José Almeida
88 lines
4.5 KiB
Markdown
88 lines
4.5 KiB
Markdown
---
|
|
id: "08-integration"
|
|
title: "Kubernetes integration verification"
|
|
status: completed
|
|
wave: 4
|
|
depends_on: ["02-lifecycle", "03-service-api", "04-backend-parity", "05-frontend-settings", "06-kind-e2e-ci", "07-docs-rbac"]
|
|
plan: "plan.md"
|
|
spec: "../../specs/kubernetes-executor/spec.md"
|
|
---
|
|
|
|
# Task 08: Kubernetes integration verification
|
|
|
|
- **Acceptance:** all child diffs are reconciled, every task's actual files and
|
|
targeted results are recorded, and the plan/spec statuses match reality.
|
|
- **Acceptance:** backend build/lint/tests, frontend lint/typecheck/i18n/tests,
|
|
focused production E2E, docs validation, and diff hygiene pass after the last
|
|
production edit, or each concrete external blocker is documented.
|
|
- **Acceptance:** manual Kind acceptance confirms no credentials in Pod spec,
|
|
exact restart/resume/cleanup boundaries, and desktop/mobile admin/member flows.
|
|
- **Verification:** task-defined commands from Tasks 01-07, followed by `make -C apps/backend build && make -C apps/backend lint && git diff --check`.
|
|
- **Files likely touched:** integration fixes across previously owned files plus
|
|
this plan/task status package; no speculative refactor.
|
|
- **Dependencies:** Tasks 02-07.
|
|
- **Parallelism:** primary-session integration only.
|
|
- **Inputs:** all task results and complete feature diff.
|
|
|
|
## Results
|
|
|
|
Completed on 2026-08-25. The task-owned and cross-task diffs were reconciled
|
|
against the shipped spec, including fresh per-create ownership nonces,
|
|
administrator-only global session-impact counts, exact authorized session
|
|
inventory, full settings Reset behavior, and mobile task/session identity
|
|
projection. No commit or push was created.
|
|
|
|
### Backend
|
|
|
|
- The focused race command passed for `internal/agent/kubernetes`,
|
|
`internal/agent/runtime/lifecycle`, `internal/kubernetes`,
|
|
`internal/backendapp`, `internal/task/service`, `internal/task/handlers`, and
|
|
`internal/orchestrator/executor`.
|
|
- From `apps/backend`, `GOFLAGS='-p=2' make test`, `make lint`, and `make build`
|
|
all passed; lint reported zero issues. An earlier unconstrained all-package
|
|
run exhausted the retry budget in one concurrency stress test under full
|
|
machine load. That exact test passed 10/10 in isolation before the complete
|
|
constrained suite passed.
|
|
- `go mod tidy -diff` produced no diff and `go mod verify` reported all modules
|
|
verified.
|
|
|
|
### Web and responsive UI
|
|
|
|
- From `apps/web`, `pnpm run lint`, `pnpm run typecheck`,
|
|
`pnpm run i18n:check`, and `pnpm run i18n:ratchet` all passed.
|
|
- `VITEST_MAX_WORKERS=2 pnpm test` passed 1,551 files: 13,092 tests passed and
|
|
4 were skipped, with no unhandled errors. The integration audit added a
|
|
Chrome user-agent contract to the shared Vitest environment so happy-dom no
|
|
longer makes Monaco install its persistent Safari clipboard workaround and
|
|
emit cancelled promise rejections after otherwise-green suites.
|
|
- Desktop and Pixel 5 settings flows cover administrator create/test/save,
|
|
reload persistence, member read-only behavior, touch-visible actions, YAML
|
|
containment, and no document horizontal overflow. A final targeted
|
|
mobile-chrome active-session projection passed 1/1 without retries.
|
|
|
|
### Live Kubernetes
|
|
|
|
- With a fresh source-checked build, pinned Kind 0.32.0 and Kubernetes 1.36.1
|
|
passed exactly 12/12 browser lifecycle cases on the first attempt. Coverage
|
|
includes kubeconfig and in-cluster auth, credential nonleakage, exec and
|
|
loopback-only port-forward, backend reconnect, main-container re-handshake,
|
|
same-session managed-PVC stop/resume and terminal deletion, existing-claim
|
|
retention, foreign-resource protection, and causal RBAC, scheduling,
|
|
image-pull, and PVC failures.
|
|
- The separate API-only compatibility project passed exactly 1/1 on both
|
|
Kubernetes 1.34.8 and 1.36.1 without retries or freshness bypasses.
|
|
- The frozen backend/web/workflow source digest was unchanged after every run.
|
|
Final teardown found no owned Kind clusters, runtime images, containers,
|
|
ownership markers, Playwright/backend/Vite processes, or port-forwards.
|
|
[Task 06](task-06-kind-e2e-ci.md) records the exact pins, digests, commands,
|
|
timings, artifacts, and teardown proof.
|
|
|
|
### Documentation and hygiene
|
|
|
|
- `node --test scripts/validate-public-docs.test.mjs` passed 61/61 and
|
|
`node scripts/validate-public-docs.mjs` validated all 41 published pages.
|
|
- `kubectl apply --dry-run=client --validate=false -f k8s/executor-rbac.yaml`
|
|
accepted the ServiceAccount, namespaced Role, and RoleBinding.
|
|
- Changed Go files were gofmt-clean and `git diff --check` passed after the
|
|
final documentation/status edits.
|