AWS / Azure-AKS / EKS cloud-deploy build history #221

Open

benjivers wants to merge 1 commit from docs/aws-eks-build-history into main

benjivers commented

2026-08-25 20:37:11 +00:00

Collaborator

What this is

docs/ops/aws-eks-build-history.md — the trail of problems hit and fixes made while standing up the cloud-deploy paths. Not a current-state audit; this is how the build actually went.

Synthesized from four sources: the git commit history, the closed PRs, the in-repo build notes (GATE-NOTES.md, aks-cost-experiment.md, deploy/eks/UPGRADE.md, deploy/README.md), and the leftover germination run logs (germinate-aks-poc*.log, mirror-run2.log). Every entry cites its commit sha and/or PR number.

Shape

Three tracks, with the inheritance chain called out (a lot of AWS/EKS behavior was fixed on the AKS path first and carried over):

AWS / EC2-k3s — cold-start hardening (set -u / nix locale / Docker ≥28 raw-table DROP), the turnkey one-command IaC (#120), zero-DNS DOMAIN=auto + report-home (#132), gzip user-data for the EC2 16 KB cap.
Azure / AKS (the managed-k8s precedent) — mode=aks + trim_gitops_aks (#139); the full azure-gate CI saga (#143→#159, incl. the cert-zone-doubling bug that never issued certs); the coredns/mirror/CNPG/storageClass bundle (#162/#167/#178/#183/#187/#188); and the AKS cost experiment with its pile of hard-won az gotchas (CNPG PDBs blocking drains, B-v2 quota 0, nodepool add client crash → az rest, the CNPG image-redirect restart-loop, the 12-disk attach limit).
EKS (modeled on AKS) — turnkey hardening (IRSA→Pod Identity, CloudWatch, single-AZ EBS, credit-guard-as-IaC, clean teardown) and trim_gitops_eks; plus the operational rules from UPGRADE.md (version-drift billing trap, --force node roll past CNPG PDBs). Note EKS has no merged PRs — code-complete but ran out-of-band, which is why deploy/eks/ is still untracked.

A closing section traces which build-era through-lines are still open.

🤖 Generated with Claude Code

## What this is `docs/ops/aws-eks-build-history.md` — the trail of **problems hit and fixes made while standing up the cloud-deploy paths**. Not a current-state audit; this is *how the build actually went*. Synthesized from four sources: the git commit history, the closed PRs, the in-repo build notes (`GATE-NOTES.md`, `aks-cost-experiment.md`, `deploy/eks/UPGRADE.md`, `deploy/README.md`), and the leftover germination run logs (`germinate-aks-poc*.log`, `mirror-run2.log`). Every entry cites its commit sha and/or PR number. ## Shape Three tracks, with the inheritance chain called out (a lot of AWS/EKS behavior was fixed on the AKS path first and carried over): - **AWS / EC2-k3s** — cold-start hardening (`set -u` / nix locale / Docker ≥28 raw-table DROP), the turnkey one-command IaC (#120), zero-DNS `DOMAIN=auto` + report-home (#132), gzip user-data for the EC2 16 KB cap. - **Azure / AKS** (the managed-k8s precedent) — `mode=aks` + `trim_gitops_aks` (#139); the full **azure-gate CI saga** (#143→#159, incl. the cert-zone-doubling bug that never issued certs); the **coredns/mirror/CNPG/storageClass** bundle (#162/#167/#178/#183/#187/#188); and the **AKS cost experiment** with its pile of hard-won `az` gotchas (CNPG PDBs blocking drains, B-v2 quota 0, `nodepool add` client crash → `az rest`, the CNPG image-redirect restart-loop, the 12-disk attach limit). - **EKS** (modeled on AKS) — turnkey hardening (IRSA→Pod Identity, CloudWatch, single-AZ EBS, credit-guard-as-IaC, clean teardown) and `trim_gitops_eks`; plus the operational rules from `UPGRADE.md` (version-drift billing trap, `--force` node roll past CNPG PDBs). Note EKS has **no merged PRs** — code-complete but ran out-of-band, which is why `deploy/eks/` is still untracked. A closing section traces which build-era through-lines are still open. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

benjivers added 1 commit

2026-08-25 20:37:11 +00:00

docs(ops): cloud-deploy build history — AWS, Azure/AKS, EKS

guard-ppt / no-ppt (pull_request) Successful in 19s

Details

guard-ppt / no-ppt (push) Successful in 19s

Details

bf000482ca

The trail of problems hit and fixes made while standing up the cloud-deploy
paths (companion to the current-state audit in #212). Synthesized from git
history, closed PRs, in-repo build notes (GATE-NOTES, aks-cost-experiment,
eks UPGRADE), and germination run logs. Three tracks with the AKS->EKS
inheritance chain called out.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

benjivers referenced this pull request

2026-08-25 20:37:20 +00:00

AWS deployment audit — EC2 leader + EKS backlog (34 items) #212