feat: deploy ADR-0026 quota enforcement (quota-cm) #76

Open
waldemar.kindler wants to merge 1 commit from port/quota-controller-deployment into main

Ports feat/quota-controller-deployment onto the current layout. That branch is
based 52 commits behind main, before the directory restructure and the move of
KCP workspace delivery from ArgoCD to Flux, so every path it touched is gone and
argocd/kcp-controllers-workspaces.yaml, which it modified, no longer exists.

The manifests are carried over unchanged — the APIExport, both
APIResourceSchemas, the quota-cm RBAC, the root:orgs APIBinding, the
ExternalSecret and the values are byte-identical. Only placement and wiring
differ:

kcp-controllers-workspaces/quota.yaml -> workspaces/controllers/quota.yaml
edge-connect-kcp-controllers-quota/manifests -> workspaces/controllers-quota/
edge-connect-kcp-orgs/manifests/* -> workspaces/orgs/quota-apibinding.yaml
edge-connect-quota/manifests/* -> cluster/quota-cm/
quota-cm-values-dev.yaml -> env/{dev,local}/quota-cm.yaml

Two pieces are deliberately dropped rather than ported. The
kcp-controllers-quota ArgoCD cluster registration in kcp/base/argo.yaml carried
a shared cluster-admin client certificate, and those were retired in favour of
projected tokens. The edge-connect-quota-apiexports ApplicationSet pushed the
export into KCP through that registration; workspace delivery is Flux's now, so
that half is flux/stages/controllers-quota.yaml — a bootstrap foothold, then the
export and its RBAC in one stage, since RBAC naming an APIExport that does not
exist yet applies cleanly and simply grants nothing until it does.

Three things Flux needs that the ArgoCD version did not:

  • a controllers-quota key in cluster/flux/base/kubeconfigs.yaml. That file
    asks the reader to keep its list aligned with workspaces/ and flux/stages by
    hand, so check-references.sh now asserts every stage's kubeConfig key exists
    in the Secret. Verified by renaming the key: two failures, then clean.
  • kcp-orgs-rbac dependsOn kcp-controllers-quota. workspaces/orgs gained an
    APIBinding whose APIExport lives in the quota workspace, and an APIBinding
    without its export sits unbound rather than failing, so waiting for it is
    declared rather than left to retries.
  • the hardcoded Flux Kustomization wait, 27 -> 29. Not counted by hand:
    check-app-lists.sh derives it from the rendered overlays and failed on 27.

The generator element carries env: dev and the chart reads
$values/env/{{env}}/quota-cm.yaml, so local resolves env/local/quota-cm.yaml,
which differs only in the KCP audience.

Not yet deployed. Every reference resolves and the stage graph builds, but a
cold make foundation && make controllers is what would prove the new stages
reconcile.

Ports feat/quota-controller-deployment onto the current layout. That branch is based 52 commits behind main, before the directory restructure and the move of KCP workspace delivery from ArgoCD to Flux, so every path it touched is gone and argocd/kcp-controllers-workspaces.yaml, which it modified, no longer exists. The manifests are carried over unchanged — the APIExport, both APIResourceSchemas, the quota-cm RBAC, the root:orgs APIBinding, the ExternalSecret and the values are byte-identical. Only placement and wiring differ: kcp-controllers-workspaces/quota.yaml -> workspaces/controllers/quota.yaml edge-connect-kcp-controllers-quota/manifests -> workspaces/controllers-quota/ edge-connect-kcp-orgs/manifests/* -> workspaces/orgs/quota-apibinding.yaml edge-connect-quota/manifests/* -> cluster/quota-cm/ quota-cm-values-dev.yaml -> env/{dev,local}/quota-cm.yaml Two pieces are deliberately dropped rather than ported. The kcp-controllers-quota ArgoCD cluster registration in kcp/base/argo.yaml carried a shared cluster-admin client certificate, and those were retired in favour of projected tokens. The edge-connect-quota-apiexports ApplicationSet pushed the export into KCP through that registration; workspace delivery is Flux's now, so that half is flux/stages/controllers-quota.yaml — a bootstrap foothold, then the export and its RBAC in one stage, since RBAC naming an APIExport that does not exist yet applies cleanly and simply grants nothing until it does. Three things Flux needs that the ArgoCD version did not: - a controllers-quota key in cluster/flux/base/kubeconfigs.yaml. That file asks the reader to keep its list aligned with workspaces/ and flux/stages by hand, so check-references.sh now asserts every stage's kubeConfig key exists in the Secret. Verified by renaming the key: two failures, then clean. - kcp-orgs-rbac dependsOn kcp-controllers-quota. workspaces/orgs gained an APIBinding whose APIExport lives in the quota workspace, and an APIBinding without its export sits unbound rather than failing, so waiting for it is declared rather than left to retries. - the hardcoded Flux Kustomization wait, 27 -> 29. Not counted by hand: check-app-lists.sh derives it from the rendered overlays and failed on 27. The generator element carries `env: dev` and the chart reads $values/env/{{env}}/quota-cm.yaml, so local resolves env/local/quota-cm.yaml, which differs only in the KCP audience. Not yet deployed. Every reference resolves and the stage graph builds, but a cold `make foundation && make controllers` is what would prove the new stages reconcile.
feat: deploy ADR-0026 quota enforcement (quota-cm)
All checks were successful
validate / validate (pull_request) Successful in 39s
c9de3ecabb
Ports feat/quota-controller-deployment onto the current layout. That branch is
based 52 commits behind main, before the directory restructure and the move of
KCP workspace delivery from ArgoCD to Flux, so every path it touched is gone and
argocd/kcp-controllers-workspaces.yaml, which it modified, no longer exists.

The manifests are carried over unchanged — the APIExport, both
APIResourceSchemas, the quota-cm RBAC, the root:orgs APIBinding, the
ExternalSecret and the values are byte-identical. Only placement and wiring
differ:

  kcp-controllers-workspaces/quota.yaml        -> workspaces/controllers/quota.yaml
  edge-connect-kcp-controllers-quota/manifests -> workspaces/controllers-quota/
  edge-connect-kcp-orgs/manifests/*            -> workspaces/orgs/quota-apibinding.yaml
  edge-connect-quota/manifests/*               -> cluster/quota-cm/
  quota-cm-values-dev.yaml                     -> env/{dev,local}/quota-cm.yaml

Two pieces are deliberately dropped rather than ported. The
kcp-controllers-quota ArgoCD cluster registration in kcp/base/argo.yaml carried
a shared cluster-admin client certificate, and those were retired in favour of
projected tokens. The edge-connect-quota-apiexports ApplicationSet pushed the
export into KCP through that registration; workspace delivery is Flux's now, so
that half is flux/stages/controllers-quota.yaml — a bootstrap foothold, then the
export and its RBAC in one stage, since RBAC naming an APIExport that does not
exist yet applies cleanly and simply grants nothing until it does.

Three things Flux needs that the ArgoCD version did not:

  - a controllers-quota key in cluster/flux/base/kubeconfigs.yaml. That file
    asks the reader to keep its list aligned with workspaces/ and flux/stages by
    hand, so check-references.sh now asserts every stage's kubeConfig key exists
    in the Secret. Verified by renaming the key: two failures, then clean.
  - kcp-orgs-rbac dependsOn kcp-controllers-quota. workspaces/orgs gained an
    APIBinding whose APIExport lives in the quota workspace, and an APIBinding
    without its export sits unbound rather than failing, so waiting for it is
    declared rather than left to retries.
  - the hardcoded Flux Kustomization wait, 27 -> 29. Not counted by hand:
    check-app-lists.sh derives it from the rendered overlays and failed on 27.

The generator element carries `env: dev` and the chart reads
$values/env/{{env}}/quota-cm.yaml, so local resolves env/local/quota-cm.yaml,
which differs only in the KCP audience.

Not yet deployed. Every reference resolves and the stage graph builds, but a
cold `make foundation && make controllers` is what would prove the new stages
reconcile.
All checks were successful
validate / validate (pull_request) Successful in 39s
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin port/quota-controller-deployment:port/quota-controller-deployment
git switch port/quota-controller-deployment

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff port/quota-controller-deployment
git switch port/quota-controller-deployment
git rebase main
git switch main
git merge --ff-only port/quota-controller-deployment
git switch port/quota-controller-deployment
git rebase main
git switch main
git merge --no-ff port/quota-controller-deployment
git switch main
git merge --squash port/quota-controller-deployment
git switch main
git merge --ff-only port/quota-controller-deployment
git switch main
git merge port/quota-controller-deployment
git push origin main
Sign in to join this conversation.
No reviewers
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
DevFW-CICD/poc-core-deploy!76
No description provided.