Roadmap: a resilient, current, well-abstracted GitOps platform #2043

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

This is the roadmap of record for platform: the GitOps platform that runs the devantler-tech estate on Hetzner (Talos, Cilium, Flux, Longhorn, OpenBao, CloudNativePG). Each theme below names the epic that owns it; concrete work is tracked as sub-issues of those epics. Last strategy review: 2026-10-17.

Where the product is

In active production with a very high change rate: 689 commits reached main in the 30 days to 2026-10-17, 215 of them dependency updates. The pain is operational rather than functional. Leaving out dependency updates, the largest commit scopes were fix(ci) (48), fix(deploy) (22), fix(coroot) (20), fix(observability) (16), fix(kubescape) (14), fix(backup) (10) and fix(recovery) (10). Most of the remaining effort goes into keeping the production delivery lane, the databases and the security scanners working, not into new capability.

Pins on main (2026-10-17): Talos v1.13.11, Kubernetes v1.36.4. The Talos v1.13 line supports Kubernetes up to 1.36, so Kubernetes cannot move to 1.37 until Talos moves to v1.14 (#3626).

Direction — themes, in priority order

1. A delivery lane that fails only for the change it deploys — #4979

Every candidate deploys to production in the merge queue before it merges, and deploy gates still fail or stall for faults the candidate did not cause. Measure the eviction causes first, then remove the largest unrelated ones. Also: #4569 (run independent validation families in parallel).

2. Data that survives: stable primaries, complete backups, storage-layer retention — #4980, #3369

Unplanned PostgreSQL primary switches (about 1.5 a day, #4885), failed daily volume backups and one-off recovery repairs (#4980). In parallel, deletion becomes safe at the storage layer instead of through prune opt-outs (#3369, ADR docs/adr/storage-retention.md).

3. A fault never reads green — #4981

Several outages stayed silent for hours because a component reported itself healthy or nothing watched the failing signal (an 18-hour Crossplane provider outage, #3457). Give each silent-failure class an alert on its real signal, and fix known false warnings at their source.

4. Run only upstream-supported versions — #4982

Talos 1.13 and Flux 2.8 are both outside upstream support today, and Kyverno 1.20 (estimated November 2026) removes the policy kind behind 49 of the platform's policies (#4982). Talos v1.14 first, then Kubernetes one minor at a time (#3626, with the v1.14 machine-config migration #3850); Flux 2.9 (#4983); the Kyverno migration (#4984); flux-operator updates (#4985). Adopt the Kubernetes and Cilium features those upgrades unlock (#1807, #2029, and the native Gateway API external-auth refactor #1881, waiting on #2284).

5. Security posture that holds at 100% — #2447, #2824, #3148, #2613, #2653, #2664, #2663

Kubescape posture, vulnerability and runtime surfaces driven to 100% and held (#2447; runtime detection currently loads no rules, #4968). Narrow the pod-security exception (#2824), harden github-config delegation (#3148), and move credentials to short-lived, single-source identities (#2613, #2653, #2664, #2663).

6. Control-plane and node lifecycle — #4592, #2120, #2272

Find and prevent the correlated control-plane interruption (#4592), give the production API a stable endpoint (#2120), and fix cross-node mutual authentication for private-only nodes (#2272).

7. Capabilities for tenants and products — #3418, #4927, #2496

Scale idle applications to zero (#3418), a headless CMS for client sites (#4927), and retiring Headlamp once the KSail web UI reaches parity (#2496).

How work enters

New issues fold into the theme epic they serve as real sub-issues; this issue holds only the theme epics and work that fits no theme yet. Implementing pull requests use Fixes #N on the delivery issue.

Workload-identity direction agreed with the maintainer — 2026-10-31

Within security theme 5, prefer workload identity wherever the supported integration gives a practical security benefit. The outcome is fewer long-lived credentials distributed to applications, least-privilege access per workload and environment, and proven renewal without unplanned disruption. Unavoidable root credentials remain protected and documented; authenticating to a secret store does not by itself make the credential it returns short-lived.

The maintainer defines needs and constraints. Agents own technical decisions, decomposition, implementation and evidence, and raise a maintainer ask only for a genuine unresolved business decision or impact.

R2 follow-up within this theme

After proving the first consumer pattern, evaluate temporary, narrowly scoped R2 credentials for supported backup consumers. This is a compatibility investigation, not a claim that existing consumers already support it or that Cloudflare accepts any workload identity directly.

• Evaluate the exchange from a validated workload identity to temporary R2 credentials, keeping the required parent credential in a protected issuing boundary.
• Determine the supported bucket/path and operation restrictions for each consumer. Prove that unrelated data and existing recovery points cannot be modified by an isolated restore.
• Prove session-token support, renewal and reload during real backup and restore operations, including operations spanning expiry and issuer unavailability. A successful initial connection is insufficient.
• Preserve independent recovery access when the source platform is unavailable. Record unsupported consumers and retain a justified scoped fallback until a safe replacement is demonstrated.
• Record the decision and create only the delivery slices the evidence supports, reusing existing backup work rather than duplicating it.

For service-to-service identity, assess currently supported mechanisms separately from external cloud authorization. Do not turn on Cilium's historical mutual-authentication/SPIRE integration merely to claim workload-identity coverage; any SPIFFE/SPIRE choice needs its own supported integration and demonstrated consumer.