From 70295b6b2b292822da878e29ee78f6717983c4d3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 21 Sep 2026 18:41:24 +0200 Subject: [PATCH] Declare Argo CD Core v3.5.3 on railiance01 and its resource bounds Pinned core-install.yaml (sha256 1a87025d...c448) with a kustomize resources patch for the four workloads. The unpatched pin diffs clean against live; the resources patch is declared only, and its apply waits on the founder in RAIL-EN-WP-0002-T02. SCOPE.md no longer says ArgoCD is absent from railiance01. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703 --- .gitignore | 2 + Makefile | 16 +++- SCOPE.md | 25 +++--- deploy/argocd/railiance01/PIN | 4 + deploy/argocd/railiance01/README.md | 82 +++++++++++++++++ deploy/argocd/railiance01/kustomization.yaml | 10 +++ deploy/argocd/railiance01/resources.yaml | 68 ++++++++++++++ ...-0002-argocd-railiance01-declared-state.md | 90 +++++++++++++++++++ 8 files changed, 284 insertions(+), 13 deletions(-) create mode 100644 .gitignore create mode 100644 deploy/argocd/railiance01/PIN create mode 100644 deploy/argocd/railiance01/README.md create mode 100644 deploy/argocd/railiance01/kustomization.yaml create mode 100644 deploy/argocd/railiance01/resources.yaml create mode 100644 workplans/RAIL-EN-WP-0002-argocd-railiance01-declared-state.md diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..f50721e --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +deploy/argocd/*/upstream/ +__pycache__/ diff --git a/Makefile b/Makefile index b75a35c..59a55a3 100644 --- a/Makefile +++ b/Makefile @@ -10,4 +10,18 @@ check: ## Verify workflow templates remain private and deployment-free test: ## Run enablement regression tests python3 -m unittest discover -s tests -v -.PHONY: help check test +ARGOCD_DIR := deploy/argocd/railiance01 +include $(ARGOCD_DIR)/PIN + +argocd-fetch: ## Fetch the pinned Argo CD core manifest and verify its sha256 + mkdir -p $(ARGOCD_DIR)/upstream + curl -fsSL -o $(ARGOCD_DIR)/upstream/core-install.yaml $(ARGOCD_MANIFEST_URL) + echo "$(ARGOCD_MANIFEST_SHA256) $(ARGOCD_DIR)/upstream/core-install.yaml" | sha256sum -c - + +argocd-render: argocd-fetch ## Render the declared Argo CD state (no cluster contact) + kubectl kustomize $(ARGOCD_DIR) + +argocd-diff: argocd-fetch ## Read-only server-side diff of declared Argo CD state against railiance01 + kubectl kustomize $(ARGOCD_DIR) | ssh railiance01 'kubectl diff --server-side -n argocd -f -' + +.PHONY: help check test argocd-fetch argocd-render argocd-diff diff --git a/SCOPE.md b/SCOPE.md index af3f59e..8e3ffb3 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -74,25 +74,26 @@ services. S5 applications consume S4 templates and conventions, while ## Current State -- Status: emerging, with reusable Forgejo workflow templates and an active - private-by-default template workplan. +- Status: emerging, with reusable Forgejo workflow templates and the + railiance01 ArgoCD declared state (RAIL-EN-WP-0002 active). - S4 owns the consumer-facing contract for runner labels, registries, credentials, and artifact evidence. `railiance-forge` continues to operate those capabilities; they are not duplicated here. -- Implementation: ArgoCD is deployed in the `argocd` namespace on CoulombCore as - a cluster addon managed from S2 — verified still true 2026-08-12 -- **But GitOps does not reach the live cluster.** ArgoCD is not deployed on - `railiance01`, its Applications target CoulombCore in-cluster, and no - `railiance01` namespace is ArgoCD-managed. The live workloads deploy by - Makefile, outside GitOps. Whether to adopt, retire or relocate ArgoCD is - reopened — see `railiance-platform/ArchitectureBlueprint.md` §5.6 -- Stability: n/a for S4-owned content; ArgoCD itself runs, but two of its - Applications are Degraded and one is OutOfSync/Missing +- Implementation: Argo CD Core v3.5.3 (headless) is installed on + `railiance01` in namespace `argocd` since 2026-09-21. ArchitectureBlueprint + §5.6 (railiance-platform) is settled as **adopt properly**. Its declared + state is `deploy/argocd/railiance01/` (RAIL-EN-WP-0002). It has 0 + Applications and 0 AppProjects, so no workload is under GitOps yet; the live + workloads still deploy by Makefile. Adoption (phase B) and retiring + CoulombCore's ArgoCD (phase C) each need a founder go-ahead +- Stability: the pinned install matches live (read-only server-side diff, + 2026-09-21); resource requests/limits are declared but not yet applied, so + the pods are BestEffort until RAIL-EN-WP-0002-T02 - Usage: formal S4 tooling work begins after S3 baseline and should consume runner/registry capabilities from `railiance-forge` until that migration completes - Honest gap: this layer's `INTENT.md` promises considerably more than the repo - contains (25 commits, no workplans). Read that as open debt, not description + contains. Read that as open debt, not description --- diff --git a/deploy/argocd/railiance01/PIN b/deploy/argocd/railiance01/PIN new file mode 100644 index 0000000..b8e3758 --- /dev/null +++ b/deploy/argocd/railiance01/PIN @@ -0,0 +1,4 @@ +# Pinned upstream manifest for Argo CD Core on railiance01. +ARGOCD_VERSION := v3.5.3 +ARGOCD_MANIFEST_URL := https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/core-install.yaml +ARGOCD_MANIFEST_SHA256 := 1a87025d8eb2eae621653fd312fb9ca51df1b4b3b6992a030e3a9ef38e45c448 diff --git a/deploy/argocd/railiance01/README.md b/deploy/argocd/railiance01/README.md new file mode 100644 index 0000000..7650bcc --- /dev/null +++ b/deploy/argocd/railiance01/README.md @@ -0,0 +1,82 @@ +# Argo CD Core on railiance01 — declared state + +Owner: `railiance-enablement` (S4). ArgoCD is an S4 concern per +railiance-infra (RAIL-HO-WP-0004 service inventory). Settled as +ArchitectureBlueprint §5.6 option 1, **adopt properly** (founder, +`GOVERN @ estate`, 2026-09-21). + +| Item | Value | +|---|---| +| Distribution | upstream Argo CD **Core** (headless: no API server, UI or Dex) | +| Version | `v3.5.3` | +| Manifest | `core-install.yaml` at tag `v3.5.3` (URL in `PIN`) | +| sha256 | `1a87025d8eb2eae621653fd312fb9ca51df1b4b3b6992a030e3a9ef38e45c448` | +| Images | `quay.io/argoproj/argocd:v3.5.3`, `public.ecr.aws/docker/library/redis:8.2.3-alpine` | +| Namespace | `argocd` (created 2026-09-21T13:55:29Z) | +| Objects | 34, server-side applied, field manager `kubectl` | +| Applications / AppProjects | none (nothing adopted) | +| Listeners | no LoadBalancer or NodePort Service (ADR-0008) | + +The live install was a direct `ADMINISTER @ realm:kubernetes/railiance01`, +`activation=APPROVED` by the founder, performed by the custodian session on +2026-09-21 (record: `the-custodian/docs/kubernetes-change-gate-decision.md`). +This directory is its declared state. Evidence: `target-audited` for the +install itself; this repository adds `external-audited` evidence from here on. + +## Files + +- `PIN` — pinned manifest URL, version, sha256 (included by the Makefile). +- `kustomization.yaml` — pinned upstream plus `resources.yaml`. +- `resources.yaml` — requests and limits for the four workloads. + **Declared, not yet applied** (RAIL-EN-WP-0002-T02). +- `upstream/` — fetched manifest, gitignored; `make argocd-fetch` verifies it. + +## Read-only commands + +```bash +make argocd-fetch # download + sha256 check +make argocd-render # render declared state locally +make argocd-diff # server-side diff against railiance01 (read-only) +``` + +## Install (as performed 2026-09-21, pinned upstream, no resources patch) + +```bash +make argocd-fetch +ssh railiance01 'kubectl create namespace argocd' +ssh railiance01 'kubectl apply --server-side --dry-run=server -n argocd -f -' \ + < deploy/argocd/railiance01/upstream/core-install.yaml +ssh railiance01 'kubectl apply --server-side -n argocd -f -' \ + < deploy/argocd/railiance01/upstream/core-install.yaml +``` + +## Apply the declared state (includes resources) — needs founder go-ahead + +```bash +make argocd-diff # expect: only resources on the 4 workloads +kubectl kustomize deploy/argocd/railiance01 \ + | ssh railiance01 'kubectl apply --server-side -n argocd -f -' +ssh railiance01 'kubectl -n argocd rollout status sts/argocd-application-controller deploy/argocd-repo-server deploy/argocd-applicationset-controller deploy/argocd-redis' +``` + +## Rollback + +Resources only (return to upstream BestEffort): + +```bash +ssh railiance01 'kubectl apply --server-side -n argocd -f -' \ + < deploy/argocd/railiance01/upstream/core-install.yaml +``` + +Whole install (nothing else depends on it while there are 0 Applications): + +```bash +ssh railiance01 'kubectl delete namespace argocd' +ssh railiance01 'kubectl delete crd applications.argoproj.io applicationsets.argoproj.io appprojects.argoproj.io' +``` + +The upstream core manifest also creates one ClusterRole and one +ClusterRoleBinding (`argocd-application-controller`). For a clean cluster, +delete everything it declares first: +`ssh railiance01 'kubectl delete -n argocd -f -' < deploy/argocd/railiance01/upstream/core-install.yaml`, +then the namespace. diff --git a/deploy/argocd/railiance01/kustomization.yaml b/deploy/argocd/railiance01/kustomization.yaml new file mode 100644 index 0000000..6cacc7b --- /dev/null +++ b/deploy/argocd/railiance01/kustomization.yaml @@ -0,0 +1,10 @@ +# Declared state of Argo CD Core on railiance01 (namespace argocd). +# Upstream manifest is fetched and sha256-verified by `make argocd-fetch` +# into upstream/ (gitignored); see PIN and README.md. Like upstream, the +# render carries no namespace: apply it with `-n argocd`. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - upstream/core-install.yaml +patches: + - path: resources.yaml diff --git a/deploy/argocd/railiance01/resources.yaml b/deploy/argocd/railiance01/resources.yaml new file mode 100644 index 0000000..64828f1 --- /dev/null +++ b/deploy/argocd/railiance01/resources.yaml @@ -0,0 +1,68 @@ +# Requests and limits for the four Argo CD Core workloads. Upstream core sets +# none, so the live pods are BestEffort. Idle use on 2026-09-21 (kubectl top, +# 0 Applications): controller 2m/23Mi, applicationset 1m/19Mi, +# repo-server 1m/19Mi, redis 5m/4Mi. Requests sit above idle to leave room for +# phase B adoption; memory limits bound the pods; CPU limits are generous. +# Total added requests: 95m CPU, 480Mi memory (init containers do not add). +# NOT YET APPLIED: see RAIL-EN-WP-0002-T02. +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: argocd-application-controller +spec: + template: + spec: + containers: + - name: argocd-application-controller + resources: + requests: {cpu: 50m, memory: 256Mi} + limits: {cpu: 1000m, memory: 1Gi} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: argocd-repo-server +spec: + template: + spec: + initContainers: + - name: copyutil + resources: + requests: {cpu: 10m, memory: 32Mi} + limits: {cpu: 100m, memory: 64Mi} + containers: + - name: argocd-repo-server + resources: + requests: {cpu: 25m, memory: 128Mi} + limits: {cpu: 1000m, memory: 1Gi} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: argocd-applicationset-controller +spec: + template: + spec: + containers: + - name: argocd-applicationset-controller + resources: + requests: {cpu: 10m, memory: 64Mi} + limits: {cpu: 250m, memory: 256Mi} +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: argocd-redis +spec: + template: + spec: + initContainers: + - name: secret-init + resources: + requests: {cpu: 10m, memory: 32Mi} + limits: {cpu: 100m, memory: 64Mi} + containers: + - name: redis + resources: + requests: {cpu: 10m, memory: 32Mi} + limits: {cpu: 200m, memory: 128Mi} diff --git a/workplans/RAIL-EN-WP-0002-argocd-railiance01-declared-state.md b/workplans/RAIL-EN-WP-0002-argocd-railiance01-declared-state.md new file mode 100644 index 0000000..24a63bc --- /dev/null +++ b/workplans/RAIL-EN-WP-0002-argocd-railiance01-declared-state.md @@ -0,0 +1,90 @@ +--- +id: RAIL-EN-WP-0002 +type: workplan +title: "Declare Argo CD Core on railiance01 and bound its resources" +domain: financials +repo: railiance-enablement +status: active +flavor: implementation +owner: codex +topic_slug: railiance +created: "2026-09-21" +updated: "2026-09-21" +related: + - ArchitectureBlueprint-5.6 + - RPF-WP-0043 +--- + +# RAIL-EN-WP-0002 — Argo CD Core on railiance01: declared state + +Argo CD Core v3.5.3 was installed on railiance01 on 2026-09-21 as a direct +`ADMINISTER @ realm:kubernetes/railiance01`, `activation=APPROVED` by the +founder, performed by the custodian session +(`the-custodian/docs/kubernetes-change-gate-decision.md`). ArgoCD is an S4 +concern (railiance-infra RAIL-HO-WP-0004 inventory), so its declared state +lives here: `deploy/argocd/railiance01/`. + +## T01 — Declare the install + +```task +id: RAIL-EN-WP-0002-T01 +status: done +priority: high +``` + +Pin manifest URL and sha256 (`PIN`), kustomization, install and rollback +commands (`README.md`), read-only `make argocd-fetch|render|diff`. + +**Outcome (2026-09-21):** fetched manifest sha256 matches the pin +(`1a87025d…c448`, 34 objects). Read-only `kubectl diff --server-side -n argocd` +of the unpatched pinned manifest against railiance01: **no diff**. So the +declared base matches live exactly. + +## T02 — Apply resource requests and limits (live change, awaits founder) + +```task +id: RAIL-EN-WP-0002-T02 +status: wait +priority: high +``` + +Upstream core sets no resources, so all four pods are BestEffort (verified +2026-09-21). `resources.yaml` declares: + +| Workload | Request cpu/mem | Limit cpu/mem | Idle use 2026-09-21 | +|---|---|---|---| +| application-controller (sts) | 50m / 256Mi | 1 / 1Gi | 2m / 23Mi | +| repo-server (+ copyutil init 10m/32Mi, 100m/64Mi) | 25m / 128Mi | 1 / 1Gi | 1m / 19Mi | +| applicationset-controller | 10m / 64Mi | 250m / 256Mi | 1m / 19Mi | +| redis (+ secret-init init 10m/32Mi, 100m/64Mi) | 10m / 32Mi | 200m / 128Mi | 5m / 4Mi | + +Added requests: 95m CPU, 480Mi memory. Node requests before: 3320m (83%) CPU, +8856Mi (55%) memory, so this fits. Pods become Burstable. Idle use is with 0 +Applications; revisit after phase B adoption. + +This is a **live change** (rolls all four pods). It is not taken in this +session. On the founder's go-ahead, mode `ADMINISTER @ realm:kubernetes/railiance01`, +`activation=APPROVED`: + +```bash +make argocd-diff # expect only resources on the 4 workloads +kubectl kustomize deploy/argocd/railiance01 \ + | ssh railiance01 'kubectl apply --server-side -n argocd -f -' +ssh railiance01 'kubectl -n argocd rollout status sts/argocd-application-controller deploy/argocd-repo-server deploy/argocd-applicationset-controller deploy/argocd-redis' +``` + +Rollback (back to upstream BestEffort): + +```bash +ssh railiance01 'kubectl apply --server-side -n argocd -f -' \ + < deploy/argocd/railiance01/upstream/core-install.yaml +``` + +**Done when:** all four pods Ready with qosClass Burstable and `make argocd-diff` +is empty. + +## Not in this workplan + +Phase B (AppProjects, root app, per-application adoption) and phase C +(retire coulombcore's ArgoCD) each need their own founder go-ahead. +Once phase B exists, ArgoCD's own manifest should move under GitOps too.