tegwick
77452492ec
user-engine already runs from net-kingdom/sso-mfa/k8s/user-engine. The rapp absorbs those manifests (manifest-managed), keeps or cutovers the dedicated CNPG cluster, and becomes the only apply home.
129 lines
4.1 KiB
Markdown
129 lines
4.1 KiB
Markdown
---
|
||
id: RMGR-WP-0006
|
||
type: workplan
|
||
title: "Railiance managed-app wrapper setup"
|
||
domain: infotech
|
||
repo: repo-manager
|
||
status: active
|
||
owner: grok
|
||
topic_slug: infotech
|
||
created: "2026-08-18"
|
||
updated: "2026-08-18"
|
||
parent_project: prj-state-hub-retirement
|
||
related:
|
||
- RMGR-WP-0004
|
||
state_hub_workstream_id: "0d6d2ebf-4b74-4908-995c-17b8987ede05"
|
||
---
|
||
|
||
# Railiance managed-app wrapper setup
|
||
|
||
## Goal
|
||
|
||
Give Repo Manager a governed path to set up `rapp-<app>` repositories so
|
||
ordinary applications (starting with `user-engine`) can run on Railiance
|
||
as managed workloads: declared, packaged, bound to a rail and reef, and
|
||
operable without copying charts into `railiance-apps`.
|
||
|
||
This specializes `RMGR-WP-0004` scaffolding for the `rapp-*` family. It
|
||
does not move family schemas out of `railiance-master`, and it does not
|
||
operate the cluster.
|
||
|
||
Practice and remaining work are structured in
|
||
[`docs/RailianceAppDeploymentGuide.md`](../docs/RailianceAppDeploymentGuide.md).
|
||
|
||
## Record the wrapper best-practice guide
|
||
|
||
```task
|
||
id: RMGR-WP-0006-T01
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "cb1e2e4e-9aef-4669-89f6-86ea8512b7d2"
|
||
```
|
||
|
||
Survey live rails (`rail-kubernetes`, `rail-knative`), reefs
|
||
(`reef-railiance`, `reef-storage`), existing rapps, and the `user-engine`
|
||
/ `rapp-user-engine` pair. Write
|
||
`docs/RailianceAppDeploymentGuide.md` as the best-practice shape and the
|
||
work breakdown for later scaffolder phases.
|
||
|
||
**Result (2026-08-18):** guide written. Pilot target is
|
||
`rapp-user-engine` (empty stub). Copy targets are `rapp-policy-nexus` and
|
||
`rapp-openbao`, not drifted `rapp-qonto`.
|
||
|
||
## Bootstrap the user-engine wrapper to `declared`
|
||
|
||
```task
|
||
id: RMGR-WP-0006-T02
|
||
status: todo
|
||
priority: high
|
||
state_hub_task_id: "f0e53954-403a-4e2c-b39f-0bab00eed3cc"
|
||
```
|
||
|
||
Fill `rapp-user-engine` with the bootstrap baseline and a schema-valid
|
||
`declarations/rapp.yaml` at `readiness_state: declared` (or `draft` if
|
||
image/consumer pins are still missing). Follow the worked example in the
|
||
guide. Validate with
|
||
`railiance-master/tools/validate-family-declarations.py --root ..`.
|
||
|
||
Do not place the rapp (`bound_reefs` stays empty) and do not set public
|
||
exposure.
|
||
|
||
## Generate the Kubernetes package skeleton
|
||
|
||
```task
|
||
id: RMGR-WP-0006-T03
|
||
status: todo
|
||
priority: high
|
||
state_hub_task_id: "3ba6828e-7514-4f4d-a1d3-54134e039f55"
|
||
```
|
||
|
||
Absorb `net-kingdom/sso-mfa/k8s/user-engine/` into
|
||
`rapp-user-engine/manifests/` (or a Helm chart only if a rewrite is
|
||
justified separately). Add Makefile `server-dry-run` / `deploy` /
|
||
`verify-live` / `rollback DIGEST=…` and a runtime-contract doc. Leave a
|
||
pointer in NetKingdom so there is one apply path.
|
||
|
||
`make server-dry-run` must pass. No production apply in this task.
|
||
Package type is `manifest-managed-platform-service` unless the rewrite
|
||
to Helm is an explicit later decision.
|
||
|
||
## Draft platform handoffs
|
||
|
||
```task
|
||
id: RMGR-WP-0006-T04
|
||
status: todo
|
||
priority: medium
|
||
state_hub_task_id: "0c2846d9-5db2-4b97-becd-0367b5737188"
|
||
```
|
||
|
||
Draft the `rapp-postgres` consumer and secret-reference list for
|
||
user-engine. Apply them only in the owning repos (`rapp-postgres`,
|
||
`railiance-platform`) after those owners accept the draft. This repo
|
||
records the request; it does not become the credential home.
|
||
|
||
## Implement `rmgr rapp` scaffolding
|
||
|
||
```task
|
||
id: RMGR-WP-0006-T05
|
||
status: todo
|
||
priority: high
|
||
state_hub_task_id: "6cf89776-ff31-4dd1-aa9a-39474fc387aa"
|
||
```
|
||
|
||
Turn P1–P4 from the guide into Repo Manager commands (`rapp init`,
|
||
`rapp skeleton`, `rapp validate`) that are idempotent, secret-free, and
|
||
refuse to invent rails, reefs, or package types. Pilot by regenerating
|
||
the user-engine wrapper (or the next engine stub) without hand-editing
|
||
the baseline files.
|
||
|
||
Depends on the shape proven in T02–T03 and on `RMGR-WP-0004` scaffolding
|
||
ownership.
|
||
|
||
## Residuals
|
||
|
||
- `rapp-secrets-engine` and `rapp-tenant-engine` remain undeclared stubs;
|
||
wrap them only after the user-engine path validates.
|
||
- `rapp-vergabe-teilnahme` extraction stays a `railiance-apps` residual
|
||
(ADR-0003). This workplan does not close that item.
|
||
- Schema enum `helm-managed-application` would be a `railiance-master`
|
||
change if the platform-service name proves misleading.
|