70 lines
3.0 KiB
Markdown
70 lines
3.0 KiB
Markdown
# k8s/base/app AGENTS
|
|
|
|
Role:
|
|
- own application-facing infrastructure base units
|
|
- define environment-neutral app workload, service, config reference, secret reference, storage, network policy, probe, and resource shapes
|
|
- organize many services by domain/service path directly under `k8s/base/app/<domain>/`
|
|
|
|
Current structure:
|
|
- domains sit directly under `k8s/base/app/` (`identity/`, `storage/`, `test/`)
|
|
- inside each domain, separate by workload role (`stateful/`, `stateless/`)
|
|
- example: `identity/auth/stateful/identity-postgres/`, `identity/auth/stateless/auth-server/`
|
|
|
|
Allowed:
|
|
- Kustomize base edits for application units
|
|
- Deployment / StatefulSet / Job / CronJob base resources
|
|
- Service / NetworkPolicy / PDB / HPA base resources
|
|
- ConfigMap / Secret reference wiring without secret values
|
|
- probe / resource / PVC / StorageClass reference shape
|
|
- component-specific manifests aligned with standards
|
|
|
|
Forbidden:
|
|
- environment-specific values that belong in `k8s/overlays/<env>`
|
|
- editing packaged K3s component manifests directly
|
|
- treating server-local manifests as source of truth
|
|
- embedding production secret values in Git
|
|
- generating opaque YAML via script as the primary ownership path
|
|
- merging unrelated app rollout + migration + cluster upgrade into one hidden change
|
|
|
|
Read first:
|
|
- `/docs/standards/infra/architecture-environments.md`
|
|
- `/docs/standards/infra/kustomize.md`
|
|
- `/docs/standards/infra/config-and-secrets.md`
|
|
- `/docs/standards/infra/workload-selection.md`
|
|
- `/docs/standards/infra/storage-pvc.md`
|
|
- `/docs/standards/infra/network-ingress-tls.md`
|
|
- `/docs/standards/infra/resources-probes-availability.md`
|
|
- `/docs/standards/infra/security-hardening.md`
|
|
- `/docs/standards/infra/observability-health.md`
|
|
- `/docs/standards/infra/db-and-migration.md`
|
|
|
|
Component-specific routing:
|
|
- paths containing `keycloak` -> `/docs/standards/infra/keycloak.md`
|
|
- paths containing `vault` -> `/docs/standards/infra/vault.md`
|
|
- paths containing `minio` -> `/docs/standards/infra/minio.md`
|
|
- paths containing `flyway` or migration jobs -> `/docs/standards/infra/flyway.md`
|
|
|
|
Examples:
|
|
- `/docs/examples/infra/kustomize.md`
|
|
- `/docs/examples/infra/config-and-secrets.md`
|
|
- `/docs/examples/infra/workload-selection.md`
|
|
- `/docs/examples/infra/storage-pvc.md`
|
|
- `/docs/examples/infra/network-ingress-tls.md`
|
|
- `/docs/examples/infra/resources-probes-availability.md`
|
|
- `/docs/examples/infra/security-hardening.md`
|
|
- `/docs/examples/infra/observability-health.md`
|
|
- `/docs/examples/infra/db-and-migration.md`
|
|
- `/docs/examples/infra/keycloak.md`
|
|
- `/docs/examples/infra/vault.md`
|
|
- `/docs/examples/infra/minio.md`
|
|
- `/docs/examples/infra/flyway.md`
|
|
|
|
Rules:
|
|
- base must stay environment-neutral
|
|
- app services default to `ClusterIP`
|
|
- public exposure must be explicit and added through overlays/ingress policy
|
|
- health/metrics/admin endpoints stay non-public by default
|
|
- DB migration must stay separate from app startup
|
|
- stateful workloads must have explicit storage and restore reasoning
|
|
- domain/unit nesting should make ownership clear for large service counts
|