feat: convert K8s deployment manifests to KCL

[patrick-hermann-sva]

Context

The current deployment manifests in golden-image-workflow/deploy/ are static YAML files:

• deployment.yaml
• namespace.yaml
• secret.yaml
• statestore.yaml

These should be converted to KCL for type-safe, templatable infrastructure code with validation.

Reference Implementation

Use homerun2-omni-pitcher/kcl/ as the pattern:

golden-image-workflow/kcl/
├── main.k              # Entry point, exports all manifests
├── schema.k            # GoldenImageWorkflow schema with defaults + validation
├── labels.k            # Common/selector labels + option() config overrides
├── namespace.k
├── serviceaccount.k
├── deploy.k            # Deployment with Dapr sidecar annotations
├── service.k
├── secret.k            # GH token, Vault credentials
├── statestore.k        # Dapr statestore component (Redis)
├── kcl.mod
└── README.md

Key differences from homerun2 pattern

• Dapr annotations on the Deployment pod template (dapr.io/enabled, dapr.io/app-id, dapr.io/app-port)
• Dapr components as KCL resources (statestore, optionally cron binding, secretstore)
• No ingress/httproute needed (internal service only)
• Dagger Cloud token secret for dagger engine access

Schema fields (adapt from homerun2's schema.k)

schema GoldenImageWorkflow:
    name: str = "golden-image-workflow"
    namespace: str = "sthings-system"
    image: str = "ghcr.io/stuttgart-things/dapr-golden-packer-image-workflow:latest"
    replicas: int = 1
    containerPort: int = 8080

    # Dapr
    daprEnabled: bool = True
    daprAppId: str = "golden-image-workflow"
    daprAppPort: int = 8080

    # Statestore
    statestoreType: str = "state.redis"
    statestoreHost: str = "redis.sthings-system.svc.cluster.local:6379"
    statestorePassword: str = ""

    # Secrets
    daggerCloudToken: str = ""
    githubToken: str = ""

CI/CD integration

Release workflow calls call-go-release.yaml with:

kcl-source-dir: golden-image-workflow/kcl
kcl-profile-file: tests/kcl-deploy-profile.yaml
kustomize-oci-repo: ghcr.io/stuttgart-things/dapr-golden-packer-image-workflow-kustomize

Test profile (tests/kcl-deploy-profile.yaml)

config.image: ghcr.io/stuttgart-things/dapr-golden-packer-image-workflow:latest
config.namespace: sthings-system
config.statestoreHost: redis.sthings-system.svc.cluster.local:6379
config.daggerCloudToken: changeme
config.githubToken: changeme

Scope

• Convert all manifests in golden-image-workflow/deploy/ to KCL
• Add Dapr component resources (statestore, optionally cron binding)
• Support environment-specific overrides via option() config
• Validate Dapr annotations and component schemas at compile time
• Add test profile for CI rendering
• Add kcl-render task to Taskfile
• Remove old deploy/ static YAML after migration

Related

• Part of #1
• Reference: homerun2-omni-pitcher/kcl/ + homerun2-omni-pitcher/.github/workflows/release.yaml