weebo-angos

Kubernetes operator running Angos OCI registries, built on weebo-operator-kit. Angos has no administration API: the operator renders its configuration, runs its workload, and reads what the pods did with it in their logs.

Kind	Short	What it does
AngosLocalInstance	ali	An Angos registry in a namespace: its workload and configuration
AngosRepository	arepo	A repository of an instance: its prefix, access, upstreams, downstreams
AngosIdentity	aid	A Basic identity: generated password, Argon2id hash, written to targets
AngosMaintenance	amaint	scrub, prune, reconcile … as Jobs, scheduled, prune-locked

Coming next (milestones M4–M5): the worker and replicas, webhooks, version upgrades, the importer.

Targets Angos 1.12.3 (api::angos): the configuration model (domain::config), the rules Angos checks it with (domain::validation, each citing Angos's code) and the startup keys are those of that version; moving to another Angos release is a release of the operator.

Layout

Hexagonal, one crate per layer, same rules as every weebo operator:

Crate	Holds
domain	the reason codes, Angos's configuration model, its two layers and validation
api	the CRD types (#[derive(CustomResource)]), the kit's shared field types
application	ports (the kit's OwnedObjects, PodLogs, InstanceDirectory), use cases
adapters-outbound	the instance directory (the kit's LocalInstances), the workload settings
adapters-inbound	the controllers and the webhook router
operator	the binary: telemetry, leader election, webhook server, controllers
crdgen	writes deploy/crd/ from api
testkit	envtest and fakes for the integration tests

deploy/charts/weebo-angos is a thin chart on the kit's library chart: templates/_params.tpl holds what is the operator's own (group, kinds, the namespaced rules of an instance's objects, pods/log, env), values.yaml follows the kit's values contract plus defaults and managedInstances.allowedImages. Creating an instance runs an Angos pod with the namespace's Secrets labelled angos.weebo.io/credential: "true".

Tasks

task lint        # fmt --check, clippy -D warnings, actionlint, hadolint
task lint:helm   # helm lint + the kit's smoke renders
task test        # unit + contract tests
task test:all    # + envtest integration tests
task coverage    # cargo llvm-cov, fails under 85%
task audit       # cargo-deny + trivy + trivy config
task kit:sync TAG=vX.Y.Z  # move to another kit release (crates, tasks, CI, chart, cog.toml)

lint, audit, coverage, doctor and the chart tasks are the kit's (tasks/*.yaml, included remotely and pinned by checksum); CI calls the kit's reusable checks.yml.