Conversation
Add a dedicated *_private_* namespace (distinct from the dead *_extras_*
"extra public charts" vars) so the catalogue ApplicationSets can layer a
private, SSH-accessed, values-only overlay repo over the public catalogues.
Across all three stacks (on-prem, hub-spoke/hub, hub-spoke/spokes):
- gitops_private_org: SSH org/prefix (git@github.com:SilexConsulting), separate
from the HTTPS gitops_org
- gitops_{addons,workloads}_private_{repo,revision} vars (default gitops-private@main)
- gitops_{addons,workloads}_private_url locals
- {addons,workloads}_private_repo_{url,revision} cluster-secret annotations
- private_overlays added to allowed_addons so enable_private_overlays is a known flag
Values-only overlay -> a ref source consumes only url+revision; basepath/path
omitted to avoid dead annotations (environments/ and clusters/ live at repo root).
terraform validate passes on all three stacks.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Documents the agreed architecture: clean public catalogues (trial-able), a private "deployments" repo that owns bootstrap/ and carries the Kustomize patching layering private values/secrets over the public appsets, two modes (trial vs deployments) selected by repo path/basepath annotations, the private annotation contract, precedence, and secrets/ESO scope. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Align the Terraform wiring with the final deployments-repo design:
- add {addons,workloads}_private_repo_basepath (vars/locals/annotations) across
all three stacks — basepath selects the addons/workloads subtree and enables the
one-repo-or-two choice; consumed by the private repo's bootstrap Kustomize.
- remove the enable_private_overlays toggle: mode is chosen by which appsets the
root app targets (public vs private bootstrap/), not a per-cluster label. Revert
private_overlays from allowed_addons.
terraform validate passes on all three stacks.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Make the private deployments repo opt-in and let the hub root appsets target it
without forking the public catalogues.
Terraform (on-prem, hub, spokes):
- gitops_{addons,workloads}_private_repo now default to "" (opt-in). locals compute
the private URL as `repo == "" ? "" : <org>/<repo>`, so a public-only trial cluster
emits an empty private annotation and never references the private repo.
Root bootstrap appsets (bootstrap/hub/{addons,workloads}.yaml):
- Convert to goTemplate. The source is conditional on whether the cluster secret carries
a non-empty {addons,workloads}_private_repo_url:
set -> target the private repo's <basepath>/bootstrap (Kustomize: imports the clean
public appsets, layers private values, adds extra apps)
unset -> the public catalogue directory (trial), with directory.recurse re-added via
spec.templatePatch (structural toggles can't live in `template`)
- The public *_repo_url is never repointed, so every child appset keeps sourcing its
$values/$workloads base from the public catalogue (resolves the two-consumers collision).
- Drop an invalid `preserveResourcesOnDeletion` under template.spec.syncPolicy in
workloads.yaml (an ApplicationSet-level field, not valid on an Application).
Verified live on the kind-hub: addons flips to the private repo, remote Kustomize bases
build in Argo repo-server, velero-ui gains a ref:private source (+2 replicas from a private
value), and a net-new podinfo addon deploys. Public base sources remain unforked.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- bootstrap/hub/resources-{addons,workloads}.yaml: trial-only root appsets (is_hub) that
source the public repos' bootstrap/; omitted in deployments mode (private bootstrap delivers)
- terraform (on-prem, hub-spoke/hub, hub-spoke/spokes): allowed_workloads + widened enable_*
validation (allowed_addons + allowed_workloads + enable_resources); on-prem gains validate.tf
- argocd_apps built from argocd_apps_all with empty entries filtered; RFC1123 release-name keys;
resource roots gated to trial mode (no private repo)
- load_resources in argocd_files_config; enable_resources for on-prem
- docs/git-20-resources-design.md (incl. live KinD-hub validation results)
…-root, workload-resources-root)
…ed cluster-<name>[-scope]-resources; root-level global resources appset
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GIT-20 control-plane changes: trial-only resource root appsets (`bootstrap/hub/{resources,addons-resources-root,workloads-resources-root}.yaml`), `allowed_workloads` + widened enable_* validation across all 3 stacks, `load_resources` + `argocd_apps` wiring, and `docs/git-20-resources-design.md`.
Stacked on GIT-13 (#6) — this branch is based on GIT-13, so the diff currently includes GIT-13's changes; merge after #6 and the diff collapses to GIT-20-only. Companion PRs: gitops-addons#? / gitops-workloads#? (resources trees + appsets).
🤖 Generated with Claude Code