Document Gitea CI and required secrets in README

Co-Authored-By: Claude <noreply@anthropic.com>
Record MR creation in plan execution summary
2026-08-11 19:46:55 +02:00 · 2026-08-11 19:41:57 +02:00 · 2026-08-11 19:39:23 +02:00 · 2026-08-11 19:37:42 +02:00 · 2026-08-11 19:21:14 +02:00 · 2026-08-11 19:17:58 +02:00
26 changed files with 1954 additions and 15 deletions
--- a/.claude/agents/operator-reviewer.md
+++ b/.claude/agents/operator-reviewer.md
@@ -0,0 +1,15 @@
 ---
 name: operator-reviewer
 description: Reviews Kubernetes operator PRs for controller-runtime correctness, reconcile semantics, and API design
 tools: Read, Grep, Glob, Bash
 ---
 You are a senior reviewer specializing in Kubernetes operators.
 Review with focus on:
 - Reconcile idempotency and requeue behavior; no state assumptions between reconciles
 - Informer cache reads vs direct API reads; stale-cache races
 - Finalizer handling, deletion flow, orphaned resources
 - CRD schema evolution, conversion webhooks, status subresource / conditions conventions
 - RBAC minimality vs what the controller actually touches
 - Leader election, watch predicates, event filtering for churn reduction
 - Go: context propagation, error wrapping, client.Object handling
 Output: findings ranked by severity, with file:line refs. No praise padding.
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -71,7 +71,19 @@
      "Bash(kind load *)",
      "Bash(make deploy *)",
      "Bash(kubectl -n egress-proxies-operator-system rollout status deploy/egress-proxies-operator-controller-manager --timeout=120s)",
-      "Bash(kubectl -n egress-proxies-operator-system rollout restart deploy/egress-proxies-operator-controller-manager)"
+      "Bash(kubectl -n egress-proxies-operator-system rollout restart deploy/egress-proxies-operator-controller-manager)",
      "Bash(git -C /Users/jan.novak/srv/go/egress-proxies-operator add docs/plans/2026-08-11-1742-gcp-provider-verbose-logging.md)",
      "Bash(git -C /Users/jan.novak/srv/go/egress-proxies-operator commit -m 'Add plan: verbose V-level logging in the GCP provider *)",
      "Bash(echo \"exit: $?\")",
      "Bash(echo \"tests exit: $?\")",
      "Bash(./bin/manager --version)",
      "Bash(./bin/manager-stamped --version)",
      "Bash(./bin/manager-pkg --version)",
      "Bash(docker run *)",
      "Bash(kubectl -n egress-proxies-operator-system get pods -o wide)",
      "Bash(kubectl -n egress-proxies-operator-system get deploy egress-proxies-operator-controller-manager -o jsonpath='{.spec.template.spec.containers[0].args}')",
      "Bash(kubectl -n egress-proxies-operator-system logs deploy/egress-proxies-operator-controller-manager)",
      "Bash(python3 -c \"import json; d=json.load\\(open\\('docs/deploy/sa_key.json'\\)\\); print\\(d.get\\('type'\\), d.get\\('client_email'\\)\\)\")"
    ],
    "additionalDirectories": [
      "/Users/jan.novak/srv/go/egress-proxies-operator/.claude",
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -0,0 +1,76 @@
 name: Build and Push
 on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Image tag'
        required: true
        default: 'latest'
  push:
    tags:
      - '*'
 concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true
 jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
      - name: Vet
        run: go vet ./...
      - name: Build
        run: go build ./...
      - name: Test (short)
        run: go test -short ./...
  build:
    needs: check
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Compute image tags
        id: meta
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            TAG="${{ inputs.tag }}"
          else
            TAG="${{ github.ref_name }}"
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "sha=sha-$(echo '${{ github.sha }}' | cut -c1-12)" >> "$GITHUB_OUTPUT"
      - name: Login to Gitea registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin gitea.home.hrajfrisbee.cz
      - name: Build and push
        run: |
          IMAGE=gitea.home.hrajfrisbee.cz/${{ github.repository }}
          docker build \
            --build-arg GIT_COMMIT=$(echo '${{ github.sha }}' | cut -c1-12) \
            --label org.opencontainers.image.source=https://gitea.home.hrajfrisbee.cz/${{ github.repository }} \
            --label org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
            -t "$IMAGE:${{ steps.meta.outputs.tag }}" \
            -t "$IMAGE:${{ steps.meta.outputs.sha }}" \
            .
          docker push "$IMAGE:${{ steps.meta.outputs.tag }}"
          docker push "$IMAGE:${{ steps.meta.outputs.sha }}"
      # Only real tag pushes move :latest — an ad-hoc dispatch of an old ref must not clobber it.
      - name: Push latest (tag builds only)
        if: github.event_name == 'push'
        run: |
          IMAGE=gitea.home.hrajfrisbee.cz/${{ github.repository }}
          docker tag "$IMAGE:${{ steps.meta.outputs.tag }}" "$IMAGE:latest"
          docker push "$IMAGE:latest"
--- a/.gitignore
+++ b/.gitignore
@@ -28,3 +28,6 @@ go.work
 # Kubeconfig might contain secrets
 *.kubeconfig
 # GCP service-account keys (created per docs/gcp-in-specific-project.md)
 sa_key.json
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -199,8 +199,18 @@ Always append a `Co-Authored-By` trailer to indicate AI assistance:
    Co-Authored-By: Claude <noreply@anthropic.com>
-TODO: no `.gitea/workflows/` CI pipeline exists yet — add a CI/CD subsection here once
+### CI/CD
-one is set up.
+
 `.gitea/workflows/build.yaml` builds the manager image and pushes it to the Gitea
 registry. Triggers: any tag push, or manual `workflow_dispatch` with a `tag` input.
 A lightweight `check` job (`go vet` / `go build` / `go test -short`) gates the build.
 - Images: `gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator:<tag>` plus an
  immutable `sha-<12-char-commit>` tag on every build; `:latest` moves only on real
  tag pushes, never on manual dispatch.
 - Requires the `REGISTRY_TOKEN` repo secret (Gitea PAT with `write:package`),
  same convention as the other projects on this Gitea instance.
 - The commit is baked into the binary via the `GIT_COMMIT` build arg (see Dockerfile).
 ## Gotchas
--- a/7
+++ b/7
@@ -2,6 +2,7 @@
 FROM golang:1.26 AS builder
 ARG TARGETOS
 ARG TARGETARCH
 ARG GIT_COMMIT=unknown
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -19,11 +20,15 @@ COPY . .
 # was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
 # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
-RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a \
    -ldflags "-X gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/version.Commit=${GIT_COMMIT}" \
    -o manager cmd/main.go
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
 FROM gcr.io/distroless/static:nonroot
 ARG GIT_COMMIT=unknown
 LABEL org.opencontainers.image.revision="${GIT_COMMIT}"
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532
--- a/9
+++ b/9
@@ -2,6 +2,9 @@
 IMG ?= controller:latest
 # YEAR defines the year value used for substituting the YEAR placeholder in the boilerplate header.
 YEAR ?= $(shell date +%Y)
 # GIT_COMMIT is baked into the image (-ldflags in the Dockerfile); -dirty
 # covers staged and untracked changes too, which `git diff --quiet` misses.
 GIT_COMMIT ?= $(shell git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)$(shell test -z "$$(git status --porcelain 2>/dev/null)" || echo -dirty)
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -110,7 +113,7 @@ lint-config: golangci-lint ## Verify golangci-lint linter configuration
 .PHONY: build
 build: manifests generate fmt vet ## Build manager binary.
-	go build -o bin/manager cmd/main.go
+	go build -o bin/manager ./cmd
 .PHONY: run
 run: manifests generate fmt vet ## Run a controller from your host.
@@ -125,7 +128,7 @@ run-dev: manifests generate fmt vet ## Run locally against the current kubeconfi
 # More info: https://docs.docker.com/develop/develop-images/build_enhancements/
 .PHONY: docker-build
 docker-build: ## Build docker image with the manager.
-	$(CONTAINER_TOOL) build -t ${IMG} .
+	$(CONTAINER_TOOL) build --build-arg GIT_COMMIT=$(GIT_COMMIT) -t ${IMG} .
 .PHONY: docker-push
 docker-push: ## Push docker image with the manager.
@@ -144,7 +147,7 @@ docker-buildx: ## Build and push docker image for the manager for cross-platform
 	sed -e '1 s/\(^FROM\)/FROM --platform=\$$\{BUILDPLATFORM\}/; t' -e ' 1,// s//FROM --platform=\$$\{BUILDPLATFORM\}/' Dockerfile > Dockerfile.cross
 	- $(CONTAINER_TOOL) buildx create --name egress-proxies-operator-builder
 	$(CONTAINER_TOOL) buildx use egress-proxies-operator-builder
-	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --tag ${IMG} -f Dockerfile.cross .
+	- $(CONTAINER_TOOL) buildx build --push --platform=$(PLATFORMS) --build-arg GIT_COMMIT=$(GIT_COMMIT) --tag ${IMG} -f Dockerfile.cross .
 	- $(CONTAINER_TOOL) buildx rm egress-proxies-operator-builder
 	rm Dockerfile.cross
--- a/README.md
+++ b/README.md
@@ -167,6 +167,40 @@ cloud.google.com/go/compute v1.65.0. envtest uses the 1.36.2 binary
 bundle (the latest 1.36 patch with published binaries — do not "fix" the
 Makefile's derived version to 1.36.3, which has none).
 ## Gitea CI
 [.gitea/workflows/build.yaml](.gitea/workflows/build.yaml) builds the
 manager image and pushes it to this Gitea instance's container registry.
 It runs on **any tag push** or manually via **Run workflow** (with a `tag`
 input) — never on branch pushes. A lightweight `check` job (`go vet`,
 `go build`, `go test -short`) gates the build.
 Every build pushes two tags to
 `gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator`:
 - the human tag (the git tag, or the dispatch input), and
 - an immutable `sha-<12-char-commit>` tag — pin deployments to this one.
 `:latest` is additionally updated on real tag pushes only, so a manual
 dispatch of an old ref can never clobber it. The commit is baked into the
 binary (`internal/version.Commit`) via the `GIT_COMMIT` build arg.
 ### Mandatory Gitea secrets
 Set under **Settings → Actions → Secrets** in this repo:
 | Secret           | Required by                   | What it is                               |
 | ---------------- | ----------------------------- | ---------------------------------------- |
 | `REGISTRY_TOKEN` | `build.yaml` (registry login) | Gitea PAT with the `write:package` scope |
 The token is paired with `${{ github.actor }}` as the username, so it
 must belong to the user triggering the workflow — same convention as the
 other projects on this instance.
 Without `REGISTRY_TOKEN` the `check` job still passes but the build job
 fails at the `docker login` step. No other secrets are needed — the
 workflow does not deploy anywhere.
 ## Development
 ```sh
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -24,7 +24,9 @@ import (
 	"context"
 	"crypto/tls"
 	"flag"
 	"fmt"
 	"os"
 	goruntime "runtime"
 	"time"
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
@@ -56,6 +58,7 @@ import (
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider/gcp"
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider/kubernetes"
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider/registry"
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/version"
 	// +kubebuilder:scaffold:imports
 )
@@ -88,6 +91,8 @@ func main() {
 	var gcInterval, gcMinAge time.Duration
 	var gcAllowNamespaced bool
 	var leaseCooldown, maxLeaseTTL time.Duration
 	var showVersion bool
 	var gcpWireFullPayloads bool
 	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
 		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
@@ -124,6 +129,10 @@ func main() {
 		"How long a reported proxy/target pair is excluded from lease selection.")
 	flag.DurationVar(&maxLeaseTTL, "max-lease-ttl", time.Hour,
 		"Maximum lease TTL a client may request.")
 	flag.BoolVar(&showVersion, "version", false,
 		"Print the commit the binary was built from and exit.")
 	flag.BoolVar(&gcpWireFullPayloads, "gcp-wire-log-full-payloads", false,
 		"Log GCP V(5) wire payloads verbatim instead of eliding fields larger than 1KiB.")
 	opts := zap.Options{
 		Development: true,
@@ -131,7 +140,14 @@ func main() {
 	opts.BindFlags(flag.CommandLine)
 	flag.Parse()
 	if showVersion {
 		fmt.Println(version.Resolve())
 		os.Exit(0)
 	}
 	ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
 	setupLog.Info("Starting egress-proxies-operator",
 		"commit", version.Resolve(), "goVersion", goruntime.Version())
 	ctx := ctrl.SetupSignalHandler()
 	// Providers load first and fail fast: a manager that comes up without
@@ -147,7 +163,9 @@ func main() {
 	}
 	providers, err := registry.Build(ctx, cfg, map[string]registry.Constructor{
 		"kubernetes": kubernetes.New,
-		"gcp":        gcp.New,
+		"gcp": func(ctx context.Context, pc provider.ProviderConfig) (provider.Provider, error) {
 			return gcp.NewWithWireOptions(ctx, pc, gcp.WireLogOptions{FullPayloads: gcpWireFullPayloads})
 		},
 	})
 	if err != nil {
 		setupLog.Error(err, "Failed to build providers")
--- a/docs/gcp-in-specific-project.md
+++ b/docs/gcp-in-specific-project.md
@@ -0,0 +1,255 @@
 ## Project egress-proxy
 ```bash
 PROJECT_ID=egress-proxy
 # 1. Create the service account
 gcloud iam service-accounts create proxy-operator \
  --project ${PROJECT_ID} \
  --display-name "egress-proxies-operator"
 # Output: 
 # Created service account [proxy-operator].
 # Service account email: proxy-operator@egress-proxy.iam.gserviceaccount.com
 # 2. Grant compute.instanceAdmin.v1 on the project
 gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member "serviceAccount:proxy-operator@${PROJECT_ID}.iam.gserviceaccount.com" \
  --role roles/compute.instanceAdmin.v1
 # Output:
 # ---------
 # Updated IAM policy for project [egress-proxy].
 # bindings:
 # - members:
 #   - serviceAccount:proxy-operator@egress-proxy.iam.gserviceaccount.com
 #   role: roles/compute.instanceAdmin.v1
 # - members:
 #   - serviceAccount:541231138892@cloudservices.gserviceaccount.com
 #   role: roles/compute.instanceGroupManagerServiceAgent
 # - members:
 #   - serviceAccount:service-541231138892@compute-system.iam.gserviceaccount.com
 #   role: roles/compute.serviceAgent
 # - members:
 #   - user:admin@fujultimate.cz
 #   role: roles/owner
 # etag: BwZYuFXko24=
 # version: 1
 # 3. Create the JSON key (this is what goes into the Secret)
 SA_KEY_PATH=sa_key.json
 gcloud iam service-accounts keys create $SA_KEY_PATH \
  --iam-account proxy-operator@${PROJECT_ID}.iam.gserviceaccount.com
 # output:
 # created key [fdff85174a8e80bbd684e76c4d9fe28e2f4b2ddf] of type [json] as [sa_key.json] for [proxy-operator@egress-proxy.iam.gserviceaccount.com]
 # 4. A **firewall rule**: created VMs get network tag `proxy-operator` (the
 #    default; configurable as `gcp.networkTag`), an ephemeral external IP,
 #    and Squid listening on 3128.
 gcloud compute firewall-rules create allow-proxy-operator \
    --project $PROJECT_ID \
    --network default \
    --allow tcp:3128 \
    --target-tags proxy-operator \
    --source-ranges 94.230.145.216/32
 ```
 ## Phase 2 - resources in kube
 ```bash
 SA_KEY_PATH=sa_key.json
 kubectl -n egress-proxies-operator-system create secret generic gcp-credentials \
  --from-file=key.json=$SA_KEY_PATH
 ```
 ## Appendix - full manifests
 ```bash
 # crawl CR
 kubectl apply -f - <<'EOF'
 apiVersion: crawl.example.com/v1alpha1
 kind: Proxy
 metadata:
  name: proxy-gcp-sample
 spec:
  mode: Managed
  provider: gcp-eu                   # must match a provider NAME in providers.yaml
  placement:
    zone: europe-west1-b
    machineType: e2-micro
    # debian-cloud images have no cloud-init, so spec.cloudInit (passed as
    # user-data metadata) would be silently ignored there. Ubuntu images do.
    image: projects/ubuntu-os-cloud/global/images/family/ubuntu-2404-lts-amd64
  port: 3128
  cloudInit:
    inline: |
      #cloud-config
      package_update: true
      packages:
        - squid
      write_files:
        - path: /etc/squid/conf.d/proxy-operator.conf
          content: |
            http_access allow all
            via off
            forwarded_for off
      runcmd:
        - systemctl restart squid
  attributes:
    geo: eu
    purpose: crawl
 EOF
 # configmap
 kubectl apply -f - <<'EOF'
 apiVersion: v1
 data:
  providers.yaml: |
    providers:
      - name: kubernetes
        type: kubernetes
      - name: gcp-eu          # spec.provider on a Proxy refers to this NAME, not the type
        type: gcp
        gcp:
            project: egress-proxy
            # network: default            # these three default as shown
            # networkTag: proxy-operator
            # diskSizeGb: 10
 kind: ConfigMap
 metadata:
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: egress-proxies-operator
  name: egress-proxies-operator-providers-config
  namespace: egress-proxies-operator-system
 EOF
 # operator deployment
 kubectl apply -f - <<'EOF'
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    deployment.kubernetes.io/revision: "2"
  labels:
    app.kubernetes.io/managed-by: kustomize
    app.kubernetes.io/name: egress-proxies-operator
    control-plane: controller-manager
  name: egress-proxies-operator-controller-manager
  namespace: egress-proxies-operator-system
 spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app.kubernetes.io/name: egress-proxies-operator
      control-plane: controller-manager
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: manager
      labels:
        app.kubernetes.io/name: egress-proxies-operator
        control-plane: controller-manager
    spec:
      containers:
        - args:
            - --metrics-bind-address=:8443
            - --leader-elect
            - --health-probe-bind-address=:8081
            - --providers-config=/etc/proxy-operator/providers.yaml
          command:
            - /manager
          env:
            - name: DISCOVERY_TOKEN
              valueFrom:
                secretKeyRef:
                  key: token
                  name: discovery-token
                  optional: true
            - name: GOOGLE_APPLICATION_CREDENTIALS
              value: /var/secrets/gcp/key.json
          image: egress-proxies-operator:dev
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 3
            httpGet:
              path: /healthz
              port: 8081
              scheme: HTTP
            initialDelaySeconds: 15
            periodSeconds: 20
            successThreshold: 1
            timeoutSeconds: 1
          name: manager
          ports:
            - containerPort: 8081
              name: health
              protocol: TCP
            - containerPort: 8090
              name: discovery
              protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /readyz
              port: 8081
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources:
            limits:
              cpu: 500m
              memory: 128Mi
            requests:
              cpu: 10m
              memory: 64Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /etc/proxy-operator
              name: providers-config
              readOnly: true
            - mountPath: /var/secrets/gcp
              name: gcp-credentials
              readOnly: true
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      serviceAccount: egress-proxies-operator-controller-manager
      serviceAccountName: egress-proxies-operator-controller-manager
      terminationGracePeriodSeconds: 10
      volumes:
        - configMap:
            defaultMode: 420
            name: egress-proxies-operator-providers-config
          name: providers-config
        - name: gcp-credentials
          secret:
            defaultMode: 420
            secretName: gcp-credentials
 EOF
 ```
--- a/docs/gcp-vm-validation.md
+++ b/docs/gcp-vm-validation.md
@@ -0,0 +1,158 @@
 # Validating real VM creation on GCP
 Recipe for wiring the GCP provider into a live cluster and watching a
 `Proxy` CR create a real Compute Engine VM. Angle brackets mark values you
 supply: `<PROJECT_ID>`, `<SA_KEY_PATH>`, `<ZONE>`, `<CLUSTER_EGRESS_IP>`,
 `<REGISTRY_IMAGE>`.
 The one important fact up front: **the operator takes no GCP credentials
 through its own config.** The client is built with Application Default
 Credentials (`internal/provider/gcp/gcp.go`, `New()`); there is no
 key-file field in the providers config. The only secret to prepare is a
 service-account JSON key, injected via the standard
 `GOOGLE_APPLICATION_CREDENTIALS` mechanism. On GKE you would use workload
 identity instead and skip the key entirely.
 ## 1. GCP-side prerequisites (prepared outside the cluster)
 1. A project — `<PROJECT_ID>` — with the **Compute Engine API enabled**.
 2. A **service account** with `roles/compute.instanceAdmin.v1` on the
   project. The operator only calls instances
   `Insert`/`Get`/`Delete`/`AggregatedList` and does not attach a service
   account to the VMs it creates, so no `iam.serviceAccountUser` is
   needed.
 3. A **JSON key** for that service account, saved at `<SA_KEY_PATH>`.
 4. A **firewall rule**: created VMs get network tag `proxy-operator` (the
   default; configurable as `gcp.networkTag`), an ephemeral external IP,
   and Squid listening on 3128.
   ```sh
   gcloud compute firewall-rules create allow-proxy-operator \
     --project <PROJECT_ID> \
     --network default \
     --allow tcp:3128 \
     --target-tags proxy-operator \
     --source-ranges <CLUSTER_EGRESS_IP>/32
   ```
   The source range must cover the cluster's egress IP — the operator's
   CONNECT health probes originate there, and without the rule the Proxy
   hangs at `Running`/unhealthy instead of reaching `Ready`. ⚠️ The
   sample cloud-init configures `http_access allow all`, so on a public
   IP this is an open proxy — keep the source ranges tight.
 ## 2. Create the credentials Secret
 Namespace is `egress-proxies-operator-system` after kustomize prefixing:
 ```sh
 kubectl -n egress-proxies-operator-system create secret generic gcp-credentials \
  --from-file=key.json=<SA_KEY_PATH>
 ```
 ## 3. Add a GCP entry to the providers ConfigMap
 Edit `config/manager/providers_config.yaml` (mounted at
 `/etc/proxy-operator/providers.yaml`):
 ```yaml
 providers:
  - name: kubernetes
    type: kubernetes
  - name: gcp-eu          # spec.provider on a Proxy refers to this NAME, not the type
    type: gcp
    gcp:
      project: <PROJECT_ID>
      # network: default            # these three default as shown
      # networkTag: proxy-operator
      # diskSizeGb: 10
 ```
 The config is validated fail-fast at startup — a typo shows up
 immediately in the manager log, not on first use.
 ## 4. Mount the Secret and point ADC at it
 In `config/manager/manager.yaml`, add to the manager container:
 ```yaml
 env:
  - name: GOOGLE_APPLICATION_CREDENTIALS
    value: /var/secrets/gcp/key.json
 volumeMounts:
  - name: gcp-credentials
    mountPath: /var/secrets/gcp
    readOnly: true
 volumes:
  - name: gcp-credentials
    secret:
      secretName: gcp-credentials
 ```
 (`volumeMounts` merges into the existing container list; `volumes` into
 the existing pod-level list.)
 ## 5. Deploy and create the Proxy
 ```sh
 make deploy IMG=<REGISTRY_IMAGE>
 ```
 `config/samples/proxy_gcp.yaml` is usable as-is once `spec.provider`
 matches the name from step 3. All three placement fields are mandatory
 for GCP — a missing one sets the Proxy to `Failed` with a message naming
 it:
 ```yaml
 spec:
  mode: Managed
  provider: gcp-eu
  placement:
    zone: <ZONE>                     # e.g. europe-west1-b
    machineType: e2-micro
    image: projects/debian-cloud/global/images/family/debian-12
 ```
 ```sh
 kubectl apply -f config/samples/proxy_gcp.yaml
 ```
 ## 6. What you should see
 ```sh
 kubectl get proxy -w
 ```
 `Provisioning` → `Running` (VM's external IP published in status) →
 `Ready` (CONNECT health probe succeeded through the public IP). Then:
 ```sh
 # the VM exists and carries the GC labels
 gcloud compute instances list --project <PROJECT_ID> \
  --filter 'labels.proxy-operator-managed=yes'
 # the proxy actually tunnels — should print the VM's external IP
 curl -x http://<EXTERNAL_IP>:3128 https://ifconfig.me
 ```
 Cleanup — the finalizer deletes the VM:
 ```sh
 kubectl delete proxy proxy-gcp-sample
 gcloud compute instances list --project <PROJECT_ID>   # should be empty again
 ```
 ## Gotchas
 - **The orphan GC sweeps the whole project**: any VM labeled
  `proxy-operator-managed=yes` whose UID does not match a live Proxy CR
  in *this* cluster is deleted once past the age threshold. Do not point
  two operator installs at the same project, and do not hand-create VMs
  with that label.
 - **VM creation is fire-and-forget** — the provider never waits on the
  insert operation; progress is discovered by polling `Get`. A quota
  error or bad image name surfaces on the Proxy's status/conditions a
  reconcile later, not synchronously. `kubectl describe proxy` is the
  place to look when something stalls.
 - **e2-micro costs pennies but is not free everywhere** — remember to
  delete the CR (or check `gcloud compute instances list`) when done.
--- a/docs/plans-executions/2026-08-11-1742-gcp-provider-verbose-logging.md
+++ b/docs/plans-executions/2026-08-11-1742-gcp-provider-verbose-logging.md
@@ -0,0 +1,42 @@
 # Execution: Verbose (V-level) logging in the GCP provider
 Plan: `docs/plans/2026-08-11-1742-gcp-provider-verbose-logging.md`
 - [x] Step 0 — Save and commit the plan
 - [x] Step 1 — V(1)/V(2) logging in `internal/provider/gcp` (gcp.go, errors.go)
 - [x] Step 2 — Tests (verbosity tiers, error detail, cloud-init leak guard)
 - [ ] Step 3 — CHANGELOG entry (after the user confirms it works live)
 ## Step 1 — logging in the provider
 Went as planned: context-carried logger (`logf.FromContext(ctx).WithName("gcp")`),
 V(1) one line per API call, V(2) request/list detail, opNames captured from the
 `instancesAPI` seam instead of being discarded. `logAPIError` lives in
 `errors.go` (next to `classify`, whose imports it shares) rather than `gcp.go`
 as loosely implied by the plan — same package, so no behavioural difference.
 These are the first `.V(n)` calls and the first logging import anywhere under
 `internal/provider/`.
 Worth noting: the gopls `errorsastype` suggestion fired on the new
 `errors.As` in `logAPIError` (Go's newer `errors.AsType`); kept `errors.As`
 for consistency with the three existing uses in the same file. Same for the
 `newexpr` (`proto.String` → `new`) suggestions — the codebase consistently
 uses `proto.String`.
 ## Step 2 — tests
 `funcr.New` as the capturing sink, injected via `logr.NewContext`, exactly the
 seam the plan predicted. One deviation: instead of a single
 `TestLogging_verbosity` table, it split into three tests — `_verbosityTiers`
 (table over V=0/1/2, incl. the cloud-init sentinel leak assertion),
 `_apiErrorKeepsHTTPDetail` (403 quotaExceeded keeps `httpStatus`/reason at
 V(1)), and `_treatedAsSuccessPathsAreExplicit` (409-on-create /
 404-on-delete each log their "treated as success" line) — the last two
 exercise fake error wiring that didn't fit the tier table cleanly.
 Verified with:
 ```bash
 go test -race ./internal/provider/gcp/
 go test ./...
 ```
--- a/docs/plans-executions/2026-08-11-1802-bake-commit-version.md
+++ b/docs/plans-executions/2026-08-11-1802-bake-commit-version.md
@@ -0,0 +1,61 @@
 # Execution: Bake the git commit into the operator binary and log it at startup
 Plan: `docs/plans/2026-08-11-1802-bake-commit-version.md`
 - [x] Step 0 — Save and commit the plan
 - [x] Step 1 — `internal/version` package + tests
 - [x] Step 2 — `cmd/main.go`: `--version` flag + startup log line
 - [x] Step 3 — Makefile `GIT_COMMIT` + `--build-arg` wiring
 - [x] Step 4 — Dockerfile `-ldflags` stamp + OCI revision label
 - [ ] Step 5 — CHANGELOG entry (after the user confirms it works live)
 ## Steps 1–4
 Mostly as planned. One deviation worth recording: the plan claimed
 `build`/`run` targets need no changes because Go's automatic VCS stamp covers
 host builds — that turned out to be only half true. Go skips VCS stamping
 when the build target is a *file argument* rather than a package pattern, and
 the Makefile's `build` target used `go build -o bin/manager cmd/main.go`.
 Verified empirically:
 ```bash
 go build -o bin/manager cmd/main.go && ./bin/manager --version   # unknown (no vcs settings)
 go build -o bin/manager ./cmd       && ./bin/manager --version   # e4d2a191d0c2-dirty
 ```
 So `build:` now uses `go build -o bin/manager ./cmd`. `go run` never stamps
 VCS info regardless of invocation form — `make run`/`run-dev` print
 `commit=unknown`, which is acceptable for dev loops (the Dockerfile path uses
 the explicit ldflags stamp and is unaffected; it kept `cmd/main.go`).
 The ldflags path was verified independently:
 ```bash
 go build -ldflags "-X gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/version.Commit=deadbeef1234" \
  -o bin/manager-stamped cmd/main.go
 ./bin/manager-stamped --version   # deadbeef1234
 ```
 Worth noting: `cmd/main.go` imports k8s apimachinery as `runtime`, so the
 stdlib runtime needed an alias (`goruntime "runtime"`) for
 `goruntime.Version()` in the startup line. The `--version` check happens
 right after `flag.Parse()`, before logger and manager setup, so it works
 without a kubeconfig.
 ## Verification
 ```bash
 go vet ./... && go test ./...           # all green, incl. new resolve() table tests
 go build -o bin/manager ./cmd && ./bin/manager --version   # e4d2a191d0c2-dirty
 ```
 The image-level check initially failed (Docker daemon not running); after
 the daemon was started it passed in full:
 ```bash
 make docker-build IMG=egress-proxies-operator:dev
 docker run --rm egress-proxies-operator:dev --version
 # ae434a7167ec-dirty  (matches git rev-parse --short=12 HEAD + untracked files)
 docker inspect egress-proxies-operator:dev --format '{{index .Config.Labels "org.opencontainers.image.revision"}}'
 # ae434a7167ec-dirty
 ```
--- a/docs/plans-executions/2026-08-11-1838-gcp-http-wire-logging-v5.md
+++ b/docs/plans-executions/2026-08-11-1838-gcp-http-wire-logging-v5.md
@@ -0,0 +1,63 @@
 # Execution: GCP HTTP wire logging at V(5)
 Plan: `docs/plans/2026-08-11-1838-gcp-http-wire-logging-v5.md`
 - [x] Step 1 — `wireLogger` + `option.WithLogger` wiring in `internal/provider/gcp/gcp.go`
 - [x] Step 2 — Tests (`TestWireLogger_gatesAtV5`, `TestWireLogger_infoLandsAtV1`)
 - [x] Step 3 — Live verification at `--zap-log-level=5` (user, on cluster)
 - [x] Step 3b — Post-verification fix: drop auth records, elide huge fields
 - [ ] Step 4 — CHANGELOG entry (after live confirmation of 3b; batch with the
      two earlier pending entries: GCP V-logging, version stamp)
 ## Steps 1–2
 Went exactly as planned — the whole feature is ~10 lines of production code
 because both halves already existed: the compute SDK logs full HTTP
 request/response records at slog Debug to an injectable logger, and
 `logr.ToSlogHandler` does the slog→logr bridging. The only real design
 content is the level shift (`base.V(1)` + slog-Debug's +4 = V(5)) and the
 startup warning line when V(5) is active (raw payloads include cloud-init
 user-data, which the curated V(2) logging deliberately hides).
 Worth noting for future readers:
 - `option.WithLogger` **disables** `GOOGLE_SDK_GO_LOGGING_LEVEL` for this
  client (documented SDK precedence) — `--zap-log-level` is now the only knob
  for GCP wire logs.
 - The V(5) check in `New` runs once at startup; that is sound because the zap
  level is fixed by flags at process start.
 - Added `TestWireLogger_infoLandsAtV1` beyond the plan's table — it pins the
  shift arithmetic from the other side (slog Info → V(1)), so a future logr
  mapping change would fail loudly.
 Verified with:
 ```bash
 go test -race ./internal/provider/gcp/
 go build ./... && go test ./...
 ```
 ## Step 3b — what live verification exposed, and the fix
 Live V(5) output revealed two problems the plan missed:
 1. **Security: the injected logger propagates into `cloud.google.com/go/auth`**,
   which logs its own token exchange (`auth.go:571/576`) — signed JWT
   assertion in the request, full bearer access token in the response. The
   plan's "auth token is safe" analysis only covered the compute client's
   request headers, not the auth library's own records. Fix: `wireLogger`
   now wraps the handler in a filter that drops every Debug record except
   the compute client's `"api request"`/`"api response"` (allowlist, so
   future SDK additions fail closed); Warn/Error still pass through.
 2. **Readability: GCP responses embed multi-KB blobs** (Shielded-VM UEFI
   dbx databases) that swamp the line. Fix: string fields >1KiB are elided
   to `[elided N bytes]` by default, recursively through payload
   maps/arrays. Opt-out via new manager flag
   `--gcp-wire-log-full-payloads` (threaded through a constructor closure
   in `cmd/main.go` → `gcp.NewWithWireOptions`; the `registry.Constructor`
   signature stays unchanged). Chosen by the user: elision on by default,
   verbatim available on demand. Auth records are dropped in both modes.
 The filter/elision logic lives in `internal/provider/gcp/wirelog.go` with
 tests covering: auth-record drop (both modes), elision marker + small-field
 preservation, verbatim mode, and the original V(5) gating.
--- a/docs/plans-executions/2026-08-11-1935-gitea-build-workflow.md
+++ b/docs/plans-executions/2026-08-11-1935-gitea-build-workflow.md
@@ -0,0 +1,53 @@
 # Execution: Distilled Gitea Actions image-build workflow
 Plan: `docs/plans/2026-08-11-1935-gitea-build-workflow.md`
 - [x] Step 1 — Create `.gitea/workflows/build.yaml`
 - [x] Step 2 — Replace CLAUDE.md CI TODO with a CI/CD subsection
 - [x] Step 3 — Push branch + open MR
 - [ ] Step 4 — CHANGELOG entry (after the first successful run is confirmed)
 ## Steps 1–2 — workflow + CLAUDE.md
 The workflow distills the house pattern from 9 sibling projects (survey in the plan)
 plus improvements none of them combine: an immutable `sha-<12>` tag, a lightweight
 test gate, `:latest` moving only on real tag pushes, and a `concurrency` group.
 Work happened in a git worktree off `origin/main` so the main checkout (which had
 unrelated uncommitted changes) stayed untouched:
 ```bash
 git worktree add -b feat/gitea-build-workflow \
  "$SCRATCH/wt-build" origin/main
 ```
 Deviation from the plan's assumptions: while planning, `feat/proxy-operator` was
 still unmerged and the plan noted `main` lacked `internal/`/`test/`. By execution
 time `origin/main` had moved (`076bc66..f7000f7` — the proxy-operator MR merged),
 so the branch and its CI gate cover the full operator code.
 Verified the workflow parses and the check-gate commands pass on this exact tree
 (ruby stands in for a YAML linter because the system python3 has no `yaml` module):
 ```bash
 ruby -ryaml -e "YAML.load_file('.gitea/workflows/build.yaml'); puts 'YAML OK'"
 go vet ./... && go build ./... && go test -short ./...   # all packages ok
 ```
 ## Step 3 — push + MR
 Branch pushed and MR opened with `tea` (the worktree was then removed and the main
 checkout switched onto the branch so the files are visible locally):
 ```bash
 tea pr create --title "Add Gitea Actions image-build workflow" \
  --description "..." --base main --head feat/gitea-build-workflow
 # → https://gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/pulls/2
 ```
 Worth noting: the workflow itself cannot run end-to-end until (a) the MR merges
 (it only triggers on tags / manual dispatch, not branch pushes) and (b) the
 `REGISTRY_TOKEN` secret is created in this repo's Gitea settings (PAT with
 `write:package`). First real verification = manual dispatch with tag
 `manual-test`, expecting `manual-test` + `sha-…` in Packages and `:latest`
 untouched.
--- a/docs/plans/2026-08-11-1742-gcp-provider-verbose-logging.md
+++ b/docs/plans/2026-08-11-1742-gcp-provider-verbose-logging.md
@@ -0,0 +1,87 @@
 # Plan: Verbose (V-level) logging in the GCP provider
 **Created:** 2026-08-11 17:42
 ## Context
 Debugging GCP provisioning is currently blind: the operator has zero `.V(n)` calls
 anywhere, so `--zap-log-level=debug` (or any numeric level) reveals nothing about
 what the GCP provider is doing — which API calls it makes, with what parameters,
 and what came back. The goal: with debug/V-level logging enabled, see the details
 of every GCP Compute API call (Insert/Get/Delete/AggregatedList) including a
 summary of the response; with default `info` level, the provider stays as quiet
 as today.
 ## Approach (the "how")
 **Logger source — context-carried, not injected.** Provider methods all take
 `ctx`, and the reconciler already builds a per-request logger
 (`logf.FromContext(ctx)` in `internal/controller/proxy_controller.go:117`) that
 carries the proxy's name/namespace. The GCP provider will do
 `log := logf.FromContext(ctx).WithName("gcp").WithValues("provider", p.name)` at
 the top of each public method. Zero wiring changes (no registry/constructor/struct
 changes), and every provider log line automatically inherits the reconcile
 context (which Proxy triggered it). Calls from the GC sweeper inherit its
 `orphan-gc` logger name the same way.
 **Verbosity scheme** (logr convention: `.Info()` = V(0), `debug` flag = V(1)):
 - **V(1)** — one line per GCP API call, after it returns: operation, identifying
  params, outcome. Examples:
  - `Create`: `"GCP insert instance"` with `zone`, `name`, `machineType`,
    `image`, `opName` (currently discarded at gcp.go:117 — capture it, it's the
    only handle for correlating with GCP's operation log), plus a line for the
    409-already-exists path.
  - `Get`: `"GCP get instance"` with `zone`, `name`, `status`, mapped `state`, `ip`.
  - `Delete`: `"GCP delete instance"` with `zone`, `name`, `opName`, and the
    404-treated-as-success path.
  - `ListByTag`: `"GCP aggregated list"` with `filter`, `count`.
  - Error paths at V(1) too: log the raw classification (HTTP status / reason
    from `googleapi.Error`) before it's wrapped, since the wrapped error the
    reconciler sees is coarser.
 - **V(2)** — request/response detail: full curated insert-request summary
  (network, networkTag, diskSizeGB, port, labels, `cloudInitBytes` = `len`),
  per-instance lines in `ListByTag` (id, state, uid, age).
 **Curated fields, never raw proto dumps.** `CreateRequest.CloudInit` is resolved
 user-data possibly sourced from a Secret, and it lands in the insert request's
 metadata — so logging the request proto wholesale would leak it. Log named safe
 fields only; for cloud-init, log only its byte length. This is a hard rule, and
 a test asserts it.
 **Where the calls live: the `Provider` methods in
 `internal/provider/gcp/gcp.go`** (Create/Get/Delete/ListByTag), not in
 `realInstances` (deliberately untested by design, gcp.go:86) and not an HTTP
 round-tripper (would log auth headers/user-data, unredactable). The
 `instancesAPI` fake seam (`newWithAPI`, gcp.go:96) keeps everything testable.
 To surface `opName`, change `Provider.Create`/`Delete` to capture the string
 their `instancesAPI` calls already return instead of discarding it.
 ## Files to change
 - `internal/provider/gcp/gcp.go` — add `logf` import; V(1)/V(2) logging in
  `Create`, `Get`, `Delete`, `ListByTag`; capture opNames. Only file with
  production changes.
 - `internal/provider/gcp/gcp_test.go` — new table-driven test
  `TestLogging_verbosity` (name TBD per house `Test<Function>_<scenario>`
  style): inject a capturing logger via `logf.IntoContext(ctx, funcr.New(...))`
  (`github.com/go-logr/logr/funcr`, logr already a direct dep), assert:
  - at V(1): expected message + keys per operation (incl. opName),
  - at V(0): nothing logged,
  - **cloud-init content never appears in any log output** (grep the captured
    lines for a sentinel string placed in `CloudInit`).
 - No changes to `provider.Provider` interface, registry, `cmd/main.go`,
  manifests, or the kubernetes provider (it can copy this pattern later).
 ## Verification
 ```bash
 go test -race ./internal/provider/gcp/...
 go build ./...
 ```
 Optional live check: run the manager with `--zap-log-level=2` against the GCP
 project and confirm insert/get lines appear during a Proxy reconcile, and that
 `--zap-log-level=info` stays quiet.
 Also append a CHANGELOG.md entry per house convention once confirmed working.
--- a/docs/plans/2026-08-11-1802-bake-commit-version.md
+++ b/docs/plans/2026-08-11-1802-bake-commit-version.md
@@ -0,0 +1,75 @@
 # Plan: Bake the git commit into the operator binary and log it at startup
 **Created:** 2026-08-11 18:02
 ## Context
 There is no versioning yet, and the image tag (`egress-proxies-operator:dev`,
 `imagePullPolicy: IfNotPresent`) says nothing about what code is actually
 running. The user wants the commit hash baked into the image at build time,
 and — the key requirement — the binary itself must know it and print it into
 the log stream during initialization, so `kubectl logs | head` answers "which
 version is running". Docker builds cannot use Go's automatic VCS stamp because
 `.dockerignore` excludes `.git` (correctly — re-including it would bust layer
 caching), so the hash must travel git → Makefile → `--build-arg` → `-ldflags -X`.
 ## Implementation
 **1. New package `internal/version`** (`version.go` + `version_test.go`):
 - `var Commit string` — stamped at link time via
  `-ldflags "-X gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/version.Commit=<hash>"`.
 - `func Resolve() string` — returns `Commit` if non-empty; otherwise falls
  back to `debug.ReadBuildInfo()` VCS settings (`vcs.revision` truncated to
  12 chars, `-dirty` suffix when `vcs.modified=true`), so plain host builds
  (`make build`, `make run`, `go run`) are stamped for free since `.git` is
  present there; `"unknown"` when neither source is available (e.g. `go test`).
 - Internal `resolve(ldflagsCommit string, readBuildInfo func() (*debug.BuildInfo, bool)) string`
  so the fallback logic is table-testable with a fake build-info func
  (house style: stdlib testing, `t.Parallel()`, subtests,
  `Test<Function>_<scenario>` names).
 **2. `cmd/main.go`**:
 - Add `--version` bool flag; immediately after the existing `flag.Parse()`
  (main.go:132), if set: print `version.Resolve()` to stdout and exit 0
  (before logger/manager setup).
 - Right after `ctrl.SetLogger(...)` (main.go:134):
  `setupLog.Info("Starting egress-proxies-operator", "commit", version.Resolve(), "goVersion", runtime.Version())`
  — first line of every run, plain V(0) so it appears at any log level.
 **3. `Makefile`**:
 - Near the other variables:
  `GIT_COMMIT ?= $(shell git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)$(shell test -z "$$(git status --porcelain 2>/dev/null)" || echo -dirty)`
  (`git status --porcelain` catches staged and untracked changes, which
  `git diff --quiet` misses).
 - `docker-build`: add `--build-arg GIT_COMMIT=$(GIT_COMMIT)`.
 - `docker-buildx`: add the same `--build-arg` to the `buildx build` line.
 - `build`/`run`/`run-dev` stay untouched — the ReadBuildInfo fallback covers them.
 **4. `Dockerfile`**:
 - `ARG GIT_COMMIT=unknown` in the builder stage; extend the existing
  `go build` with `-ldflags "-X <module>/internal/version.Commit=${GIT_COMMIT}"`.
 - Re-declare `ARG GIT_COMMIT` in the distroless stage and add
  `LABEL org.opencontainers.image.revision="${GIT_COMMIT}"` so the hash is
  also visible via `docker inspect` without running the binary.
 No changes to deploy manifests, providers, or the reconciler. CHANGELOG entry
 after the user confirms it works (house convention).
 ## Verification
 ```bash
 go test ./internal/version/            # resolve() table tests
 go build ./... && go test ./...        # nothing else broke
 go run ./cmd/main.go --version         # host build: VCS-stamped hash (+ -dirty), exit 0
 make docker-build IMG=egress-proxies-operator:dev
 docker run --rm egress-proxies-operator:dev --version          # prints the baked commit
 docker inspect egress-proxies-operator:dev \
  --format '{{index .Config.Labels "org.opencontainers.image.revision"}}'
 ```
 Live check: redeploy on the cluster and confirm the first log line carries
 `"commit"`.
--- a/docs/plans/2026-08-11-1838-gcp-http-wire-logging-v5.md
+++ b/docs/plans/2026-08-11-1838-gcp-http-wire-logging-v5.md
@@ -0,0 +1,85 @@
 # Plan: GCP HTTP wire logging at V(5)
 **Created:** 2026-08-11 18:38
 ## Context
 The GCP provider logs curated call summaries at V(1)/V(2), but when debugging
 against the real API the user wants ground truth: the actual HTTP requests and
 responses ("gory details") — visible at `--zap-log-level=5`, in the same log
 stream as everything else. The compute SDK already produces exactly this:
 `cloud.google.com/go/compute@v1.65.0/apiv1/helpers.go:60,70` logs
 `"api request"`/`"api response"` (method, URL, headers, full JSON payloads,
 lazily via `internallog.HTTPRequest/HTTPResponse`) to an injectable
 `*slog.Logger` at slog Debug level. We inject one bridged to the operator's
 zap sink, level-shifted so those Debug records surface only at V(5).
 Level scheme after this change: V(1) call outcomes, V(2) curated detail,
 V(5) raw HTTP traffic. V(3)/V(4) reserved.
 ## Mechanism (verified in module sources)
 - `option.WithLogger(*slog.Logger)` exists in `google.golang.org/api@v0.292.0`
  (option.go:529) and **takes precedence over `GOOGLE_SDK_GO_LOGGING_LEVEL`**
  — after this change, V(5) is the single knob for this client; document that.
 - `logr.ToSlogHandler` (go-logr/logr v1.4.3, already a direct dep) maps
  slog Debug → logr V(4), plus the base logger's V-bias. logr's own docs
  (sloghandler.go:180-184): `slog.New(ToSlogHandler(logrV2)).Debug()` ≈ V(6).
  So a base of `.V(1)` lands Debug at exactly V(5).
 - Gating is cheap: the slog handler's `Enabled()` consults the zap sink, so
  below level 5 the SDK's lazy `LogValuer`s are never evaluated.
 ## Implementation
 **`internal/provider/gcp/gcp.go`** (only production file):
 1. New pure function:
   ```go
   // wireLogger returns the slog logger handed to the SDK: its Debug-level
   // "api request"/"api response" records (slog Debug = +4 on the logr
   // scale) land at V(5) on top of the base's V(1) shift.
   func wireLogger(base logr.Logger) *slog.Logger {
       return slog.New(logr.ToSlogHandler(base.V(1)))
   }
   ```
 2. In `New` (gcp.go:96): pass it to the client —
   `compute.NewInstancesRESTClient(ctx, option.WithLogger(wireLogger(logf.Log.WithName("gcp").WithName("http"))))`.
   Base is the process-root `logf.Log` (client is built once at startup;
   `ctrl.SetLogger` runs before `registry.Build` in cmd/main.go, so it
   resolves to the real zap logger).
 3. One-time notice in `New`: if `logf.Log.V(5).Enabled()`, log at Info:
   `"GCP HTTP wire logging active — request payloads include cloud-init user-data"`
   (the secret-leak warning our curated V(2) logging exists to avoid; at V(5)
   the user has explicitly opted into raw payloads).
 4. New imports: `log/slog`, `google.golang.org/api/option` (module already in
   go.mod as a direct dep; `option` package is a first-time import in the repo).
 **`internal/provider/gcp/gcp_test.go`**:
 - `TestWireLogger_gatesAtV5`: table over funcr sink verbosities
  (`funcr.Options{Verbosity: N}`, pattern already used by `captureContext`):
  at 5 a `Debug("api request", ...)` through `wireLogger` emits (message and
  attrs present); at 4 it emits nothing; an `Info` record through the same
  logger lands at V(1) (sanity-check of the shift).
 - `New` itself stays untested by design (dials real Google endpoints —
  existing convention, gcp.go:86-87).
 No changes to manifests, Makefile, other providers, or the reconciler.
 CHANGELOG entry after the user confirms it works (house convention) — this
 plus the two earlier pending entries (GCP V-logging, version stamp).
 ## Verification
 ```bash
 go test -race ./internal/provider/gcp/
 go build ./... && go test ./...
 ```
 Live (the real proof, needs the cluster):
 ```bash
 # rebuild + load image, set --zap-log-level=5, restart, then:
 kubectl -n egress-proxies-operator-system logs deploy/egress-proxies-operator-controller-manager -f \
  | grep -m2 'api request\|api response'   # full URL/headers/payload visible
 # and at --zap-log-level=2: the same grep stays silent while V(2) lines still appear
 ```
--- a/docs/plans/2026-08-11-1935-gitea-build-workflow.md
+++ b/docs/plans/2026-08-11-1935-gitea-build-workflow.md
@@ -0,0 +1,135 @@
 # Plan: Distilled Gitea Actions image-build workflow
 **Created:** 2026-08-11 19:35
 ## Context
 This repo (`egress-proxies-operator`) has a Dockerfile, a Makefile with `docker-build`/`docker-push` targets, and a Gitea remote — but no CI workflow (CLAUDE.md flags this as a TODO). A survey of all projects under `/Users/jan.novak/srv` found 9 image-build workflows, all variations of one lineage: trigger on `workflow_dispatch` + tag push, `docker login` to `gitea.home.hrajfrisbee.cz` with `secrets.REGISTRY_TOKEN`, raw `docker build`/`docker push`, `runs-on: ubuntu-latest`, `permissions: {contents: read, packages: write}`.
 The best individual ideas are scattered:
 - **aviso_v2**: quality-gate job before build; computes `sha-<short>` as a second immutable tag via `$GITHUB_OUTPUT`.
 - **gateway-helper-operator** (closest sibling — same kubebuilder shape): passes build args (`GIT_COMMIT` etc.), tags `:latest` alongside the version tag.
 - **psmf-data-sync test.yaml**: `actions/setup-go@v5` with `go-version-file: go.mod` + module cache (proven to work on the act_runner).
 Goal: distill these into one `build.yaml` for this repo. User decisions: triggers = **tags + manual dispatch only** (house convention, no builds from main); build tool = **raw docker CLI** (the runner bind-mounts docker.sock, so this just works); **lightweight test gate** (`go vet` + `go build` + `go test -short`, no envtest download); **amd64 only**.
 ## The workflow
 Create `.gitea/workflows/build.yaml`:
 ```yaml
 name: Build and Push
 on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Image tag'
        required: true
        default: 'latest'
  push:
    tags:
      - '*'
 concurrency:
  group: build-${{ github.ref }}
  cancel-in-progress: true
 jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
          cache: true
      - name: Vet
        run: go vet ./...
      - name: Build
        run: go build ./...
      - name: Test (short)
        run: go test -short ./...
  build:
    needs: check
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Compute image tags
        id: meta
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            TAG="${{ inputs.tag }}"
          else
            TAG="${{ github.ref_name }}"
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "sha=sha-$(echo '${{ github.sha }}' | cut -c1-12)" >> "$GITHUB_OUTPUT"
      - name: Login to Gitea registry
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin gitea.home.hrajfrisbee.cz
      - name: Build and push
        run: |
          IMAGE=gitea.home.hrajfrisbee.cz/${{ github.repository }}
          docker build \
            --build-arg GIT_COMMIT=$(echo '${{ github.sha }}' | cut -c1-12) \
            --label org.opencontainers.image.source=https://gitea.home.hrajfrisbee.cz/${{ github.repository }} \
            --label org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
            -t "$IMAGE:${{ steps.meta.outputs.tag }}" \
            -t "$IMAGE:${{ steps.meta.outputs.sha }}" \
            .
          docker push "$IMAGE:${{ steps.meta.outputs.tag }}"
          docker push "$IMAGE:${{ steps.meta.outputs.sha }}"
      - name: Push latest (tag builds only)
        if: github.event_name == 'push'
        run: |
          IMAGE=gitea.home.hrajfrisbee.cz/${{ github.repository }}
          docker tag "$IMAGE:${{ steps.meta.outputs.tag }}" "$IMAGE:latest"
          docker push "$IMAGE:latest"
 ```
 ### What's distilled vs. improved over the existing workflows
 Distilled (house patterns kept as-is): triggers, `REGISTRY_TOKEN` + `github.actor` login, image name `gitea.home.hrajfrisbee.cz/${{ github.repository }}`, `ubuntu-latest`, raw docker CLI, `permissions` block.
 Improvements none of the existing workflows have all of:
 1. **`sha-<12>` immutable tag** alongside the human tag (aviso_v2 had this; nobody else) — lets deployments pin exactly what was built.
 2. **Test gate** (aviso_v2 had one; the Go projects don't) — lightweight variant per user choice; uses `go-version-file: go.mod` so the Go version never drifts from the module.
 3. **`GIT_COMMIT` build arg** matches the Makefile/Dockerfile contract — the binary's `internal/version.Commit` and the `org.opencontainers.image.revision` label get the real commit (12-char, same width as the Makefile's `git rev-parse --short=12`; no `-dirty` needed since CI checkouts are clean).
 4. **`:latest` only on real tag pushes**, not manual dispatch — gateway-helper pushed `latest` unconditionally, which lets an ad-hoc dispatch of an old ref clobber `latest`.
 5. **`concurrency` group** — cancels a superseded run of the same ref (none of the 20 surveyed workflows have this).
 6. **OCI `source`/`created` labels** added at build time (revision label already comes from the Dockerfile).
 ## Files
 - **Create** `.gitea/workflows/build.yaml` — content above.
 - **Update** `CLAUDE.md` — replace the `TODO: no .gitea/workflows/ CI pipeline exists yet` note in the Git Commits section with a short CI/CD subsection describing the workflow (triggers, secret, tags produced).
 - **Update** `CHANGELOG.md` — new top entry (after user confirms it works, per convention; timestamp via `date "+%Y-%m-%d %H:%M %Z"`).
 - Copy this plan to `docs/plans/YYYY-MM-DD-HHMM-gitea-build-workflow.md` (timestamp via `date "+%Y-%m-%d-%H%M"`) and commit it first, per CLAUDE.md ordering rule.
 ## Branch & MR
 House convention: feature → own branch + MR. Dockerfile and `cmd/` already exist on `main`, so:
 1. `git checkout -b feat/gitea-build-workflow origin/main` (do not touch the current `feat/proxy-operator` branch's uncommitted `.claude/settings.json` change — leave it be).
 2. Commit plan file, then the workflow + CLAUDE.md update (with `Co-Authored-By: Claude <noreply@anthropic.com>`).
 3. `git push -u origin feat/gitea-build-workflow`, open MR with `tea pr create --base main --head feat/gitea-build-workflow`. Do not merge.
 Note: `main` has no `internal/`/`test/` dirs yet (those are on `feat/proxy-operator`), which is fine — the workflow only fires on tags/dispatch, and by then the operator branch will be merged. `go build ./...` / `go test -short ./...` work on both branch states.
 ## Prerequisite (user action)
 `REGISTRY_TOKEN` secret must exist in this repo's Gitea settings (Settings → Actions → Secrets): a personal access token with `write:package` scope — same as every other project uses. Flag this in the MR description.
 ## Verification
 The workflow doesn't trigger on branch pushes, so end-to-end verification happens after merge:
 1. Local sanity: `docker build --build-arg GIT_COMMIT=test -t scratch-check .` (confirms the build args/labels line is valid) — or at minimum a YAML parse check.
 2. After the MR merges: run the workflow manually via Gitea UI (Actions → Build and Push → Run workflow, tag `manual-test`), confirm both `manual-test` and `sha-…` tags appear under Packages, and that `:latest` was NOT updated.
 3. Then push a real version tag (e.g. `v0.1.0`) and confirm `v0.1.0`, `sha-…`, and `latest` all appear.
--- a/docs/reviews/2026-08-10-1134-proxy-operator-pr-review.md
+++ b/docs/reviews/2026-08-10-1134-proxy-operator-pr-review.md
@@ -0,0 +1,131 @@
 # PR review findings: feat/proxy-operator
 **Created:** 2026-08-10 11:34
 **Scope:** `origin/main...feat/proxy-operator` (merge-base 076bc66, 25 commits, ~80 files)
 **Reviewers:** `go-operator-reviewer` + `operator-reviewer` agents; findings consolidated, most severe first. Check off items as they're processed.
 Both reviewers rated the core reconcile architecture sound: single status writer with one
 deferred patch, finalizer added before any provider call, Get-before-RemoveFinalizer on
 delete, CEL immutability rules correctly split to avoid the oldSelf-on-CREATE trap,
 leader-election gating on destructive runnables, GC tombstone rules (MinAge, UID-less
 instances never deleted).
 ## Merge-blockers
 - [ ] **Discovery leases proxies with an empty IP** — found independently by both reviewers.
  `internal/discovery/handlers.go:151`, `internal/controller/proxy_controller.go:226`
  During instance replacement (and the Get→NotFound recovery path) the reconciler clears
  `status.ip` but only the create branch removes the `Healthy` condition, and the health
  engine prunes state for empty-host proxies so nothing refreshes it. For the whole
  delete→recreate window (minutes on GCP), `isHealthy` still returns true and
  `handleAcquireLease` grants `201 Created` with `"ip": ""`, burning a `MaxLeases` slot.
  **Fix:** add `EffectiveHost() != ""` to `isHealthy` (covers list + acquire), and
  remove/downgrade `Healthy` wherever `status.IP` is cleared.
 - [ ] **Orphan GC deletes other installations' fleets in a shared GCP project.**
  `internal/provider/gcp/insert.go:57`, `internal/gc/gc.go:93`
  Instances are tagged only `proxy-operator-managed=true` + CR UID; the sweeper deletes any
  tagged instance whose UID isn't in *its own cluster's* Proxy list. Two clusters sharing a
  GCP project delete each other's VMs every GC interval in a permanent loop.
  **Fix:** add an installation-identity label (cluster/deployment ID) set by both providers
  and filtered on in `ListByTag`.
 - [ ] **Permanent-error latch wedges proxies on failures that aren't spec-caused.**
  `internal/controller/proxy_controller.go:126`
  Latch keys on `observedGeneration == generation`, but two failure inputs live outside the
  spec: an unconfigured provider (config fix + restart doesn't bump generation, and
  `spec.provider` is CEL-immutable → stuck `Failed` short of deleting the CR) and resolved
  Secret content (Secret fix enqueues a reconcile that short-circuits at the latch before
  re-resolving cloud-init).
  **Fix:** latch should also consider current spec-hash / provider availability.
 ## Worth fixing
 - [ ] **Deletion-path failures invisible in status** — flagged by both reviewers.
  `internal/controller/proxy_controller.go:319`, `:266`
  `deletionFailure` swallows `ErrQuotaExceeded` (nil error, no status write); unconfigured
  provider returns a bare error forever. A Proxy wedged in `Deleting` shows nothing in
  `kubectl describe`. Stage `setProvisioned(p, False, ReasonDeleting, ...)` before returning.
  Also: `Delete` is resubmitted on every `DeletionPoll` pass, churning GCP quota — a state
  check on the `Get` result would avoid it.
 - [ ] **Lost providerID on `setSpecHash` conflict.**
  `internal/controller/proxy_controller.go:161`
  On Update conflict the function returns before `p.Status.ProviderID = id`, so the deferred
  patch persists an empty providerID for a just-created instance. Self-heals via GC.
  **Fix:** set `p.Status.ProviderID = id` before returning the error (one line).
 - [ ] **Terminating pods still report `StateRunning`.**
  `internal/provider/kubernetes/kubernetes.go:151`
  A pod with a deletionTimestamp keeps `phase=Running` + `PodIP` while terminating, so drift
  reconcile republishes `Provisioned=True` and discovery keeps leasing a dying pod.
  **Fix:** map non-zero `pod.DeletionTimestamp` to `StateTerminated` in `instanceFromPod`.
 - [ ] **Stale-cache spec-hash race deletes the freshly created replacement instance.**
  `internal/controller/proxy_controller.go:176`
  Instance name derives from CR UID, so old and new instances share a providerID. A reconcile
  served a cached object from before a just-completed replacement re-enters `replaceInstance`
  and deletes the *new* healthy instance. Converges, but destroys a good instance.
  **Fix:** re-read uncached before the destructive branch, or compare `inst.CreatedAt`
  against the annotation-update time.
 - [ ] **`observedGeneration` written before the generation is actually processed.**
  `internal/controller/status.go:114`
  Set unconditionally in `patchStatusIfChanged`, including on the finalizer-add pass and
  `resolveCloudInit` failures — misleads kstatus-style tooling. Set it only once the state
  machine has genuinely evaluated the spec.
 - [ ] **No event filtering on the Proxy watch.**
  `internal/controller/proxy_controller.go:402`
  Every self-inflicted status patch triggers a follow-up reconcile with an extra cloud `Get`,
  roughly doubling provider read traffic. Caution: a plain `GenerationChangedPredicate`
  breaks the finalizer flow (relies on its own Update event to re-enter) — needs a
  status-only/resourceVersion-only filter or an explicit requeue in the finalizer pass.
 - [ ] **Unlabelled cloud-init Secrets produce a misleading NotFound with endless backoff.**
  `internal/controller/proxy_controller.go:344`, `cmd/main.go:210`
  The label-restricted cache turns "exists but missing `crawl.example.com/cloud-init=true`"
  into `CloudInitError: not found`. Mention the label requirement in the condition message,
  or read via uncached `APIReader` and validate the label explicitly.
 - [ ] **RBAC over-grant.**
  `config/rbac/role.yaml:25`
  `create;delete` on `proxies` is scaffold residue (controller never creates/deletes CRs);
  cluster-wide `pods create/delete` and `secrets get/list/watch` apply even when only the GCP
  provider is configured — pod rules belong in an optional kustomize component.
 ## Simplifications
 - [ ] **Delete `internal/provider/registry`** — 14 lines of logic, one caller
  (`cmd/main.go:148`); fold `Build`/`Constructor` into the composition root. Also fixes the
  two-sources-of-truth problem: `internal/provider/config.go:84` hardcodes
  `"kubernetes"`/`"gcp"` while `registry.Build` dispatches through a caller-supplied map —
  validate against the constructor map instead. Net −1 package, −44 lines, −92 test lines.
 - [ ] **Collapse `LeaseStore` interface to `*lease.Store`.**
  `internal/discovery/server.go:28`
  Single implementation and not a test seam (tests wire the real `lease.NewStore`).
  Keep `HealthSnapshotter` and `instancesAPI` — those are genuine seams.
 - [ ] **Replace metrics nil-guards with no-op defaults.**
  `internal/health/engine.go:68`, `internal/discovery/server.go:38`,
  `internal/provider/metrics.go:8`
  Keep the interfaces (legit "no prometheus in domain packages" rationale) but default the
  fields to a no-op impl — `provider.WithMetrics` already dereferences unconditionally, so
  the guards are inconsistent anyway.
 ## Nice-to-have
 - [ ] Add an `OwnerReference` to provider pods (`internal/provider/kubernetes/pod.go:24`) —
  free cascading deletion if the finalizer is ever bypassed; `CreateRequest` already carries
  Namespace/ProxyName/UID.
 - [ ] `Close()` the GCP `*compute.InstancesClient` (`internal/provider/gcp/gcp.go:89`) —
  harmless today, a leak the moment providers are rebuilt on config reload.
 - [ ] Fix `.golangci` config: it references a missing `logcheck` plugin, so the linter only
  runs with the project config disabled.
 - [ ] External-mode endpoint edits don't reset health-engine counters
  (`internal/health/engine.go:206` keys on name+UID): flipping `endpoint.host` keeps the old
  host's `Healthy=True` for `failureThreshold × interval`. Arguably a replacement, not a flap.
 - [ ] `init()` funcs at `api/v1alpha1/proxy_types.go:353` and `cmd/main.go:67` conflict with
  the repo's "no `init()`" convention; kubebuilder-idiomatic, but scheme registration could
  use the scaffold's `SchemeBuilder.Register` at package var scope.
--- a/internal/provider/gcp/errors.go
+++ b/internal/provider/gcp/errors.go
@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"slices"
 	"github.com/go-logr/logr"
 	"google.golang.org/api/googleapi"
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider"
@@ -41,6 +42,25 @@ func (p *Provider) wrapErr(op, id string, err error) error {
 	return provider.Wrap(classify(err), op, p.name, id, err)
 }
 // logAPIError records the raw googleapi error shape (HTTP status, reasons)
 // at V(1) — classify collapses it onto the coarser provider taxonomy, so
 // this line is the only place the original status survives.
 func logAPIError(log logr.Logger, op string, err error) {
 	if !log.V(1).Enabled() {
 		return
 	}
 	kv := []any{"op", op, "error", err.Error()}
 	var gerr *googleapi.Error
 	if errors.As(err, &gerr) {
 		reasons := make([]string, 0, len(gerr.Errors))
 		for _, item := range gerr.Errors {
 			reasons = append(reasons, item.Reason)
 		}
 		kv = append(kv, "httpStatus", gerr.Code, "reasons", reasons)
 	}
 	log.V(1).Info("GCP API call failed", kv...)
 }
 func hasReason(gerr *googleapi.Error, reasons ...string) bool {
 	for _, item := range gerr.Errors {
 		if slices.Contains(reasons, item.Reason) {
--- a/internal/provider/gcp/gcp.go
+++ b/internal/provider/gcp/gcp.go
@@ -14,8 +14,11 @@ import (
 	compute "cloud.google.com/go/compute/apiv1"
 	"cloud.google.com/go/compute/apiv1/computepb"
 	"github.com/go-logr/logr"
 	"google.golang.org/api/iterator"
 	"google.golang.org/api/option"
 	"google.golang.org/protobuf/proto"
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider"
 )
@@ -86,7 +89,22 @@ type Provider struct {
 // Deliberately untested: it dials real Google endpoints; everything below
 // it is exercised through newWithAPI.
 func New(ctx context.Context, pc provider.ProviderConfig) (provider.Provider, error) {
-	client, err := compute.NewInstancesRESTClient(ctx)
+	return NewWithWireOptions(ctx, pc, WireLogOptions{})
 }
 // NewWithWireOptions is New with explicit control over the V(5) wire
 // logging; the injected wire logger surfaces the SDK's HTTP
 // request/response records at V(5). Note option.WithLogger overrides the
 // SDK's own GOOGLE_SDK_GO_LOGGING_LEVEL env var, so --zap-log-level is
 // the only knob.
 func NewWithWireOptions(ctx context.Context, pc provider.ProviderConfig, opts WireLogOptions) (provider.Provider, error) {
 	base := logf.Log.WithName("gcp").WithName("http")
 	if base.V(5).Enabled() {
 		logf.Log.WithName("gcp").Info(
 			"GCP HTTP wire logging active — request payloads include cloud-init user-data",
 			"fullPayloads", opts.FullPayloads)
 	}
 	client, err := compute.NewInstancesRESTClient(ctx, option.WithLogger(wireLogger(base, opts)))
 	if err != nil {
 		return nil, fmt.Errorf("creating GCP instances client: %w", err)
 	}
@@ -101,6 +119,12 @@ func newWithAPI(pc provider.ProviderConfig, api instancesAPI) *Provider {
 	return &Provider{name: pc.Name, cfg: withDefaults(cfg), api: api}
 }
 // logger derives the request-scoped logger from ctx, so provider lines
 // inherit the reconcile context (which Proxy triggered the call).
 func (p *Provider) logger(ctx context.Context) logr.Logger {
 	return logf.FromContext(ctx).WithName("gcp").WithValues("provider", p.name)
 }
 // Create submits the insert and returns immediately with the
 // zone-qualified providerID. A 409 alreadyExists is success — the
 // deterministic instance name means a repeat call after a crash found the
@@ -113,8 +137,28 @@ func (p *Provider) Create(ctx context.Context, req provider.CreateRequest) (stri
 			"gcp requires placement.zone, placement.machineType and placement.image (got zone=%q machineType=%q image=%q)",
 			pl.Zone, pl.MachineType, pl.Image))
 	}
 	log := p.logger(ctx)
 	id := formatProviderID(pl.Zone, req.Name)
-	if _, err := p.api.Insert(ctx, buildInsertRequest(p.cfg, req)); err != nil && !isAlreadyExists(err) {
+	insertReq := buildInsertRequest(p.cfg, req)
 	// Curated fields only: the request proto embeds the cloud-init
 	// user-data, which may be Secret-sourced and must never reach logs.
 	log.V(2).Info("GCP insert request built",
 		"zone", pl.Zone, "name", req.Name,
 		"network", p.cfg.Network, "networkTag", p.cfg.NetworkTag,
 		"diskSizeGb", p.cfg.DiskSizeGB, "port", req.Port,
 		"labels", insertReq.GetInstanceResource().GetLabels(),
 		"cloudInitBytes", len(req.CloudInit))
 	opName, err := p.api.Insert(ctx, insertReq)
 	switch {
 	case err == nil:
 		log.V(1).Info("GCP instance insert submitted",
 			"zone", pl.Zone, "name", req.Name,
 			"machineType", pl.MachineType, "image", pl.Image, "opName", opName)
 	case isAlreadyExists(err):
 		log.V(1).Info("GCP instance already exists, insert treated as success",
 			"zone", pl.Zone, "name", req.Name)
 	default:
 		logAPIError(log, "create", err)
 		return "", p.wrapErr("create", id, err)
 	}
 	return id, nil
@@ -128,15 +172,21 @@ func (p *Provider) Get(ctx context.Context, providerID string) (*provider.Instan
 	if err != nil {
 		return nil, provider.Wrap(provider.ErrPermanent, "get", p.name, providerID, err)
 	}
 	log := p.logger(ctx)
 	inst, err := p.api.Get(ctx, &computepb.GetInstanceRequest{
 		Project:  p.cfg.Project,
 		Zone:     zone,
 		Instance: name,
 	})
 	if err != nil {
 		logAPIError(log, "get", err)
 		return nil, p.wrapErr("get", providerID, err)
 	}
-	return toInstance(inst, zone), nil
+	out := toInstance(inst, zone)
 	log.V(1).Info("GCP instance fetched",
 		"zone", zone, "name", name,
 		"status", inst.GetStatus(), "state", out.State, "ip", out.IP)
 	return out, nil
 }
 // Delete submits the delete and returns; deleting an instance that is
@@ -146,11 +196,21 @@ func (p *Provider) Delete(ctx context.Context, providerID string) error {
 	if err != nil {
 		return provider.Wrap(provider.ErrPermanent, "delete", p.name, providerID, err)
 	}
-	if _, err := p.api.Delete(ctx, &computepb.DeleteInstanceRequest{
+	log := p.logger(ctx)
 	opName, err := p.api.Delete(ctx, &computepb.DeleteInstanceRequest{
 		Project:  p.cfg.Project,
 		Zone:     zone,
 		Instance: name,
-	}); err != nil && !isNotFound(err) {
+	})
 	switch {
 	case err == nil:
 		log.V(1).Info("GCP instance delete submitted",
 			"zone", zone, "name", name, "opName", opName)
 	case isNotFound(err):
 		log.V(1).Info("GCP instance already gone, delete treated as success",
 			"zone", zone, "name", name)
 	default:
 		logAPIError(log, "delete", err)
 		return p.wrapErr("delete", providerID, err)
 	}
 	return nil
@@ -160,17 +220,24 @@ func (p *Provider) Delete(ctx context.Context, providerID string) error {
 // ReturnPartialSuccess matters: without it one unreachable zone fails the
 // entire GC sweep.
 func (p *Provider) ListByTag(ctx context.Context) ([]provider.Instance, error) {
 	log := p.logger(ctx)
 	filter := fmt.Sprintf("labels.%s = %s", provider.LabelManaged, provider.LabelManagedYes)
 	instances, err := p.api.AggregatedList(ctx, &computepb.AggregatedListInstancesRequest{
 		Project:              p.cfg.Project,
-		Filter:               proto.String(fmt.Sprintf("labels.%s = %s", provider.LabelManaged, provider.LabelManagedYes)),
+		Filter:               proto.String(filter),
 		ReturnPartialSuccess: proto.Bool(true),
 	})
 	if err != nil {
 		logAPIError(log, "list", err)
 		return nil, p.wrapErr("list", "", err)
 	}
 	log.V(1).Info("GCP instances listed", "filter", filter, "count", len(instances))
 	out := make([]provider.Instance, 0, len(instances))
 	for _, inst := range instances {
-		out = append(out, *toInstance(inst, lastPathSegment(inst.GetZone())))
+		conv := toInstance(inst, lastPathSegment(inst.GetZone()))
 		out = append(out, *conv)
 		log.V(2).Info("GCP listed instance",
 			"id", conv.ID, "state", conv.State, "uid", conv.UID, "createdAt", conv.CreatedAt)
 	}
 	return out, nil
 }
--- a/internal/provider/gcp/gcp_test.go
+++ b/internal/provider/gcp/gcp_test.go
@@ -3,10 +3,14 @@ package gcp
 import (
 	"context"
 	"errors"
 	"log/slog"
 	"strings"
 	"testing"
 	"time"
 	"cloud.google.com/go/compute/apiv1/computepb"
 	"github.com/go-logr/logr"
 	"github.com/go-logr/logr/funcr"
 	"google.golang.org/protobuf/proto"
 	"gitea.home.hrajfrisbee.cz/kacerr/egress-proxies-operator/internal/provider"
@@ -269,3 +273,292 @@ func TestParseProviderID_roundTrip(t *testing.T) {
 		t.Errorf("round trip = %s/%s (%v), want europe-west1-b/proxy-abc", zone, name, err)
 	}
 }
 // captureContext returns a ctx carrying a funcr logger that records every
 // emitted line, capped at the given verbosity — the test stand-in for
 // --zap-log-level=<verbosity>.
 func captureContext(verbosity int) (context.Context, *[]string) {
 	lines := &[]string{}
 	log := funcr.New(func(prefix, args string) {
 		*lines = append(*lines, prefix+" "+args)
 	}, funcr.Options{Verbosity: verbosity})
 	return logr.NewContext(context.Background(), log), lines
 }
 func runningInstance() *computepb.Instance {
 	return &computepb.Instance{
 		Name:              proto.String("proxy-abc123def456ghij"),
 		Status:            proto.String("RUNNING"),
 		Zone:              proto.String("https://www.googleapis.com/compute/v1/projects/my-project/zones/europe-west1-b"),
 		CreationTimestamp: proto.String("2026-08-09T10:00:00+02:00"),
 		Labels: map[string]string{
 			provider.LabelManaged: provider.LabelManagedYes,
 			provider.LabelUID:     "uid-1",
 		},
 		NetworkInterfaces: []*computepb.NetworkInterface{{
 			AccessConfigs: []*computepb.AccessConfig{{NatIP: proto.String("34.1.2.3")}},
 		}},
 	}
 }
 func runAllOps(t *testing.T, ctx context.Context, req provider.CreateRequest) {
 	t.Helper()
 	inst := runningInstance()
 	p := newTestProvider(&fakeAPI{getInst: inst, listInsts: []*computepb.Instance{inst}})
 	if _, err := p.Create(ctx, req); err != nil {
 		t.Fatalf("Create: %v", err)
 	}
 	if _, err := p.Get(ctx, "zones/europe-west1-b/instances/proxy-abc123def456ghij"); err != nil {
 		t.Fatalf("Get: %v", err)
 	}
 	if err := p.Delete(ctx, "zones/europe-west1-b/instances/proxy-abc123def456ghij"); err != nil {
 		t.Fatalf("Delete: %v", err)
 	}
 	if _, err := p.ListByTag(ctx); err != nil {
 		t.Fatalf("ListByTag: %v", err)
 	}
 }
 func TestLogging_verbosityTiers(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name        string
 		verbosity   int
 		wantLines   []string
 		absentLines []string
 	}{
 		{
 			name:      "v0 stays silent",
 			verbosity: 0,
 			absentLines: []string{
 				"GCP instance insert submitted",
 				"GCP instance fetched",
 				"GCP instance delete submitted",
 				"GCP instances listed",
 			},
 		},
 		{
 			name:      "v1 logs one line per API call",
 			verbosity: 1,
 			wantLines: []string{
 				`"msg"="GCP instance insert submitted"`,
 				`"opName"="op-insert"`,
 				`"msg"="GCP instance fetched"`,
 				`"status"="RUNNING"`,
 				`"msg"="GCP instance delete submitted"`,
 				`"opName"="op-delete"`,
 				`"msg"="GCP instances listed"`,
 				`"provider"="gcp-eu"`,
 			},
 			absentLines: []string{
 				"GCP insert request built",
 				"GCP listed instance",
 			},
 		},
 		{
 			name:      "v2 adds request and per-instance detail",
 			verbosity: 2,
 			wantLines: []string{
 				`"msg"="GCP insert request built"`,
 				`"cloudInitBytes"=`,
 				`"msg"="GCP listed instance"`,
 			},
 		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			ctx, lines := captureContext(tc.verbosity)
 			req := testCreateRequest()
 			const sentinel = "SENTINEL-cloud-init-must-never-be-logged"
 			req.CloudInit = sentinel
 			runAllOps(t, ctx, req)
 			joined := strings.Join(*lines, "\n")
 			if tc.verbosity == 0 && len(*lines) != 0 {
 				t.Errorf("verbosity 0 logged %d lines:\n%s", len(*lines), joined)
 			}
 			for _, want := range tc.wantLines {
 				if !strings.Contains(joined, want) {
 					t.Errorf("output missing %q:\n%s", want, joined)
 				}
 			}
 			for _, absent := range tc.absentLines {
 				if strings.Contains(joined, absent) {
 					t.Errorf("output unexpectedly contains %q:\n%s", absent, joined)
 				}
 			}
 			if strings.Contains(joined, sentinel) {
 				t.Errorf("cloud-init content leaked into logs:\n%s", joined)
 			}
 		})
 	}
 }
 func TestWireLogger_gatesAtV5(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		name      string
 		verbosity int
 		wantDebug bool
 	}{
 		{name: "v5 shows wire records", verbosity: 5, wantDebug: true},
 		{name: "v4 hides wire records", verbosity: 4, wantDebug: false},
 		{name: "v2 hides wire records", verbosity: 2, wantDebug: false},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			lines := &[]string{}
 			base := funcr.New(func(prefix, args string) {
 				*lines = append(*lines, prefix+" "+args)
 			}, funcr.Options{Verbosity: tc.verbosity})
 			slogger := wireLogger(base, WireLogOptions{})
 			slogger.Debug("api request", "rpcName", "Insert")
 			joined := strings.Join(*lines, "\n")
 			if got := strings.Contains(joined, "api request"); got != tc.wantDebug {
 				t.Errorf("Debug record visible = %v, want %v; output:\n%s", got, tc.wantDebug, joined)
 			}
 			if tc.wantDebug && !strings.Contains(joined, "rpcName") {
 				t.Errorf("wire record lost its attrs:\n%s", joined)
 			}
 		})
 	}
 }
 func TestWireLogger_infoLandsAtV1(t *testing.T) {
 	t.Parallel()
 	lines := &[]string{}
 	base := funcr.New(func(prefix, args string) {
 		*lines = append(*lines, prefix+" "+args)
 	}, funcr.Options{Verbosity: 1})
 	wireLogger(base, WireLogOptions{}).Info("hello")
 	if joined := strings.Join(*lines, "\n"); !strings.Contains(joined, "hello") {
 		t.Errorf("slog Info should land at V(1) and be visible at verbosity 1; output:\n%s", joined)
 	}
 }
 func captureWireLogger(verbosity int, opts WireLogOptions) (*slog.Logger, *[]string) {
 	lines := &[]string{}
 	base := funcr.New(func(prefix, args string) {
 		*lines = append(*lines, prefix+" "+args)
 	}, funcr.Options{Verbosity: verbosity})
 	return wireLogger(base, opts), lines
 }
 func TestWireLogger_dropsNonAPIDebugRecords(t *testing.T) {
 	t.Parallel()
 	slogger, lines := captureWireLogger(9, WireLogOptions{})
 	const secret = "assertion=eyJhbGciOiJSUzI1NiJ9.SECRET"
 	slogger.Debug("2LO token request", "request", map[string]any{"payload": secret})
 	slogger.Debug("2LO token response", "response", map[string]any{"payload": "ya29.SECRET-TOKEN"})
 	if len(*lines) != 0 {
 		t.Errorf("auth token-exchange records must be dropped; got:\n%s", strings.Join(*lines, "\n"))
 	}
 	slogger.Warn("credential refresh failed")
 	if joined := strings.Join(*lines, "\n"); !strings.Contains(joined, "credential refresh failed") {
 		t.Errorf("non-debug SDK records should pass through; output:\n%s", joined)
 	}
 }
 func TestWireLogger_elidesLargeFields(t *testing.T) {
 	t.Parallel()
 	slogger, lines := captureWireLogger(9, WireLogOptions{})
 	huge := strings.Repeat("x", 4096)
 	slogger.Debug("api response", "response", map[string]any{
 		"status": "200",
 		"payload": map[string]any{
 			"name":  "proxy-abc",
 			"disks": []any{map[string]any{"content": huge}},
 		},
 	})
 	joined := strings.Join(*lines, "\n")
 	if strings.Contains(joined, huge[:64]) {
 		t.Errorf("large field not elided:\n%.500s", joined)
 	}
 	if !strings.Contains(joined, "[elided 4096 bytes]") {
 		t.Errorf("elision marker missing:\n%s", joined)
 	}
 	for _, keep := range []string{"proxy-abc", "200", "api response"} {
 		if !strings.Contains(joined, keep) {
 			t.Errorf("small field %q lost during elision:\n%s", keep, joined)
 		}
 	}
 }
 func TestWireLogger_fullPayloadsDisablesElision(t *testing.T) {
 	t.Parallel()
 	slogger, lines := captureWireLogger(9, WireLogOptions{FullPayloads: true})
 	huge := strings.Repeat("y", 4096)
 	slogger.Debug("api response", "response", map[string]any{"payload": huge})
 	joined := strings.Join(*lines, "\n")
 	if !strings.Contains(joined, huge) {
 		t.Errorf("FullPayloads should keep fields verbatim:\n%.200s", joined)
 	}
 	slogger.Debug("2LO token response", "response", "ya29.SECRET")
 	if joined := strings.Join(*lines, "\n"); strings.Contains(joined, "ya29.SECRET") {
 		t.Error("auth records must be dropped even with FullPayloads")
 	}
 }
 func TestLogging_apiErrorKeepsHTTPDetail(t *testing.T) {
 	t.Parallel()
 	ctx, lines := captureContext(1)
 	p := newTestProvider(&fakeAPI{insertErr: gerr(403, "quotaExceeded")})
 	if _, err := p.Create(ctx, testCreateRequest()); err == nil {
 		t.Fatal("Create: want error")
 	}
 	joined := strings.Join(*lines, "\n")
 	for _, want := range []string{
 		`"msg"="GCP API call failed"`,
 		`"httpStatus"=403`,
 		`"quotaExceeded"`,
 		`"op"="create"`,
 	} {
 		if !strings.Contains(joined, want) {
 			t.Errorf("output missing %q:\n%s", want, joined)
 		}
 	}
 }
 func TestLogging_treatedAsSuccessPathsAreExplicit(t *testing.T) {
 	t.Parallel()
 	ctx, lines := captureContext(1)
 	p := newTestProvider(&fakeAPI{insertErr: gerr(409), deleteErr: gerr(404)})
 	if _, err := p.Create(ctx, testCreateRequest()); err != nil {
 		t.Fatalf("Create with 409: %v", err)
 	}
 	if err := p.Delete(ctx, "zones/z/instances/gone"); err != nil {
 		t.Fatalf("Delete with 404: %v", err)
 	}
 	joined := strings.Join(*lines, "\n")
 	for _, want := range []string{
 		`"msg"="GCP instance already exists, insert treated as success"`,
 		`"msg"="GCP instance already gone, delete treated as success"`,
 	} {
 		if !strings.Contains(joined, want) {
 			t.Errorf("output missing %q:\n%s", want, joined)
 		}
 	}
 }
--- a/internal/provider/gcp/wirelog.go
+++ b/internal/provider/gcp/wirelog.go
@@ -0,0 +1,117 @@
 package gcp
 import (
 	"context"
 	"fmt"
 	"log/slog"
 	"github.com/go-logr/logr"
 )
 // wireLogMaxFieldBytes is the elision threshold for string fields in wire
 // payloads: GCP responses embed multi-KB blobs (Shielded-VM UEFI dbx
 // databases, licenses) that swamp the log line without diagnostic value.
 const wireLogMaxFieldBytes = 1024
 // WireLogOptions controls the V(5) HTTP wire logging of the GCP SDK.
 type WireLogOptions struct {
 	// FullPayloads disables field elision and logs payloads verbatim.
 	FullPayloads bool
 }
 // wireLogger returns the slog logger handed to the SDK: its Debug-level
 // "api request"/"api response" records (slog Debug = +4 on the logr
 // scale) land at V(5) on top of the base's V(1) shift.
 //
 // Debug records other than the compute client's api request/response are
 // dropped entirely: the same logger propagates into the auth library,
 // whose token-exchange records contain the signed JWT assertion and the
 // bearer access token. Warnings and errors pass through.
 func wireLogger(base logr.Logger, opts WireLogOptions) *slog.Logger {
 	return slog.New(&wireFilterHandler{
 		inner:        logr.ToSlogHandler(base.V(1)),
 		fullPayloads: opts.FullPayloads,
 	})
 }
 type wireFilterHandler struct {
 	inner        slog.Handler
 	fullPayloads bool
 }
 func (h *wireFilterHandler) Enabled(ctx context.Context, level slog.Level) bool {
 	return h.inner.Enabled(ctx, level)
 }
 func (h *wireFilterHandler) Handle(ctx context.Context, rec slog.Record) error {
 	if rec.Level <= slog.LevelDebug && rec.Message != "api request" && rec.Message != "api response" {
 		return nil
 	}
 	if h.fullPayloads {
 		return h.inner.Handle(ctx, rec)
 	}
 	elided := slog.NewRecord(rec.Time, rec.Level, rec.Message, rec.PC)
 	rec.Attrs(func(a slog.Attr) bool {
 		elided.AddAttrs(slog.Attr{Key: a.Key, Value: elideValue(a.Value)})
 		return true
 	})
 	return h.inner.Handle(ctx, elided)
 }
 func (h *wireFilterHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
 	return &wireFilterHandler{inner: h.inner.WithAttrs(attrs), fullPayloads: h.fullPayloads}
 }
 func (h *wireFilterHandler) WithGroup(name string) slog.Handler {
 	return &wireFilterHandler{inner: h.inner.WithGroup(name), fullPayloads: h.fullPayloads}
 }
 func elideValue(v slog.Value) slog.Value {
 	v = v.Resolve()
 	switch v.Kind() {
 	case slog.KindString:
 		if s := v.String(); len(s) > wireLogMaxFieldBytes {
 			return slog.StringValue(elisionMarker(len(s)))
 		}
 		return v
 	case slog.KindGroup:
 		attrs := v.Group()
 		out := make([]slog.Attr, 0, len(attrs))
 		for _, a := range attrs {
 			out = append(out, slog.Attr{Key: a.Key, Value: elideValue(a.Value)})
 		}
 		return slog.GroupValue(out...)
 	case slog.KindAny:
 		return slog.AnyValue(elideAny(v.Any()))
 	default:
 		return v
 	}
 }
 func elideAny(v any) any {
 	switch t := v.(type) {
 	case string:
 		if len(t) > wireLogMaxFieldBytes {
 			return elisionMarker(len(t))
 		}
 		return t
 	case map[string]any:
 		out := make(map[string]any, len(t))
 		for k, val := range t {
 			out[k] = elideAny(val)
 		}
 		return out
 	case []any:
 		out := make([]any, len(t))
 		for i, val := range t {
 			out[i] = elideAny(val)
 		}
 		return out
 	default:
 		return v
 	}
 }
 func elisionMarker(size int) string {
 	return fmt.Sprintf("[elided %d bytes]", size)
 }
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -0,0 +1,47 @@
 // Package version reports which commit the binary was built from. Docker
 // builds stamp it via -ldflags (the build context has no .git, so Go's
 // automatic VCS stamp is absent there); host builds fall back to that
 // automatic stamp.
 package version
 import "runtime/debug"
 // Commit is set at link time via
 // -ldflags "-X <module>/internal/version.Commit=<hash>".
 var Commit string
 // Resolve returns the commit the binary was built from, or "unknown" when
 // neither the ldflags stamp nor build info is available (e.g. go test).
 func Resolve() string {
 	return resolve(Commit, debug.ReadBuildInfo)
 }
 func resolve(ldflagsCommit string, readBuildInfo func() (*debug.BuildInfo, bool)) string {
 	if ldflagsCommit != "" {
 		return ldflagsCommit
 	}
 	bi, ok := readBuildInfo()
 	if !ok {
 		return "unknown"
 	}
 	var revision string
 	var modified bool
 	for _, s := range bi.Settings {
 		switch s.Key {
 		case "vcs.revision":
 			revision = s.Value
 		case "vcs.modified":
 			modified = s.Value == "true"
 		}
 	}
 	if revision == "" {
 		return "unknown"
 	}
 	if len(revision) > 12 {
 		revision = revision[:12]
 	}
 	if modified {
 		revision += "-dirty"
 	}
 	return revision
 }
--- a/internal/version/version_test.go
+++ b/internal/version/version_test.go
@@ -0,0 +1,74 @@
 package version
 import (
 	"runtime/debug"
 	"testing"
 )
 func buildInfoWith(settings ...debug.BuildSetting) func() (*debug.BuildInfo, bool) {
 	return func() (*debug.BuildInfo, bool) {
 		return &debug.BuildInfo{Settings: settings}, true
 	}
 }
 func TestResolve_precedenceAndFallback(t *testing.T) {
 	t.Parallel()
 	noBuildInfo := func() (*debug.BuildInfo, bool) { return nil, false }
 	tests := []struct {
 		name          string
 		ldflagsCommit string
 		readBuildInfo func() (*debug.BuildInfo, bool)
 		want          string
 	}{
 		{
 			name:          "ldflags stamp wins over build info",
 			ldflagsCommit: "abc123def456-dirty",
 			readBuildInfo: buildInfoWith(debug.BuildSetting{Key: "vcs.revision", Value: "ffffffffffffffffffffffffffffffffffffffff"}),
 			want:          "abc123def456-dirty",
 		},
 		{
 			name:          "no stamp, no build info",
 			readBuildInfo: noBuildInfo,
 			want:          "unknown",
 		},
 		{
 			name:          "build info without vcs settings",
 			readBuildInfo: buildInfoWith(),
 			want:          "unknown",
 		},
 		{
 			name: "full revision truncated to 12 chars",
 			readBuildInfo: buildInfoWith(
 				debug.BuildSetting{Key: "vcs.revision", Value: "0123456789abcdef0123456789abcdef01234567"},
 				debug.BuildSetting{Key: "vcs.modified", Value: "false"},
 			),
 			want: "0123456789ab",
 		},
 		{
 			name: "modified tree gets dirty suffix",
 			readBuildInfo: buildInfoWith(
 				debug.BuildSetting{Key: "vcs.revision", Value: "0123456789abcdef0123456789abcdef01234567"},
 				debug.BuildSetting{Key: "vcs.modified", Value: "true"},
 			),
 			want: "0123456789ab-dirty",
 		},
 		{
 			name: "short revision kept as-is",
 			readBuildInfo: buildInfoWith(
 				debug.BuildSetting{Key: "vcs.revision", Value: "abc123"},
 			),
 			want: "abc123",
 		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			if got := resolve(tc.ldflagsCommit, tc.readBuildInfo); got != tc.want {
 				t.Errorf("resolve() = %q, want %q", got, tc.want)
 			}
 		})
 	}
 }
Author	SHA1	Message	Date
Jan Novak	9230b1213c	Document Gitea CI and required secrets in README Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 19:46:55 +02:00
Jan Novak	57e3ea22cf	Record MR creation in plan execution summary Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 19:41:57 +02:00
Jan Novak	95c487415b	Add Gitea Actions image-build workflow Distilled from the house pattern across sibling projects: tag push + workflow_dispatch triggers, REGISTRY_TOKEN login, raw docker build/push to gitea.home.hrajfrisbee.cz. Adds a lightweight test gate, an immutable sha-<12> tag, :latest only on real tag pushes, and a concurrency group. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 19:39:23 +02:00
Jan Novak	849ec1083e	Add plan: distilled Gitea Actions image-build workflow Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 19:37:42 +02:00
kacerr	f7000f7514	Merge pull request 'proxy-operator: Kubernetes operator for crawling-proxy fleets' (#1 ) from feat/proxy-operator into main Reviewed-on: #1	2026-08-11 19:21:14 +02:00
Jan Novak	19d6a8dfba	Add GCP deployment docs, PR review notes, and Claude tooling updates docs/gcp-in-specific-project.md: SA + firewall setup for the egress-proxy project, in-kube secret, and apply-ready ConfigMap/Deployment/Proxy manifests (Ubuntu image — debian-cloud lacks cloud-init). docs/gcp-vm-validation.md: end-to-end GCP VM validation walkthrough. docs/reviews/: proxy-operator PR review notes from 2026-08-10. .claude/: operator-reviewer agent, accumulated permission allowlist. .gitignore: never commit sa_key.json (live SA key stays untracked). Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 19:17:58 +02:00
Jan Novak	420c3509b0	Wire logging: drop auth token-exchange records, elide huge payload fields The option.WithLogger logger also reaches cloud.google.com/go/auth, which logged its token exchange at Debug — JWT assertion and bearer token included. wireLogger now allowlists only the compute client's api request/response records at Debug (fail-closed for future SDK additions); Warn/Error pass through. String fields over 1KiB (e.g. Shielded-VM UEFI dbx blobs) are elided recursively by default; the new --gcp-wire-log-full-payloads flag restores verbatim payloads. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 19:02:28 +02:00
Jan Novak	ed59a4c384	Surface GCP SDK HTTP wire logs at V(5) Inject an option.WithLogger slog logger bridged to the zap sink via logr.ToSlogHandler with a V(1) shift, so the SDK's Debug-level "api request"/"api response" records (URL, headers, full payloads) appear only at --zap-log-level=5. Startup warning when active, since raw insert payloads include cloud-init user-data. Note WithLogger overrides GOOGLE_SDK_GO_LOGGING_LEVEL for this client. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 18:39:37 +02:00
Jan Novak	4619c352c0	Add plan: GCP HTTP wire logging at V(5) Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 18:38:16 +02:00
Jan Novak	5a7f0a30c3	Record completed Docker verification of the version stamp Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 18:12:01 +02:00
Jan Novak	ae434a7167	Bake git commit into the binary and log it at startup New internal/version package: ldflags-stamped Commit with a debug.ReadBuildInfo VCS fallback for host builds. Startup log line carries commit + Go version; --version prints the hash and exits. Makefile computes GIT_COMMIT (12 chars, -dirty on any local change) and passes it to docker-build/buildx; Dockerfile injects it via -ldflags and an org.opencontainers.image.revision label. make build now uses ./cmd — file-argument builds skip Go's automatic VCS stamp. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 18:10:11 +02:00
Jan Novak	e4d2a191d0	Add plan: bake git commit into the operator binary and log it at startup Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 18:02:41 +02:00
Jan Novak	837e374228	Add V(1)/V(2) verbose logging to the GCP provider One V(1) line per GCP API call (insert/get/delete/aggregatedList) with outcome and operation name, V(2) request/per-instance detail, and raw googleapi status+reasons logged before classify collapses them. Curated fields only — cloud-init user-data never reaches logs (test-enforced). Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 17:48:34 +02:00
Jan Novak	c137028364	Add plan: verbose V-level logging in the GCP provider Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-11 17:43:51 +02:00