From 72d93f7e921024f293c1a007ed3719f7d6dfb565 Mon Sep 17 00:00:00 2001 From: Jose Henrique Date: Sat, 5 Sep 2026 13:06:17 -0300 Subject: [PATCH] docs: add Haven project context --- project-context.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 project-context.md diff --git a/project-context.md b/project-context.md new file mode 100644 index 0000000..695b0de --- /dev/null +++ b/project-context.md @@ -0,0 +1,25 @@ +# Haven project context + +## Purpose + +`haven` is the public GitOps specification repository for the Haven Kubernetes cluster. Argo CD continuously reconciles the manifests on `main` into the cluster. + +## Repository organization + +- `apps//*.yaml` — one application or infrastructure specification per file. The directory name selects its target namespace through the root ApplicationSet. +- `apps/root/applicationset.yaml` — discovers `apps/*/*.yaml` and creates Argo CD Applications that automatically prune and self-heal. +- `bootstrap/` — cluster bootstrap manifests such as namespaces, Argo CD configuration, and address pools. +- `secrets/` — Kubernetes secret specifications referenced by applications. +- `.gitea/workflows/trigger-renovate.yaml` — manually triggered Gitea Actions workflow that creates an immediate one-off Job from the live `cronjobs/renovate` CronJob. + +## Build and deploy + +- Commit manifest changes to `main`; the root ApplicationSet reconciles them automatically. +- The `Trigger Renovate` Gitea workflow is manual-only (`workflow_dispatch`). It downloads `kubectl`, writes `${{ secrets.KUBE_CONFIG }}` to an ephemeral kubeconfig, verifies the live CronJob, then creates a uniquely named Job in the `cronjobs` namespace from `cronjob/renovate`. +- The kubeconfig is supplied at execution time as the repository or organization `KUBE_CONFIG` secret. No credentials are stored in this repository. + +## Conventions + +- Keep Kubernetes manifest and workflow YAML LF-terminated; `.gitattributes` enforces this for `.yaml` and `.yml` files. +- Do not commit plaintext credentials. Kubernetes resources should continue to reference the existing secret mechanisms. +- A manual Renovate dispatch starts an additional run; the weekly CronJob schedule remains unchanged.