Conversation
Add a dedicated *_private_* namespace (distinct from the dead *_extras_*
"extra public charts" vars) so the catalogue ApplicationSets can layer a
private, SSH-accessed, values-only overlay repo over the public catalogues.
Across all three stacks (on-prem, hub-spoke/hub, hub-spoke/spokes):
- gitops_private_org: SSH org/prefix (git@github.com:SilexConsulting), separate
from the HTTPS gitops_org
- gitops_{addons,workloads}_private_{repo,revision} vars (default gitops-private@main)
- gitops_{addons,workloads}_private_url locals
- {addons,workloads}_private_repo_{url,revision} cluster-secret annotations
- private_overlays added to allowed_addons so enable_private_overlays is a known flag
Values-only overlay -> a ref source consumes only url+revision; basepath/path
omitted to avoid dead annotations (environments/ and clusters/ live at repo root).
terraform validate passes on all three stacks.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Documents the agreed architecture: clean public catalogues (trial-able), a private "deployments" repo that owns bootstrap/ and carries the Kustomize patching layering private values/secrets over the public appsets, two modes (trial vs deployments) selected by repo path/basepath annotations, the private annotation contract, precedence, and secrets/ESO scope. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Align the Terraform wiring with the final deployments-repo design:
- add {addons,workloads}_private_repo_basepath (vars/locals/annotations) across
all three stacks — basepath selects the addons/workloads subtree and enables the
one-repo-or-two choice; consumed by the private repo's bootstrap Kustomize.
- remove the enable_private_overlays toggle: mode is chosen by which appsets the
root app targets (public vs private bootstrap/), not a per-cluster label. Revert
private_overlays from allowed_addons.
terraform validate passes on all three stacks.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Make the private deployments repo opt-in and let the hub root appsets target it
without forking the public catalogues.
Terraform (on-prem, hub, spokes):
- gitops_{addons,workloads}_private_repo now default to "" (opt-in). locals compute
the private URL as `repo == "" ? "" : <org>/<repo>`, so a public-only trial cluster
emits an empty private annotation and never references the private repo.
Root bootstrap appsets (bootstrap/hub/{addons,workloads}.yaml):
- Convert to goTemplate. The source is conditional on whether the cluster secret carries
a non-empty {addons,workloads}_private_repo_url:
set -> target the private repo's <basepath>/bootstrap (Kustomize: imports the clean
public appsets, layers private values, adds extra apps)
unset -> the public catalogue directory (trial), with directory.recurse re-added via
spec.templatePatch (structural toggles can't live in `template`)
- The public *_repo_url is never repointed, so every child appset keeps sourcing its
$values/$workloads base from the public catalogue (resolves the two-consumers collision).
- Drop an invalid `preserveResourcesOnDeletion` under template.spec.syncPolicy in
workloads.yaml (an ApplicationSet-level field, not valid on an Application).
Verified live on the kind-hub: addons flips to the private repo, remote Kustomize bases
build in Argo repo-server, velero-ui gains a ref:private source (+2 replicas from a private
value), and a net-new podinfo addon deploys. Public base sources remain unforked.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds support for GIT-13 “deployments” (private overlays) as an opt-in mode, allowing clusters to layer private values and add net-new apps without forking the public catalog repos. This is implemented by extending Terraform to emit private-repo annotation inputs and updating hub bootstrap ApplicationSets to select either public catalog directories (trial) or a private repo bootstrap/ Kustomize entrypoint (deployments mode).
Changes:
- Add Terraform variables/locals to define optional private repo URL/basepath/revision for addons and workloads, and propagate them as Argo CD cluster Secret annotations.
- Update
bootstrap/hub/{addons,workloads}.yamltogoTemplateand switch sources based on presence of private repo annotations, usingtemplatePatchto conditionally enabledirectory.recurseonly for trial mode. - Add
docs/private-overlays-design.mddesign document describing the repo layout and annotation contract.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| terraform/on-prem/variables.tf | Adds private-repo opt-in variables and SSH org/prefix for on-prem stack. |
| terraform/on-prem/locals.tf | Constructs private repo URLs and propagates private annotation keys into cluster secret metadata. |
| terraform/hub-spoke/spokes/variables.tf | Adds private-repo opt-in variables and SSH org/prefix for spokes stack. |
| terraform/hub-spoke/spokes/locals.tf | Constructs private repo URLs and propagates private annotation keys into spoke cluster secret metadata. |
| terraform/hub-spoke/hub/variables.tf | Adds private-repo opt-in variables and SSH org/prefix for hub stack. |
| terraform/hub-spoke/hub/locals.tf | Constructs private repo URLs and propagates private annotation keys into hub cluster secret metadata. |
| docs/private-overlays-design.md | Documents the private deployments repo design, layering, and annotation contract. |
| bootstrap/hub/workloads.yaml | Switches workloads root ApplicationSet to template-driven public vs private source selection and fixes invalid per-Application field placement. |
| bootstrap/hub/addons.yaml | Switches addons root ApplicationSet to template-driven public vs private source selection. |
Suppressed comments (2)
bootstrap/hub/addons.yaml:43
- Same issue as above:
if not .metadata.annotations.addons_private_repo_urlwill error undermissingkey=errorif the optional annotation key is absent. Useindexfor the optional lookup.
{{- if not .metadata.annotations.addons_private_repo_url }}
bootstrap/hub/workloads.yaml:43
- Same optional-annotation issue in
templatePatch: dot-access will error undermissingkey=errorif the key is absent. Useindexfor this lookup.
{{- if not .metadata.annotations.workloads_private_repo_url }}
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds GIT-13: an opt-in "deployments" repo that layers private values over the public catalogues and adds net-new apps — without ever forking the public repos. A cluster opts in purely by annotating its Argo CD cluster secret with a private repo URL; with no annotation, a public-only "trial" install works unchanged.
How it works
*_repo_urlis never repointed, so every child appset keeps sourcing its$values/$workloadsbase from the public repo.gitops_{addons,workloads}_private_reponow default to""; locals emit the private URL only when a repo is set. Trial clusters emit no private annotation.bootstrap/hub/{addons,workloads}.yamlbecomegoTemplateand switch on{addons,workloads}_private_repo_url:<basepath>/bootstrap(a Kustomize build that imports the clean public appsets, layers private values, and adds extra apps)directory.recurseis re-added viaspec.templatePatch(structural toggles can't live intemplate).Also fixes a latent bug: an invalid
preserveResourcesOnDeletionundertemplate.spec.syncPolicyinworkloads.yaml(an ApplicationSet-level field, not valid on an Application;kubectl applystrict-decodes and rejects it).Design doc:
docs/private-overlays-design.md.Verified live (kind hub/spoke)
Flipped the local hub to deployments mode against
gitops-private:addonsroot Synced/Healthy off the private repo's Kustomize.velero-uigained aref: privatesource + private valueFiles and scaled 1→2 replicas from a private cluster value — public base source unforked.Scope / follow-ups
terraform validatepasses on each.type: workloadspoke to exercise.