tegwick
70295b6b2b
Pinned core-install.yaml (sha256 1a87025d...c448) with a kustomize resources patch for the four workloads. The unpatched pin diffs clean against live; the resources patch is declared only, and its apply waits on the founder in RAIL-EN-WP-0002-T02. SCOPE.md no longer says ArgoCD is absent from railiance01. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
82 lines
3.4 KiB
Markdown
82 lines
3.4 KiB
Markdown
# Argo CD Core on railiance01 — declared state
|
|
|
|
Owner: `railiance-enablement` (S4). ArgoCD is an S4 concern per
|
|
railiance-infra (RAIL-HO-WP-0004 service inventory). Settled as
|
|
ArchitectureBlueprint §5.6 option 1, **adopt properly** (founder,
|
|
`GOVERN @ estate`, 2026-09-21).
|
|
|
|
| Item | Value |
|
|
|---|---|
|
|
| Distribution | upstream Argo CD **Core** (headless: no API server, UI or Dex) |
|
|
| Version | `v3.5.3` |
|
|
| Manifest | `core-install.yaml` at tag `v3.5.3` (URL in `PIN`) |
|
|
| sha256 | `1a87025d8eb2eae621653fd312fb9ca51df1b4b3b6992a030e3a9ef38e45c448` |
|
|
| Images | `quay.io/argoproj/argocd:v3.5.3`, `public.ecr.aws/docker/library/redis:8.2.3-alpine` |
|
|
| Namespace | `argocd` (created 2026-09-21T13:55:29Z) |
|
|
| Objects | 34, server-side applied, field manager `kubectl` |
|
|
| Applications / AppProjects | none (nothing adopted) |
|
|
| Listeners | no LoadBalancer or NodePort Service (ADR-0008) |
|
|
|
|
The live install was a direct `ADMINISTER @ realm:kubernetes/railiance01`,
|
|
`activation=APPROVED` by the founder, performed by the custodian session on
|
|
2026-09-21 (record: `the-custodian/docs/kubernetes-change-gate-decision.md`).
|
|
This directory is its declared state. Evidence: `target-audited` for the
|
|
install itself; this repository adds `external-audited` evidence from here on.
|
|
|
|
## Files
|
|
|
|
- `PIN` — pinned manifest URL, version, sha256 (included by the Makefile).
|
|
- `kustomization.yaml` — pinned upstream plus `resources.yaml`.
|
|
- `resources.yaml` — requests and limits for the four workloads.
|
|
**Declared, not yet applied** (RAIL-EN-WP-0002-T02).
|
|
- `upstream/` — fetched manifest, gitignored; `make argocd-fetch` verifies it.
|
|
|
|
## Read-only commands
|
|
|
|
```bash
|
|
make argocd-fetch # download + sha256 check
|
|
make argocd-render # render declared state locally
|
|
make argocd-diff # server-side diff against railiance01 (read-only)
|
|
```
|
|
|
|
## Install (as performed 2026-09-21, pinned upstream, no resources patch)
|
|
|
|
```bash
|
|
make argocd-fetch
|
|
ssh railiance01 'kubectl create namespace argocd'
|
|
ssh railiance01 'kubectl apply --server-side --dry-run=server -n argocd -f -' \
|
|
< deploy/argocd/railiance01/upstream/core-install.yaml
|
|
ssh railiance01 'kubectl apply --server-side -n argocd -f -' \
|
|
< deploy/argocd/railiance01/upstream/core-install.yaml
|
|
```
|
|
|
|
## Apply the declared state (includes resources) — needs founder go-ahead
|
|
|
|
```bash
|
|
make argocd-diff # expect: only resources on the 4 workloads
|
|
kubectl kustomize deploy/argocd/railiance01 \
|
|
| ssh railiance01 'kubectl apply --server-side -n argocd -f -'
|
|
ssh railiance01 'kubectl -n argocd rollout status sts/argocd-application-controller deploy/argocd-repo-server deploy/argocd-applicationset-controller deploy/argocd-redis'
|
|
```
|
|
|
|
## Rollback
|
|
|
|
Resources only (return to upstream BestEffort):
|
|
|
|
```bash
|
|
ssh railiance01 'kubectl apply --server-side -n argocd -f -' \
|
|
< deploy/argocd/railiance01/upstream/core-install.yaml
|
|
```
|
|
|
|
Whole install (nothing else depends on it while there are 0 Applications):
|
|
|
|
```bash
|
|
ssh railiance01 'kubectl delete namespace argocd'
|
|
ssh railiance01 'kubectl delete crd applications.argoproj.io applicationsets.argoproj.io appprojects.argoproj.io'
|
|
```
|
|
|
|
The upstream core manifest also creates one ClusterRole and one
|
|
ClusterRoleBinding (`argocd-application-controller`). For a clean cluster,
|
|
delete everything it declares first:
|
|
`ssh railiance01 'kubectl delete -n argocd -f -' < deploy/argocd/railiance01/upstream/core-install.yaml`,
|
|
then the namespace.
|