Serving and Kourier v1.22.0 assets before applying them over SSH. It is idempotent.

It does not apply the upstream manifests as published. render.sh (also usable on its own, with no cluster contact) renders them through the kustomize overlays in overlays/: CRDs verbatim and first, because serving-core.yaml repeats one of them; then serving-core and kourier with the CPU requests and HPA ceilings that rail-knative declares in substrate/v1.22.0/ (cpu-requests.patch.yaml: 10m for activator, autoscaler, controller, webhook, net-kourier-controller and 3scale-kourier-gateway; hpa-caps.patch.yaml: maxReplicas activator 3, webhook 2, 3scale-kourier-gateway 3; RAIL-KNATIVE-WP-0003), the Kourier Service as ClusterIP and the Envoy gateway image pinned to ENVOY_IMAGE. Memory requests, limits, minReplicas and HPA targets stay upstream. Applying the unpatched upstream files restores 300m/200m/100m and HPA ceilings 20/5/10, and exhausts railiance01's CPU requests again. tests/test_knative_render.py proves the render offline and fails if these overlays drift from rail-knative's declaration. install.sh needs a local kubectl for kubectl kustomize. Kourier is kept ClusterIP; public entry through Traefik, DNS, and TLS requires separate reef admission evidence.

The installer enables only Knative's kubernetes.podspec-init-containers feature. Production workloads use init containers for fail-closed admission checks such as verifying that egress policy has reconciled before application code starts.

Run install.sh railiance01, then verify.sh railiance01; verify.sh is read-only and also checks the six CPU requests, the three HPA ceilings and the Envoy pin.

Before workload admission, rollback deletes Kourier, Serving core, then CRDs using the same verified assets. After Knative Services exist, removal requires a workload migration and backup review and is not unattended.