project-gitops/CHANGELOG.md

Changelog

2026-07-26

• Clarified that this repository is an independent GitOps reference lab, not a shared production platform or an application source monorepo.
• Reclassified Kubernetes ownership as platform, systems and workloads; moved the Project Auth PostgreSQL/Keycloak boundary to systems/auth-system.
• Replaced generic cluster manifests with ownership-aligned clusters/dev-k3s/overlays.
• Moved the Argo control-plane inventory to platform/control-plane/argocd and separated permission-scoped AppProjects for addons, shared services, systems and workloads.
• Added a bootstrap-only gitops-control-plane AppProject so the root no longer reconciles through Argo CD's unrestricted default project.
• Replaced repeated child Application definitions with strict list-generated ApplicationSets and explicit autoSync bootstrap gates.
• Renamed the Project Auth backing-system namespace to auth-system-dev and aligned service DNS, NetworkPolicy and ConfigMap ownership.
• Changed Vault KV ownership from legacy dev/platform paths to dev/systems/auth-system and dev/workloads/auth-server paths.
• Split the broad vault-core ownership into vault-foundation and vault-workloads, retaining vault-database as a third isolated state.
• Documented delegated Terraform identities, stage-by-stage bootstrap and non-destructive state/path migration procedures.
• Kept GHCR as the image artifact boundary and made immutable digests the promotion target; existing short commit tags remain until a registry-verified promotion PR replaces them.
• Performed repository-only refactoring and static validation; no Kubernetes, Vault, Argo CD, registry or remote Terraform backend was mutated.

2026-07-25

• Established the internal Gitea repository as the single GitOps source.
• Replaced staged Argo roots with one bootstrap seed and one cluster-owned root Application.
• Reorganized the repository around clusters/dev-k3s, environment-neutral platform/workloads bases and separate iac/terraform.
• Corrected the Sealed Secrets Helm repository and added controller resources and key renewal configuration.
• Removed incomplete production skeletons; production remains unsupported.
• Changed application promotion to a Gitea pull request carrying an immutable OCI digest and removed direct writes to main.
• Pinned Vault, PostgreSQL, Keycloak, Vault Injector and Sealed Secrets images to verified multi-architecture digests.
• Removed routine kubectl apply, port-forward orchestration and reusable Vault operator-token scripts.
• Added a guarded, dev-only Vault init/unseal/root-revoke entrypoint.
• Fixed auth migration and Keycloak sync Job lifecycle and ordering.
• Removed selective sync from Applications containing Sync hooks.
• Enabled ConfigMap hash rollouts and projected Vault authentication tokens.
• Removed the same-cluster Transit Vault and its credential rotation cycle.
• Consolidated Terraform into vault-core and vault-database remote states with write-only/ephemeral credential inputs.
• Removed tracked Terraform providers and backend metadata.
• Moved machine-consumed Vault policies out of runbooks and narrowed routine automation permissions.
• Recorded Gateway API first and deferred Istio ambient adoption criteria.
• Reduced shell entrypoints from 18 files/1,205 lines to 3 files/300 lines.
• Split current documentation from archived historical material.