,-,------,
          _ \(\(_,--'
     <`--'\>/(/(__
     /. .  `'` '  \
    (`')  ,        @
     `-._,        /
        )-)_/--( >
       ''''  ''''

PIG deployment

Deploy Promptless Instruction Governance into an existing EKS cluster. Releases 0.3.0, 0.3.1, 0.3.3, 0.3.4, and 0.3.5 target AWS. Azure/AKS and GCP/GKE support is experimental. Terraform provisions the customer database, native object storage, network access, workload identity, and recovery settings. Helm/GitOps owns collector ingress. A namespace-scoped supervisor installs and updates the analyzer from immutable releases.

This repository contains intentionally public deployment assets and supervisor source. Analyzer application source is maintained separately.

Start here

• Infrastructure examples: AWS, Azure, and GCP prerequisites, remote state, Terraform ownership, and the Kubernetes handoff.
• Deployment contract: release policy, credentials, recovery, capacity acknowledgement, and acceptance.
• HTTPS ingress: required collector endpoint for enrolled hosts and cloud agents.
• Storage operations: database roles, diagnostics, retention, and recovery.
• Release operations: artifact integrity, publication gates, and release acceptance.
• Customer guides.

Version 0.3.3 includes the analyzer's NUL ingestion repair and targets schema revision 4. The AWS unattended update test retains its pinned schema-3 candidates. The 0.3.3 AWS-only owner-signoff exception leaves live analysis acceptance pending and does not certify cloud lifecycle checks.

Version 0.3.5 pairs the Go supervisor and analyzer through PIG_* settings and targets schema revision 5. See the release preparation for candidate selection, secret provisioning, and acceptance requirements. Source preparation does not publish or promote a release. Installations using the Python supervisor must complete the operator ownership handoff.

The stable catalog lists published releases. Versions 0.3.1, 0.3.3, 0.3.4, and 0.3.5 use explicit AWS-only owner sign-off in place of stored acceptance reports. A release becomes eligible for automatic updates only after accepted images and charts are publicly available and its reviewed catalog promotion is merged. Do not use the existing 0.2.0 worker image for the supervisor contract.

Repository layout

Path	Responsibility
modules/{aws,azure,gcp}	Cloud resources for an existing cluster and network
examples/{aws,azure,gcp}	Locked providers, remote state, and local module references
charts/pig-supervisor	Supervisor bootstrap, required collector Ingress, CRD, and bounded RBAC
charts/pig-trace-analyzer	Operator-managed analyzer installation
supervisor/cmd, supervisor/internal	Go supervisor process, reconciliation, and Kubernetes client
supervisor/pig_supervisor	Python release publication, inspection, and schema tooling
catalog	Immutable manifests and the stable release index
releases/requirements	Reviewed live checks and operator prerequisites
schemas	Generated CR, release, and acceptance-evidence schemas

Published charts live at oci://ghcr.io/promptless/charts/pig-supervisor and oci://ghcr.io/promptless/charts/pig-trace-analyzer. Every packaged chart contains an immutable image digest. Source charts require an explicit digest.

The supervisor runs as a static Go binary with controller-runtime and client-go. It polls the namespace every 15 seconds using direct API reads, retaining the existing bootstrap RBAC without requiring watches or API discovery. Leadership uses the existing pig-supervisor Lease with resource-version-guarded patches. Writes stop before the local Lease deadline; this guard does not provide server-side fencing for requests already accepted by Kubernetes.

The Go runtime preserves reconciliation and release safety behavior. The 0.3.4 ingress ownership split removes spec.endpoint and changes the configuration hash once; complete active transitions and follow the operator handoff before upgrading. Subsequent ingress edits do not revalidate analyzer workloads. Python remains the release-publication, inspection, and schema-generation toolchain; the runtime image contains no Python. The compatibility fixtures describe the recorded Python behavior checked by the Go suite.

Local validation

See CI checks for required pull-request checks, real Kubernetes integration tests, security scanning, and local reproduction.

Use Python 3.11+, uv 0.8.22, Helm 3.18.6, Go from go.mod, and Terraform 1.11.4. Provider versions and checksums are committed with each example and module.

go test -race ./...
go vet ./...
uv sync --frozen
uv run ruff check supervisor tests scripts
uv run ruff format --check supervisor tests scripts
uv run pytest -q
uv run python scripts/generate-schema.py
uv build
(cd tests/crd-validation && go run .)
terraform fmt -check -recursive

Each cloud module has credential-free mock plans. For example:

terraform -chdir=examples/aws init -backend=false -input=false -lockfile=readonly
terraform -chdir=examples/aws validate
terraform -chdir=modules/aws init -backend=false -input=false -lockfile=readonly
terraform -chdir=modules/aws test

These checks exercise contracts and migration coordination. They do not prove cloud identity, networking, database TLS, host enrollment, analysis, or Dashboard synchronization in a real customer environment.