Repository navigation
Stage OpenCost retirement behind the Coroot option #81
Description
🤖 Generated by the Daily AI Engineer
Evidence and problem
The first implementation of this child followed the reference Platform and pointed OpenCost at Coroot's bundled Prometheus. Exact-head review prompted a live read-only check before that design was propagated. The check proved the reference setup is functionally degraded: Coroot Prometheus exposes kube-state requests but no standard node/cAdvisor usage series, and OpenCost returns 34 namespace allocations with non-zero requested-resource costs while CPU and RAM usage are zero for all 34. The Platform defect is tracked in devantler-tech/platform#2689.
The parent #65's original retirement direction is therefore safer than copying the current false-green handoff. Coroot's own node/application cost rollups have separately been live-verified on Platform (#2148), so the template should not stage a second cost surface whose usage inputs are absent.
Audience and hypothesis
Template consumers need the default-off Coroot migration to avoid inheriting misleading OpenCost allocations. If the explicit opt-in fixtures model OpenCost retirement while real provider payloads remain unchanged, later provider activation can remove the obsolete cost surface without silently switching it to an incompatible metrics backend.
Smallest useful slice
- Make both explicit Coroot controller fixtures remove every legacy OpenCost object
and cross-layer route, network-policy, and grant reference. - Keep both explicit Coroot infrastructure fixtures free of a replacement OpenCost
release and obsolete security exemptions. - Extend the executable observability validator to prove OpenCost objects and
references are absent in both opt-in layers while unchanged provider defaults
retain them, and to fail closed if an indexed policy entry drifts. - Preserve the existing Coroot operator/CR ordering and Hetzner-only audit forwarder contract.
Acceptance criteria
- Default Docker and Hetzner provider renders remain byte-for-byte unchanged and Coroot remains off.
- Both opt-in controller renders contain the Coroot operator and no OpenCost objects or references.
- Both opt-in infrastructure renders contain the Coroot custom resource and no OpenCost objects or references.
- Hetzner's opt-in render still uniquely includes the audit-log-forwarder.
- The executable validator rejects any OpenCost object/reference returning and
any indexed cleanup patch whose expected target has drifted. - Both existing cluster overlays remain statically valid.
Out of scope
Real provider activation, deletion of Prometheus/Loki/Alloy bases, the live Platform remediation in platform#2689, Coroot authentication/routes, Coroot HA, and production mutation remain in #65 or their owning issue.
Rough size: S
Activity
coderabbitai commentedon Jul 18, 2026
🔗 Related PRs
#62 - feat(coredns): migrate docker-provider CoreDNS from Deployment to HelmRelease [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
[-]Stage the Coroot-backed OpenCost layer handoff[/-][+]Stage OpenCost retirement behind the Coroot option[/+]devantler commentedon Jul 18, 2026
Direction corrected before merge: exact-head review prompted a read-only production check, which proved the Coroot-backed OpenCost design has zero CPU/RAM usage across every returned namespace allocation. The child now stages retirement, matching parent #65, and the reference Platform defect is captured as devantler-tech/platform#2689.