32 lines
1.7 KiB
Markdown
32 lines
1.7 KiB
Markdown
# Changelog
|
|
|
|
## 2026-07-25
|
|
|
|
- Established the internal Gitea repository as the single GitOps source.
|
|
- Replaced staged Argo roots with one bootstrap seed and one cluster-owned
|
|
root Application.
|
|
- Reorganized the repository around `clusters/dev-k3s`, environment-neutral
|
|
`platform`/`workloads` bases and separate `iac/terraform`.
|
|
- Corrected the Sealed Secrets Helm repository and added controller resources
|
|
and key renewal configuration.
|
|
- Removed incomplete production skeletons; production remains unsupported.
|
|
- Changed application promotion to a Gitea pull request carrying an immutable
|
|
OCI digest and removed direct writes to `main`.
|
|
- Pinned Vault, PostgreSQL, Keycloak, Vault Injector and Sealed Secrets images
|
|
to verified multi-architecture digests.
|
|
- Removed routine `kubectl apply`, port-forward orchestration and reusable
|
|
Vault operator-token scripts.
|
|
- Added a guarded, dev-only Vault init/unseal/root-revoke entrypoint.
|
|
- Fixed auth migration and Keycloak sync Job lifecycle and ordering.
|
|
- Removed selective sync from Applications containing Sync hooks.
|
|
- Enabled ConfigMap hash rollouts and projected Vault authentication tokens.
|
|
- Removed the same-cluster Transit Vault and its credential rotation cycle.
|
|
- Consolidated Terraform into `vault-core` and `vault-database` remote states
|
|
with write-only/ephemeral credential inputs.
|
|
- Removed tracked Terraform providers and backend metadata.
|
|
- Moved machine-consumed Vault policies out of runbooks and narrowed routine
|
|
automation permissions.
|
|
- Recorded Gateway API first and deferred Istio ambient adoption criteria.
|
|
- Reduced shell entrypoints from 18 files/1,205 lines to 3 files/300 lines.
|
|
- Split current documentation from archived historical material.
|