inside.hoortrend.com: the playground, seen from the inside

demo-app becomes the inside view of the portfolio's playground.

• Backend (FastAPI): LIST + WATCH of pods, EndpointSlices, Deployments, ReplicaSets, events, quota and Service in the namespace playground; one log stream per pod; a probe calling the Service 4 times per second; fixed Prometheus queries. Every change becomes a fact (with the component that caused it), facts become stories (what followed each action, step by step, timed).
• Page: one Server-Sent Events stream; the machinery as a live diagram, the story of the last action with its measurements and a replay, the traffic as a client sees it, the inside of a pod, the raw feed, the guardrails, what the monitoring sees. FR/EN, strict CSP, side-by-side mode with the real playground.
• Tests: the observer replays a recording of the real playground while every button was played (tests/fixtures); the web layer runs without a cluster.
• Rights: get/list/watch only (checked by the pipeline); egress limited to the API server, Prometheus, the playground's port 8080 and DNS.
• Pipeline: tests, page scripts, manifests, gitleaks -> Kaniko -> Trivy (blocking) -> promote (:latest after the scan) + deploy -> smoke test (page, health, first event of the stream).

First deployment by hand after the merge: kubectl apply -f k8s/, the gitlab-registry pull Secret, and the infra Role. Depends on portfolio (play-app /whoami, NetworkPolicy, embed) and infra (CI Role).

🤖 Generated with Claude Code