15 lines
829 B
Markdown
15 lines
829 B
Markdown
# Repository operating rules
|
|
|
|
- Treat the Gitea `origin` as the canonical deployment repository.
|
|
- Production is disabled; do not create or enable production Applications
|
|
without a complete production design and explicit approval.
|
|
- Never commit Terraform state, provider directories, plan files, tfvars,
|
|
Vault init JSON, unseal/recovery material or plaintext credentials.
|
|
- A Vault API object may be owned by only one Terraform state.
|
|
- Keep secret payloads outside Terraform resources and data sources.
|
|
- Routine GitOps automation changes Git only; direct cluster mutation is
|
|
reserved for documented bootstrap and recovery runbooks.
|
|
- Run `make validate` before handing off repository changes.
|
|
- Do not apply to a live cluster unless the user explicitly requests live
|
|
deployment and the kube context has been verified.
|