diff --git a/docs/drafts/policy-nexus-application.yaml b/docs/drafts/policy-nexus-application.yaml new file mode 100644 index 0000000..bb22cf9 --- /dev/null +++ b/docs/drafts/policy-nexus-application.yaml @@ -0,0 +1,38 @@ +# DRAFT for RPF-WP-0043-T03. Not applied. Not synced. +# Do not copy this file under argocd/applications/ or +# argocd/railiance01/applications/. No root reads docs/drafts/. +# Accepts rapp-policy-nexus reply 41678d1f (2026-10-03). Not a new placement. +# No automated sync. No finalizers. +# Both targetRevision values are placeholders. They must be filled from the +# attended read-only helm history / kubectl diff. This session did not read +# or change the cluster. +# The railiance-apps values path is still owed by that repo. Do not invent it. +# The private-repository ArgoCD credential is a separate CCR and is not here. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: policy-nexus + namespace: argocd + labels: + app.kubernetes.io/part-of: railiance-gitops +spec: + project: railiance-tenants + sources: + - repoURL: https://forgejo.coulomb.social/coulomb/rapp-policy-nexus.git + targetRevision: "" # must be filled from the attended read + path: helm/policy-nexus + helm: + releaseName: policy-nexus + valueFiles: + - $values/ + - repoURL: https://forgejo.coulomb.social/coulomb/railiance-apps.git + targetRevision: "" # must be filled from the attended read + ref: values + destination: + server: https://kubernetes.default.svc + namespace: policy-nexus + syncPolicy: + syncOptions: + - CreateNamespace=false + - ApplyOutOfSyncOnly=true + - PruneLast=true diff --git a/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md b/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md index ff0e2f2..cd4e035 100644 --- a/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md +++ b/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md @@ -9,7 +9,7 @@ flavor: planning owner: railiance-platform topic_slug: railiance created: "2026-09-21" -updated: "2026-10-03" +updated: "2026-10-05" due: "2026-12-21" related: [RPF-WP-0022] state_hub_workstream_id: "ec41a4bd-df18-5b07-9b63-ccb80d9f001c" @@ -71,7 +71,7 @@ ArgoCD install belongs to the cluster layer and needs its own go-ahead. ```task id: RPF-WP-0043-T02 -status: todo +status: done priority: high state_hub_task_id: "49143c5e-a455-526e-a26f-403dc2fb075a" ``` @@ -116,46 +116,40 @@ credential through its own CCR; `make deploy`/`make rollback` stop being production paths after adoption. The whole-workplan `depends_on` was removed because it made the wait circular. Next act is railiance-platform's: confirm the shape back to rapp-policy-nexus and draft the Application. + +2026-10-05: railiance-platform confirms that shape. This is acceptance of the +tenant's answer, not a new placement decision. + +- Chart `helm/policy-nexus`, pinned to a tag or commit. No `k8s/railiance/` copy. +- Values stay owned by railiance-apps. The Application is multi-source and + named `policy-nexus`. +- The repository is private. The ArgoCD repository credential is a separate CCR. +- After adoption, `make deploy` and `make rollback` stop being production paths. + +The draft is `docs/drafts/policy-nexus-application.yaml`. Its pinned revisions +are placeholders and must be filled from the attended read. + ## Prepare the Application and the dry-run evidence ```task id: RPF-WP-0043-T03 status: wait -depends_on: [RPF-WP-0043-T02] -blocking_reason: "Draft the Application only after the tenant decision in T02." +needs_human: true +decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e +blocking_reason: "Draft is prepared. The attended read-only helm history / kubectl diff remains. This session did not touch the cluster." priority: high state_hub_task_id: "2afb1aac-66dd-5e1e-92e1-fc020a59a927" ``` -Draft the Application in this workplan or in a review branch, **not** under -`argocd/applications/` on `main`. Draft shape for adoption: - -```yaml -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: policy-nexus # no finalizers: deletion must not cascade - namespace: argocd - labels: - app.kubernetes.io/part-of: railiance-gitops -spec: - project: railiance-tenants - source: - repoURL: https://forgejo.coulomb.social/coulomb/rapp-policy-nexus.git - targetRevision: - path: helm/policy-nexus - helm: - releaseName: policy-nexus - valueFiles: [] - destination: - server: https://kubernetes.default.svc - namespace: policy-nexus - syncPolicy: # adoption stage: no `automated` block - syncOptions: - - CreateNamespace=false - - ApplyOutOfSyncOnly=true - - PruneLast=true -``` +Draft the Application under `docs/`, **not** under `argocd/applications/` on +`main`. The single-source sketch is superseded by the tenant's multi-source +shape. The draft is `docs/drafts/policy-nexus-application.yaml`: chart +`helm/policy-nexus` from rapp-policy-nexus, railiance-apps values as the second +source, `helm.releaseName: policy-nexus`, no `automated` block, no finalizers. +Pinned revisions are placeholders. They must be filled from the attended read. +The railiance-apps values path is still that owner's; the draft does not invent +it. Decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is still open and is not +resolved here. Read-only evidence to collect before T04, in an attended session: @@ -254,3 +248,7 @@ the inventory. ## Loose-end review — 2026-09-27 The workplan is blocked on the source-owner agreement and its downstream adoption gates. RAPP-POLICY-NEXUS-WP-0002 proposes a multi-source Application: chart in rapp-policy-nexus and release values in railiance-apps. This supersedes the earlier platform-only suggestion to put production values in the package repository. The platform accepts that shape and the helm/policy-nexus path exception in principle; it still needs railiance-apps acceptance, an actual committed values path/revision, source access and a zero-diff render before T02/T03 can close. No owner acceptance or cross-repository change is inferred. T01 remains proven by current railiance01 Synced/Healthy evidence. + +## Confirmation — 2026-10-05 + +T02 is done. Platform accepts rapp-policy-nexus reply `41678d1f`. That is not a new placement decision. T03 stays `wait`: the draft is prepared at `docs/drafts/policy-nexus-application.yaml`, and the attended read-only helm history / kubectl diff remains. This session did not touch the cluster. T04 stays `wait`. The workplan stays blocked. Decision `89f1058f-33bc-47a8-8a49-0b44d426c67e` is still open and was not resolved.