Multi-cluster catalog: cluster registry + per-app deployment targets #32

New issue

Open

opened 2026-08-12 16:01:24 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-08-12 16:01:24 +00:00

Owner

Multi-cluster catalog: cluster registry + per-app deployment targets

Part of the multi-cluster architecture. Establishes how an application
"requests deployment to multiple clusters" and how each system root learns
about it, mirroring Argo CD's model (clusters registered once; AppProjects
hold a list of destinations).

What changed

`apps/clusters.yaml` (new) — cluster registry

The canonical fleet. Each cluster carries its argo_server (the apiserver URL
Argo CD targets it by). Currently mini, portable, remote; clusters are
added when they first host an app deployment.

`apps/catalog.yaml` — per-app `deployments`

Replaces the single namespace field with a deployments map:

apps:
  privatebin:
    deployments:
      mini:
        namespace: privatebin
    ...

An app targeting a new cluster is a one-line catalog addition. Pilot apps
(privatebin, syncthing) stay on mini only.

Consumers threaded

argocd/: AppProject destination blocks are now a dynamic over the
app's deployments, with server from the cluster registry (was a hardcoded
mini destination). New argocd_cluster resource registers catalog
clusters — gated behind var.register_clusters (default false) until
cluster credentials exist (T13 #28).
k8s/: tenant module takes the deployments map; namespace derived from
the primary (mini) deployment. Per-cluster rendering (one bundle per
target, delivered by Sveltos) is the follow-on (research #31).

Out of scope / follow-ons

Registering clusters in Argo CD with working credentials (T13 #28)
Per-cluster k8s bundle rendering via Sveltos (research #31, T10 #25 wiring)
Vault per-cluster k8s auth roles (T14 #29) — already keyed by cluster; the
catalog namespace shape here is compatible (roles bind per deployments)
Firewalled-cluster reachability (T13 #28)

Verification

tofu validate green on all five roots (argocd, forgejo, k8s, kanidm, vault)
scripts/validate-argocd-rbac.sh passes (50/50)
tofu plan on argocd shows destinations expanded per deployment
tofu plan on k8s shows namespaces derived from deployments

## Multi-cluster catalog: cluster registry + per-app deployment targets Part of the multi-cluster architecture. Establishes how an application "requests deployment to multiple clusters" and how each system root learns about it, mirroring Argo CD's model (clusters registered once; AppProjects hold a list of destinations). ## What changed ### `apps/clusters.yaml` (new) — cluster registry The canonical fleet. Each cluster carries its `argo_server` (the apiserver URL Argo CD targets it by). Currently `mini`, `portable`, `remote`; clusters are added when they first host an app deployment. ### `apps/catalog.yaml` — per-app `deployments` Replaces the single `namespace` field with a `deployments` map: ```yaml apps: privatebin: deployments: mini: namespace: privatebin ... ``` An app targeting a new cluster is a one-line catalog addition. Pilot apps (`privatebin`, `syncthing`) stay on `mini` only. ### Consumers threaded - **argocd/**: AppProject `destination` blocks are now a `dynamic` over the app's `deployments`, with server from the cluster registry (was a hardcoded `mini` destination). New `argocd_cluster` resource registers catalog clusters — gated behind `var.register_clusters` (default false) until cluster credentials exist (T13 #28). - **k8s/**: tenant module takes the `deployments` map; namespace derived from the primary (`mini`) deployment. Per-cluster rendering (one bundle per target, delivered by Sveltos) is the follow-on (research #31). ## Out of scope / follow-ons - Registering clusters in Argo CD with working credentials (T13 #28) - Per-cluster k8s bundle rendering via Sveltos (research #31, T10 #25 wiring) - Vault per-cluster k8s auth roles (T14 #29) — already keyed by cluster; the catalog namespace shape here is compatible (roles bind per `deployments`) - Firewalled-cluster reachability (T13 #28) ## Verification - `tofu validate` green on all five roots (argocd, forgejo, k8s, kanidm, vault) - `scripts/validate-argocd-rbac.sh` passes (50/50) - `tofu plan` on argocd shows destinations expanded per deployment - `tofu plan` on k8s shows namespaces derived from `deployments`

ginjiruu referenced this issue from a pull request that will close it,

2026-08-12 16:01:47 +00:00

Multi-cluster catalog: cluster registry + per-app deployment targets #33

ginjiruu referenced this issue

2026-08-12 16:50:32 +00:00

Argo CD: in-place migration of cluster auth from static SA to Kanidm SA + OIDC #37

~~ginjiruu referenced this issue 2026-08-12 16:51:36 +00:00~~

Research: short-lived id_token refresh for static cluster credentials #38