From 7c7d65c58c6f183089a2493ec4e4a8fa630cde30 Mon Sep 17 00:00:00 2001 From: Karl Isenberg Date: Mon, 3 Aug 2026 02:18:50 -0700 Subject: [PATCH] docs(features): say GHES is untested against a real appliance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both GHES entries read as finished support. The end-to-end claim has never been observed: q536-ghes-private-ca-trust.md's own "What this plan will not verify" says no appliance is involved, and Q506's fix was the same. The v1.3.0 dogfood validation runs against github.com, so it says nothing about GHES either. Kept to one clause per entry because check-roadmap caps a features.md line at 45 words and the fuller version pushed both past it — which is the gate working: the detail belongs in the linked troubleshooting page, not the index. GHES is named in the clause itself rather than "a real appliance", so the warning survives being read out of context on a page that gets scanned. --- docs/features.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/features.md b/docs/features.md index 50acf588c..6a92d836b 100644 --- a/docs/features.md +++ b/docs/features.md @@ -88,8 +88,8 @@ under its first stability contract. - **[The v2 API](operations/migration-v1-to-v2.md)** v2 beta — the recommended shape for new tenants: a decomposed `ActionsGateway` + `RunnerSet` + `RunnerTemplate`, with `v2beta1` as the graduated storage and hub version. - **[Reusable runner templates](operations/migration-v1-to-v2.md)** v2 beta — one `RunnerTemplate` referenced by many runner sets, or a cluster-wide `ClusterRunnerTemplate` shared across namespaces. - **[Multiple gateways per namespace](operations/migration-v1-to-v2.md)** v2 beta — scoped gateways coexist, each with its own GitHub binding and runner sets. -- **[GitHub Enterprise Server gateways](operations/troubleshooting.md#a-ghes-tenants-traffic-never-reaches-the-appliance)** — a gateway whose `gitHubURL` names a GHES appliance addresses that appliance on every GitHub surface, with a `GitHubEgressIncomplete` condition flagging an incomplete CIDR allow-list. -- **[GHES behind a private CA](operations/troubleshooting.md#a-ghes-appliances-certificate-is-not-trusted)** v2 — `spec.githubCABundleRef` names a ConfigMap whose CA bundle is added to the trust of both the gateway's AGC and its worker pods, never replacing the system roots. +- **[GitHub Enterprise Server gateways](operations/troubleshooting.md#a-ghes-tenants-traffic-never-reaches-the-appliance)** — a gateway whose `gitHubURL` names a GHES appliance addresses that appliance on every GitHub surface, with a `GitHubEgressIncomplete` condition flagging an incomplete CIDR allow-list. **Untested against a real GHES appliance.** +- **[GHES behind a private CA](operations/troubleshooting.md#a-ghes-appliances-certificate-is-not-trusted)** v2 — `spec.githubCABundleRef` names a ConfigMap whose CA bundle is added to the trust of both the gateway's AGC and its worker pods, never replacing the system roots. **Untested against a real GHES appliance.** - **[`gag-migrate`](operations/migration-v1-to-v2.md)** — a one-shot fan-out that moves a tenant off `v1alpha1` without changing how jobs are acquired: dry-run, review, apply. - **[Deprecations and the `v2.0.0` removal](operations/v1alpha1-deprecation.md)** — what `v2.0.0` removes, what keeps working until then, and the pre-upgrade checklist. - **[Migrating from ARC](operations/migration-from-arc.md)** — concept mapping, behavioral differences, and a worked zero-downtime migration of one runner group.