Close RAILIANCE-WP-0015-T02 platform rapp schema convergence
Converge the S3 platform-service pattern onto ADR-0007, emit the reef-railiance live deployable inventory for the family coverage check, and mark T02 done. Declaration edits land in rapp-openbao and rapp-postgres.
This commit is contained in:
codex
parent
deabcde73c
commit
ccb5972b42
5 changed files with 430 additions and 20 deletions
222
docs/evidence/reef-railiance-deployables.json
Normal file
222
docs/evidence/reef-railiance-deployables.json
Normal file
|
|
@ -0,0 +1,222 @@
|
|||
{
|
||||
"source": "railiance-platform",
|
||||
"captured_at": "2026-08-13T22:37:46Z",
|
||||
"reef": "reef-railiance",
|
||||
"deployables": [
|
||||
{
|
||||
"name": "actcore-api",
|
||||
"namespace": "activity-core",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "actcore-app-db",
|
||||
"namespace": "activity-core",
|
||||
"kind": "StatefulSet"
|
||||
},
|
||||
{
|
||||
"name": "actcore-event-router",
|
||||
"namespace": "activity-core",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "actcore-issue-core-bridge",
|
||||
"namespace": "activity-core",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "actcore-nats",
|
||||
"namespace": "activity-core",
|
||||
"kind": "StatefulSet"
|
||||
},
|
||||
{
|
||||
"name": "actcore-statehub-edge-relay",
|
||||
"namespace": "activity-core",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "actcore-temporal",
|
||||
"namespace": "activity-core",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "actcore-temporal-db",
|
||||
"namespace": "activity-core",
|
||||
"kind": "StatefulSet"
|
||||
},
|
||||
{
|
||||
"name": "actcore-temporal-ui",
|
||||
"namespace": "activity-core",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "actcore-worker",
|
||||
"namespace": "activity-core",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "llm-connect",
|
||||
"namespace": "activity-core",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "audit-core",
|
||||
"namespace": "audit-core",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "ihp-railiance-probe",
|
||||
"namespace": "coulomb",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "coulomb-social",
|
||||
"namespace": "coulomb-social",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "apps-pg",
|
||||
"namespace": "databases",
|
||||
"kind": "Cluster"
|
||||
},
|
||||
{
|
||||
"name": "forgejo-db",
|
||||
"namespace": "databases",
|
||||
"kind": "Cluster"
|
||||
},
|
||||
{
|
||||
"name": "net-kingdom-pg",
|
||||
"namespace": "databases",
|
||||
"kind": "Cluster"
|
||||
},
|
||||
{
|
||||
"name": "platform-pg",
|
||||
"namespace": "databases",
|
||||
"kind": "Cluster"
|
||||
},
|
||||
{
|
||||
"name": "state-hub-db",
|
||||
"namespace": "databases",
|
||||
"kind": "Cluster"
|
||||
},
|
||||
{
|
||||
"name": "email-connect",
|
||||
"namespace": "email-connect",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "flex-auth-tenant-engine",
|
||||
"namespace": "flex-auth",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "flex-auth-user-engine",
|
||||
"namespace": "flex-auth",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "forgejo-gitea",
|
||||
"namespace": "forgejo",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "forgejo-runner",
|
||||
"namespace": "forgejo",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "inter-hub",
|
||||
"namespace": "inter-hub",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "privacyidea",
|
||||
"namespace": "mfa",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "openbao",
|
||||
"namespace": "openbao",
|
||||
"kind": "StatefulSet"
|
||||
},
|
||||
{
|
||||
"name": "openbao-ui-gateway",
|
||||
"namespace": "openbao",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "rapp-qonto",
|
||||
"namespace": "rapp-qonto",
|
||||
"kind": "KnativeService"
|
||||
},
|
||||
{
|
||||
"name": "qonto-egress-proxy",
|
||||
"namespace": "rapp-qonto-egress",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "rein-aharness",
|
||||
"namespace": "rein-aharness",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "reuse-surface",
|
||||
"namespace": "reuse",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "reuse-surface-landing",
|
||||
"namespace": "reuse",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "authelia",
|
||||
"namespace": "sso",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "identity-provisioner",
|
||||
"namespace": "sso",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "keycape",
|
||||
"namespace": "sso",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "lldap",
|
||||
"namespace": "sso",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "state-hub",
|
||||
"namespace": "state-hub",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "target-revenue",
|
||||
"namespace": "target-revenue",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "target-revenue-pg",
|
||||
"namespace": "target-revenue",
|
||||
"kind": "Cluster"
|
||||
},
|
||||
{
|
||||
"name": "tenant-engine",
|
||||
"namespace": "tenant-engine",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "user-engine",
|
||||
"namespace": "user-engine",
|
||||
"kind": "Deployment"
|
||||
},
|
||||
{
|
||||
"name": "user-engine-pg",
|
||||
"namespace": "user-engine",
|
||||
"kind": "Cluster"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -70,10 +70,9 @@ applies decides it.
|
|||
|
||||
## Reference `rapp.yaml` for a platform service
|
||||
|
||||
Pending the normative schema from `railiance-master`, a platform-service rapp
|
||||
should carry at least the following. Fields marked † are the consistency fields
|
||||
currently present in `rail.yaml` and `rapp-qonto` but missing from both platform
|
||||
rapps; `RAILIANCE-WP-0015-T02` adds them once the schema settles.
|
||||
The normative shape is `railiance-master/schemas/rapp.schema.json` (ADR-0007).
|
||||
A platform-service rapp fills that schema as follows. `RAILIANCE-WP-0015-T02`
|
||||
converged `rapp-openbao` and `rapp-postgres` onto this shape.
|
||||
|
||||
```yaml
|
||||
kind: managed-workload-package
|
||||
|
|
@ -81,10 +80,10 @@ repo_family: rapp
|
|||
rapp_id: rapp-<workload>
|
||||
repo: rapp-<workload>
|
||||
ownership_repo: railiance-platform # the S3 home retaining governance
|
||||
contract_version: 1.0.0 # †
|
||||
readiness_state: verified # †
|
||||
data_classification: <internal|restricted> # †
|
||||
criticality: <high|critical> # †
|
||||
contract_version: 1.0.0
|
||||
readiness_state: verified
|
||||
data_classification: <internal|restricted>
|
||||
criticality: <high|critical>
|
||||
workload_identity:
|
||||
name: <workload> # the workload, never the repo name
|
||||
package_type: helm-managed-platform-service
|
||||
|
|
@ -93,10 +92,27 @@ workload_identity:
|
|||
app_version: <pinned>
|
||||
primary_rail: rail-kubernetes
|
||||
supported_rails: [rail-kubernetes]
|
||||
runtime_dependencies: [...] # what must exist for this to run
|
||||
rollout_contract: {...}
|
||||
smoke_contract: {...}
|
||||
rollback_contract: {...}
|
||||
bound_reefs: [reef-railiance] # empty only if the package is not placed
|
||||
runtime_dependencies: [...] # capabilities, not the resource that satisfies them
|
||||
composition:
|
||||
purpose: <what this coherent workload does>
|
||||
member_repos:
|
||||
- repo: rapp-<workload> # single-repo rapp: one member, itself
|
||||
role: <what it contributes>
|
||||
deployables: [<running unit names>]
|
||||
upstream_components:
|
||||
- name: <chart|image>
|
||||
source: <repo/chart or registry ref>
|
||||
version: <exact pin>
|
||||
rollout_contract:
|
||||
default_mode: <helm-upgrade-install|kubectl-server-side-apply>
|
||||
commands: [...] # renamed from supported_commands
|
||||
smoke_contract:
|
||||
required: [...] # outcomes the commands establish
|
||||
commands: [...]
|
||||
rollback_contract:
|
||||
order: [...] # most-preferred strategy first
|
||||
commands: [...]
|
||||
source_documents: [...]
|
||||
```
|
||||
|
||||
|
|
@ -147,7 +163,7 @@ its rollout. That distinction is what makes the coverage check well-defined:
|
|||
|
||||
A rapp declares what it combines: first-party repos and pinned third-party
|
||||
components, plus the purpose the combination serves. The normative shape is
|
||||
`railiance-master`'s to settle; the proposed form is:
|
||||
`railiance-master/schemas/rapp.schema.json`; the form is:
|
||||
|
||||
```yaml
|
||||
composition:
|
||||
|
|
@ -187,6 +203,20 @@ The existing rule holds without exception: the package never commits
|
|||
credentials, and a workload receives a short-lived lease through the platform
|
||||
broker rather than a package-managed secret.
|
||||
|
||||
## Live deployable inventory
|
||||
|
||||
`railiance-master` coverage check (`tools/validate-family-declarations.py
|
||||
--inventory`) must not query the cluster. S3 emits the interchange file:
|
||||
|
||||
```text
|
||||
docs/evidence/reef-railiance-deployables.json
|
||||
```
|
||||
|
||||
Refresh with `scripts/capture-reef-deployables.py -o docs/evidence/reef-railiance-deployables.json`.
|
||||
The file lists non-substrate Deployments, StatefulSets, CNPG Clusters, and
|
||||
Knative Services on `reef-railiance`. Declared `composition.member_repos.deployables`
|
||||
names must match these live names.
|
||||
|
||||
## When a platform service earns a rapp
|
||||
|
||||
Not every S3 service needs one. A platform service is ready for extraction when
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue