From c3ebd6dddc830373c75144da178f829b47c3e5de Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 21 Sep 2026 19:04:15 +0200 Subject: [PATCH] Declare railiance01 ArgoCD bootstrap on its own path, automated sync off (RPF-WP-0044-T01). Founder's Option A: argocd/railiance01/bootstrap (3 AppProjects, root with no automated block, tenants whitelist + postgresql.cnpg.io/Cluster), root path argocd/railiance01/applications (README placeholder, renders zero children), pinned child drafts in argocd/railiance01/drafts (issue-core repointed to rapp-issue-core manifests), rapp-issue-core repository template; issue-core template marked obsolete. argocd/bootstrap and argocd/applications untouched (coulombcore). Nothing applied. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703 --- argocd/railiance01/applications/README.md | 14 +++++ .../00-railiance-bootstrap-project.yaml | 22 ++++++++ .../01-railiance-tenants-project.yaml | 56 +++++++++++++++++++ .../02-railiance-platform-addons-project.yaml | 48 ++++++++++++++++ .../10-railiance-apps-root.application.yaml | 27 +++++++++ .../railiance01/bootstrap/kustomization.yaml | 11 ++++ .../drafts/external-secrets.application.yaml | 35 ++++++++++++ .../drafts/issue-core.application.yaml | 27 +++++++++ .../openbao-secretstore.application.yaml | 27 +++++++++ .../drafts/target-revenue.application.yaml | 29 ++++++++++ .../issue-core.repository.sops.yaml.template | 4 ++ ...p-issue-core.repository.sops.yaml.template | 22 ++++++++ 12 files changed, 322 insertions(+) create mode 100644 argocd/railiance01/applications/README.md create mode 100644 argocd/railiance01/bootstrap/00-railiance-bootstrap-project.yaml create mode 100644 argocd/railiance01/bootstrap/01-railiance-tenants-project.yaml create mode 100644 argocd/railiance01/bootstrap/02-railiance-platform-addons-project.yaml create mode 100644 argocd/railiance01/bootstrap/10-railiance-apps-root.application.yaml create mode 100644 argocd/railiance01/bootstrap/kustomization.yaml create mode 100644 argocd/railiance01/drafts/external-secrets.application.yaml create mode 100644 argocd/railiance01/drafts/issue-core.application.yaml create mode 100644 argocd/railiance01/drafts/openbao-secretstore.application.yaml create mode 100644 argocd/railiance01/drafts/target-revenue.application.yaml create mode 100644 argocd/repositories/rapp-issue-core.repository.sops.yaml.template diff --git a/argocd/railiance01/applications/README.md b/argocd/railiance01/applications/README.md new file mode 100644 index 0000000..903e353 --- /dev/null +++ b/argocd/railiance01/applications/README.md @@ -0,0 +1,14 @@ +# railiance01 child Applications + +Synced by `railiance-apps-root` on railiance01 (declared in +`argocd/railiance01/bootstrap/`), by hand only until RPF-WP-0044-T07. + +This file is a placeholder: git does not keep an empty directory, and a +missing path is a `ComparisonError` in ArgoCD. ArgoCD's directory source reads +only `*.yaml`, `*.yml` and `*.json`, so this README renders to zero children. + +Add a child Application here only as part of its RPF-WP-0044 adoption task, +with the founder's go-ahead: no `automated` block, no finalizer, and a pinned +`targetRevision`. A merge here plus a hand sync of the root is a live +production change on railiance01. Drafts wait in `../drafts/`, which no root +syncs. diff --git a/argocd/railiance01/bootstrap/00-railiance-bootstrap-project.yaml b/argocd/railiance01/bootstrap/00-railiance-bootstrap-project.yaml new file mode 100644 index 0000000..4192ec9 --- /dev/null +++ b/argocd/railiance01/bootstrap/00-railiance-bootstrap-project.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: railiance-bootstrap + namespace: argocd + labels: + app.kubernetes.io/part-of: railiance-gitops + railiance-platform/component: gitops +spec: + description: Platform-owned ArgoCD bootstrap project for Railiance app-of-apps. + sourceRepos: + - https://forgejo.coulomb.social/coulomb/railiance-platform.git + destinations: + - server: https://kubernetes.default.svc + namespace: argocd + clusterResourceWhitelist: [] + namespaceResourceWhitelist: + - group: argoproj.io + kind: Application + orphanedResources: + warn: true + diff --git a/argocd/railiance01/bootstrap/01-railiance-tenants-project.yaml b/argocd/railiance01/bootstrap/01-railiance-tenants-project.yaml new file mode 100644 index 0000000..3aadff6 --- /dev/null +++ b/argocd/railiance01/bootstrap/01-railiance-tenants-project.yaml @@ -0,0 +1,56 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: railiance-tenants + namespace: argocd + labels: + app.kubernetes.io/part-of: railiance-gitops + railiance-platform/component: gitops +spec: + description: Guardrails for Railiance tenant applications deployed by ArgoCD. + sourceRepos: + - https://forgejo.coulomb.social/coulomb/*.git + # Emergency rollback only (T12 Option A through 2026-08-07) + - https://gitea.coulomb.social/coulomb/*.git + destinations: + - server: https://kubernetes.default.svc + namespace: "*" + clusterResourceWhitelist: + - group: "" + kind: Namespace + namespaceResourceWhitelist: + - group: "" + kind: ConfigMap + - group: "" + kind: PersistentVolumeClaim + - group: "" + kind: Secret + - group: "" + kind: Service + - group: "" + kind: ServiceAccount + - group: apps + kind: Deployment + - group: apps + kind: StatefulSet + - group: autoscaling + kind: HorizontalPodAutoscaler + - group: batch + kind: CronJob + - group: batch + kind: Job + - group: external-secrets.io + kind: ExternalSecret + - group: postgresql.cnpg.io + kind: Cluster + - group: networking.k8s.io + kind: Ingress + - group: networking.k8s.io + kind: NetworkPolicy + - group: traefik.io + kind: IngressRoute + - group: traefik.io + kind: Middleware + orphanedResources: + warn: true + diff --git a/argocd/railiance01/bootstrap/02-railiance-platform-addons-project.yaml b/argocd/railiance01/bootstrap/02-railiance-platform-addons-project.yaml new file mode 100644 index 0000000..182b110 --- /dev/null +++ b/argocd/railiance01/bootstrap/02-railiance-platform-addons-project.yaml @@ -0,0 +1,48 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: railiance-platform-addons + namespace: argocd + labels: + app.kubernetes.io/part-of: railiance-gitops + railiance-platform/component: gitops +spec: + description: Platform-owned cluster add-ons required by tenant workloads. + sourceRepos: + - https://forgejo.coulomb.social/coulomb/railiance-platform.git + - https://charts.external-secrets.io + destinations: + - server: https://kubernetes.default.svc + namespace: "*" + clusterResourceWhitelist: + - group: "" + kind: Namespace + - group: apiextensions.k8s.io + kind: CustomResourceDefinition + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + - group: rbac.authorization.k8s.io + kind: ClusterRole + - group: rbac.authorization.k8s.io + kind: ClusterRoleBinding + - group: external-secrets.io + kind: ClusterSecretStore + namespaceResourceWhitelist: + - group: "" + kind: ConfigMap + - group: "" + kind: Secret + - group: "" + kind: Service + - group: "" + kind: ServiceAccount + - group: apps + kind: Deployment + - group: rbac.authorization.k8s.io + kind: Role + - group: rbac.authorization.k8s.io + kind: RoleBinding + orphanedResources: + warn: true diff --git a/argocd/railiance01/bootstrap/10-railiance-apps-root.application.yaml b/argocd/railiance01/bootstrap/10-railiance-apps-root.application.yaml new file mode 100644 index 0000000..b8a5a48 --- /dev/null +++ b/argocd/railiance01/bootstrap/10-railiance-apps-root.application.yaml @@ -0,0 +1,27 @@ +# railiance01 root app (RPF-WP-0044, founder's Option A, 2026-09-21). +# No `automated` block: the root syncs only when synced by hand, with the +# revision pinned in the sync operation. T07 restores automated sync after +# T03-T06 are proven. coulombcore keeps argocd/bootstrap -> argocd/applications +# until phase C; nothing here is read by coulombcore. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: railiance-apps-root + namespace: argocd + labels: + app.kubernetes.io/part-of: railiance-gitops + railiance-platform/component: gitops +spec: + project: railiance-bootstrap + source: + repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git + targetRevision: main + path: argocd/railiance01/applications + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + syncOptions: + - CreateNamespace=false + - ApplyOutOfSyncOnly=true + - PruneLast=true diff --git a/argocd/railiance01/bootstrap/kustomization.yaml b/argocd/railiance01/bootstrap/kustomization.yaml new file mode 100644 index 0000000..9e7963c --- /dev/null +++ b/argocd/railiance01/bootstrap/kustomization.yaml @@ -0,0 +1,11 @@ +# railiance01 ArgoCD bootstrap, applied by hand (RPF-WP-0044-T02). +# Separate from argocd/bootstrap/, which is coulombcore's and stays unchanged +# until phase C. Do not point `make argocd-bootstrap-deploy` at the old path on +# railiance01: its root declares automated prune + self-heal. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - 00-railiance-bootstrap-project.yaml + - 01-railiance-tenants-project.yaml + - 02-railiance-platform-addons-project.yaml + - 10-railiance-apps-root.application.yaml diff --git a/argocd/railiance01/drafts/external-secrets.application.yaml b/argocd/railiance01/drafts/external-secrets.application.yaml new file mode 100644 index 0000000..347278d --- /dev/null +++ b/argocd/railiance01/drafts/external-secrets.application.yaml @@ -0,0 +1,35 @@ +# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to +# ../applications/ only in this app's adoption task, with the founder's go-ahead. +# No automated sync, no finalizer. targetRevision: chart version; T06 adds CRD Prune=false,Delete=false before merge. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets + namespace: argocd + labels: + app.kubernetes.io/part-of: railiance-gitops + railiance-platform/component: external-secrets + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + project: railiance-platform-addons + source: + repoURL: https://charts.external-secrets.io + chart: external-secrets + targetRevision: 0.16.1 + helm: + releaseName: external-secrets + values: | + installCRDs: true + serviceAccount: + create: true + name: external-secrets + destination: + server: https://kubernetes.default.svc + namespace: external-secrets + syncPolicy: + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + - ApplyOutOfSyncOnly=true + - PruneLast=true diff --git a/argocd/railiance01/drafts/issue-core.application.yaml b/argocd/railiance01/drafts/issue-core.application.yaml new file mode 100644 index 0000000..4d2a7c8 --- /dev/null +++ b/argocd/railiance01/drafts/issue-core.application.yaml @@ -0,0 +1,27 @@ +# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to +# ../applications/ only in this app's adoption task, with the founder's go-ahead. +# No automated sync, no finalizer. targetRevision: rapp-issue-core commit diffed 2026-09-21. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: issue-core + namespace: argocd + labels: + app.kubernetes.io/part-of: railiance-gitops + railiance.io/domain: issue-core + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + project: railiance-tenants + source: + repoURL: https://forgejo.coulomb.social/coulomb/rapp-issue-core.git + targetRevision: a78f38cfd8afb29ed23d150a4ea3e3dcd1f35381 + path: manifests + destination: + server: https://kubernetes.default.svc + namespace: issue-core + syncPolicy: + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - PruneLast=true diff --git a/argocd/railiance01/drafts/openbao-secretstore.application.yaml b/argocd/railiance01/drafts/openbao-secretstore.application.yaml new file mode 100644 index 0000000..b654bce --- /dev/null +++ b/argocd/railiance01/drafts/openbao-secretstore.application.yaml @@ -0,0 +1,27 @@ +# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to +# ../applications/ only in this app's adoption task, with the founder's go-ahead. +# No automated sync, no finalizer. targetRevision: railiance-platform commit, last to touch argocd/platform-addons/openbao-secretstore. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao-secretstore + namespace: argocd + labels: + app.kubernetes.io/part-of: railiance-gitops + railiance-platform/component: external-secrets + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + project: railiance-platform-addons + source: + repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git + targetRevision: d2dbc19c254247652c49fda8721c80d53bca206a + path: argocd/platform-addons/openbao-secretstore + destination: + server: https://kubernetes.default.svc + namespace: external-secrets + syncPolicy: + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - PruneLast=true diff --git a/argocd/railiance01/drafts/target-revenue.application.yaml b/argocd/railiance01/drafts/target-revenue.application.yaml new file mode 100644 index 0000000..1f1cdc9 --- /dev/null +++ b/argocd/railiance01/drafts/target-revenue.application.yaml @@ -0,0 +1,29 @@ +# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to +# ../applications/ only in this app's adoption task, with the founder's go-ahead. +# No automated sync, no finalizer. targetRevision: target-revenue commit diffed 2026-09-21. +# Target Revenue Trust Service + Control Plane (WP-0011). +# Source of truth: coulomb/target-revenue k8s/railiance (issue-core pattern). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: target-revenue + namespace: argocd + labels: + app.kubernetes.io/part-of: railiance-gitops + railiance.io/domain: target-revenue + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + project: railiance-tenants + source: + repoURL: https://forgejo.coulomb.social/coulomb/target-revenue.git + targetRevision: f1109d54eeda9f187daa215cf1c7163610d35d0a + path: k8s/railiance + destination: + server: https://kubernetes.default.svc + namespace: target-revenue + syncPolicy: + syncOptions: + - CreateNamespace=true + - ApplyOutOfSyncOnly=true + - PruneLast=true diff --git a/argocd/repositories/issue-core.repository.sops.yaml.template b/argocd/repositories/issue-core.repository.sops.yaml.template index 119e1a3..c57ee15 100644 --- a/argocd/repositories/issue-core.repository.sops.yaml.template +++ b/argocd/repositories/issue-core.repository.sops.yaml.template @@ -1,3 +1,7 @@ +# OBSOLETE (RPF-WP-0044, 2026-09-21): issue-core.git is public and no longer +# the deploy source (runtime moved to rapp-issue-core, issue-core 51440da). +# Use rapp-issue-core.repository.sops.yaml.template. Do not instantiate. +# # Copy to issue-core.repository.sops.yaml, fill from the approved # operator/OpenBao path, then encrypt with: # sops -e -i argocd/repositories/issue-core.repository.sops.yaml diff --git a/argocd/repositories/rapp-issue-core.repository.sops.yaml.template b/argocd/repositories/rapp-issue-core.repository.sops.yaml.template new file mode 100644 index 0000000..a7e3a4f --- /dev/null +++ b/argocd/repositories/rapp-issue-core.repository.sops.yaml.template @@ -0,0 +1,22 @@ +# Copy to rapp-issue-core.repository.sops.yaml, fill from the approved +# OpenBao path platform/operators/argocd/repositories/rapp-issue-core +# (read-only deploy token, via its CCR; RPF-WP-0044-T04), then encrypt with: +# sops -e -i argocd/repositories/rapp-issue-core.repository.sops.yaml +# +# Do not commit plaintext credentials. +apiVersion: v1 +kind: Secret +metadata: + name: rapp-issue-core-repository + namespace: argocd + labels: + argocd.argoproj.io/secret-type: repository + app.kubernetes.io/part-of: railiance-gitops + railiance-platform/component: gitops +stringData: + type: git + project: railiance-tenants + url: https://forgejo.coulomb.social/coulomb/rapp-issue-core.git + username: CHANGE_ME + password: CHANGE_ME +