project-gitops/CHANGELOG.md

Changelog

2026-07-25

• Established the internal Gitea repository as the single GitOps source.
• Replaced staged Argo roots with one bootstrap seed and one cluster-owned root Application.
• Reorganized the repository around clusters/dev-k3s, environment-neutral platform/workloads bases and separate iac/terraform.
• Corrected the Sealed Secrets Helm repository and added controller resources and key renewal configuration.
• Removed incomplete production skeletons; production remains unsupported.
• Changed application promotion to a Gitea pull request carrying an immutable OCI digest and removed direct writes to main.
• Pinned Vault, PostgreSQL, Keycloak, Vault Injector and Sealed Secrets images to verified multi-architecture digests.
• Removed routine kubectl apply, port-forward orchestration and reusable Vault operator-token scripts.
• Added a guarded, dev-only Vault init/unseal/root-revoke entrypoint.
• Fixed auth migration and Keycloak sync Job lifecycle and ordering.
• Removed selective sync from Applications containing Sync hooks.
• Enabled ConfigMap hash rollouts and projected Vault authentication tokens.
• Removed the same-cluster Transit Vault and its credential rotation cycle.
• Consolidated Terraform into vault-core and vault-database remote states with write-only/ephemeral credential inputs.
• Removed tracked Terraform providers and backend metadata.
• Moved machine-consumed Vault policies out of runbooks and narrowed routine automation permissions.
• Recorded Gateway API first and deferred Istio ambient adoption criteria.
• Reduced shell entrypoints from 18 files/1,205 lines to 3 files/300 lines.
• Split current documentation from archived historical material.