Add ArgoCD GitOps bootstrap contract for railiance01

Define platform-owned AppProjects, root app-of-apps, repository registration templates, and tenant onboarding docs so issue-core can deploy via ArgoCD. Ignore encrypted repository secrets locally and cross-link OpenBao delivery guidance with the new GitOps contract.
2026-06-19 21:05:12 +02:00 · 2026-06-19 21:05:12 +02:00 · 64d7c18c3f
commit 64d7c18c3f
parent cb45f29fb2
13 changed files with 655 additions and 1 deletions
--- a/argocd/applications/README.md
+++ b/argocd/applications/README.md
@ -0,0 +1,18 @@
+# Railiance ArgoCD Tenant Applications
+
+This directory is synced by the `railiance-apps-root` ArgoCD Application.
+
+Tenant teams author a thin ArgoCD `Application` manifest against the contract
+in `docs/argocd-gitops.md`. Platform review merges that manifest here after
+checking namespace, repository, sync policy, and secret-delivery shape.
+
+Workload manifests stay in the owning tenant repo. The default source path for
+tenant workloads is:
+
+```text
+k8s/railiance/
+```
+
+Do not commit Kubernetes Secret values, ArgoCD repository credentials, OpenBao
+tokens, deploy keys, or API keys here.
+
--- a/argocd/applications/issue-core.application.yaml
+++ b/argocd/applications/issue-core.application.yaml
@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: issue-core
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance.io/domain: issue-core
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  project: railiance-tenants
+  source:
+    repoURL: https://gitea.coulomb.social/coulomb/issue-core.git
+    targetRevision: main
+    path: k8s/railiance
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: issue-core
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true
--- a/argocd/bootstrap/00-railiance-bootstrap-project.yaml
+++ b/argocd/bootstrap/00-railiance-bootstrap-project.yaml
@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: railiance-bootstrap
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+spec:
+  description: Platform-owned ArgoCD bootstrap project for Railiance app-of-apps.
+  sourceRepos:
+    - https://gitea.coulomb.social/coulomb/railiance-platform.git
+  destinations:
+    - server: https://kubernetes.default.svc
+      namespace: argocd
+  clusterResourceWhitelist: []
+  namespaceResourceWhitelist:
+    - group: argoproj.io
+      kind: Application
+  orphanedResources:
+    warn: true
+
--- a/argocd/bootstrap/01-railiance-tenants-project.yaml
+++ b/argocd/bootstrap/01-railiance-tenants-project.yaml
@ -0,0 +1,52 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: railiance-tenants
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+spec:
+  description: Guardrails for Railiance tenant applications deployed by ArgoCD.
+  sourceRepos:
+    - https://gitea.coulomb.social/coulomb/*.git
+  destinations:
+    - server: https://kubernetes.default.svc
+      namespace: "*"
+  clusterResourceWhitelist:
+    - group: ""
+      kind: Namespace
+  namespaceResourceWhitelist:
+    - group: ""
+      kind: ConfigMap
+    - group: ""
+      kind: PersistentVolumeClaim
+    - group: ""
+      kind: Secret
+    - group: ""
+      kind: Service
+    - group: ""
+      kind: ServiceAccount
+    - group: apps
+      kind: Deployment
+    - group: apps
+      kind: StatefulSet
+    - group: autoscaling
+      kind: HorizontalPodAutoscaler
+    - group: batch
+      kind: CronJob
+    - group: batch
+      kind: Job
+    - group: external-secrets.io
+      kind: ExternalSecret
+    - group: networking.k8s.io
+      kind: Ingress
+    - group: networking.k8s.io
+      kind: NetworkPolicy
+    - group: traefik.io
+      kind: IngressRoute
+    - group: traefik.io
+      kind: Middleware
+  orphanedResources:
+    warn: true
+
--- a/argocd/bootstrap/10-railiance-apps-root.application.yaml
+++ b/argocd/bootstrap/10-railiance-apps-root.application.yaml
@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: railiance-apps-root
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+spec:
+  project: railiance-bootstrap
+  source:
+    repoURL: https://gitea.coulomb.social/coulomb/railiance-platform.git
+    targetRevision: main
+    path: argocd/applications
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true
+
--- a/argocd/bootstrap/kustomization.yaml
+++ b/argocd/bootstrap/kustomization.yaml
@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - 00-railiance-bootstrap-project.yaml
+  - 01-railiance-tenants-project.yaml
+  - 10-railiance-apps-root.application.yaml
+
--- a/argocd/repositories/README.md
+++ b/argocd/repositories/README.md
@ -0,0 +1,23 @@
+# ArgoCD Repository Registration
+
+ArgoCD discovers Git repositories from Kubernetes Secrets in the `argocd`
+namespace with `argocd.argoproj.io/secret-type: repository`.
+
+Use the templates in this directory to create SOPS-encrypted, non-plaintext
+repository Secret files. Credentials must be sourced from the approved
+operator/OpenBao path and must never be committed in plaintext.
+
+Recommended OpenBao path:
+
+```text
+platform/operators/argocd/repositories/<repo-name>
+```
+
+After creating an encrypted file such as
+`argocd/repositories/railiance-platform.repository.sops.yaml`, apply it with:
+
+```bash
+ARGOCD_REPOSITORY_SECRET=argocd/repositories/railiance-platform.repository.sops.yaml \
+  make argocd-repo-apply
+```
+
--- a/argocd/repositories/issue-core.repository.sops.yaml.template
+++ b/argocd/repositories/issue-core.repository.sops.yaml.template
@ -0,0 +1,21 @@
+# Copy to issue-core.repository.sops.yaml, fill from the approved
+# operator/OpenBao path, then encrypt with:
+#   sops -e -i argocd/repositories/issue-core.repository.sops.yaml
+#
+# Do not commit plaintext credentials.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: issue-core-repository
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+stringData:
+  type: git
+  project: railiance-tenants
+  url: https://gitea.coulomb.social/coulomb/issue-core.git
+  username: CHANGE_ME
+  password: CHANGE_ME
+
--- a/argocd/repositories/railiance-platform.repository.sops.yaml.template
+++ b/argocd/repositories/railiance-platform.repository.sops.yaml.template
@ -0,0 +1,21 @@
+# Copy to railiance-platform.repository.sops.yaml, fill from the approved
+# operator/OpenBao path, then encrypt with:
+#   sops -e -i argocd/repositories/railiance-platform.repository.sops.yaml
+#
+# Do not commit plaintext credentials.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: railiance-platform-repository
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+stringData:
+  type: git
+  project: railiance-bootstrap
+  url: https://gitea.coulomb.social/coulomb/railiance-platform.git
+  username: CHANGE_ME
+  password: CHANGE_ME
+