coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Record phase B start (T02, T03), ArgoCD resources, and the external-secrets release repair.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-09-21 19:10:40 +02:00
parent 994aac3df3
commit e1ac9c6016
1 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/kubernetes-change-gate-decision.md
View file

@ -175,3 +175,25 @@ State Hub's CPU request was **100m → 250m**, the chart's own default. The mode
4. Ran `helm upgrade --atomic` with the pinned image `main-0747b4d`, giving **revision 64**, 1/1 ready.
Hub health afterwards: `ok`, db connected, schema `b5e6f7a8c9d0` as expected. There was no downtime (maxUnavailable=0).
## Phase B begun, and external-secrets repaired, 2026-09-21
All of the following were done with the founder's go-ahead, in `ADMINISTER @ realm:kubernetes/railiance01` with `activation=APPROVED`, by the custodian session.
**1. ArgoCD resources** (railiance-enablement RAIL-EN-WP-0002-T02). Requests and limits were applied from the declared kustomization. All four pods are now Burstable, Ready, with 0 restarts. Free capacity was checked first, with 680m free, so the rollouts did not deadlock.
**2. Phase B layout** (RPF-WP-0044-T01). The founder chose option A: a railiance01-only path, `argocd/railiance01/`. Nothing under `argocd/applications/` or `argocd/bootstrap/`, which coulombcore's ArgoCD reads, was changed. **Hazard:** `make argocd-bootstrap-deploy` still renders the old root with automated sync and must not be run on railiance01.
**3. T02 and T03.**
- **T02:** 3 AppProjects and a root app with automated sync off were applied at `c3ebd6d`. The root is Synced/Healthy with zero children, which shows the repo-server reaches Forgejo.
- **T03:** openbao-secretstore was adopted:
- the diff was rc=0;
- the child was merged in `182e788`;
- a manual sync at `d2dbc19`, with the apply strategy and prune off, succeeded;
- `ClusterSecretStore/openbao` is Valid and tracked, and issue-core-runtime is SecretSynced.
**It is the first workload under GitOps on railiance01.** It is now in its 24-hour proving period. `selfHeal` needs a second go-ahead, and `prune` a third.
**4. external-secrets Helm release.** It had been stuck in `pending-upgrade` (rev 7) since 2026-07-07. Rev 6 and rev 7 were identical in values and manifests, and live matched both exactly, so the upgrade had fully applied and only the status was stuck. It was fixed with `helm rollback external-secrets 6`: dry run first, the chart has no hooks, and the result is rev 8, deployed. All three pods kept their names and their 36-day age, so nothing restarted.
**Found and routed, not fixed:** two ClusterSecretStores have been failing since 2026-09-13 (`openbao-email-connect`) and 2026-09-19 (`openbao-activity-core`). Their static OpenBao tokens are rejected with 403 on `lookup-self`, so 5 of 37 ExternalSecrets are not syncing, including activity-core's offsite-backup credential. This is credential custody, so it was routed to railiance-platform, activity-core and email-connect. No token was read or minted.