feat/fleet-cd-staging-deploy #310

johnride · 2026-05-29T18:55:47Z

johnride commented

2026-05-29 18:55:47 +00:00

No description provided.

johnride added 3 commits 2026-05-29 18:55:48 +00:00

feat(fleet): clickable CD deploy of the operator to staging 245d7dd9a5

Adds the deploy half of fleet-operator CD: a manual workflow_dispatch
that installs a published operator chart version via harmony apply,
run from an in-cluster, permissionless runner.

- FleetDeploySecrets (#[config(secret)]) loaded via ConfigClient: the
  published-chart path is Zitadel-SSO-only by construction — operator
  credentials + deployer kubeconfig come from OpenBao, no user/pass
  field reachable. user/pass stays a dev-only rendered-chart flag.
- FleetOperatorScore::credentials() so the published-chart path applies
  the operator Secret (was a no-op).
- Deprecate SecretManager in favour of harmony_config::ConfigClient.

refactor(fleet): densify CD deploy comments — WHY-only, no narration 96d78f8671

feat(fleet): deploy by release tag, not a typed version

Run Check Script / check (pull_request) Successful in 2m22s

Details

8736efc29e

The deploy workflow took a hand-typed chart version (a second source of
truth, typo-prone). Take a --from-tag instead and parse the version in
Rust via the existing version_from_tag — the tag is the single source of
truth and YAML never parses it. --operator-chart-version stays for the
laptop path.

johnride added 1 commit 2026-05-29 19:18:44 +00:00

refactor(fleet): deploy binary is operator-only — load config, run one Score

Run Check Script / check (pull_request) Successful in 2m32s

Details

7f76c9e81f

The binary carried a dev nats+operator+agent stack with user/pass flags
that no automated caller used (the e2e harness composes those Scores
from the lib directly). Cut it: main.rs is now load FleetDeploySecrets →
run one FleetOperatorScore. 265→118 lines. Matches ADR-023 (one Score
per component, compose upward).

johnride added 4 commits 2026-05-29 21:50:49 +00:00

docs(fleet): manual staging deploy is interim; drop premature CD workflow d687b29f35

Full in-cluster CD is blocked on headless OpenBao auth (Zitadel machine
identity), so the clickable deploy-staging workflow + its runner would be
dead config. Drop it; document the manual operator deploy (same secure
OpenBao-config path) until the auth flow lands.

feat(openbao): optional cert-manager ingress TLS 1f525cd5d1

OpenbaoScore.tls_issuer: Some(issuer) adds the cert-manager
cluster-issuer annotation + tls block (edge TLS, listener stays plain);
None keeps plain HTTP. Option<String> not bool — cert-manager needs the
issuer name. Rendering extracted to values() and covered by tests.

refactor(openbao): share OpenbaoInstance across deploy + setup scores

Run Check Script / check (pull_request) Successful in 2m21s

Details

7638611b9f

namespace/release/pod were duplicated as independent literals across
OpenbaoScore (hardcoded) and OpenbaoSetupScore (defaults) — pod was a
derived fact (`{release}-0`) stored as a literal that rots if release
changes, and namespace agreement was by coincidence. Introduce
OpenbaoInstance { namespace, release } with a derived pod(); both scores
take it. Only the shared identity moves; per-score knobs (host, tls,
kv_mount, policies, …) stay on their owner.

Merge pull request 'refactor/openbao-instance' (#312 ) from refactor/openbao-instance into feat/fleet-cd-staging-deploy

Run Check Script / check (pull_request) Successful in 2m23s

Details

03bc98cd38

Reviewed-on: #312

johnride merged commit 3025ee7c43 into master

2026-05-29 22:49:25 +00:00

johnride deleted branch feat/fleet-cd-staging-deploy

2026-05-29 22:49:25 +00:00

johnride referenced this issue from a commit

2026-05-29 22:49:27 +00:00

Merge pull request 'feat/fleet-cd-staging-deploy' (#310) from feat/fleet-cd-staging-deploy into master

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NationTech/harmony#310