feat!: establish Lightkite as the independent mainline - #8
Merged
Merged
Conversation
added 24 commits
August 19, 2026 15:49
Replace shared kubeconfigs and Kite-local authorization with Realmroot OIDC BFF sessions and per-user Kubernetes clients. Keep a credential-free multi-cluster catalog, add a transport-only tunnel agent, remove privileged terminal paths, and include a kind OIDC demo.
Replace provider-specific configuration and claim mapping with standard OIDC discovery, configurable scopes and claims, and platform admin groups. Keep Realmroot only as an isolated deployment example.
Share one credential-free transport per cluster, inject the current OIDC ID token per request, and remove per-user informer and version probes. Add a transparent Kubernetes API gateway, remove application-side resource RBAC checks, and restrict Prometheus to the Kubernetes service proxy. BREAKING CHANGE: config files now accept only credential-free cluster catalog metadata; local identity, API key, LDAP, OAuth provider, and Kite RBAC sections are unsupported.
Delegate user authentication to standard OIDC and resource authorization to Kubernetes RBAC. Remove Kite-local identity, RBAC, API-key, passkey, LDAP, and embedded AI subsystems.\n\nUse credential-free cluster metadata with per-request user tokens, shared cluster runtimes, Kubernetes-authorized Helm, metrics, search, terminal, and resource history flows. Add the DPoP-protected Realmroot Resource Server, agent access audit API/UI, deployment hardening, compatibility checks, documentation, and full native-authorization E2E coverage.\n\nBREAKING CHANGE: local authentication, Kite RBAC, API keys, embedded AI, and credential-bearing cluster configuration are removed. Kubernetes API servers must trust the configured OIDC issuer and enforce user permissions through native RBAC.
Delete obsolete helpers, handlers, model types, and tests that are not reachable from the production application. Restore the persisted login prompt in bootstrap responses and remove duplicate startup validation.
Request the Hub catalog resource during PKCE, use its access token only for catalog APIs, and continue forwarding the shared-client ID token to Kubernetes. Cover the protocol boundary in backend tests and document the deployment contract.
Route ordinary CRUD, watch, metrics, events, and subresource operations through the transparent Kubernetes gateway while retaining product-specific aggregates. Record mutations at the gateway boundary and remove Helm auto-upgrade. BREAKING CHANGE: legacy Kite resource CRUD endpoints and Helm auto-upgrade are removed.
Delete the Cluster Agent enrollment and reverse-tunnel implementation, keep only credential-free reachable API endpoints, and resolve Kubernetes resource API versions through live discovery instead of a hardcoded version table. Hub Agent audit remains owned by Hub and Kite integrates only through standard Cluster Inventory and Kubernetes APIs.\n\nBREAKING CHANGE: cluster connectionMode, tunnel enrollment, Cluster Agent settings, and JWT_SECRET are removed; legacy tunnel entries are disabled during migration.
Rename the product, Go module, binary, container image, Helm chart, Kubernetes resources, UI, and documentation. Document the independent relationship to upstream Kite and preserve the existing KITE_* configuration and persisted compatibility identifiers. BREAKING CHANGE: The Go module, executable, image, Helm chart, and default Kubernetes resource names now use lightkite.
Remove Kite-to-Lightkite upgrade guidance, align installation examples and the SQLite filename with the Lightkite name, and remove stale tunnel and jwtSecret documentation. Keep the existing KITE_* environment variable interface unchanged.
Begin an independent Lightkite release line. Treat inherited upstream Kite tags as repository ancestry rather than upgrade predecessors.
Install ripgrep in CI and release quality jobs before running Makefile verification targets.
Attach the test identity provider to the kind network and forward the control-plane localhost issuer directly to its container address, avoiding host NAT differences on CI runners.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Establish Lightkite as an independently maintained Kubernetes dashboard based on Kite v0.15.0.
Compatibility
This is intentionally a breaking fork. Existing Kite installations are not upgraded in place. The inherited Kite tags remain repository ancestry only.
Verification
make pre-commitmake test docs-build build🤖 Created by Jarvis via Realmroot