feat: deploy ADR-0026 quota enforcement (quota-cm) #76
Loading…
Reference in a new issue
No description provided.
Delete branch "port/quota-controller-deployment"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Ports feat/quota-controller-deployment onto the current layout. That branch is
based 52 commits behind main, before the directory restructure and the move of
KCP workspace delivery from ArgoCD to Flux, so every path it touched is gone and
argocd/kcp-controllers-workspaces.yaml, which it modified, no longer exists.
The manifests are carried over unchanged — the APIExport, both
APIResourceSchemas, the quota-cm RBAC, the root:orgs APIBinding, the
ExternalSecret and the values are byte-identical. Only placement and wiring
differ:
kcp-controllers-workspaces/quota.yaml -> workspaces/controllers/quota.yaml
edge-connect-kcp-controllers-quota/manifests -> workspaces/controllers-quota/
edge-connect-kcp-orgs/manifests/* -> workspaces/orgs/quota-apibinding.yaml
edge-connect-quota/manifests/* -> cluster/quota-cm/
quota-cm-values-dev.yaml -> env/{dev,local}/quota-cm.yaml
Two pieces are deliberately dropped rather than ported. The
kcp-controllers-quota ArgoCD cluster registration in kcp/base/argo.yaml carried
a shared cluster-admin client certificate, and those were retired in favour of
projected tokens. The edge-connect-quota-apiexports ApplicationSet pushed the
export into KCP through that registration; workspace delivery is Flux's now, so
that half is flux/stages/controllers-quota.yaml — a bootstrap foothold, then the
export and its RBAC in one stage, since RBAC naming an APIExport that does not
exist yet applies cleanly and simply grants nothing until it does.
Three things Flux needs that the ArgoCD version did not:
asks the reader to keep its list aligned with workspaces/ and flux/stages by
hand, so check-references.sh now asserts every stage's kubeConfig key exists
in the Secret. Verified by renaming the key: two failures, then clean.
APIBinding whose APIExport lives in the quota workspace, and an APIBinding
without its export sits unbound rather than failing, so waiting for it is
declared rather than left to retries.
check-app-lists.sh derives it from the rendered overlays and failed on 27.
The generator element carries
env: devand the chart reads$values/env/{{env}}/quota-cm.yaml, so local resolves env/local/quota-cm.yaml,
which differs only in the KCP audience.
Not yet deployed. Every reference resolves and the stage graph builds, but a
cold
make foundation && make controllersis what would prove the new stagesreconcile.
Ports feat/quota-controller-deployment onto the current layout. That branch is based 52 commits behind main, before the directory restructure and the move of KCP workspace delivery from ArgoCD to Flux, so every path it touched is gone and argocd/kcp-controllers-workspaces.yaml, which it modified, no longer exists. The manifests are carried over unchanged — the APIExport, both APIResourceSchemas, the quota-cm RBAC, the root:orgs APIBinding, the ExternalSecret and the values are byte-identical. Only placement and wiring differ: kcp-controllers-workspaces/quota.yaml -> workspaces/controllers/quota.yaml edge-connect-kcp-controllers-quota/manifests -> workspaces/controllers-quota/ edge-connect-kcp-orgs/manifests/* -> workspaces/orgs/quota-apibinding.yaml edge-connect-quota/manifests/* -> cluster/quota-cm/ quota-cm-values-dev.yaml -> env/{dev,local}/quota-cm.yaml Two pieces are deliberately dropped rather than ported. The kcp-controllers-quota ArgoCD cluster registration in kcp/base/argo.yaml carried a shared cluster-admin client certificate, and those were retired in favour of projected tokens. The edge-connect-quota-apiexports ApplicationSet pushed the export into KCP through that registration; workspace delivery is Flux's now, so that half is flux/stages/controllers-quota.yaml — a bootstrap foothold, then the export and its RBAC in one stage, since RBAC naming an APIExport that does not exist yet applies cleanly and simply grants nothing until it does. Three things Flux needs that the ArgoCD version did not: - a controllers-quota key in cluster/flux/base/kubeconfigs.yaml. That file asks the reader to keep its list aligned with workspaces/ and flux/stages by hand, so check-references.sh now asserts every stage's kubeConfig key exists in the Secret. Verified by renaming the key: two failures, then clean. - kcp-orgs-rbac dependsOn kcp-controllers-quota. workspaces/orgs gained an APIBinding whose APIExport lives in the quota workspace, and an APIBinding without its export sits unbound rather than failing, so waiting for it is declared rather than left to retries. - the hardcoded Flux Kustomization wait, 27 -> 29. Not counted by hand: check-app-lists.sh derives it from the rendered overlays and failed on 27. The generator element carries `env: dev` and the chart reads $values/env/{{env}}/quota-cm.yaml, so local resolves env/local/quota-cm.yaml, which differs only in the KCP audience. Not yet deployed. Every reference resolves and the stage graph builds, but a cold `make foundation && make controllers` is what would prove the new stages reconcile.View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.