roadmap: KSail strategy & roadmap (July 2026)

> 🤖 Generated by the Daily AI Assistant

**KSail Monthly Strategy — July 2026.** The roadmap home for KSail (monthly refresh of #4988; same scheme: theme/epic items carry `roadmap`, actionable children use normal labels). Grounded in the live backlog and the June merge history.

## June outcomes (vs #4988)

June was a **feature-heavy month** — the roadmap structure worked and most of it shipped:

- **Theme B (supply-chain) — DONE.** #4987 cosign `spec.verify` shipped and closed; platform now runs verify in prod (platform#1570 → #2319).
- **Theme D (observability) — DONE.** #4778 Hubble closed complete (`workload network` one-shot + `--follow`).
- **Theme E (lifecycle & auth) — half DONE.** #4602 OIDC federation closed (all 6 ACs, shared-issuer + standards-delegation). #4899 advanced: per-component status merged (#5527); uninstall-on-spec-flip is review-ready draft #5551; remaining phases are environment-gated.
- **Theme C (inner-loop DX) — half DONE.** #4777 DevContainer closed. #4521 mirroring: P0 `ResolveTarget` (#5534) + P1 `SelectTapPoint` (#5537) merged.
- **Theme A (cloud expansion) — major motion, still gated.** #3983 Hetzner K3s/Vanilla: typed k3s/kubeadm config renderers, cloud-init, shared `hetznerbase`, factory wiring all merged — completion (validation flip #5514 + E2E #5515) blocked on #4972. #4328 EKS stays code-complete, credential-gated. **#4510 GKE/AKS started:** GKE client merged (#5677), `pkg/svc/provider/gcp` in flight (#5682).
- **Born mid-June, now core roadmap:** #5344 in-process validate/scan (phases 1–2, 3a, per-layer attribution, chart caching ALL merged), #5441 multi-cluster scaffolding (item 1 `cluster add-environment` complete; item 2 layout derive+write merged), #5606 Flux v2.9.0 capabilities epic (children 1–2 done), and KSail became a Flux 2.9 distributor with a matched-pair manifests pin after the v0.53.0 Receiver-CRD breakage (#5595/#5596).

## July themes

### Theme A — Cloud-provider & distribution expansion → epic #4627 (`roadmap`)
**Problem.** One SDK across the major clouds; GKE/AKS missing, Hetzner K3s/Vanilla and EKS unfinished. **Direction.** Finish #4510 GKE slices in order — (3) provisioner + factory routing after #5682 merges, (4) Provider/Distribution enum + schema surface, (5) AKS mirror via `armcontainerservice` — these are startable now and NOT credential-gated (unit-tested like the merged EKS/GKE code). #3983/#4328 completion stays gated on **#4972/#4973 (credentials/machines — maintainer-only)**; the platform-side AWS chain (platform#2324–#2327) is advancing (#2377 promoted). **Size:** L. **Priority:** **High — the default substantive lane for July.**

### Theme B — GitOps depth: finish #5344, scope #5606 → `roadmap`
**Problem.** #5344 is one slice from done; the Flux-2.9 epic's children #3–#8 are unscoped wishes. **Direction.** #5344 remainder: 3b `--ephemeral` operator-children (env-gated, reuses #4899) + native `cel-go` CEL validation (per #5624: stay-native, no external tool). From #5606 pick and spec 1–2 children for July — suggested first: #3 `Kustomization.spec.ignore` drift handling (extends `workload reconcile`) and #4 CEL Helm health checks (builds on #5576). **Size:** M. **Priority:** High (maintainer-requested epic).

### Theme C — Multi-cluster & CLI shape: #5441 · #5626 · #5654 → `roadmap`
**Problem.** Multi-cluster scaffolding is mid-flight; the CLI's command taxonomy (#5626 `ksail project`) and scope over unmanaged clusters (#5654, filed 07-01) are open shape questions. **Direction.** #5441: next increment = `cluster init --multi-cluster` flag composing the merged Derive+Write; then item 3 (environments×providers). **#5654 needs a decomposition pass first** (kubeconfig discovery, context ops, which commands go cluster-agnostic) — it is the freshest scope question and should get an ADR-style design comment + child issues early in July. #5626 follows the same ADR-first path (command-migration matrix). **Size:** M–L. **Priority:** High for the #5654 decomposition; Medium for implementation until the design lands.

### Theme D — Inner-loop DX (#4521) → epic
**Problem.** P1 is half-shipped (tap-point selection merged; no traffic path yet). **Direction.** Next: ephemeral-container tap injection + reverse port-forward tunnel (Vanilla/K3s/VCluster), then P2 intercept, P3 env/volume. **Size:** M per increment. **Priority:** Medium.

### Theme E — Operator lifecycle (#4899) → epic
**Problem.** Remaining phases need real child clusters (Connectors for Kind-DinD/k3k/KWOK/Talos-DinD, Docker provider, cloud kubeconfigs) — not unit-testable on the dev hub. **Direction.** Land #5551 (awaiting promotion); then pick the KWOK Connector as the one possibly-testable slice; the rest as environments allow. **Size:** L. **Priority:** Medium, env-gated.

### Operational health (not roadmap, named blockers)
- **#4972 (HCLOUD_TOKEN invalid) / #4973 (Omni no machines)** — still red, still maintainer-only; they cap Theme A completion (validation flips + E2E). Standing ask.
- #5673 (autoscaler scale-down knobs, **maintainer-authored 07-01 — the freshest direct maintainer signal**) — triaged into the normal `enhancement` queue; pairs with platform's DaemonSet-VPA work (#2370).

## Suggested sequencing (July)

1. **#4510 GKE slices 3–5** — the substantive default; each slice is a clean unit-tested PR.
2. **#5654 decomposition** (+ #5626 ADR) — maintainer-hot design work, unblocks a Q3 lane.
3. **#5606 children #3/#4 spec-then-implement**; #5344 CEL slice alongside.
4. **#4521 P1 completion** as the alternating lane.
5. Env-gated tails (#3983 flip, #4328 E2E, #4899 phases) the moment #4972/#4973/credentials clear.

## How to use this roadmap

Unchanged from #4988: new feature work maps to a theme (or proposes one here first); implementing PRs `Fixes #child`; epics close with their children; refreshed monthly.

*Supersedes #4988 (June). No new epics minted — all themes point at existing tracking issues.*

Start by reading the referenced tracking issues, especially #4510, #5344, #5441, #5606, #5626, and #5654, together with the sequencing and maintainer-only blockers in this roadmap. This issue is done when the July priorities and child-issue scope are agreed; it does not identify a file, test, or standalone implementation task.

Written by the indexing model from the issue text.