Decide blueprint 5.6 (adopt ArgoCD) and plan phase B adoption on railiance01.
Records the founder's 2026-09-21 decision, read-only diff evidence for the four Applications, and RPF-WP-0044 (one founder go-ahead per app). Nothing applied. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
codex
parent
0b70765e0a
commit
f1e885aa9e
4 changed files with 398 additions and 24 deletions
|
|
@ -48,7 +48,9 @@ through git.
|
|||
What this means for platform review in this repository:
|
||||
|
||||
- A merge to `argocd/applications/` is a live production change. Once the
|
||||
commit is on `main`, `railiance-apps-root` syncs it with prune and self-heal.
|
||||
commit is on `main`, `railiance-apps-root` syncs it with prune and self-heal
|
||||
(today on coulombcore; on railiance01 only after RPF-WP-0044 applies the
|
||||
bootstrap).
|
||||
Treat the merge as the `APPROVED` gate, not as a draft.
|
||||
- A new Application for a workload that is already running is an **adoption**.
|
||||
Follow the adoption steps in `workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md`:
|
||||
|
|
@ -63,29 +65,23 @@ Application here. Until 2026-12-21 its changes keep `activation=APPROVED` by
|
|||
founder plan approval, and each one is recorded as production-tier.
|
||||
Onboarding is due by 2026-12-21 (RPF-WP-0043).
|
||||
|
||||
**Not verified: that ArgoCD syncs on railiance01.** This repository does not
|
||||
show it, and some records point the other way:
|
||||
**ArgoCD on railiance01: installed, not yet reconciling anything
|
||||
(2026-09-21).** The custodian's read-only check found no ArgoCD on
|
||||
railiance01 (namespace and CRDs NotFound; RPF-WP-0043-T01 evidence). The
|
||||
founder then decided ArchitectureBlueprint §5.6 as option 1, adopt properly,
|
||||
and Argo CD Core v3.5.3 was installed there (phase A). As of this record it
|
||||
has 0 AppProjects, 0 Applications and 0 repository Secrets: the bootstrap in
|
||||
`argocd/bootstrap/` is **not applied**, so `railiance-apps-root` does not yet
|
||||
sync anything on railiance01. The records calling the controller "coulombcore
|
||||
ArgoCD" were right about the past; coulombcore's ArgoCD still reads
|
||||
`argocd/applications/` until phase C retires it.
|
||||
|
||||
- The only record of ArgoCD's health is the RPF-WP-0022 inbox evidence from
|
||||
2026-06: "installed and healthy on `railiance01`", with zero Applications.
|
||||
That is from before the 2026-07-02 naming correction. Until then, "railiance01
|
||||
cluster" often meant coulombcore.
|
||||
- The later records in this file and in
|
||||
`argocd/platform-addons/openbao-secretstore/kustomization.yaml` name the
|
||||
ArgoCD that runs these Applications "coulombcore ArgoCD". They say the
|
||||
railiance01 stores are "not managed by coulombcore ArgoCD".
|
||||
- Every Application uses `destination.server: https://kubernetes.default.svc`,
|
||||
so it reconciles whichever cluster ArgoCD itself runs in.
|
||||
- No evidence file in this repository records a sync of `railiance-apps-root`
|
||||
on railiance01 (92.205.62.239).
|
||||
|
||||
Confirming it takes an attended **read-only** check against railiance01, not
|
||||
coulombcore: check the node IP, the `argocd` namespace, and the `railiance-apps-root`
|
||||
sync and health status, for example `make argocd-status` with a kubeconfig whose
|
||||
server is verified to be 92.205.62.239. Record the result as evidence. If ArgoCD
|
||||
is not running there, the production row has no working path on railiance01
|
||||
yet. Installing ArgoCD belongs to the cluster layer and needs its own go-ahead
|
||||
from the founder. This is RPF-WP-0043-T01.
|
||||
**Do not apply the bootstrap as committed.** The root app and all four
|
||||
children declare `automated` sync with prune and self-heal, so applying it
|
||||
would adopt all four live workloads at once. Phase B (`RPF-WP-0044`) first
|
||||
neutralises automated sync, then adopts one application at a time, each with
|
||||
its own founder go-ahead. Read-only diff evidence:
|
||||
`docs/evidence/argocd-phase-b-adoption-diff-2026-09-21.json`.
|
||||
|
||||
## Bootstrap Layout
|
||||
|
||||
|
|
|
|||
87
docs/evidence/argocd-phase-b-adoption-diff-2026-09-21.json
Normal file
87
docs/evidence/argocd-phase-b-adoption-diff-2026-09-21.json
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
{
|
||||
"record": "argocd-phase-b-adoption-diff",
|
||||
"date": "2026-09-21",
|
||||
"workplan": "RPF-WP-0044",
|
||||
"mode": "read-only",
|
||||
"evidence_boundary": "target-audited",
|
||||
"performed_by": "railiance-platform agent session (Claude Code), founder-authorised session",
|
||||
"cluster": {
|
||||
"node": "239.62.205.92.host.secureserver.net",
|
||||
"internal_ip": "92.205.62.239",
|
||||
"k3s": "v1.35.1+k3s1",
|
||||
"access": "ssh railiance01 'kubectl ...'; helm --kubeconfig /etc/rancher/k3s/k3s.yaml for get/history/list"
|
||||
},
|
||||
"commands_used": [
|
||||
"kubectl get / kubectl diff (client-side and --server-side dry run; nothing persisted)",
|
||||
"helm list -A -a, helm history, helm get values (user-supplied values only)",
|
||||
"local: helm template, kubectl kustomize, rapp-issue-core tools/render.py into a scratch directory"
|
||||
],
|
||||
"argocd_live": {
|
||||
"version": "v3.5.3 core (headless)",
|
||||
"workloads": "application-controller sts 1/1, repo-server 1/1, redis 1/1, applicationset-controller 1/1",
|
||||
"applications": 0,
|
||||
"appprojects": 0,
|
||||
"repository_secrets": 0,
|
||||
"tracking_method": "default (annotation) - argocd-cm sets no application.resourceTrackingMethod",
|
||||
"argocd_cli_on_node": false
|
||||
},
|
||||
"apps": {
|
||||
"openbao-secretstore": {
|
||||
"source": "railiance-platform.git main argocd/platform-addons/openbao-secretstore (kustomize)",
|
||||
"rendered": ["ClusterSecretStore/openbao"],
|
||||
"diff_server_side": "empty (rc=0)",
|
||||
"diff_client_side": "empty (rc=0)",
|
||||
"live_managers": ["railiance-platform", "external-secrets"],
|
||||
"would_change_live": "no spec change; ArgoCD adds its tracking annotation only",
|
||||
"would_prune": "nothing - no live object carries an ArgoCD tracking annotation; the other 24 ClusterSecretStores are not in the kustomization and stay untracked",
|
||||
"repository_credential": "none needed - coulomb/railiance-platform is public (Forgejo API private=false, anonymous ls-remote works)",
|
||||
"blockers": []
|
||||
},
|
||||
"issue-core": {
|
||||
"source_declared": "issue-core.git main k8s/railiance",
|
||||
"source_status": "PATH DOES NOT EXIST - removed by issue-core 51440da (2026-08-19, ISSUE-WP-0007); runtime moved to coulomb/rapp-issue-core",
|
||||
"effective_source": "rapp-issue-core.git main manifests/ (a78f38c), image pinned in the file",
|
||||
"rendered": ["Namespace", "ConfigMap", "ExternalSecret", "ServiceAccount", "Service", "Deployment", "NetworkPolicy x2"],
|
||||
"diff_server_side": "empty for both the raw manifests/ directory and the tools/render.py output",
|
||||
"live_image": "forgejo.coulomb.social/coulomb/issue-core@sha256:a56c80ccbd1690bc0bcea384165b1967704f0fdbaf1c506ce1082f56190b92cf",
|
||||
"live_managers": ["rapp-issue-core (server-side apply)", "kubectl-rollout", "k3s"],
|
||||
"would_change_live": "as declared: nothing (ComparisonError, path missing). Repointed to rapp-issue-core: no spec change, tracking annotation only",
|
||||
"would_prune": "nothing",
|
||||
"repository_credential": "NEW: coulomb/rapp-issue-core is private (anonymous API returns nothing). Needs a template rapp-issue-core.repository.sops.yaml.template and OpenBao path platform/operators/argocd/repositories/rapp-issue-core. The existing issue-core template is obsolete (issue-core is public and no longer the source).",
|
||||
"blockers": ["Application must be repointed", "credential CCR", "rapp-issue-core make deploy must stop being a production path (would fight self-heal)"]
|
||||
},
|
||||
"target-revenue": {
|
||||
"source": "target-revenue.git main k8s/railiance (f1109d5, kustomize)",
|
||||
"rendered": ["Deployment", "Service", "Ingress", "ExternalSecret", "postgresql.cnpg.io/Cluster", "Job/target-revenue-migrate (Sync hook, wave 1)", "Job/target-revenue-bootstrap-binky (Sync hook, wave 2)"],
|
||||
"diff_server_side": "Deployment, Service, Ingress, ExternalSecret, Cluster: empty. Only the two Jobs differ: absent live (completed, TTL-deleted), would be created",
|
||||
"diff_client_side": "same result",
|
||||
"live_image": "forgejo.coulomb.social/coulomb/target-revenue:0.1.4 (tag, not digest)",
|
||||
"live_managers": ["kubectl-client-side-apply", "k3s"],
|
||||
"would_change_live": "yes: every sync with the default hook strategy runs the migrate Job against the production database and the binky bootstrap Job (commented idempotent)",
|
||||
"would_prune": "nothing",
|
||||
"project_whitelist": "BLOCKER: postgresql.cnpg.io/Cluster is not in railiance-tenants namespaceResourceWhitelist; the sync would be refused",
|
||||
"repository_credential": "none needed - coulomb/target-revenue is public; no template exists",
|
||||
"blockers": ["CNPG Cluster whitelist", "Sync-hook Jobs"]
|
||||
},
|
||||
"external-secrets": {
|
||||
"source": "https://charts.external-secrets.io external-secrets 0.16.1, values installCRDs=true, serviceAccount.create=true name=external-secrets",
|
||||
"rendered_kinds": {"CustomResourceDefinition": 20, "ClusterRole": 5, "ClusterRoleBinding": 2, "Deployment": 3, "ServiceAccount": 3, "ValidatingWebhookConfiguration": 2, "Role": 1, "RoleBinding": 1, "Secret": 1, "Service": 1},
|
||||
"diff_server_side": "empty (rc=0), rendered with --include-crds --kube-version 1.35.1",
|
||||
"live_helm_release": "external-secrets rev 7 status pending-upgrade since 2026-07-07 22:32; rev 6/7 user values identical to the Application values",
|
||||
"live_managers": ["helm", "kubectl-rollout", "k3s"],
|
||||
"would_change_live": "no spec change in the dry run; ArgoCD adds tracking annotations to 39 objects including 20 CRDs. Watch caBundle fields injected by cert-controller for drift",
|
||||
"would_prune": "nothing now. Later, pruning a CRD would delete every ExternalSecret and SecretStore cluster-wide",
|
||||
"repository_credential": "none needed - public Helm repository",
|
||||
"blockers": ["cluster-wide blast radius", "CRDs need Prune=false before prune is ever enabled", "stale helm release pending-upgrade"]
|
||||
}
|
||||
},
|
||||
"sync_policy_found": {
|
||||
"railiance-apps-root": "automated prune+selfHeal",
|
||||
"children": "all four: automated prune+selfHeal, no finalizers",
|
||||
"consequence": "applying the bootstrap as committed adopts all four at once"
|
||||
},
|
||||
"not_verified": [
|
||||
"repo-server egress to forgejo.coulomb.social and charts.external-secrets.io from inside railiance01",
|
||||
"state of coulombcore's ArgoCD, which still reads argocd/applications on main (outside this session's read-only railiance01 scope)"
|
||||
]
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue