coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Declare railiance01 ArgoCD bootstrap on its own path, automated sync off (RPF-WP-0044-T01).

Browse source 
Founder's Option A: argocd/railiance01/bootstrap (3 AppProjects, root with no
automated block, tenants whitelist + postgresql.cnpg.io/Cluster), root path
argocd/railiance01/applications (README placeholder, renders zero children),
pinned child drafts in argocd/railiance01/drafts (issue-core repointed to
rapp-issue-core manifests), rapp-issue-core repository template; issue-core
template marked obsolete. argocd/bootstrap and argocd/applications untouched
(coulombcore). Nothing applied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
codex 2026-09-21 19:04:15 +02:00
parent 538a3087fe
commit c3ebd6dddc
12 changed files with 322 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
argocd/railiance01/applications/README.md Normal file
View file

@ -0,0 +1,14 @@
# railiance01 child Applications
Synced by `railiance-apps-root` on railiance01 (declared in
`argocd/railiance01/bootstrap/`), by hand only until RPF-WP-0044-T07.
This file is a placeholder: git does not keep an empty directory, and a
missing path is a `ComparisonError` in ArgoCD. ArgoCD's directory source reads
only `*.yaml`, `*.yml` and `*.json`, so this README renders to zero children.
Add a child Application here only as part of its RPF-WP-0044 adoption task,
with the founder's go-ahead: no `automated` block, no finalizer, and a pinned
`targetRevision`. A merge here plus a hand sync of the root is a live
production change on railiance01. Drafts wait in `../drafts/`, which no root
syncs.

22
argocd/railiance01/bootstrap/00-railiance-bootstrap-project.yaml Normal file
View file

@ -0,0 +1,22 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: railiance-bootstrap
namespace: argocd
labels:
app.kubernetes.io/part-of: railiance-gitops
railiance-platform/component: gitops
spec:
description: Platform-owned ArgoCD bootstrap project for Railiance app-of-apps.
sourceRepos:
- https://forgejo.coulomb.social/coulomb/railiance-platform.git
destinations:
- server: https://kubernetes.default.svc
namespace: argocd
clusterResourceWhitelist: []
namespaceResourceWhitelist:
- group: argoproj.io
kind: Application
orphanedResources:
warn: true

56
argocd/railiance01/bootstrap/01-railiance-tenants-project.yaml Normal file
View file

@ -0,0 +1,56 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: railiance-tenants
namespace: argocd
labels:
app.kubernetes.io/part-of: railiance-gitops
railiance-platform/component: gitops
spec:
description: Guardrails for Railiance tenant applications deployed by ArgoCD.
sourceRepos:
- https://forgejo.coulomb.social/coulomb/*.git
# Emergency rollback only (T12 Option A through 2026-08-07)
- https://gitea.coulomb.social/coulomb/*.git
destinations:
- server: https://kubernetes.default.svc
namespace: "*"
clusterResourceWhitelist:
- group: ""
kind: Namespace
namespaceResourceWhitelist:
- group: ""
kind: ConfigMap
- group: ""
kind: PersistentVolumeClaim
- group: ""
kind: Secret
- group: ""
kind: Service
- group: ""
kind: ServiceAccount
- group: apps
kind: Deployment
- group: apps
kind: StatefulSet
- group: autoscaling
kind: HorizontalPodAutoscaler
- group: batch
kind: CronJob
- group: batch
kind: Job
- group: external-secrets.io
kind: ExternalSecret
- group: postgresql.cnpg.io
kind: Cluster
- group: networking.k8s.io
kind: Ingress
- group: networking.k8s.io
kind: NetworkPolicy
- group: traefik.io
kind: IngressRoute
- group: traefik.io
kind: Middleware
orphanedResources:
warn: true

48
argocd/railiance01/bootstrap/02-railiance-platform-addons-project.yaml Normal file
View file

@ -0,0 +1,48 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
name: railiance-platform-addons
namespace: argocd
labels:
app.kubernetes.io/part-of: railiance-gitops
railiance-platform/component: gitops
spec:
description: Platform-owned cluster add-ons required by tenant workloads.
sourceRepos:
- https://forgejo.coulomb.social/coulomb/railiance-platform.git
- https://charts.external-secrets.io
destinations:
- server: https://kubernetes.default.svc
namespace: "*"
clusterResourceWhitelist:
- group: ""
kind: Namespace
- group: apiextensions.k8s.io
kind: CustomResourceDefinition
- group: admissionregistration.k8s.io
kind: MutatingWebhookConfiguration
- group: admissionregistration.k8s.io
kind: ValidatingWebhookConfiguration
- group: rbac.authorization.k8s.io
kind: ClusterRole
- group: rbac.authorization.k8s.io
kind: ClusterRoleBinding
- group: external-secrets.io
kind: ClusterSecretStore
namespaceResourceWhitelist:
- group: ""
kind: ConfigMap
- group: ""
kind: Secret
- group: ""
kind: Service
- group: ""
kind: ServiceAccount
- group: apps
kind: Deployment
- group: rbac.authorization.k8s.io
kind: Role
- group: rbac.authorization.k8s.io
kind: RoleBinding
orphanedResources:
warn: true

27
argocd/railiance01/bootstrap/10-railiance-apps-root.application.yaml Normal file
View file

@ -0,0 +1,27 @@
# railiance01 root app (RPF-WP-0044, founder's Option A, 2026-09-21).
# No `automated` block: the root syncs only when synced by hand, with the
# revision pinned in the sync operation. T07 restores automated sync after
# T03-T06 are proven. coulombcore keeps argocd/bootstrap -> argocd/applications
# until phase C; nothing here is read by coulombcore.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: railiance-apps-root
namespace: argocd
labels:
app.kubernetes.io/part-of: railiance-gitops
railiance-platform/component: gitops
spec:
project: railiance-bootstrap
source:
repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
targetRevision: main
path: argocd/railiance01/applications
destination:
server: https://kubernetes.default.svc
namespace: argocd
syncPolicy:
syncOptions:
- CreateNamespace=false
- ApplyOutOfSyncOnly=true
- PruneLast=true

11
argocd/railiance01/bootstrap/kustomization.yaml Normal file
View file

@ -0,0 +1,11 @@
# railiance01 ArgoCD bootstrap, applied by hand (RPF-WP-0044-T02).
# Separate from argocd/bootstrap/, which is coulombcore's and stays unchanged
# until phase C. Do not point `make argocd-bootstrap-deploy` at the old path on
# railiance01: its root declares automated prune + self-heal.
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- 00-railiance-bootstrap-project.yaml
- 01-railiance-tenants-project.yaml
- 02-railiance-platform-addons-project.yaml
- 10-railiance-apps-root.application.yaml

35
argocd/railiance01/drafts/external-secrets.application.yaml Normal file
View file

@ -0,0 +1,35 @@
# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to
# ../applications/ only in this app's adoption task, with the founder's go-ahead.
# No automated sync, no finalizer. targetRevision: chart version; T06 adds CRD Prune=false,Delete=false before merge.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: external-secrets
namespace: argocd
labels:
app.kubernetes.io/part-of: railiance-gitops
railiance-platform/component: external-secrets
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: railiance-platform-addons
source:
repoURL: https://charts.external-secrets.io
chart: external-secrets
targetRevision: 0.16.1
helm:
releaseName: external-secrets
values: |
installCRDs: true
serviceAccount:
create: true
name: external-secrets
destination:
server: https://kubernetes.default.svc
namespace: external-secrets
syncPolicy:
syncOptions:
- CreateNamespace=true
- ServerSideApply=true
- ApplyOutOfSyncOnly=true
- PruneLast=true

27
argocd/railiance01/drafts/issue-core.application.yaml Normal file
View file

@ -0,0 +1,27 @@
# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to
# ../applications/ only in this app's adoption task, with the founder's go-ahead.
# No automated sync, no finalizer. targetRevision: rapp-issue-core commit diffed 2026-09-21.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: issue-core
namespace: argocd
labels:
app.kubernetes.io/part-of: railiance-gitops
railiance.io/domain: issue-core
annotations:
argocd.argoproj.io/sync-wave: "10"
spec:
project: railiance-tenants
source:
repoURL: https://forgejo.coulomb.social/coulomb/rapp-issue-core.git
targetRevision: a78f38cfd8afb29ed23d150a4ea3e3dcd1f35381
path: manifests
destination:
server: https://kubernetes.default.svc
namespace: issue-core
syncPolicy:
syncOptions:
- CreateNamespace=true
- ApplyOutOfSyncOnly=true
- PruneLast=true

27
argocd/railiance01/drafts/openbao-secretstore.application.yaml Normal file
View file

@ -0,0 +1,27 @@
# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to
# ../applications/ only in this app's adoption task, with the founder's go-ahead.
# No automated sync, no finalizer. targetRevision: railiance-platform commit, last to touch argocd/platform-addons/openbao-secretstore.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: openbao-secretstore
namespace: argocd
labels:
app.kubernetes.io/part-of: railiance-gitops
railiance-platform/component: external-secrets
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: railiance-platform-addons
source:
repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
targetRevision: d2dbc19c254247652c49fda8721c80d53bca206a
path: argocd/platform-addons/openbao-secretstore
destination:
server: https://kubernetes.default.svc
namespace: external-secrets
syncPolicy:
syncOptions:
- CreateNamespace=true
- ApplyOutOfSyncOnly=true
- PruneLast=true

29
argocd/railiance01/drafts/target-revenue.application.yaml Normal file
View file

@ -0,0 +1,29 @@
# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to
# ../applications/ only in this app's adoption task, with the founder's go-ahead.
# No automated sync, no finalizer. targetRevision: target-revenue commit diffed 2026-09-21.
# Target Revenue Trust Service + Control Plane (WP-0011).
# Source of truth: coulomb/target-revenue k8s/railiance (issue-core pattern).
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: target-revenue
namespace: argocd
labels:
app.kubernetes.io/part-of: railiance-gitops
railiance.io/domain: target-revenue
annotations:
argocd.argoproj.io/sync-wave: "10"
spec:
project: railiance-tenants
source:
repoURL: https://forgejo.coulomb.social/coulomb/target-revenue.git
targetRevision: f1109d54eeda9f187daa215cf1c7163610d35d0a
path: k8s/railiance
destination:
server: https://kubernetes.default.svc
namespace: target-revenue
syncPolicy:
syncOptions:
- CreateNamespace=true
- ApplyOutOfSyncOnly=true
- PruneLast=true

4
argocd/repositories/issue-core.repository.sops.yaml.template
View file

@ -1,3 +1,7 @@
# OBSOLETE (RPF-WP-0044, 2026-09-21): issue-core.git is public and no longer
# the deploy source (runtime moved to rapp-issue-core, issue-core 51440da).
# Use rapp-issue-core.repository.sops.yaml.template. Do not instantiate.
#
# Copy to issue-core.repository.sops.yaml, fill from the approved
# operator/OpenBao path, then encrypt with:
# sops -e -i argocd/repositories/issue-core.repository.sops.yaml

22
argocd/repositories/rapp-issue-core.repository.sops.yaml.template Normal file
View file

@ -0,0 +1,22 @@
# Copy to rapp-issue-core.repository.sops.yaml, fill from the approved
# OpenBao path platform/operators/argocd/repositories/rapp-issue-core
# (read-only deploy token, via its CCR; RPF-WP-0044-T04), then encrypt with:
# sops -e -i argocd/repositories/rapp-issue-core.repository.sops.yaml
#
# Do not commit plaintext credentials.
apiVersion: v1
kind: Secret
metadata:
name: rapp-issue-core-repository
namespace: argocd
labels:
argocd.argoproj.io/secret-type: repository
app.kubernetes.io/part-of: railiance-gitops
railiance-platform/component: gitops
stringData:
type: git
project: railiance-tenants
url: https://forgejo.coulomb.social/coulomb/rapp-issue-core.git
username: CHANGE_ME
password: CHANGE_ME