---
title: "ADR-0006: Automated Data Seeding Strategy"
---

# ADR-0006: Automated Data Seeding Strategy

**Status:** Accepted

**Date:** 2026-05-14

**Deciders:** TBD

**Relates to:**
- [ADR-0003 (Waldur Proposal Workflow)](/adr/0003-waldur-proposal-workflow)
- [ADR-0005 (AAI → Waldur User Synchronization)](/adr/0005-aai-waldur-user-sync)

## Context

Themelio requires a fully automated, end-to-end data seeding process for development, staging, and CI environments. This process must provision a Waldur project and order, seed the `themelio-admin` user as project owner, add additional members as project managers, and mirror specified Git/LFS repositories from an external GitLab instance (e.g. `gitlab.grnet.gr`) into the internal one.

## Decision

We will implement an automated seeding strategy using a dedicated Kubernetes Job orchestrated via the existing `themelio` Ansible role. The Job runs a bash script rendered inline into the Job manifest by Ansible (no separate ConfigMap or script file). Required CLI tools are installed at runtime by an init container, keeping the base image minimal. Before deploying the seeder Job, the Ansible role also bootstraps the Waldur environment: creating a dedicated seeder user and provisioning the waldur order. The `gitlab-root-actor` requires no modifications — the existing impersonation token endpoint is sufficient for all repository write operations.

**See also:** [DD-0006: Implementation details](/dd/0006-automated-seeding-strategy)

---

## Decision Drivers

- **Security:** The remote gitlab external token is restricted to the short-lived Seeder Job. The internal GitLab is accessed only via a short-lived `themelio-admin` impersonation token — no root credentials are exposed to the Job.
- **Simplicity:** The GRA requires no modifications; the existing `POST /users/:user_id/impersonation_tokens` endpoint is sufficient.
- **Reliability:** Local clone-then-push gives full control over LFS data migration, which is error-prone when done via remote import.
- **Architectural Consistency:**  Creates a new Ansible role called `seed-initial-admin-data` and follows the established Root Actor pattern for internal GitLab access.

## Consequences

- **GRA not modified:** No new endpoints are needed; the seeder uses the existing impersonation token endpoint.
- **Storage requirements:** The Job must have sufficient ephemeral storage for the largest repository being seeded. Operator adjusts `themelio_seeder_ephemeral_storage` accordingly.
- **Network traffic:** Data is pulled to the Job and then pushed to internal GitLab, which doubles traffic versus a direct server-side import, but provides better isolation and LFS control.
- **Provisioning dependency:** Repository seeding only starts after the readiness poll confirms that `waldur-k8s-site-agent` has provisioned the `themelio-admin` GitLab user and the expected subgroups.
- **Script versioning:** Because the bash script is baked into the Job manifest by Ansible, the script version is tied directly to the Ansible role version — there is no separate script artifact to manage.
- **Waldur bootstrap is a pre-requisite:** The Ansible role must successfully create the dedicated Waldur seeder user and the cloud offering before the seeder Job is deployed. These steps are idempotent — they are skipped if the resources already exist.

## Open Questions

**How will Waldur have AAI users available to be added to the seeder project? (skip for now, revisit later)**

When the seeder calls the Waldur API to add members to the project, Waldur must already know these users — they must exist in Waldur's user database. It is not yet decided how AAI-federated users will be pre-populated in Waldur before the seeder runs. Options include:

- **(a)** Requiring users to have logged in at least once via AAI, which triggers automatic Waldur user creation.
- **(b)** Pre-creating users via Waldur's user import API as part of the Ansible bootstrap.
- **(c)** Relying on [ADR-0005 (AAI → Waldur User Synchronization)](/adr/0005-aai-waldur-user-sync) to have already run and populated Waldur users before seeding begins.

This needs investigation before the seeder's "add project managers" step can be fully implemented.