ROS 2 / K8S LAB
Phase 2 · days 15–30

Make it runnable and safe

Phase 1 picks the target. Phase 2 plans three things: a short command flow that proves messages cross workers, a lighter cluster that fits on an ordinary laptop, and safer defaults than the historical setup. None of it exists yet.

Proposal · planning targets, not promisesIssues #14, #16, #6, #4

What exists today and what does not

The repository has no Makefile, so make demo, make verify and make clean are planned names, not working commands. Do not try to run them.

Planned

Three make targets

Issue #16 proposes them for a lightweight kind or k3d profile (small Kubernetes clusters that run inside containers). The Vagrant lab would stay for the full three-VM setup.

Legacy

Risky defaults in the monitoring setup

The historical setup binds a dashboard account to cluster-admin and applies chmod -R 777 to host storage folders. Both are listed in the roadmap for replacement.

Not yet passed

The quickstart gate

A public modern quickstart waits for one gate. Nothing has passed it, so no modern quickstart is published.

Three commands and a safer setup

Step through the planned flow, then the defaults it would replace. Every box here is a plan.

Planned: demo, verify, clean, and safer defaults

Illustration · all planned
Planned command flow and safer defaults for phase 2 A row of three dashed boxes, each labelled Planned: make demo, make verify and make clean, joined by arrows. Below them, two rows compare a risky default today with its planned replacement: a dashboard token with cluster-admin becomes Headlamp with read-only default access, and chmod 777 on host storage becomes scoped permissions for storage. At the bottom a dashed box reads Public quickstart gate, Not yet passed. make demoPlanned make verifyPlanned make cleanPlanned Risky default todayPlanned replacement Dashboard tokencluster-admin Headlampread-only default chmod 777on host storage Scoped permissionsfor storage Public quickstart gateNot yet passed
Step 1 of 5

The make targets are shown as planned because the repository has no Makefile today. The safer defaults describe the plan, not a change that has been made.

Why the defaults matter

RBAC (role-based access control) is how Kubernetes decides who may do what. The cluster-admin role allows everything, so a long-lived token for it is a standing risk, even in a teaching lab.

What the historical setup does

  • admin-user.yaml ↗ binds a dashboard service account to cluster-admin.
  • monitoring.sh ↗ saves that account's token to a file and applies chmod -R 777 to storage folders.
  • The roadmap calls these unnecessarily broad for a default educational install.

What the plan asks for instead

  • Headlamp, a maintained dashboard, with read-only default access and no standing tokens left exposed (#4).
  • Safe storage permissions, least-privilege RBAC and careful secrets handling, with pinned dependencies and test CI (#6).
  • A UI smoke test and a ROS integration check before either is called done.

The gate for a public modern quickstart

Not yet passed

A clean host runs the supported installation, shows messages between different workers and passes the documented verification. Until all three are true, the modern quickstart stays unpublished and the Vagrant lab remains the historical example. A Docker build or a lint pass does not count as that verification.

See all eight release gates

Issues in this phase

Status labels come from what the repository's files show, not from the state of the issue on GitHub.

  • #14

    Verified talker and listener across workers

    The scripted check behind make verify: correct namespace and manifest names, pod readiness checks, and delivery across nodes. Issue #14 ↗

    Not yet verified
  • #16

    Lightweight kind or k3d profile

    A small cluster with make demo, make verify and make clean. No Makefile exists yet. Issue #16 ↗

    Planned
  • #6

    Test CI, pinned dependencies, least-privilege defaults

    An image CI workflow exists. Cluster-level tests and the safer permission defaults do not. Issue #6 ↗

    Planned
  • #4

    Headlamp instead of the archived Dashboard

    Today the monitoring setup still installs the Kubernetes Dashboard with a cluster-admin account. Issue #4 ↗

    Legacy

Source of truth: docs/ROADMAP-2026.md ↗, section 4. Back to the roadmap hub.