roadmap: KSail strategy & roadmap (July 2026)

[devantler]

🤖 Generated by the Daily AI Assistant

KSail Monthly Strategy — July 2026. The roadmap home for KSail (monthly refresh of #4988; same scheme: theme/epic items carry roadmap, actionable children use normal labels). Grounded in the live backlog and the June merge history.

June outcomes (vs #4988)

June was a feature-heavy month — the roadmap structure worked and most of it shipped:

• Theme B (supply-chain) — DONE. feat: support cosign signature verification (spec.verify) on the generated Flux OCIRepository #4987 cosign spec.verify shipped and closed; platform now runs verify in prod (platform#1570 → chore(deps): Bump actions/checkout from 4.3.1 to 6.0.2 #2319).
• Theme D (observability) — DONE. [Repo Assist] [feature]: add eBPF traffic observability via Hubble (ksail workload network) #4778 Hubble closed complete (workload network one-shot + --follow).
• Theme E (lifecycle & auth) — half DONE. [Repo Assist] [feature]: add OIDC federation and multi-cluster auth support #4602 OIDC federation closed (all 6 ACs, shared-issuer + standards-delegation). Operator-driven component-install lifecycle #4899 advanced: per-component status merged (feat(operator): report per-component install status in ClusterStatus #5527); uninstall-on-spec-flip is review-ready draft feat(operator): uninstall components removed from the cluster spec #5551; remaining phases are environment-gated.
• Theme C (inner-loop DX) — half DONE. [Repo Assist] [feature]: add DevContainer scaffolding to ksail cluster init #4777 DevContainer closed. [Repo Assist] [feature]: add local-remote service mirroring (Telepresence/mirrord-style dev bridge) #4521 mirroring: P0 ResolveTarget (feat(workload): add native mirror target resolution #5534) + P1 SelectTapPoint (feat(workload): select the pod and container a mirror tap attaches to #5537) merged.
• Theme A (cloud expansion) — major motion, still gated. [Repo Assist] [feature]: extend Hetzner provider to support K3s and Vanilla (Kind) distributions #3983 Hetzner K3s/Vanilla: typed k3s/kubeadm config renderers, cloud-init, shared hetznerbase, factory wiring all merged — completion (validation flip feat(apis): enable K3s/Vanilla × Hetzner — validation flip + docs (lands last) #5514 + E2E test(system): smoke tests for Hetzner × K3s/Vanilla (blocked on #4972) #5515) blocked on bug(ci): Hetzner system test red for 6+ weeks — HCLOUD_TOKEN invalid (unauthorized) #4972. [Repo Assist] [chore]: complete AWS EKS provider #4328 EKS stays code-complete, credential-gated. [Repo Assist] [chore]: add GKE and AKS cloud providers to extend KSail beyond AWS EKS #4510 GKE/AKS started: GKE client merged (feat(gke): add native GKE cluster-lifecycle client foundation #5677), pkg/svc/provider/gcp in flight (feat(provider): add the GCP infrastructure provider over the GKE client #5682).
• Born mid-June, now core roadmap: Extend workload validate and workload scan to validate/scan all GitOps layers in-process #5344 in-process validate/scan (phases 1–2, 3a, per-layer attribution, chart caching ALL merged), feat(cluster): scaffold and grow multi-cluster, multi-provider GitOps repos #5441 multi-cluster scaffolding (item 1 cluster add-environment complete; item 2 layout derive+write merged), feat(flux): enrich KSail with Flux v2.9.0 capabilities (distribution bump + new features) #5606 Flux v2.9.0 capabilities epic (children 1–2 done), and KSail became a Flux 2.9 distributor with a matched-pair manifests pin after the v0.53.0 Receiver-CRD breakage (bug(flux): FluxInstance BuildFailed — floating flux-operator-manifests:latest + distribution 2.x breaks Flux bootstrap #5595/fix(flux): pin flux-operator-manifests distribution artifact (no floating :latest) #5596).

July themes

Theme A — Cloud-provider & distribution expansion → epic #4627 (roadmap)

Problem. One SDK across the major clouds; GKE/AKS missing, Hetzner K3s/Vanilla and EKS unfinished. Direction. Finish #4510 GKE slices in order — (3) provisioner + factory routing after #5682 merges, (4) Provider/Distribution enum + schema surface, (5) AKS mirror via armcontainerservice — these are startable now and NOT credential-gated (unit-tested like the merged EKS/GKE code). #3983/#4328 completion stays gated on #4972/#4973 (credentials/machines — maintainer-only); the platform-side AWS chain (platform#2324–#2327) is advancing (#2377 promoted). Size: L. Priority: High — the default substantive lane for July.

Theme B — GitOps depth: finish #5344, scope #5606 → roadmap

Problem. #5344 is one slice from done; the Flux-2.9 epic's children #3–#8 are unscoped wishes. Direction. #5344 remainder: 3b --ephemeral operator-children (env-gated, reuses #4899) + native cel-go CEL validation (per #5624: stay-native, no external tool). From #5606 pick and spec 1–2 children for July — suggested first: #3 Kustomization.spec.ignore drift handling (extends workload reconcile) and #4 CEL Helm health checks (builds on #5576). Size: M. Priority: High (maintainer-requested epic).

Theme C — Multi-cluster & CLI shape: #5441 · #5626 · #5654 → roadmap

Problem. Multi-cluster scaffolding is mid-flight; the CLI's command taxonomy (#5626 ksail project) and scope over unmanaged clusters (#5654, filed 07-01) are open shape questions. Direction. #5441: next increment = cluster init --multi-cluster flag composing the merged Derive+Write; then item 3 (environments×providers). #5654 needs a decomposition pass first (kubeconfig discovery, context ops, which commands go cluster-agnostic) — it is the freshest scope question and should get an ADR-style design comment + child issues early in July. #5626 follows the same ADR-first path (command-migration matrix). Size: M–L. Priority: High for the #5654 decomposition; Medium for implementation until the design lands.

Theme D — Inner-loop DX (#4521) → epic

Problem. P1 is half-shipped (tap-point selection merged; no traffic path yet). Direction. Next: ephemeral-container tap injection + reverse port-forward tunnel (Vanilla/K3s/VCluster), then P2 intercept, P3 env/volume. Size: M per increment. Priority: Medium.

Theme E — Operator lifecycle (#4899) → epic

Problem. Remaining phases need real child clusters (Connectors for Kind-DinD/k3k/KWOK/Talos-DinD, Docker provider, cloud kubeconfigs) — not unit-testable on the dev hub. Direction. Land #5551 (awaiting promotion); then pick the KWOK Connector as the one possibly-testable slice; the rest as environments allow. Size: L. Priority: Medium, env-gated.

Operational health (not roadmap, named blockers)

• bug(ci): Hetzner system test red for 6+ weeks — HCLOUD_TOKEN invalid (unauthorized) #4972 (HCLOUD_TOKEN invalid) / bug(ci): Omni system test red for 6 weeks — no available machines registered in Omni instance #4973 (Omni no machines) — still red, still maintainer-only; they cap Theme A completion (validation flips + E2E). Standing ask.
• feat(autoscaler): expose scale-down tuning — ignore-daemonsets-utilization and scale-down-utilization-threshold #5673 (autoscaler scale-down knobs, maintainer-authored 07-01 — the freshest direct maintainer signal) — triaged into the normal enhancement queue; pairs with platform's DaemonSet-VPA work ([agentics] Unbloat Docs failed #2370).

Suggested sequencing (July)

1. [Repo Assist] [chore]: add GKE and AKS cloud providers to extend KSail beyond AWS EKS #4510 GKE slices 3–5 — the substantive default; each slice is a clean unit-tested PR.
2. feat: see & operate on unmanaged kubeconfig clusters across the CLI, desktop app & web UI #5654 decomposition (+ feat(cli): introduce ksail project and migrate gitops-file commands off ksail cluster #5626 ADR) — maintainer-hot design work, unblocks a Q3 lane.
3. feat(flux): enrich KSail with Flux v2.9.0 capabilities (distribution bump + new features) #5606 children Configure Renovate #3/Add compile and publish workflow and gitignore file #4 spec-then-implement; Extend workload validate and workload scan to validate/scan all GitOps layers in-process #5344 CEL slice alongside.
4. [Repo Assist] [feature]: add local-remote service mirroring (Telepresence/mirrord-style dev bridge) #4521 P1 completion as the alternating lane.
5. Env-gated tails ([Repo Assist] [feature]: extend Hetzner provider to support K3s and Vanilla (Kind) distributions #3983 flip, [Repo Assist] [chore]: complete AWS EKS provider #4328 E2E, Operator-driven component-install lifecycle #4899 phases) the moment bug(ci): Hetzner system test red for 6+ weeks — HCLOUD_TOKEN invalid (unauthorized) #4972/bug(ci): Omni system test red for 6 weeks — no available machines registered in Omni instance #4973/credentials clear.

How to use this roadmap

Unchanged from #4988: new feature work maps to a theme (or proposes one here first); implementing PRs Fixes #child; epics close with their children; refreshed monthly.

Supersedes #4988 (June). No new epics minted — all themes point at existing tracking issues.