konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

chore(paperclip): remove Paperclip and everything that only served it #1291

Merged
k.renner merged 1 commits from chore/remove-paperclip into master 2026-10-16 06:46:56 +00:00
Conversation 1 Commits 1 Files Changed 72
+26 -4882
claude-bot commented 2026-10-16 05:50:53 +00:00
Member
Copy Link
Copy Source

Removes Paperclip and everything that existed only to serve it.

Removed

  • apps/paperclip and its Flux Kustomization (prune: true): Deployment, CNPG pclp-pg + PVCs, ObjectStore/ScheduledBackup, ingresses (paperclip, paperclip-api), RBAC in monitoring/paperclip-renner
  • Namespaces paperclip, paperclip-renner, agent-sandbox-system
  • agent-sandbox controller (infrastructure/agent-sandbox), its CNP and Renovate rules
  • Paperclip server image build + ci/images/paperclip; agent-runtime-{go,ops} images + build-agent-runtime pipeline; README section
  • Matrix bridge (apps/matrix/bridge.yaml) and synapse's appservice registration mount/reload
  • monitoring/loki-read-gateway (only consumer was the paperclip Role)
  • MQTT account agents-read and the controller's Role/RoleBinding in ns paperclip
  • Agent admits in CNPs: wiki (ai), lidarr (navidrome), shelly-manager + mosquitto (home-assistant), hubble-relay (kube-system; the kubelet probe rule stays)
  • paperclip-api.renner.uno from Gitea's webhook ALLOWED_HOST_LIST; wiki API key paperclip; paperclip in the OpenBao ClusterSecretStore allow-list; pclp-pg row in RECOVERY.md
  • openbao/policies/secret-exists-check.hcl
  • Paperclip design spec and plan

Changed

  • Authentik blueprint: group Paperclip Users -> state: absent
  • package-retention.py: EXCLUDE_PACKAGES is optional now (its only value was ^konairius/agent-runtime)
  • shelly-manager api-proxy sidecar kept: mqtt-account-controller calls shelly-manager-api; only comments reworded

Data

The pclp-pg database and PVCs are deleted on reconcile. Barman backups at s3://renner-uno-k8s-cnpg/pclp-pg are left in place (owner-confirmed).

Manual follow-up after merge (not in git)

  • kubectl delete crd for the *.agents.x-k8s.io CRDs (Helm leaves chart CRDs behind)
  • OpenBao: apps/paperclip*, apps/matrix-bridge, paperclip property in apps/ai/wiki-api-keys, bao policy delete secret-exists-check, userpass agent-secret-check
  • Gitea: webhook(s) targeting paperclip-api.renner.uno; packages konairius/paperclip, konairius/agent-runtime-*
  • Matrix: the @paperclip appservice user/rooms
  • S3 backups at pclp-pg, whenever no longer wanted

Verification

kubectl kustomize builds clean for infrastructure, network-policies, post-crds, image-automation, monitoring, matrix, home-assistant, wiki, gitea, authentik; renovate.json parses; repo-wide grep leaves only the Authentik retirement entries and a historical mention in the gitea-mcp spec.

🤖 Generated with Claude Code

Removes Paperclip and everything that existed only to serve it. ## Removed - `apps/paperclip` and its Flux Kustomization (`prune: true`): Deployment, CNPG `pclp-pg` + PVCs, ObjectStore/ScheduledBackup, ingresses (`paperclip`, `paperclip-api`), RBAC in `monitoring`/`paperclip-renner` - Namespaces `paperclip`, `paperclip-renner`, `agent-sandbox-system` - agent-sandbox controller (`infrastructure/agent-sandbox`), its CNP and Renovate rules - Paperclip server image build + `ci/images/paperclip`; agent-runtime-{go,ops} images + `build-agent-runtime` pipeline; README section - Matrix bridge (`apps/matrix/bridge.yaml`) and synapse's appservice registration mount/reload - `monitoring/loki-read-gateway` (only consumer was the paperclip Role) - MQTT account `agents-read` and the controller's Role/RoleBinding in ns `paperclip` - Agent admits in CNPs: wiki (ai), lidarr (navidrome), shelly-manager + mosquitto (home-assistant), hubble-relay (kube-system; the kubelet probe rule stays) - `paperclip-api.renner.uno` from Gitea's webhook ALLOWED_HOST_LIST; wiki API key `paperclip`; `paperclip` in the OpenBao ClusterSecretStore allow-list; `pclp-pg` row in RECOVERY.md - `openbao/policies/secret-exists-check.hcl` - Paperclip design spec and plan ## Changed - Authentik blueprint: group `Paperclip Users` -> `state: absent` - `package-retention.py`: `EXCLUDE_PACKAGES` is optional now (its only value was `^konairius/agent-runtime`) - shelly-manager api-proxy sidecar **kept**: `mqtt-account-controller` calls `shelly-manager-api`; only comments reworded ## Data The `pclp-pg` database and PVCs are deleted on reconcile. Barman backups at `s3://renner-uno-k8s-cnpg/pclp-pg` are left in place (owner-confirmed). ## Manual follow-up after merge (not in git) - `kubectl delete crd` for the `*.agents.x-k8s.io` CRDs (Helm leaves chart CRDs behind) - OpenBao: `apps/paperclip*`, `apps/matrix-bridge`, `paperclip` property in `apps/ai/wiki-api-keys`, `bao policy delete secret-exists-check`, userpass `agent-secret-check` - Gitea: webhook(s) targeting `paperclip-api.renner.uno`; packages `konairius/paperclip`, `konairius/agent-runtime-*` - Matrix: the `@paperclip` appservice user/rooms - S3 backups at `pclp-pg`, whenever no longer wanted ## Verification `kubectl kustomize` builds clean for infrastructure, network-policies, post-crds, image-automation, monitoring, matrix, home-assistant, wiki, gitea, authentik; `renovate.json` parses; repo-wide grep leaves only the Authentik retirement entries and a historical mention in the gitea-mcp spec. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
claude-bot added 1 commit 2026-10-16 05:50:53 +00:00
chore(paperclip): remove Paperclip and everything that only served it
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
7ada3540b5 
Removes the Paperclip deployment (namespace paperclip, CNPG cluster
pclp-pg, ingresses, image automation, server image build) and the
infrastructure that existed only for its agents:

- agent sandbox: paperclip-renner namespace and CNPs, the
  kubernetes-sigs/agent-sandbox controller with its namespace, CNP and
  Renovate rules
- agent-runtime-{go,ops} images and the build-agent-runtime pipeline
- matrix bridge (Element <-> Paperclip agents) and synapse's appservice
  registration mount
- monitoring loki-read-gateway (only called by the paperclip Role)
- MQTT account agents-read and the controller's RBAC in ns paperclip
- the OpenBao secret-exists-check policy file
- agent admits in the wiki, lidarr, shelly-manager, mosquitto and
  hubble-relay CNPs; the paperclip-api Gitea webhook host; the wiki API
  key; the ClusterSecretStore namespace entry; the pclp-pg RECOVERY row
- the Paperclip design spec and plan

Authentik group "Paperclip Users" is switched to state: absent so the
blueprint deletes it. package-retention's EXCLUDE_PACKAGES becomes
optional, since its only value was the agent-runtime prefix.

The shelly-manager api-proxy sidecar stays: mqtt-account-controller
calls shelly-manager-api too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
review-bot left a comment
Member
Copy Link
Copy Source

🤖 Automated review — model mistral-large-4-0, commit 7ada3540b52e60c203a147b01436db469d4d62e3.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review.

Summary

PR #1291 removes Paperclip (the agent-orchestration server) and everything that existed only to serve it: 72 files, −4882/+26. It deletes apps/paperclip + its Flux Kustomization (prune: true), the paperclip/paperclip-renner/agent-sandbox-system namespaces, the agent-sandbox controller, the paperclip/agent-runtime image builds and Woodpecker workflows, the Matrix bridge + synapse appservice registration, monitoring/loki-read-gateway, the MQTT agents-read account and the controller's paperclip Role/RoleBinding, and agent admits in the ai/navidrome/home-assistant/hubble-relay CNPs; it also cleans every reference (Gitea ALLOWED_HOST_LIST, wiki paperclip API key, OpenBao ClusterSecretStore allow-list + secret-exists-check policy, Renovate rules, README, RECOVERY.md, Authentik blueprint retirement entries, shelly-manager comments). Base master has not moved (PR base sha d15f3c52 == current master tip), the PR is mergeable, and both PR pipelines — ci-manifests-test (which kubectl kustomize-builds every kustomization in the tree) and ci-scripts-test — are green on head 7ada354. My own sweep of kustomizations, CI workflows, neighbouring apps, OpenBao, monitoring and docs found no dangling references and no added secrets.

⚪ Unverified

  • I cannot run kubectl kustomize myself; the PR's "builds clean" claim is verified indirectly via the green ci-manifests-test pipeline on the head sha, which runs exactly that over every kustomization.
  • The PR body says a repo-wide grep leaves "a historical mention in the gitea-mcp spec"; I could not locate a gitea-mcp spec file in this repo (kubernetes/apps/gitea-mcp/*, ci/agents/* contain no paperclip mention). Harmless either way, but I could not confirm that specific leftover.
  • The out-of-git cleanup (agent-sandbox *.agents.x-k8s.io CRDs, OpenBao paths/policy/userpass, Gitea webhooks/packages, Matrix @paperclip appservice, S3 backups) is documented as manual follow-up in the PR body; only the git side is verifiable here.

🟡 Suggestions

  • Open issue #1186 "[alert] KubePersistentVolumeFillingUp (paperclip)" becomes moot once this PR merges and the PVC is pruned; consider closing it (the PR does not link it).
  • The merge does not complete the removal: the agent-sandbox CRDs, the OpenBao secret-exists-check policy + agent-secret-check userpass, Gitea webhook(s) targeting paperclip-api.renner.uno and the konairius/paperclip + agent-runtime-* packages, and the Matrix @paperclip appservice user/rooms remain until the manual follow-ups listed in the PR body are done — worth tracking so they are not lost.
  • package-retention.py: EXCLUDE_PACKAGES is now optional (defaults to no exclusions) and the CronJob no longer sets it — verified consistent and safe.

🟢 Nits

  • kubernetes/clusters/homelab/uptime-monitor.yaml, network-policies/renovate-ns.yaml and network-policies/uptime-monitor-ns.yaml changed by one or two comment lines only (references to the deleted paperclip-ns.yaml reworded) — fine.
  • The Authentik blueprint keeps Paperclip Users / paperclip-gate entries as state: absent — deliberate, idempotent retirement entries, consistent with the repo's documented convention.

Tests

The repo's gate for manifest changes is CI, and it passes on the head sha: ci-manifests-test (woodpecker lint, kubectl kustomize over every kustomization, shellcheck, no-digest-pins, yaml-citations) and ci-scripts-test, both success for 7ada354. That covers this deletion PR's main risk — dangling kustomization/configMapGenerator references — which I also verified by hand (matrix, monitoring incl. the loki-read-gateway configMapGenerator, infrastructure, network-policies, image-automation kustomizations all updated; kubernetes/apps/kustomization.yaml never referenced paperclip). No unit tests exist for the deleted CI scripts; the package-retention.py change is stdlib-only and exercised by the lint/shellcheck steps.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `mistral-large-4-0`, commit `7ada3540b52e60c203a147b01436db469d4d62e3`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review. --- ## Summary PR #1291 removes Paperclip (the agent-orchestration server) and everything that existed only to serve it: 72 files, −4882/+26. It deletes `apps/paperclip` + its Flux Kustomization (`prune: true`), the `paperclip`/`paperclip-renner`/`agent-sandbox-system` namespaces, the agent-sandbox controller, the paperclip/agent-runtime image builds and Woodpecker workflows, the Matrix bridge + synapse appservice registration, `monitoring/loki-read-gateway`, the MQTT `agents-read` account and the controller's paperclip Role/RoleBinding, and agent admits in the ai/navidrome/home-assistant/hubble-relay CNPs; it also cleans every reference (Gitea `ALLOWED_HOST_LIST`, wiki `paperclip` API key, OpenBao ClusterSecretStore allow-list + `secret-exists-check` policy, Renovate rules, README, RECOVERY.md, Authentik blueprint retirement entries, shelly-manager comments). Base `master` has not moved (PR base sha `d15f3c52` == current master tip), the PR is `mergeable`, and both PR pipelines — `ci-manifests-test` (which `kubectl kustomize`-builds every kustomization in the tree) and `ci-scripts-test` — are green on head `7ada354`. My own sweep of kustomizations, CI workflows, neighbouring apps, OpenBao, monitoring and docs found no dangling references and no added secrets. ## ⚪ Unverified - I cannot run `kubectl kustomize` myself; the PR's "builds clean" claim is verified indirectly via the green `ci-manifests-test` pipeline on the head sha, which runs exactly that over every kustomization. - The PR body says a repo-wide grep leaves "a historical mention in the gitea-mcp spec"; I could not locate a gitea-mcp spec file in this repo (`kubernetes/apps/gitea-mcp/*`, `ci/agents/*` contain no paperclip mention). Harmless either way, but I could not confirm that specific leftover. - The out-of-git cleanup (agent-sandbox `*.agents.x-k8s.io` CRDs, OpenBao paths/policy/userpass, Gitea webhooks/packages, Matrix `@paperclip` appservice, S3 backups) is documented as manual follow-up in the PR body; only the git side is verifiable here. ## 🟡 Suggestions - Open issue #1186 "[alert] KubePersistentVolumeFillingUp (paperclip)" becomes moot once this PR merges and the PVC is pruned; consider closing it (the PR does not link it). - The merge does not complete the removal: the agent-sandbox CRDs, the OpenBao `secret-exists-check` policy + `agent-secret-check` userpass, Gitea webhook(s) targeting `paperclip-api.renner.uno` and the `konairius/paperclip` + `agent-runtime-*` packages, and the Matrix `@paperclip` appservice user/rooms remain until the manual follow-ups listed in the PR body are done — worth tracking so they are not lost. - `package-retention.py`: `EXCLUDE_PACKAGES` is now optional (defaults to no exclusions) and the CronJob no longer sets it — verified consistent and safe. ## 🟢 Nits - `kubernetes/clusters/homelab/uptime-monitor.yaml`, `network-policies/renovate-ns.yaml` and `network-policies/uptime-monitor-ns.yaml` changed by one or two comment lines only (references to the deleted `paperclip-ns.yaml` reworded) — fine. - The Authentik blueprint keeps `Paperclip Users` / `paperclip-gate` entries as `state: absent` — deliberate, idempotent retirement entries, consistent with the repo's documented convention. ## Tests The repo's gate for manifest changes is CI, and it passes on the head sha: `ci-manifests-test` (woodpecker lint, `kubectl kustomize` over every kustomization, shellcheck, no-digest-pins, yaml-citations) and `ci-scripts-test`, both `success` for `7ada354`. That covers this deletion PR's main risk — dangling kustomization/configMapGenerator references — which I also verified by hand (matrix, monitoring incl. the `loki-read-gateway` configMapGenerator, infrastructure, network-policies, image-automation kustomizations all updated; `kubernetes/apps/kustomization.yaml` never referenced paperclip). No unit tests exist for the deleted CI scripts; the `package-retention.py` change is stdlib-only and exercised by the lint/shellcheck steps. ## Recommendation Looks reasonable — no blocking issues; comments above are optional. <!-- pr-review:sha=7ada3540b52e60c203a147b01436db469d4d62e3 -->
k.renner merged commit a742ef4e3c into master 2026-10-16 06:46:56 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
review-bot
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#1291