docs(examples): mark webTerminal/tailscale as planned, not v1 CRD fields - #52
Merged
Conversation
The full-featured example advertised spec.webTerminal and spec.tailscale blocks, but the v1 CRD does not expose these fields. Only the generic spec.sidecars escape hatch exists today; web-terminal and Tailscale Serve are future "Plan 3" work. Applying the example silently pruned those blocks (the apiserver drops unknown fields), which misleads operators into thinking the features are wired up (#42). Remove the phantom blocks from the example spec and from the "fields demonstrated" table, and add a "Planned (not yet in the v1 CRD)" note that points at #42 and the spec.sidecars workaround. Refs #42 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Jun 3, 2026
stubbi
added a commit
that referenced
this pull request
Jun 3, 2026
## Summary Design + implementation plan for first-class `spec.tailscale.mode=serve` on `HermesInstance`, addressing #42. No production code yet: this is the spec and a TDD task-by-task plan for review before implementation. - **Spec:** `docs/superpowers/specs/2026-06-03-hermes-tailscale-serve-design.md` - **Plan:** `docs/superpowers/plans/2026-06-03-hermes-tailscale-serve.md` ## Design decisions - **Ephemeral node + fixed hostname.** In-memory tailscaled state, `--ephemeral`, `TS_HOSTNAME` defaulting to the instance name. Node auto-removes on pod termination; MagicDNS name stays stable. No state PVC and no `TS_KUBE_SECRET`, so no new per-instance RBAC. - **Sidecar in the hermes pod** (not a companion Deployment) so Serve can proxy tailnet `:443` to `http://127.0.0.1:8443` (the gateway port). - **Serve-only first cut.** `mode` enum is `serve` only; left extensible for funnel later (out of scope per #42). - **NetworkPolicy** gains Tailscale UDP egress (3478 STUN, 41641 direct); control/DERP already ride the baseline TCP/443, so it degrades to relayed connectivity rather than failing if UDP is blocked. - `TailscaleReady` condition and webhook validation mirror the existing gateway patterns. ## Notes surfaced during planning - `ROADMAP.md` lists tailscale under "Shipped (v1.0.0)" although it was never wired. The plan corrects this when the feature actually ships (and PR #52 already de-advertised it in the full-featured example). ## Next step On approval, implement task-by-task per the plan (subagent-driven). Happy to adjust scope/decisions first. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refs #42. The full-featured example advertised
spec.webTerminalandspec.tailscale(Tailscale Serve) blocks, but the v1 CRD does not expose these fields. They are future "Plan 3" work; the only sidecar mechanism shipping today is the genericspec.sidecarsescape hatch. Applying the example silently pruned those blocks (the apiserver drops unknown fields), which misleads operators into thinking the features are wired up.Changes
webTerminal/tailscaleblocks fromexamples/full-featured/hermesinstance.yaml, replaced with a comment pointing at Prioritize Tailscale support (spec.tailscale.mode=serve) #42 and thespec.sidecarsworkaround.Verification
webTerminal/tailscaleare gone and the realsidecarsfield remains.HermesInstanceSpecjson tags:webTerminalandtailscalewere the only two example keys with no corresponding CRD field.Tracking issue #42 stays open for the actual feature; this just stops the docs from promising it early.