feat(observability): deploy kubagachi

[jfroy]

Add the Kubagachi cockpit (https://github.com/Yscale-sh/Kubagachi) to the
observability namespace via its published OCI chart
(oci://ghcr.io/yscale-sh/charts/kubagachi, 0.1.0).

• OCIRepository + HelmRelease with rbac.podExec disabled: the chart's
  cluster-wide read RBAC is kept (needed for the dashboard), but the
  pods/exec terminal is off by default per upstream's own security
  guidance, since it's a broad write surface on a shared cluster.
• Standalone HTTPRoute on envoy-internal (the chart only supports classic
  Ingress natively) plus the envoy-gateway-oidc component, since the app
  ships with no built-in authentication.

Requires a 1Password entry "kubagachi-oidc" (client-id/client-secret) from
an OIDC client registered against https://pid.kantai.xyz with redirect URL
https://kubagachi.kantai.xyz/oauth2/callback before the route will
authenticate.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01Gs6cgwVnpPmrYSKZToLjJ4

[daddy-ro]

konflate — summary

Note

+11 added · 0 changed · −0 removed — 11 resources · 3 apps

Caution

4 render failures

• HelmRelease gpu-operator/gpu-operator — chart source OCIRepository/gpu-operator/gpu-operator not ready: OCIRepository gpu-operator/gpu-operator resolve v26.3.3: HEAD "https://ocharted.kantai.xyz/v2/helm.ngc.nvidia.com/nvidia/gpu-operator/manifests/v26.3.3": response status code 403: Forbidden
• HelmRelease observability/kubagachi — chart source OCIRepository/observability/kubagachi-chart not ready: OCIRepository observability/kubagachi-chart resolve 0.1.0: HEAD "https://ghcr.io/v2/yscale-sh/charts/kubagachi/manifests/0.1.0": GET "https://ghcr.io/token?scope=repository%3Ayscale-sh%2Fcharts%2Fkubagachi%3Apull&service=ghcr.io": response status code 401: unauthorized: authentication required
• OCIRepository gpu-operator/gpu-operator — OCIRepository gpu-operator/gpu-operator resolve v26.3.3: HEAD "https://ocharted.kantai.xyz/v2/helm.ngc.nvidia.com/nvidia/gpu-operator/manifests/v26.3.3": response status code 403: Forbidden
• OCIRepository observability/kubagachi-chart — OCIRepository observability/kubagachi-chart resolve 0.1.0: HEAD "https://ghcr.io/v2/yscale-sh/charts/kubagachi/manifests/0.1.0": GET "https://ghcr.io/token?scope=repository%3Ayscale-sh%2Fcharts%2Fkubagachi%3Apull&service=ghcr.io": response status code 401: unauthorized: authentication required

View the full rendered diff →

_{konflate · rendered b60bd4f · advisory, not a gate}