admin
3a9dd81e18
gates / gates (push) Successful in 8s
227 -> 115 effective lines, split into .claude/rules/{hub,website,manifests,docs}.md, and
repo_gates.py gains gate 6. Trim first, register second: a registered-but-failing gate refuses
every push through the pre-push hook, which is why this repo -- the one that OWNS the gate --
was the only one not running it.
Register discipline and the R-110 installer fence deliberately stayed in the core; both have
triggers no fixed glob covers, and scoping them would have rebuilt the failure class they exist
to prevent.
Scoping proven from the InstructionsLoaded hook log in two fresh sessions, not from frontmatter.
34 lines
1.5 KiB
Markdown
34 lines
1.5 KiB
Markdown
---
|
|
paths: ["manifests/**", "**/*.yaml"]
|
|
---
|
|
|
|
# Manifests — ArgoCD, deliberate sync, secrets
|
|
|
|
## One app, and auto-sync is OFF
|
|
|
|
The whole cluster is GitOps via a **single ArgoCD app `felhom`** syncing this repo's `manifests/` to
|
|
the `felhom-system` namespace. **Auto-sync is OFF — a deploy is a deliberate manual sync.**
|
|
|
|
ArgoCD's source of truth is the **manifest in git**:
|
|
|
|
- Committing a manifest change deploys nothing until the app is synced.
|
|
- **Pin explicit image versions, never `:latest`.**
|
|
- **Never bare `kubectl set image` / `kubectl apply`** — the next sync reverts it, so the fix looks
|
|
like it worked and then silently disappears.
|
|
- Sync method (hard-refresh + sync, local `sudo kubectl`): the **`felhom-build-deploy`** skill.
|
|
|
|
## Secrets
|
|
|
|
- **Out-of-band `secretKeyRef` only — never inline `stringData`** (`REUSE.md` §3).
|
|
- `manifest_bearer_gate.py` fails on any bearer-shaped literal anywhere under `manifests/`. It runs
|
|
from `python3 scripts/repo_gates.py`.
|
|
|
|
## The two git-syncs in `webpage.yaml`
|
|
|
|
`manifests/webpage.yaml` runs **two** git-syncs and they track different refs: the website from
|
|
`main`, and `/scripts/` from the tag `installer-v<SCRIPT_VERSION>`. Changing either `--ref` changes
|
|
what real machines download — the init container **and** the sidecar both carry it, and both must
|
|
move together. `hostinstall_gates.py` gate 6 fails if the manifest stops naming an `installer-v…`
|
|
tag or if the website stops tracking `main`. The full publish/rollback procedure is the R-110 fence
|
|
in the repo core `CLAUDE.md`.
|