tegwick
27ac54b32d
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
16 lines
868 B
Markdown
16 lines
868 B
Markdown
# Private-by-default template contract
|
|
|
|
Railiance enablement templates produce build and promotion evidence; they do
|
|
not create a public listener. ADR-0008 is enforced by the execution rail:
|
|
|
|
- Kubernetes workload scaffolding is owned by `rail-kubernetes`.
|
|
- Its default Service is `ClusterIP`, its generated ingress policy is
|
|
default-deny, and its Stage 2 values do not enable Ingress.
|
|
- A public Ingress requires matching rapp and reef declarations at the rail's
|
|
deploy gate. An Ingress object or successful deployment is not a grant.
|
|
- Operator access uses the named tunnel documented by the owning rail or rapp.
|
|
|
|
`make check` rejects enablement workflow templates that embed Ingress,
|
|
LoadBalancer, NodePort, or direct Kubernetes/Helm deployment commands. This
|
|
keeps reusable build workflows from becoming an accidental application or
|
|
cluster deployment owner.
|