Cilium PR5 — Sweep Obsolete Calico Policy File Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (- [ ]) syntax for tracking.

Goal: Delete the now-obsolete argocd/app-configs/cf-ssh-bastion/calico-network-policy.yaml file and remove its kustomization entry. After PR4 deleted Calico’s CRDs, this file is a silent no-op; PR5 sweeps it from the repo for cleanliness.

Architecture: Two-file change — delete the YAML and update the kustomization. ArgoCD reconciles automatically. No cluster behavior change (the Cilium policies from PR2 are the actual enforcement; the Calico file has been a no-op since PR4 merged).

Tech Stack: kubectl (for verification), ArgoCD.

Reference spec: docs/engineering/specs/2026-05-10-calico-to-cilium-design.md (commit fe05a87c).

File Structure

Files deleted:

argocd/app-configs/cf-ssh-bastion/calico-network-policy.yaml

Files modified:

argocd/app-configs/cf-ssh-bastion/kustomization.yaml — remove the line referencing the deleted file

Cluster state changes: none (the Calico policy file has been a silent no-op since PR4’s CRD deletion).

Tasks

Task 1: Pre-flight verification

Files: none (read-only checks)

Step 1: Verify PR4 has merged and Calico is truly gone

kubectl get crd | rg -i 'projectcalico|tigera' | wc -l

Expected: 0. If non-zero, PR4 hasn’t completed cleanup — finish PR4 first.

Step 2: Verify the bastion’s CiliumNetworkPolicies exist and enforce

kubectl get ciliumnetworkpolicies.cilium.io -n cf-ssh-bastion --no-headers | wc -l

Expected: 6 (the 6 policies pre-staged in PR2).

kubectl get cm -n kube-system cilium-config -o jsonpath='{.data.enable-policy}'; echo ""

Expected: default (post-PR4 production mode).

Step 3: Confirm the Calico file is a no-op currently

# Cluster has no Calico CRDs to instantiate this file's resources against
kubectl apply --dry-run=server -f argocd/app-configs/cf-ssh-bastion/calico-network-policy.yaml 2>&1 | head -5

Expected: error like no matches for kind "NetworkPolicy" in version "projectcalico.org/v3". This confirms the file is unparseable by the cluster — safe to delete.

Task 2: Delete the Calico policy file

Files:

Delete: argocd/app-configs/cf-ssh-bastion/calico-network-policy.yaml
Step 1: Remove the file

git rm argocd/app-configs/cf-ssh-bastion/calico-network-policy.yaml

Step 2: Verify deletion

ls argocd/app-configs/cf-ssh-bastion/ | rg calico-network-policy
# Expected: empty
ls argocd/app-configs/cf-ssh-bastion/ | rg cilium-network-policy
# Expected: cilium-network-policy.yaml (Cilium policy remains)

Step 3: Commit

Commit message: feat(cf-ssh-bastion): delete obsolete Calico NetworkPolicy file (PR5/5)

Task 3: Remove the kustomization entry

Files:

Modify: argocd/app-configs/cf-ssh-bastion/kustomization.yaml
Step 1: Edit the kustomization

Open argocd/app-configs/cf-ssh-bastion/kustomization.yaml. Find and DELETE this line:

  - calico-network-policy.yaml

Keep the - cilium-network-policy.yaml line.

Step 2: Verify kustomize renders cleanly

kubectl --context fzymgc-house kustomize argocd/app-configs/cf-ssh-bastion/ > /tmp/bastion-render.yaml
echo "Resources:"
rg '^kind:' /tmp/bastion-render.yaml | sort | uniq -c
echo "Policy kinds (should show only CiliumNetworkPolicy):"
rg '^kind:.*Policy' /tmp/bastion-render.yaml | sort -u
rm /tmp/bastion-render.yaml

Expected: kustomize renders without errors; only CiliumNetworkPolicy appears among policy kinds (no NetworkPolicy from Calico).

Step 3: Validate yamllint

Run: uvx --from yamllint yamllint argocd/app-configs/cf-ssh-bastion/kustomization.yaml Expected: clean.

Step 4: Commit

Commit message: feat(cf-ssh-bastion): remove Calico policy from kustomization (PR5/5)

Task 4: Verify ArgoCD sync post-merge + final PR

Files: none (PR creation)

Step 1: Lint

lefthook run pre-commit

Expected: clean.

Step 2: Open the PR

git push -u origin feat/cilium-migration  # or PR5-specific branch
gh pr create \
  --title "feat(cf-ssh-bastion): remove obsolete Calico NetworkPolicy file (PR5/5)" \
  --body "$(cat <<'EOF'
## Summary

Deletes `argocd/app-configs/cf-ssh-bastion/calico-network-policy.yaml` and its kustomization entry. The file has been a silent no-op since PR4 removed the `projectcalico.org/v3` CRD; this PR sweeps it for repo cleanliness.

## Cluster impact

None. The Cilium policies (created in PR2, enforcing since PR4's `policyEnforcementMode: default` flip) are the actual policy enforcement; the Calico file was orphaned.

## Spec / prior PR

- Spec: `docs/engineering/specs/2026-05-10-calico-to-cilium-design.md`
- PR4: #<PR4-number>

This is the final PR in the migration series. After merge, the `feat/cilium-migration` branch can be deleted and the worktree cleaned up.

## Test plan

- [x] Verified PR4 has merged and Calico CRDs are gone
- [x] Verified 6 CiliumNetworkPolicies enforce in cf-ssh-bastion
- [x] Verified the Calico file is unparseable (no projectcalico.org CRDs)
- [x] kustomize renders cleanly with only CiliumNetworkPolicy kinds
- [ ] Post-merge: ArgoCD shows cf-ssh-bastion Application Synced and Healthy

🤖 Generated with [Claude Code](https://claude.com/claude-code)
EOF
)"

Step 3: After PR5 merges — verify ArgoCD sync

kubectl --context fzymgc-house get application cf-ssh-bastion -n argocd -o jsonpath='{.status.sync.status} {.status.health.status}'
echo ""

Expected: Synced Healthy.

Step 4: Clean up worktree (optional, after merge)

# From the parent repo (not the worktree)
git worktree remove .worktrees/feat-cilium-migration
git branch -D feat/cilium-migration

Self-Review Checklist

Spec coverage — PR5 spec section: delete file (Task 2), update kustomization (Task 3), verify ArgoCD sync (Task 4 step 3). All covered.
Placeholder scan — every command is explicit; no TODO/TBD.
Type/symbol consistency — the only filename referenced is calico-network-policy.yaml; consistent throughout.
No invented references — every file path exists in the repo or was created by a prior PR in this series.

Notes for the implementer

PR5 is the smallest PR in the series. Don’t be tempted to bundle it with PR4 — keeping it separate gives a clean “decommission was fully done before file sweep” audit trail.
No cluster operations required. PR5 is purely repo cleanup. ArgoCD’s prune: true policy handles the file deletion automatically.
After PR5 merges, the migration is complete. Update beads to close the epic. The cilium-migration.md log stays in the repo as a historical artifact.

Execution handoff

Plan complete and saved to docs/engineering/plans/2026-05-11-cilium-pr5-sweep-calico-policy.md. Two execution options:

Subagent-Driven — appropriate for this small purely-repo PR.
Inline Execution — also fine; 4 tasks total.

Which approach?