coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Land RPF-WP-0039 third apps-pg consumer source.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Admit vergabe_demo_company as the third declared consumer, track
the bounded provisioner and scoped controls, and refresh admission
occupancy to 3/3. Overflow remains apps-pg-2 before any fourth.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
This commit is contained in:
codex 2026-09-15 01:29:38 +02:00
parent 0178ec3c6d
commit f05ef49c69
18 changed files with 446 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

24
docs/apps-pg.md
View file

@ -23,7 +23,8 @@ it as a consumer credential.
**Two reachable clusters each carry a CNPG `Cluster` named `apps-pg` in a
namespace named `databases`.** The one this document describes is
**railiance01** (k3s v1.35.1) — it also carries `platform-pg` and `forgejo-db`,
and holds both apps-pg consumers (`vergabe_db`, `coulomb_social_db`). The other
and holds the three apps-pg consumers (`vergabe_db`, `coulomb_social_db`,
`vergabe_demo_company`). The other
cluster carries `gitea-db` and only one apps-pg consumer.
Selecting the right one by kubeconfig filename is not safe: `KUBECONFIG` is an
@ -115,6 +116,7 @@ the standard PostgreSQL, instance manager, and metrics ports.
| --- | --- | --- | --- | --- |
| vergabe-teilnahme | `vergabe` | `vergabe_db` | `vergabe-app-credentials` | `vergabe-teilnahme` |
| coulomb-social | `coulomb_social` | `coulomb_social_db` | `coulomb-social-app-credentials` | `coulomb-social` |
| vergabe-demo-company | `vergabe_demo_company` | `vergabe_demo_company` | `vergabe-demo-company-credentials` | `vergabe-demo-company` |
Bootstrapped 2026-08-09 on railiance01: cluster healthy; both Database CRs
applied; coulomb-social connectivity smoke from labeled consumer ns OK.
@ -152,3 +154,23 @@ labor, allocation drivers) is published under
isolation evidence captured on 2026-08-20 is in
`docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md` and
`docs/evidence/RPF-WP-0019-isolation-2026-08-20.md`.
## Fresh Vergabe demo consumer — 2026-09-12
RPF-WP-0039 admits the third consumer, vergabe_demo_company, in namespace
vergabe-demo-company. Database and role both use that name; the provider Secret
is databases/vergabe-demo-company-credentials and the exact consumer runtime
bundle is vergabe-demo-company/vergabe-demo-env. The existing vergabe_db remains
separate. No bootstrap or other consumer credentials are reused.
`tools/provision-vergabe-demo.py inspect` returns metadata only. The dry-run/apply
modes require the observed cluster resourceVersion, append only the fixed third
role, and refuse conflicting existing state. Credentials are generated in memory
and delivered through captured child stdin/stdout, never arguments or files.
This is the documented interim platform-administered Kubernetes/CNPG custody
lane; it does not claim OpenBao lifecycle automation. Source declarations are
helm/vergabe-demo-company-{role,database}.yaml; scoped role/database controls are
helm/vergabe-demo-company-controls.sql. Do not apply historical consumer SQL to
accomplish this onboarding. See RAPPS-WP-0014 for live deployment and remaining
coherent recovery acceptance. The declared cell is now full at three consumers.