Skip to content

0011. Five Cluster-Hygiene Workloads

  • Status: accepted
  • Date: 2026-05-26
  • Deciders: lusoris
  • Related: PR #270

Context

PR #270 added five scheduled cluster-hygiene checks: secret-age-auditor, configmap-bloat-detector, hpa-coverage, ingress-class-coverage, and velero-schedule-coverage. Each was shipped as an Argo CD-managed chart with cluster-read RBAC and issue-reconciliation code for its findings.

Decision

Deploy the five checks as separate scheduled workloads in the ai namespace, each reading the relevant cluster resources and reconciling a dedicated GitHub issue when it finds a hygiene gap.

Alternatives considered

None recorded at decision time; documented retroactively.

Consequences

PR #270 created five Argo CD Applications and their scheduled scanners. In the current tree, secret-age-auditor and velero-schedule-coverage remain separate CronWorkflows, configmap-bloat-detector and hpa-coverage run as checks in cluster-coverage-auditor, and ingress-class-coverage is an audit-mode Kyverno ClusterPolicy.

References

  • PR #270 — feat(ai): five cluster-hygiene workloads (batch 17)