A modular, declarative Infrastructure as Code (IaC) platform for managing complete infrastructure lifecycles
- Nickel 76.5%
- HTML 15.9%
- NCL 3.8%
- Jinja 2.3%
- Nushell 1.4%
- Other 0.1%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
claude-bot
6d89de5e89
Written because answering that question by hand took a cluster sweep, a docs
read and a look at Cilium's source, and produced a WRONG intermediate conclusion
on the way — that `io.cilium/lb-ipam-ips` is ignored. It is not. v1.19.5 keeps it
as LBIPAMIPKeyAlias in pkg/annotation/k8s.go, so both spellings work, which is
precisely why the deprecated one survives unnoticed and why nothing in the
cluster reveals who depends on it.
TWO CLAIMS, and they are different questions:
spelling no LoadBalancer asks with the deprecated annotation. This
workspace does not need the backwards compatibility, so the alias
is a liability with no upside: the day it is removed, everything
still using it stops requesting an address and silently takes
whatever a selector-less pool offers.
honoured every service that requests an address HOLDS it. LB-IPAM does not
fail an unsatisfiable request — it falls back to any eligible pool,
so the service comes up on the wrong address and nothing reports it.
Both together, because either alone passes in a broken state. The spelling check
alone passes on a service that asks correctly and is given something else. The
honoured check alone passes on a cluster whose pools each hold exactly ONE
address behind a matching selector — which is libre-wuji's state, and the reason
its annotations were never load-bearing and their spelling never mattered until
someone looked.
Watched failing on both branches before being trusted: disabling the spelling
half passes, and pointing the request key at an annotation whose value is not an
IP produces the unhonoured report.
It finds three today: cilium-gateway-libre-wuji, cilium-gateway-registry and
mail/docker-mailserver still carry the deprecated key on the SERVICE. The
Gateway object was corrected; Cilium's controller propagates annotations onto
the derived Service and does not remove stale ones, so the Service keeps both
until it is recreated. The catalog also still writes the old spelling in
stalwart, fleet_daemon and zot.
Claude-Session: https://claude.ai/code/session_0188g33gGhjP3SfnXDoMAYMp
|
||
| .ontoref | ||
| assets | ||
| resources | ||
| schemas | ||
| scripts | ||
| .gitignore | ||
| CHANGELOG.md | ||
| justfile | ||
| README.md | ||
Infrastructure Orchestration With Configuration as Code
Declarative infrastructure management with Nickel schemas, Nushell orchestration, and Rust executables. Type-safe configuration, automated validation, and cloud-native deployment across Kubernetes, Docker, and custom platforms.
provisioning/
├── .ontoref/ protocol spine — ontology, ADRs, reflection, positioning
├── assets/ canonical brand assets — logos, SVG marks
├── code/ git repo (implementation, platform, CLI, Nickel schemas)
├── outreach/ web content, architecture diagrams, presentations
└── vault/ private strategy (placeholder)
Quick start
cd code
just build # build all crates
just check # cargo check + clippy
just sync-assets # sync brand assets from ../assets/ into code/assets/
ontoref describe project # project identity, axioms, FSM state
Sub-repos
| Path | Remote | Purpose |
|---|---|---|
code/ |
https://rlung.librecloud.online/jesus/provisioning | Implementation — Rust platform, Nickel schemas, Nushell orchestration |
outreach/ |
— | Web content, diagrams, presentations |
vault/ |
— | Private strategy (SOPS-encrypted) |
Full technical docs → code/README.md