lab/iac
1
0
Fork 0
Code Issues 11 Pull requests 3 Projects Releases Packages Wiki Activity Actions

Multi-cluster catalog: cluster registry + per-app deployment targets #33

Open
ginjiruu wants to merge 2 commits from t15-multicluster-catalog into master
pull from: t15-multicluster-catalog
merge into: lab:master
Conversation 0 Commits 2 Files changed 9 +219 -16
ginjiruu commented 2026-08-12 16:01:47 +00:00
Owner
Copy link

Closes #32

Multi-cluster catalog: cluster registry + per-app deployment targets

Part of the multi-cluster architecture. Establishes how an application
"requests deployment to multiple clusters" and how each system root learns
about it, mirroring Argo CD's model (clusters registered once; AppProjects
hold a list of destinations).

What changed

apps/clusters.yaml (new) — cluster registry

The canonical fleet. Each cluster carries its argo_server (the apiserver URL
Argo CD targets it by). Currently mini, portable, remote; clusters are
added when they first host an app deployment.

apps/catalog.yaml — per-app deployments

Replaces the single namespace field with a deployments map:

apps:
  privatebin:
    deployments:
      mini:
        namespace: privatebin
    ...

An app targeting a new cluster is a one-line catalog addition. Pilot apps
(privatebin, syncthing) stay on mini only.

Consumers threaded

  • argocd/: AppProject destination blocks are now a dynamic over the
    app's deployments, with server from the cluster registry (was a hardcoded
    mini destination). New argocd_cluster resource registers catalog
    clusters — gated behind var.register_clusters (default false) until
    cluster credentials exist (T13 #28).
  • k8s/: tenant module takes the deployments map; namespace derived from
    the primary (mini) deployment. Per-cluster rendering (one bundle per
    target, delivered by Sveltos) is the follow-on (research #31).

Out of scope / follow-ons

  • Registering clusters in Argo CD with working credentials (T13 #28)
  • Per-cluster k8s bundle rendering via Sveltos (research #31, T10 #25 wiring)
  • Vault per-cluster k8s auth roles (T14 #29) — already keyed by cluster; the
    catalog namespace shape here is compatible (roles bind per deployments)
  • Firewalled-cluster reachability (T13 #28)

Verification

  • tofu validate green on all five roots (argocd, forgejo, k8s, kanidm, vault)
  • scripts/validate-argocd-rbac.sh passes (50/50)
  • tofu plan on argocd shows destinations expanded per deployment
  • tofu plan on k8s shows namespaces derived from deployments
Closes #32 ## Multi-cluster catalog: cluster registry + per-app deployment targets Part of the multi-cluster architecture. Establishes how an application "requests deployment to multiple clusters" and how each system root learns about it, mirroring Argo CD's model (clusters registered once; AppProjects hold a list of destinations). ## What changed ### `apps/clusters.yaml` (new) — cluster registry The canonical fleet. Each cluster carries its `argo_server` (the apiserver URL Argo CD targets it by). Currently `mini`, `portable`, `remote`; clusters are added when they first host an app deployment. ### `apps/catalog.yaml` — per-app `deployments` Replaces the single `namespace` field with a `deployments` map: ```yaml apps: privatebin: deployments: mini: namespace: privatebin ... ``` An app targeting a new cluster is a one-line catalog addition. Pilot apps (`privatebin`, `syncthing`) stay on `mini` only. ### Consumers threaded - **argocd/**: AppProject `destination` blocks are now a `dynamic` over the app's `deployments`, with server from the cluster registry (was a hardcoded `mini` destination). New `argocd_cluster` resource registers catalog clusters — gated behind `var.register_clusters` (default false) until cluster credentials exist (T13 #28). - **k8s/**: tenant module takes the `deployments` map; namespace derived from the primary (`mini`) deployment. Per-cluster rendering (one bundle per target, delivered by Sveltos) is the follow-on (research #31). ## Out of scope / follow-ons - Registering clusters in Argo CD with working credentials (T13 #28) - Per-cluster k8s bundle rendering via Sveltos (research #31, T10 #25 wiring) - Vault per-cluster k8s auth roles (T14 #29) — already keyed by cluster; the catalog namespace shape here is compatible (roles bind per `deployments`) - Firewalled-cluster reachability (T13 #28) ## Verification - `tofu validate` green on all five roots (argocd, forgejo, k8s, kanidm, vault) - `scripts/validate-argocd-rbac.sh` passes (50/50) - `tofu plan` on argocd shows destinations expanded per deployment - `tofu plan` on k8s shows namespaces derived from `deployments` 
Add apps/clusters.yaml (cluster registry: mini, portable, remote) and replace
the per-app single namespace with a deployments map (cluster -> namespace), so
an app requesting deployment to a new cluster is a one-line catalog addition.

Thread the new shape through the cluster-aware roots:
- argocd: AppProject destinations expand one per deployment (server from the
  cluster registry, replacing the hardcoded mini destination); add argocd_cluster
  registration gated behind var.register_clusters (false until T13 credentials).
- k8s: tenant module consumes the deployments map; namespace derived from the
  primary (mini) deployment. Per-cluster rendering via Sveltos is the follow-on.

RBAC validation unaffected; all five roots validate.
ClusterProfile selection labels (sveltos.io/fleet, sveltos.io/vault-secrets-operator)
declare which infrastructure tier each cluster runs, so one Sveltos ClusterProfile
on mini (referencing the flux-system GitRepository) can replace the per-cluster
pointer files in flux-clusters. Document the Sveltos×Flux integration and the
ordering gate (CRDs before profiles) in plans/sveltos-flux-integration.md.
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin t15-multicluster-catalog:t15-multicluster-catalog
git switch t15-multicluster-catalog

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch master
git merge --no-ff t15-multicluster-catalog
git switch t15-multicluster-catalog
git rebase master
git switch master
git merge --ff-only t15-multicluster-catalog
git switch t15-multicluster-catalog
git rebase master
git switch master
git merge --no-ff t15-multicluster-catalog
git switch master
git merge --squash t15-multicluster-catalog
git switch master
git merge --ff-only t15-multicluster-catalog
git switch master
git merge t15-multicluster-catalog
git push origin master
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
needs-info
Waiting on reporter for more information

  
needs-triage
Maintainer needs to evaluate this issue

  
ready-for-agent
Fully specified, ready for an AFK agent

  
ready-for-human
Requires human implementation

  
wontfix
Will not be actioned

No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
lab/iac!33
No description provided.