pkg-host deployment

This repository is the destination for the seanfarm pkg-host GitOps bundle. The first commit copies bundle/pkg-host from released sean/pipelines main at 41a74ac7eaf37dd7d73fe8273b47c6b65285963d. The three files under manifests/pkg-host have the same bytes as that source.

The bundle deploys the public https://pkg.sean.farm package and image browser. It contains the pkg Namespace, a three-replica Deployment and its Service, two portal Gateway API routes, a disruption budget, and retained MinIO bucket and anonymous-read policy resources. It contains no Secret or persistent volume.

Shared dashboard contract

The pkg-host-dash ServiceAccount is also the identity of the Pipelines dashboard Deployment. The dashboard uses a projected token to read live and archived workflow data. For this reason, this repository must continue to own these existing objects until the dashboard has a different identity:

• ServiceAccount/pkg-host-dash in pkg;
• Role/zelnet-workflow-reader in workflows;
• RoleBinding/pkg-host-dash-workflow-reader in workflows, with the pkg/pkg-host-dash subject.

The internet-facing pkg-host container does not receive a Kubernetes token. Both its Pod and its ServiceAccount keep automatic token mounts disabled.

Application handoff

apps/pkg-host.yaml records the exact live Argo CD Application contract. Its name remains pkg-host in argocd; its project remains pipelines; its destination remains the pkg Namespace; and automated prune, self-heal, server-side apply, and CreateNamespace=false remain enabled. The live Argo CD application tracks this repository at main and uses manifests/pkg-host. Pipelines released the source handoff and retired its old bundle. The singleton Application kept its identity during the handoff.

Runtime dependencies remain outside this repository: the MinIO resource operator and MinIO service, the portal/portal-gateway pkg-http and pkg-https listeners and cross-namespace grants, and the Pipelines dashboard consumer.

Binjovi owns the Build, Release, and Deploy lifecycle. The deployment target is pkg-host-development. Its availability gate checks /healthz after Argo CD converges.

Test

Run the cluster-free contract suite:

bash tests/check.sh

The suite verifies the copied file hashes, rendered object identities, image digest, retained public bucket policy, route parents, live Application contract, and the cross-namespace dashboard RBAC seam.

Native pipeline timing

Binjovi uses native agents for this project's Build, Release, and Deploy tasks. The configured deployment target is pkg-host-development. The deployment checks the package host health endpoint after Git revision verification.

Select an exact successful Build when you release:

binjovictl builds pkg-host
binjovictl release pkg-host --build BUILD_ID --wait
binjovictl status pkg-host

Open the project dashboard and expand an execution attempt to inspect its task timeline and available profiles. The latest completed pipeline summary includes Build and Release time as well as deployment time. Check the Deploy result separately after Release completes. Telemetry explains execution; the stored revision and verification evidence establish completion.