T7: Root wiring + pilot apps (integration) #9

New issue

Open

opened 2026-08-11 15:20:44 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-08-11 15:20:44 +00:00

Owner

Parent

Spec: catalog-driven app bootstrapping and capability groups (#2)

What to build

The integration slice where everything meets: all five roots read the same catalog and plan together for the pilot apps (privatebin, syncthing), with the platform-operator note in the docs. The Argo CD root (T9, iac single-repo: live argocd_project per app via the argoproj-labs/argocd provider, role->group bindings) superseded the earlier flux-clusters manifests approach. Green tofu validate + tofu plan end-to-end.

Acceptance criteria

kanidm, forgejo, k8s, vault, argocd roots all read the same apps/catalog.yaml and plan together
pilot apps (privatebin, syncthing) fully bootstrap: namespace, kanidm groups+root, forgejo org/repos/teams, vault identity groups, argocd AppProject with role->group bindings (T9)
CONTEXT/README document the platform-operator actor vs app principals
tofu validate + tofu plan green for all five roots on the pilot catalog
task validate-argocd-rbac green for the pilot apps (ADR-0007 matrix)
tofu-controller on mini syncs all five roots with per-root runner credentials — separate ticket T10 (#25)

Blocked by

T2: Kanidm capability groups module (#5) — closed
T3: Forgejo org/repos/teams module (#4) — closed
T4: k8s namespace + capability Roles (#7) — closed
T5: Vault per-app identity groups + policies (#6) — closed
T6: Argo CD AppProject roles (catalog input shape) (#8) — closed

T8: k8s-apiserver OIDC flags (#11) runs parallel in flux-clusters — not a blocker.
T10: tofu-controller sync for provider roots (#25) runs after — the roots must plan green here first.

## Parent Spec: catalog-driven app bootstrapping and capability groups (#2) ## What to build The integration slice where everything meets: all five roots read the same catalog and plan together for the pilot apps (privatebin, syncthing), with the platform-operator note in the docs. The Argo CD root (T9, iac single-repo: live `argocd_project` per app via the `argoproj-labs/argocd` provider, role->group bindings) superseded the earlier flux-clusters manifests approach. Green `tofu validate` + `tofu plan` end-to-end. ## Acceptance criteria - [ ] kanidm, forgejo, k8s, vault, argocd roots all read the same `apps/catalog.yaml` and plan together - [ ] pilot apps (privatebin, syncthing) fully bootstrap: namespace, kanidm groups+root, forgejo org/repos/teams, vault identity groups, argocd AppProject with role->group bindings (T9) - [ ] CONTEXT/README document the `platform-operator` actor vs app principals - [ ] `tofu validate` + `tofu plan` green for all five roots on the pilot catalog - [ ] `task validate-argocd-rbac` green for the pilot apps (ADR-0007 matrix) - [ ] tofu-controller on mini syncs all five roots with per-root runner credentials — separate ticket T10 (#25) ## Blocked by - T2: Kanidm capability groups module (#5) — closed - T3: Forgejo org/repos/teams module (#4) — closed - T4: k8s namespace + capability Roles (#7) — closed - T5: Vault per-app identity groups + policies (#6) — closed - T6: Argo CD AppProject roles (catalog input shape) (#8) — closed T8: k8s-apiserver OIDC flags (#11) runs parallel in flux-clusters — not a blocker. T10: tofu-controller sync for provider roots (#25) runs after — the roots must plan green here first.

ginjiruu added the

ready-for-agent

label

2026-08-11 15:20:59 +00:00

ginjiruu referenced this issue

2026-08-11 20:26:35 +00:00

T7: rename argo root to argocd #24

ginjiruu referenced this issue

2026-08-11 20:32:58 +00:00

T10: tofu-controller sync for provider roots (flux-clusters) #25

ginjiruu referenced this issue

2026-08-12 01:16:04 +00:00