jakman85andClaude Opus 4.8
d9a80e5350
Prep only — nothing deployed; running cluster untouched. Reconciliation graph (operator-approved Option A): author clusters/dev/rollout/ = 4 per-component Flux Kustomizations (kyverno->cilium->longhorn->monitoring, monitoring dependsOn longhorn). Dev overlay $patch:delete's the monolithic base platform/apps and adds ./rollout, so only the no-secret tier reconciles; the secret-blocked components are simply not created until hand-offs arrive. The no-secret tier carries no SOPS content, so it needs no sops-age key. prod is untouched (still builds the monolith). Convergence path coded in (delete rollout/ + the two deletes) — R-ENV-02 divergence flagged for architect review. Component hardening via cluster-vars (prod keeps strict posture): - KYVERNO_VALIDATION_ACTION Enforce->Audit(dev), _WEBHOOK_FAILURE_POLICY Fail->Ignore(dev), _ADMISSION_REPLICAS 3->1(dev); webhook namespaceSelector excludes system+platform namespaces. - MONITORING_STORAGE_CLASS var; GRAFANA_ADMIN_SECRET var (dev ''=chart default); Alertmanager SMTP/secret deferred to Phase-4 with verbatim re-enable markers. Cilium parity verified against the live CNI (no-op adopt). Validated: kubectl kustomize dev/prod/all-components, envsubst->YAML parse, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
21 lines
1.1 KiB
YAML
21 lines
1.1 KiB
YAML
---
|
|
# Phase-2 NO-SECRET incremental rollout — DEV bootstrap scaffold.
|
|
#
|
|
# Per-component Flux Kustomizations for the components that need NO operator secret:
|
|
# kyverno (admission, dev-softened) · cilium (adopt running CNI) · longhorn (storage)
|
|
# · monitoring (dependsOn longhorn).
|
|
# Secret-blocked components (cert-manager, externaldns, gateway, velero, keycloak,
|
|
# oauth2-proxy, image-automation, kubevirt) are intentionally NOT created until their
|
|
# operator hand-offs arrive (DECISIONS-LOG A2 / hand-off table).
|
|
#
|
|
# TRANSITIONAL: this is the dev bootstrap graph. Once every hand-off lands, dev drops
|
|
# ./rollout and re-adopts the unified base monolith (clusters/base/platform.yaml) so dev
|
|
# and prod share one reconciliation graph again (R-ENV-02 convergence). See DECISIONS-LOG.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- kyverno.yaml # first: admission present (Audit/Ignore in dev — non-blocking) before workloads
|
|
- cilium.yaml # adopt the running CNI (parity verified — no-op reconcile)
|
|
- longhorn.yaml # storage; monitoring depends on its StorageClass
|
|
- monitoring.yaml # dependsOn longhorn
|