b666301487
- WP-0025-T03 done: public listener retracted 2026-09-15; bao.coulomb.social is retired, tunnel is the operator path; DNS withdrawal handed to S1. - WP-0043-T01 done: ArgoCD Core reconciles railiance01 at main (evidence). - WP-0043-T05 done: direct-apply gap inventory and founder proposal. - WP-0045-T05 cancelled (no rollback needed); T06 preconditions recorded. - Operator scripts default BAO_ADDR to the openbao-ui-railiance01 tunnel. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
3.7 KiB
Direct-apply gap inventory (RPF-WP-0043-T05)
Inventory date: 2026-09-22. Source: Makefile on main at 8a7ebce.
Nothing here changes a target's behaviour.
Declaration
Under the Kubernetes change gate (the-custodian/docs/kubernetes-change-gate-decision.md),
a platform object without a readiness state defaults to the production tier,
and the production row is CONSTRUCT through git and ArgoCD. The targets
below change railiance01 directly (kubectl apply, helm upgrade, or the
OpenBao API). Their evidence is target-audited only. They do not conform
to the production row. Until the founder rules on each group, every run is
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED, and is
recorded as a production-tier change.
ArgoCD Core has run on railiance01 since 2026-09-21. The evidence is
docs/evidence/2026-09-22-argocd-railiance01-status.json. A reconciled lane
therefore exists for Kubernetes objects. It does not exist for OpenBao API
state.
Inventory and proposal
| Group | Targets | What they change | Proposal |
|---|---|---|---|
| A. CNPG clusters, backups, NetworkPolicies | db-deploy, forgejo-db-deploy, apps-pg-deploy, apps-pg-backup-deploy, apps-pg-overflow-deploy, net-kingdom-pg-inter-hub-networkpolicy-deploy |
helm/*.yaml via kubectl apply |
Move to a reconciled lane. Adopt one Application per database cell, one at a time, as in RPF-WP-0044. The first sync is manual with prune off, and CNPG Cluster needs an AppProject whitelist entry. db-deploy (gitea-db) may be retirement, not adoption: check first whether gitea-db still exists. |
| B. ClusterSecretStores | the openbao-secretstore Application (already adopted) plus stores patched by hand during recoveries (RPF-WP-0037, RPF-WP-0045) |
ClusterSecretStore specs |
Move to reconciled. Store auth blocks belong in argocd/-tracked manifests. A hand patch now counts as drift to reconcile back into git. |
| C. OpenBao package | openbao-deploy, openbao-overlay-apply, openbao-public-listener-retract, openbao-public-listener-rollback |
Helm release and gateway overlay in openbao |
Move to reconciled, with rapp-openbao. The package belongs to rapp-openbao, so its Application should come from there. The listener retract and rollback stay direct as attended break-glass under APPROVED. |
| D. OpenBao configuration | openbao-configure-initial, -ssh, -external-secrets-*, -workload-kv-lanes, -credential-change-appliers, -token-grants, credential-change-applier-apply |
policies, roles and mounts over the OpenBao API | Stay direct under APPROVED. ArgoCD cannot reconcile API state. The controls are compare-before-write scripts, attended login and per-run evidence. A declarative reconciler is a separate decision. |
| E. ArgoCD bootstrap | argocd-bootstrap-deploy, argocd-repo-apply |
AppProjects, root Application, repository Secret | argocd-bootstrap-deploy: never against railiance01. It renders the old root with automated prune and self-heal. Use argocd/railiance01/bootstrap/ (RPF-WP-0044). Retire or guard the target when coulombcore is retired (RPF-WP-0044-T08). argocd-repo-apply stays direct under APPROVED because it carries SOPS-encrypted credentials. |
| F. Not Kubernetes | forgejo-package-prune, backup, forgejo-backup |
Forgejo API, backup uploads | Outside the Kubernetes gate. Stays direct. |
| Fail-closed | pg-deploy, valkey-deploy |
nothing (refuse) | No action. |
Read-only targets (*-status, *-logs, *-dry-run, *-verify*,
assurance-*) change nothing and are not in scope.
Founder decision requested
Accept or amend the per-group proposal. Adopting groups A to C is later work. It is not started by this inventory.