admin
3a9dd81e18
gates / gates (push) Successful in 8s
227 -> 115 effective lines, split into .claude/rules/{hub,website,manifests,docs}.md, and
repo_gates.py gains gate 6. Trim first, register second: a registered-but-failing gate refuses
every push through the pre-push hook, which is why this repo -- the one that OWNS the gate --
was the only one not running it.
Register discipline and the R-110 installer fence deliberately stayed in the core; both have
triggers no fixed glob covers, and scoping them would have rebuilt the failure class they exist
to prevent.
Scoping proven from the InstructionsLoaded hook log in two fresh sessions, not from frontmatter.
1.5 KiB
1.5 KiB
paths
| paths | ||
|---|---|---|
|
Manifests — ArgoCD, deliberate sync, secrets
One app, and auto-sync is OFF
The whole cluster is GitOps via a single ArgoCD app felhom syncing this repo's manifests/ to
the felhom-system namespace. Auto-sync is OFF — a deploy is a deliberate manual sync.
ArgoCD's source of truth is the manifest in git:
- Committing a manifest change deploys nothing until the app is synced.
- Pin explicit image versions, never
:latest. - Never bare
kubectl set image/kubectl apply— the next sync reverts it, so the fix looks like it worked and then silently disappears. - Sync method (hard-refresh + sync, local
sudo kubectl): thefelhom-build-deployskill.
Secrets
- Out-of-band
secretKeyRefonly — never inlinestringData(REUSE.md§3). manifest_bearer_gate.pyfails on any bearer-shaped literal anywhere undermanifests/. It runs frompython3 scripts/repo_gates.py.
The two git-syncs in webpage.yaml
manifests/webpage.yaml runs two git-syncs and they track different refs: the website from
main, and /scripts/ from the tag installer-v<SCRIPT_VERSION>. Changing either --ref changes
what real machines download — the init container and the sidecar both carry it, and both must
move together. hostinstall_gates.py gate 6 fails if the manifest stops naming an installer-v…
tag or if the website stops tracking main. The full publish/rollback procedure is the R-110 fence
in the repo core CLAUDE.md.