The operator, recorded

12 sessions, recorded at the terminal against a four-node kind cluster with the operator installed from its chart. Each one is checked while it runs: a recording is published only if every condition it claims held on the live cluster. Open one to read the session in full; Play types it out where it stands.

• Kubernetes1.37.0
• Operator8c7fe187707f
• Ptahv0.6.0
• Executorsha256:91ec0a6fa27f
• Recorded2026-09-17
• Checks held128
• Runs12

These sessions were recorded against Ptah v0.6.0. The supported executor is now v0.7.0, so read them as evidence about the operator's behaviour rather than as a check that these commands still run unchanged today.

A replay of a verified run, not a live cluster. Nothing on this page talks to anything.

sh · lab-setup

# The lab is one cluster, built from the versions this repository declares.$ demo/bin/lab versionskubernetes  1.37.0kind        v0.33.0operator    8c7fe187707f6ea7af916d6005bc237291a35e18executor    e2e-registry.demo.svc.cluster.local:5000/ptah-executor@sha256:91ec0a6fa27fab4d8ad52c77ea332dc3984def59a9c63891e120304d07edaf6fptah        v0.6.0 # The operator runs in its own namespace, two replicas, one leader.$ kubectl -n "$OPERATOR_NAMESPACE" get deploymentNAME                                                           READY   UP-TO-DATE   AVAILABLE   AGEptah-operator-cert-rotator                                     1/1     1            1           24mptah-operator                                                  2/2     2            2           24m # Available means the install finished. The image is a digest, so one exact build runs.$ kubectl -n "$OPERATOR_NAMESPACE" get deployment -o json \  | jq -r '.items[].spec.template.spec.containers[].image'e2e-registry.demo.svc.cluster.local:5000/ptah-operator@sha256:04293ec4e155b4834e86c633b4d5630af9a8062c4d0383729bb6f42f62860c2ce2e-registry.demo.svc.cluster.local:5000/ptah-operator@sha256:04293ec4e155b4834e86c633b4d5630af9a8062c4d0383729bb6f42f62860c2c # Three resources -- the desired state, the plan, and the decision that lets it run.$ kubectl get crd -o custom-columns=NAME:.metadata.name,ESTABLISHED:'.status.conditions[?(@.type=="Established")].status' \  ptahschemas.operator.ptah.run ptahschemaplans.operator.ptah.run ptahschemaapprovals.operator.ptah.runNAME                                    ESTABLISHEDptahschemas.operator.ptah.run           Trueptahschemaplans.operator.ptah.run       Trueptahschemaapprovals.operator.ptah.run   True # The namespace it works in. Credentials are Secrets; the policy cannot be edited.$ kubectl -n "$NAMESPACE" get secret,configmapNAME                          TYPE                             DATA   AGEsecret/demo-database          Opaque                           6      21msecret/demo-database-broken   Opaque                           1      2msecret/demo-registry          Opaque                           4      21msecret/demo-registry-pull     kubernetes.io/dockerconfigjson   1      21m NAME                                           DATA   AGEconfigmap/demo-migration-verification-policy   1      21mconfigmap/demo-verification-policy             1      21mconfigmap/kube-root-ca.crt                     1      21m

• Stand up the labLabA four-node kind cluster, the chart from a package, and every image pinned by digest.$ demo/bin/lab versions5 commands · 36 lines · 6 checks
• Start a new database from a checkpointLifecycleA fresh database runs the snapshot and what came after it, and ends up where the long way ends.$ ls demo/migrations-checkpoint | grep -v down7 commands · 86 lines · 8 checks
• Apply a schemaLifecyclePublish a schema as an artifact, point the operator at it, and watch it converge.$ cat demo/schemas/v1.sql10 commands · 111 lines · 13 checks
• Manage reference dataLifecycleRows declared beside the tables that hold them, reconciled through the same plan.$ sed -n '/ptah:schema:table name="regions"/,/^}/p' demo/reference/v1/catalog.go13 commands · 110 lines · 17 checks
• Change the schemaLifecycleA second revision, a new digest, and the difference applied as one plan.$ kubectl -n "$NAMESPACE" exec deploy/demo-psql -- psql -c "\dt"7 commands · 68 lines · 9 checks
• Run a prepared migration sequenceLifecycleNumbered SQL files in an artifact, matched against the database's own record of what has run.$ ls demo/migrations12 commands · 152 lines · 15 checks
• Refuse a destructive changeSafetyThe third revision drops a column. The policy says no, and says so before anything runs.$ kubectl -n "$NAMESPACE" exec deploy/demo-psql -- psql -c "INSERT INTO customers (id, email) VALUES (1, 'a@example.test') RETURNING id, email"8 commands · 53 lines · 10 checks
• Approve a planSafetyWith apply set to OnApproval, nothing runs until a person approves that exact plan.$ APPLY=OnApproval demo/bin/lab manifest storefront "$(cat demo/.lab/digest)" | tee demo/.lab/storefront.yaml10 commands · 107 lines · 14 checks
• Retire a used approvalSafetyAn approval describes one plan against one observed state. Applying it moves that state.$ kubectl -n "$NAMESPACE" get ptahschema storefront -o jsonpath='{.status.phase}{"\n"}{.status.plan.fingerprint}{"\n"}'7 commands · 52 lines · 11 checks
• Close the driftOperationsSomeone changes the database by hand. The operator notices and puts it back.$ kubectl -n "$NAMESPACE" get ptahschema storefront -o json5 commands · 36 lines · 6 checks
• Fail, then recoverOperationsPoint it at a database that is not there. It says so, keeps trying, and converges when it is.$ APPLY=Always demo/bin/lab manifest storefront "$(cat demo/.lab/digest)"6 commands · 31 lines · 9 checks
• Suspend and resumeOperationsOne field stops reconciliation without deleting anything, and resuming picks up where it stopped.$ kubectl -n "$NAMESPACE" get ptahschema storefront -o json7 commands · 37 lines · 10 checks