refactor: reorganize GitOps control plane
This commit is contained in:
@@ -0,0 +1,14 @@
|
||||
# Repository operating rules
|
||||
|
||||
- Treat the Gitea `origin` as the canonical deployment repository.
|
||||
- Production is disabled; do not create or enable production Applications
|
||||
without a complete production design and explicit approval.
|
||||
- Never commit Terraform state, provider directories, plan files, tfvars,
|
||||
Vault init JSON, unseal/recovery material or plaintext credentials.
|
||||
- A Vault API object may be owned by only one Terraform state.
|
||||
- Keep secret payloads outside Terraform resources and data sources.
|
||||
- Routine GitOps automation changes Git only; direct cluster mutation is
|
||||
reserved for documented bootstrap and recovery runbooks.
|
||||
- Run `make validate` before handing off repository changes.
|
||||
- Do not apply to a live cluster unless the user explicitly requests live
|
||||
deployment and the kube context has been verified.
|
||||
Reference in New Issue
Block a user