donghyeon.kang/project-gitops
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor(gitops): establish platform ownership boundaries

Browse Source
This commit is contained in:
donghyeon-ka
2026-07-26 01:34:29 +09:00
parent 293ee6fc97
commit a6f6c663e0
121 changed files with 2801 additions and 1204 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+10
View File
@@ -7,6 +7,16 @@
Vault init JSON, unseal/recovery material or plaintext credentials.
- A Vault API object may be owned by only one Terraform state.
- Keep secret payloads outside Terraform resources and data sources.
- Classify shared capabilities under `platform`, bounded-context backing
services under `systems`, and first-party runtimes under `workloads`.
- Manage child Argo CD Applications through the permission-scoped
ApplicationSets in `platform/control-plane/argocd`; do not add explicit
child Applications or use the `default` AppProject.
- Add new ApplicationSet entries with `autoSync: "false"` and open each gate
only after its documented external prerequisites have been verified.
- Keep `vault-foundation`, `vault-workloads`, and `vault-database` as separate
states. A delegated state must not own the policy or login role that grants
its own execution identity.
- Routine GitOps automation changes Git only; direct cluster mutation is
reserved for documented bootstrap and recovery runbooks.
- Run `make validate` before handing off repository changes.