feat: see the fleet and the runner, and rename the vault to fabrikk #2

Merged

beddari merged 1 commit from omni-and-runner into main

2026-09-17 12:58:55 +00:00

beddari commented

2026-09-17 12:29:28 +00:00

Owner

Outcome

The factory can see the fleet and the runner it releases on, and its secrets live under one vault name.

What changed

extensions/models/forgejo_actions.ts: runner_list (read-only). It shows the org runner dataverket-runner: a Kata VM pod in dataverket-prod, labels ubuntu-latest and kata. Not the fabrikk-release runner release.yaml assumes.
models/@mccormick/omni/inventory/omni.yaml: read-only fleet discovery through a Reader service account. Today: one cluster, six machines, all connected.
models/@swamp/kubernetes/pod/runner-pods.yaml: the forgejo-runners namespace over the Omni-issued kubeconfig (pairs with the fabrikk-readers RoleBinding PR in flux-bootstrap).
Vault forgejo renamed to fabrikk, file and model references updated; keys unchanged.
README: the real runner, the new models, and the release signing key design (FIDO SSH seeding into runner memory, OpenBao transit recommended).

Protected paths

Touches models/, extensions/, README.md. No factory run behind this PR.

Test plan

~/.swamp/deno/deno test --allow-all extensions/models/ (39 passing)
swamp vault list-keys fabrikk lists both keys; swamp model method run forgejo health green through the renamed vault
swamp model method run omni discover records dataverket-prod with 3 control planes and 3 workers

## Outcome The factory can see the fleet and the runner it releases on, and its secrets live under one vault name. ## What changed - `extensions/models/forgejo_actions.ts`: `runner_list` (read-only). It shows the org runner `dataverket-runner`: a Kata VM pod in `dataverket-prod`, labels `ubuntu-latest` and `kata`. Not the `fabrikk-release` runner `release.yaml` assumes. - `models/@mccormick/omni/inventory/omni.yaml`: read-only fleet discovery through a Reader service account. Today: one cluster, six machines, all connected. - `models/@swamp/kubernetes/pod/runner-pods.yaml`: the `forgejo-runners` namespace over the Omni-issued kubeconfig (pairs with the `fabrikk-readers` RoleBinding PR in flux-bootstrap). - Vault `forgejo` renamed to `fabrikk`, file and model references updated; keys unchanged. - README: the real runner, the new models, and the release signing key design (FIDO SSH seeding into runner memory, OpenBao transit recommended). ## Protected paths Touches `models/`, `extensions/`, `README.md`. No factory run behind this PR. ## Test plan - `~/.swamp/deno/deno test --allow-all extensions/models/` (39 passing) - `swamp vault list-keys fabrikk` lists both keys; `swamp model method run forgejo health` green through the renamed vault - `swamp model method run omni discover` records `dataverket-prod` with 3 control planes and 3 workers

beddari added 1 commit

2026-09-17 12:29:28 +00:00

feat: see the fleet and the runner, and rename the vault to fabrikk afc8463d00

- forgejo_actions: runner_list (read-only) shows the org runner
  dataverket-runner: a Kata VM pod in dataverket-prod, labels ubuntu-latest
  and kata, not the fabrikk-release runner release.yaml assumes
- models: omni (@mccormick/omni/inventory, read-only fleet discovery via a
  Reader service account) and runner-pods (@swamp/kubernetes/pod on the
  Omni-issued kubeconfig, forgejo-runners namespace)
- vault forgejo -> fabrikk: it holds more than the Forgejo token now; keys
  stay namespaced (forgejo/api_token, omni/service_account_key)
- README: the real runner, the new models, and the release signing key
  design (FIDO SSH seeding into memory, OpenBao transit recommended)

beddari merged commit 2e7782884d into main

2026-09-17 12:58:55 +00:00

beddari deleted branch omni-and-runner

2026-09-17 12:58:56 +00:00

beddari referenced this pull request from a commit

2026-09-17 12:58:56 +00:00

Merge pull request 'feat: see the fleet and the runner, and rename the vault to fabrikk' (#2) from omni-and-runner into main