#0039 — Development Argo CD bootstrap and ownership

Status: Proposed for review. The authorised development implementation is qualified; wider platform approval remains pending.

Date: 2026-10-13.

Deciders: ikons authorises the development implementation and live test. Wider platform approval remains pending.

Related DD: DD-0039.

#Authority and context

This is technical platform infrastructure configuration and reconciliation. The owned fact is the delivered Git revision and its explicit resource ownership. Resolving desired configuration is an administration query; bootstrap, sync and ownership recovery are administration commands. There is no new business bounded context or aggregate. Metallo's business registries remain unchanged.

ADR-0038 established an Ansible-owned mesh, host edge and Helm routes release. Argo CD must adopt that release without replacing existing resource identities, competing with Helm, or changing application, identity and storage authority. The implementation is stacked on #668, above the merged #659 AAI bindings.

#Decision

Use a currently supported, patched Argo CD 3.x release. Commit exact chart checksums and image digests, including Git transport and Redis. Bootstrap and self-management consume the same committed chart and values. Verify upstream support and Kubernetes compatibility when choosing and upgrading the pins.

The development controller delivers the checkout to a private in-cluster Git server. GitHub credentials never enter the VM. Roots and children select the exact delivered commit, including changes tested before GitHub publication. Only tracked source is delivered; private state, credentials and ignored files are excluded. Private transport storage is persistent and recoverable from the operator's checkout. Git has no receive-pack or publicly exposed port.

Use the platform AppProject with explicit repository, destination and kind allowlists. Exclude metallo-devbox and pharos-fresh. Self-management permission is limited to required infrastructure kinds; never grant all cluster kinds to permit the project to manage itself. Keep project policy under bootstrap administration unless its exact self-management authority is justified.

Use two verified API bindings to the same development cluster: self-management at https://kubernetes.default.svc:443 caches only argocd, while route management at https://kubernetes.default.svc.cluster.local caches only route kinds in its allowlisted namespaces. Both use the caller's rotating projected ServiceAccount token and public Kubernetes CA. Neither contains administrator credentials. This avoids the engine's assumption of uniform kind permissions across cached namespaces without granting access to backend Secrets. Disable the implicit in-cluster binding. Namespace/kind and RBAC changes require matching qualification.

The default project has no repository or destination grants. Bootstrap owns project policy, Git transport, API bindings and cross-namespace route rights. Admission rejects Argo ServiceAccount changes to the platform/default projects. Self-management can bind/escalate only the named Argo roles it must reconcile; its cluster role has explicit resource kinds and names, not a universal grant.

Ansible bootstraps Argo once. A durable ownership record fences Helm before Argo adoption. Application existence alone does not establish successful handover; unhealthy and interrupted states retry the selected writer. A completed handover never triggers another parallel helm upgrade. Recovery explicitly suspends Argo before returning a release to Ansible.

The first root contains only Argo self-management and platform routes. Child Application health is propagated. Readiness requires every selected Application to be Synced, Healthy and at the expected revision, with no failed/running operation. Root readiness alone is insufficient.

Adopt the existing pharos-platform-routes resources in istio-system, including paired backend NetworkPolicies. Preserve names, UIDs and Helm history. Render with the same catalogue/environment plus resolved profiles, chart source checksum and authoritative Ceph certificate fingerprint. Preview the exact resource diff before first sync. Disable destructive prune and replacement.

Ansible retains public trust Secret renewal, host TLS/Nginx, native Runtime bindings, Kubernetes, Ceph and Istio ownership. Route Helm reconciliation is fenced independently from trust renewal. Trust or profile changes after adoption must update Argo's desired inputs and pass exact health gates; a stale or missing owner record fails closed. No backend TLS validation is bypassed for adoption.

Expose the authenticated Argo UI through a management route in the existing catalogue, development CA and shared gateway. No anonymous access, new public NodePort, application injection or second Nginx writer is introduced.

The chart's upstream server NetworkPolicy admits all ingress. Replace its four policy resources under the same names/UIDs in the wrapper chart; the server admits only the catalogue's paired gateway policy, and Redis/repository peers remain local and explicit. Kubernetes policies do not establish native host-job isolation.

#Consequences and qualification

Development deployment can test exact source before publishing to GitHub. Operators retain the existing issuer, CA, PVCs, Secrets and application data. The additional controller and Git storage need explicit lifecycle and recovery. The local transport is development-only; shared/staging GitHub App access and Image Updater require later decisions and qualification.

Source checks include strict rendering, supply-chain checks, project/destination negatives, ownership/retry cases and large-file review. Live qualification covers first sync, unchanged repeat, drift correction, interruption/retry and rollback with one writer at a time, alongside affected AAI/Icarus/Site/Ceph lanes. Results and skipped lanes are recorded separately from architectural approval.

Upstream references: support policy, chart, resource tracking.

Page source

Source snapshot · Revision f928834c8.