Repository navigation
fix(chart): stabilize offline GitOps renders and preserve trust and PVCs on upgrade #882
Description
Production readiness audit of Gameplane v0.4.0, commit 07bee47b. Tracking issue and PR merge order: #867.
Finding
Helm lookup cannot reuse existing Secrets in an offline render. Identical inputs can yield new agent certificates and pod-template hashes. CRD hooks, waker admission discovery and the old SQLite claim guard also depend on delivery-controller behavior.
Work
Validate and document offline delivery using the existing external CA/client Secret settings. Assign one CRD owner, document the real controller’s prune/retention rules, surface unsupported admission capability combinations, and specify a controlled certificate rotation.
Acceptance criteria
Render twice using identical values and the target API capabilities and compare bytes. Sync/upgrade a populated installation using the supported GitOps controller. Verify CRD stored versions, waker policy enforcement, CA continuity and rotation, authenticated live agents, and unchanged API/game claim UIDs across prune.
PR ownership and prior work
Reuse the M06 trust/Secret layout when it changes. Own the offline rendering contract and one populated GitOps upgrade fixture. H10 can reuse the data assertions for an actual published chart. Reuse external Secret support in #514, rotation in #591 and the Helm upgrade fixture in #863.
mTLS generation · CRD migration hook · Existing-claim guard · Argo CD Helm behavior
Activity
[-][Medium M05] Make offline GitOps renders deterministic and qualify CRD, trust and PVC upgrades[/-][+]fix(chart): stabilize offline GitOps renders and preserve trust and PVCs on upgrade[/+]Baylem commentedon Nov 11, 2026
At #901 commit
6a24ee48, the populated amd64 kind upgrade from chart v0.3.0 passed in 195.81 seconds. The real Argo CD v3.6.1 controller completed its part in 104.12 seconds. Its repo-server fetched the tested revision from a private Git fixture. The test synced the CRDs and workload as separate Applications, adopted the populated release, pruned the disposable dashboard, renewed the client certificate and then rotated the issuer. It checked CRD stored versions, wake-only admission, the original API and game claim UIDs, and a fresh authenticated read of the original world marker through agent mTLS after each rollout. Populated Argo CD upgradeThe same commit passed the offline chart checks, including byte-identical renders from identical external trust inputs, and Helm lint. Chart rendering · Helm lint