lab/automation
1
0
Fork 0
Code Issues 6 Pull requests 3 Projects Releases Packages Wiki Activity Actions

ci namespace control plane #7

New issue
Closed
opened 2026-09-22 19:41:15 +00:00 by ginjiruu · 2 comments
ginjiruu commented 2026-09-22 19:41:15 +00:00
Owner
Copy link

What to build

The shared ci namespace on mini — the home for repo-declared CI. This is the first slice of the repo-declared CI architecture: application repos declare their own Argo Events sensors and workflows in a .ci/ folder, and the cluster provides a shared control plane that hosts them.

This ticket delivers the control plane:

  • The ci namespace with an EventBus connected to the shared NATS cluster (existing basic-auth wiring).
  • The go-build-push marketplace workflow template available in the ci namespace. It coexists with the automation-namespace copy until the central catalog is retired in a later ticket — the central tag-build sensor still references the automation-namespace copy, so the old one must keep working.
  • An Argo CD destination service account for the ci namespace with RBAC to manage sensors, workflows, and workflow templates there.
  • A workflow-executor service account (workflow task results + Harbor push) for build pods.
  • A Harbor admin ExternalSecret in the ci namespace (proof-of-concept credential; replaced by per-project robots in a later ticket).

Acceptance criteria

  • The ci namespace exists on mini and its EventBus is connected to the shared NATS cluster
  • The go-build-push workflow template is available in the ci namespace
  • A manual argo submit of go-build-push from the ci namespace (repo lab/authz-bridge, ref = an existing tag) completes successfully
  • A multi-arch image is pushed to Harbor under the expected tag
  • The automation-namespace copy of the template and the central sensor are untouched (central CI still works)

Blocked by

  • None — can start immediately
## What to build The shared `ci` namespace on mini — the home for repo-declared CI. This is the first slice of the repo-declared CI architecture: application repos declare their own Argo Events sensors and workflows in a `.ci/` folder, and the cluster provides a shared control plane that hosts them. This ticket delivers the control plane: - The `ci` namespace with an EventBus connected to the shared NATS cluster (existing basic-auth wiring). - The `go-build-push` marketplace workflow template available in the `ci` namespace. It coexists with the automation-namespace copy until the central catalog is retired in a later ticket — the central tag-build sensor still references the automation-namespace copy, so the old one must keep working. - An Argo CD destination service account for the `ci` namespace with RBAC to manage sensors, workflows, and workflow templates there. - A workflow-executor service account (workflow task results + Harbor push) for build pods. - A Harbor admin ExternalSecret in the `ci` namespace (proof-of-concept credential; replaced by per-project robots in a later ticket). ## Acceptance criteria - [ ] The `ci` namespace exists on mini and its EventBus is connected to the shared NATS cluster - [ ] The `go-build-push` workflow template is available in the `ci` namespace - [ ] A manual `argo submit` of `go-build-push` from the `ci` namespace (repo `lab/authz-bridge`, ref = an existing tag) completes successfully - [ ] A multi-arch image is pushed to Harbor under the expected tag - [ ] The automation-namespace copy of the template and the central sensor are untouched (central CI still works) ## Blocked by - None — can start immediately
ginjiruu commented 2026-09-22 20:12:13 +00:00
Author
Owner
Copy link

Implemented & verified (2026-09-22)

All acceptance criteria pass. Two commits: lab/clusters (flux-clusters) 775ee64e + 4d159c04, lab/automation cf57227.

Additional work beyond the ticket

  1. flux-clusters (lab/clusters) changes — the ticket assumed the ArgoCD side already existed; it didn't:
    • clusters/mini/ci/ — the ci Namespace, the ci-argocd destination SA, its Role/RoleBinding, and the read-only namespaces ClusterRole/ClusterRoleBinding ArgoCD 3.x needs for kubectl auth reconcile (same pattern as clusters/mini/automation/).
    • dev-applications/automation/project.yaml — added mini/ci to destinations and a destinationServiceAccounts entry routing mini/ci syncs to ci-argocd. Ordering matters: ArgoCD's DeriveServiceAccountToImpersonate is first-match-wins, so the ci entry precedes the */* catch-all (which keeps automation-application on automation-kubetenantsetup). The SA name is prefixed with the app's destination namespace by ArgoCD, so the SA lives in ci.
    • dev-applications/automation/ci-application.yaml — new ArgoCD Application (project automation, kept in the same project as requested) syncing this repo's ci/ directory → mini/ci, prune+selfHeal.
  2. New top-level ci/ directory in this repo (not under k8s/): k8s/ is synced by automation-application into the automation namespace, whose destination SA has no RBAC in ci. The control plane now lives in ci/ and is deployed by ci-application as ci-argocd.
  3. JetStream stream sharing (design note): argo-events hardcodes the stream name to default, so the ci EventBus shares the same stream as the automation bus on the shared NATS cluster (identical streamConfig, no conflict). Subjects are default.<eventsourcename>.<eventname> — keep EventSource/event names in ci distinct from automation's to avoid subject collisions.
  4. Argo CLI v4 syntax: the ticket's example argo submit -n ci wf:go-build-push is v3 syntax; with the v4 CLI it's argo submit -n ci --from wftmpl/go-build-push. The CLI creates a Workflow with workflowTemplateRef (spec merged by the controller at runtime, so serviceAccountName: ci-build applies).

Acceptance criteria

  • ci namespace exists on mini; EventBus default Configured on the shared NATS JetStream cluster (jetstreamExotic, basic auth via the nats-auth ExternalSecret, Vault-backed)
  • go-build-push WorkflowTemplate available in ci
  • Manual submit argo submit -n ci --from wftmpl/go-build-push -p repo=https://git.animeteamspeak.moe/lab/authz-bridge -p ref=refs/tags/v0.1.1 → workflow go-build-push-kbwnv Succeeded (pod ran as ci-build — v4.0.3 executor requires the workflowtaskresults RBAC, which only that SA has)
  • Multi-arch image pushed: harbor.animeteamspeak.moe/library/authz-bridge:v0.1.1 is now an OCI index with linux/amd64 + linux/arm64 (replaced the previous single-arch v0.1.1 manifest; Harbor has no immutability rule on the library project)
  • Automation-namespace copy untouched: automation/go-build-push (18h), automation/tag-build sensor (Deployed), automation/default EventBus (22h) all unchanged; automation-application Synced/Healthy

Deliverables checklist

  • ci namespace + EventBus on shared NATS (existing basic-auth wiring, duplicated per-namespace as ci/nats-auth.yaml)
  • go-build-push template in ci (coexists with the automation-namespace copy)
  • Argo CD destination SA ci-argocd + RBAC (eventbus, sensors, workflows, workflowtemplates, serviceaccounts, roles/rolebindings, externalsecrets + read-only namespaces)
  • workflow-executor SA ci-build (workflowtaskresults Role/RoleBinding; Harbor push via mounted harbor-push config.json, not RBAC)
  • Harbor admin ExternalSecret harbor-push in ci (SecretSynced; per-project robots remain a later ticket)
## Implemented & verified (2026-09-22) All acceptance criteria pass. Two commits: `lab/clusters` (flux-clusters) `775ee64e` + `4d159c04`, `lab/automation` `cf57227`. ### Additional work beyond the ticket 1. **flux-clusters (lab/clusters) changes** — the ticket assumed the ArgoCD side already existed; it didn't: - `clusters/mini/ci/` — the `ci` Namespace, the `ci-argocd` destination SA, its Role/RoleBinding, and the read-only `namespaces` ClusterRole/ClusterRoleBinding ArgoCD 3.x needs for `kubectl auth reconcile` (same pattern as `clusters/mini/automation/`). - `dev-applications/automation/project.yaml` — added `mini/ci` to destinations and a `destinationServiceAccounts` entry routing mini/ci syncs to `ci-argocd`. Ordering matters: ArgoCD's `DeriveServiceAccountToImpersonate` is first-match-wins, so the ci entry precedes the `*`/`*` catch-all (which keeps automation-application on `automation-kubetenantsetup`). The SA name is prefixed with the app's destination namespace by ArgoCD, so the SA lives in `ci`. - `dev-applications/automation/ci-application.yaml` — new ArgoCD Application (project `automation`, kept in the same project as requested) syncing this repo's `ci/` directory → mini/ci, prune+selfHeal. 2. **New top-level `ci/` directory in this repo** (not under `k8s/`): `k8s/` is synced by automation-application into the automation namespace, whose destination SA has no RBAC in `ci`. The control plane now lives in `ci/` and is deployed by ci-application as `ci-argocd`. 3. **JetStream stream sharing (design note):** argo-events hardcodes the stream name to `default`, so the ci EventBus shares the same stream as the automation bus on the shared NATS cluster (identical streamConfig, no conflict). Subjects are `default.<eventsourcename>.<eventname>` — keep EventSource/event names in `ci` distinct from automation's to avoid subject collisions. 4. **Argo CLI v4 syntax:** the ticket's example `argo submit -n ci wf:go-build-push` is v3 syntax; with the v4 CLI it's `argo submit -n ci --from wftmpl/go-build-push`. The CLI creates a Workflow with `workflowTemplateRef` (spec merged by the controller at runtime, so `serviceAccountName: ci-build` applies). ### Acceptance criteria - [x] `ci` namespace exists on mini; EventBus `default` Configured on the shared NATS JetStream cluster (jetstreamExotic, basic auth via the `nats-auth` ExternalSecret, Vault-backed) - [x] `go-build-push` WorkflowTemplate available in `ci` - [x] Manual submit `argo submit -n ci --from wftmpl/go-build-push -p repo=https://git.animeteamspeak.moe/lab/authz-bridge -p ref=refs/tags/v0.1.1` → workflow `go-build-push-kbwnv` **Succeeded** (pod ran as `ci-build` — v4.0.3 executor requires the workflowtaskresults RBAC, which only that SA has) - [x] Multi-arch image pushed: `harbor.animeteamspeak.moe/library/authz-bridge:v0.1.1` is now an OCI index with linux/amd64 + linux/arm64 (replaced the previous single-arch v0.1.1 manifest; Harbor has no immutability rule on the library project) - [x] Automation-namespace copy untouched: `automation/go-build-push` (18h), `automation/tag-build` sensor (Deployed), `automation/default` EventBus (22h) all unchanged; automation-application Synced/Healthy ### Deliverables checklist - [x] ci namespace + EventBus on shared NATS (existing basic-auth wiring, duplicated per-namespace as `ci/nats-auth.yaml`) - [x] go-build-push template in ci (coexists with the automation-namespace copy) - [x] Argo CD destination SA `ci-argocd` + RBAC (eventbus, sensors, workflows, workflowtemplates, serviceaccounts, roles/rolebindings, externalsecrets + read-only namespaces) - [x] workflow-executor SA `ci-build` (workflowtaskresults Role/RoleBinding; Harbor push via mounted `harbor-push` config.json, not RBAC) - [x] Harbor admin ExternalSecret `harbor-push` in ci (SecretSynced; per-project robots remain a later ticket)
ginjiruu commented 2026-09-22 20:50:20 +00:00
Author
Owner
Copy link

Implemented and verified across lab/clusters (775ee64e, 4d159c04) and lab/automation (cf57227). All acceptance criteria pass: ci namespace + EventBus on the shared NATS, go-build-push template in ci, manual submit succeeded (go-build-push-kbwnv), multi-arch v0.1.1 in Harbor, automation-namespace central CI untouched. See the implementation comment for the ArgoCD project/app additions and the JetStream stream-sharing note.

Implemented and verified across lab/clusters (775ee64e, 4d159c04) and lab/automation (cf57227). All acceptance criteria pass: ci namespace + EventBus on the shared NATS, go-build-push template in ci, manual submit succeeded (go-build-push-kbwnv), multi-arch v0.1.1 in Harbor, automation-namespace central CI untouched. See the implementation comment for the ArgoCD project/app additions and the JetStream stream-sharing note.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
issue-9-central-allowlist
bridge-moodle-exporter
bridge-ghost-blog
bridge-advent-of-code-2015
bridge-gofantasy
0.0.1
Labels
Clear labels   
ready-for-agent
No labels
ready-for-agent
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/automation#7
No description provided.