simpler check and deps messages

rig/ctrl/addons/airflow.sh

@@ -1,13 +1,7 @@
 #!/usr/bin/env bash
-# Apache Airflow — the cluster half of the airflow cabinet.
-#
-# Airflow needs a metadata database before it will start at all, so this refuses
-# rather than rolls a pod that will CrashLoopBackOff while the real problem
-# (postgres missing from ADDONS) stays invisible in the logs.
-#
-# One pod on `standalone`, matching the compose cabinet: migration, admin user,
-# scheduler and webserver in a single container. The official chart's five
-# deployments model an installation; switching this on means wanting pipelines.
+# Apache Airflow — the cluster half of the airflow cabinet (one `standalone` pod).
+# Requires the postgres addon; refuses to install without it.
+# Notes: docs/notes/addons.md
 set -euo pipefail
 cd "$(dirname "$0")/.."
 

rig/ctrl/addons/cert-manager.sh

@@ -1,10 +1,6 @@
 #!/usr/bin/env bash
-# cert-manager plus a self-signed cluster issuer.
-#
-# In a regulated estate almost everything is TLS, so the interesting question
-# during onboarding is "does this service present a cert my client trusts" — not
-# "can I reach a public ACME server". A local CA answers that offline, which is
-# also what makes the air-gapped profile usable.
+# cert-manager plus a self-signed cluster issuer (offline local CA).
+# Notes: docs/notes/addons.md
 set -euo pipefail
 cd "$(dirname "$0")/.."
 

rig/ctrl/addons/metallb.sh

@@ -1,15 +1,7 @@
 #!/usr/bin/env bash
 # MetalLB — makes `Service type: LoadBalancer` actually get an address.
-#
-# Why it matters here: real manifests use LoadBalancer, because a real cluster
-# has one. On a bare kind cluster those Services sit at EXTERNAL-IP <pending>
-# forever with no error anywhere — the deployment looks fine and simply is not
-# reachable. Without this, every such Service has to be edited to NodePort,
-# which means the local manifests stop matching the ones being modelled.
-#
-# The address pool is derived from the kind Docker network at install time, not
-# hardcoded: Docker picks that subnet, it differs between machines, and a pool
-# outside it is silently unroutable.
+# The pool is derived from the kind Docker network at install time.
+# Notes: docs/notes/addons.md
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
@@ -57,10 +49,7 @@ else
     $K apply -f "https://raw.githubusercontent.com/metallb/metallb/${METALLB_VERSION}/config/manifests/metallb-native.yaml"
 fi
 
-# `kubectl wait` on a selector errors out immediately when nothing matches yet,
-# and right after apply the ReplicaSet has not created the pod — so it loses a
-# race it looks like it should win. `rollout status` waits for the Deployment
-# itself and handles the not-yet-created case.
+# `rollout status`, not `kubectl wait`: wait errors out while the pod doesn't exist yet.
 echo "  waiting for the controller..."
 $K rollout status deployment/controller -n metallb-system --timeout=240s
 $K rollout status daemonset/speaker -n metallb-system --timeout=240s

rig/ctrl/addons/metrics-server.sh

@@ -1,10 +1,6 @@
 #!/usr/bin/env bash
-# metrics-server — makes `kubectl top` work.
-#
-# kind nodes serve kubelet metrics over a self-signed cert, so the standard
-# manifest never becomes ready without --kubelet-insecure-tls. That is fine here
-# (it is a local cluster) and is the single most common reason metrics-server
-# sits at 0/1 on kind.
+# metrics-server — makes `kubectl top` work (patched with --kubelet-insecure-tls for kind).
+# Notes: docs/notes/addons.md
 set -euo pipefail
 cd "$(dirname "$0")/.."
 

rig/ctrl/addons/postgres.sh

@@ -1,20 +1,6 @@
 #!/usr/bin/env bash
-# PostgreSQL — the cluster half of the postgres cabinet.
-#
-# A cabinet is a public service dropped into the environment as-is — the
-# upstream image, unmodified, reachable at a known address. This is the cluster
-# half of it; the compose half is a `service.yml` beside a `cabinet.json`. The
-# declaration is made once and both paths read it, so nothing is remembered
-# twice.
-#
-# Plain manifests rather than a helm chart, matching the other addons: a chart
-# repo is a network dependency, and the offline example profile exists precisely so
-# there is a path with none. The image is pinned in ctrl/versions.env and can be
-# preloaded into a local registry like every other image here.
-#
-# One replica on a PVC. This models a dependency for local work, not a
-# highly-available database, and pretending otherwise on a kind node would be a
-# more elaborate lie rather than a more useful one.
+# PostgreSQL — the cluster half of the postgres cabinet: plain manifests, one replica on a PVC.
+# Notes: docs/notes/addons.md
 set -euo pipefail
 cd "$(dirname "$0")/.."
 

rig/ctrl/addons/redis.sh

@@ -1,9 +1,6 @@
 #!/usr/bin/env bash
-# Redis — the cluster half of the redis cabinet.
-#
-# Cache, and the broker anything queue-shaped runs on. No persistence: a broker
-# that loses its queue on restart is the honest local model, and a PVC here buys
-# nothing but a volume to clean up.
+# Redis — the cluster half of the redis cabinet: cache/broker, no persistence.
+# Notes: docs/notes/addons.md
 set -euo pipefail
 cd "$(dirname "$0")/.."