> Per AI Blitz Plan §claude. Layer: 1. Repo: devops-infra-helm-charts.

# 07 — Singletons and blast radius

Most files in this repo affect one cluster × one application. A small number of files affect **everything** on a cluster (or every cluster). These are the singletons. They get a different review bar.

## `manifests/storageclass/*.yaml`

Cluster-wide `StorageClass` objects. Every PVC on the cluster either references one of these by name or relies on the default annotation (`storageclass.kubernetes.io/is-default-class: "true"`).

Wrong here means:

- New PVCs bind to a different disk type (cost, latency, IOPS change).
- `volumeBindingMode` change (Immediate ↔ WaitForFirstConsumer) changes scheduling semantics for every stateful workload.
- Default-class flip changes behaviour of every chart that doesn't pin a class explicitly.

**Layer-1 high risk.** Two reviewers, one of whom must be a cluster BU owner. Schema: [`../docs/platform/schemas/storageclass-priorityclass-schema.md`](../docs/platform/schemas/storageclass-priorityclass-schema.md).

## `manifests/priorityclass/<cluster>/*.yaml`

Cluster-wide `PriorityClass` objects, partitioned by cluster directory. Every pod that sets `spec.priorityClassName: <name>` resolves against this set.

Wrong here means:

- A `value:` change can swap which workloads preempt others under capacity pressure.
- A `globalDefault: true` flip changes behaviour of every pod that omits `priorityClassName`.
- Removing a `PriorityClass` referenced by a live workload causes admission failure on next pod create.

**Layer-1 high risk.** Same review policy as StorageClass. Schema: same file as above.

## `repository.yaml`

Owners, secondary owners, repo metadata. Owned by the **`registry-bootstrap` automation**, not by humans. Hand edits will be reverted on the next `registry-bootstrap` run.

**Layer-3 — refuse.** If asked to edit, redirect to `registry-bootstrap`. See [`../docs/global/escalation-matrix.md`](../docs/global/escalation-matrix.md) row 4.

## `manifests/{jenkins-filestore-caching,jenkins-gcs-caching,jfrog-filestore-data}/{dev,prd}/`

Per-env, one-shot PV / PVC manifests for stateful systems (Jenkins build cache, JFrog binary store). Bound to GCP Filestore or GCS. Once a PVC is bound to a PV with a real backend, you cannot move it without data migration.

**Layer-1 high risk.** Resize via `resources.requests.storage` only; do not recreate.

## Versioned-sibling chart deletion

Deleting a chart directory under `helm-templates/` (e.g., removing `argo-cd-green` after a successful migration) is irreversible from Argo CD's point of view — any cluster whose Application still points at it will fail to render.

**Layer-1 high risk.** Confirm zero references in [`Meesho/devops-infra-argo-config`](https://github.com/Meesho/devops-infra-argo-config) first. See [`../wiki/analyses/ADR-A2-blue-green-sibling-pattern.md`](../wiki/analyses/ADR-A2-blue-green-sibling-pattern.md) and [`../docs/global/escalation-matrix.md`](../docs/global/escalation-matrix.md) row 10.

## Chart `templates/` edits

Editing `helm-templates/<chart>/templates/` or `values.yaml` of a vanilla-pulled chart silently forks it. The next refresh clobbers the edit, but until then it ships to every cluster that consumes the chart.

**Layer-1 high risk.** Allowed only if the fork is intentional and documented in the chart's `README.md`. See [`../docs/platform/procedures/fork-upstream-chart.md`](../docs/platform/procedures/fork-upstream-chart.md).

## Kyverno cluster policies

`helm-overrides/<cluster>/kyverno/custom-values.yaml` configures admission policies. A new `enforce`-mode `ClusterPolicy` can block every pod admission on a cluster.

**Layer-1 high risk.** Roll out in `audit` mode first, observe `PolicyReport`s, then flip to `enforce`.

## Argo CD itself (`argo-cd` / `argo-cd-green`)

Argo CD self-manages — it deploys itself from this repo. A bad values change can break the control plane that would otherwise heal it. Recovery requires `kubectl` access to apply a hand-rendered manifest.

**Layer-1 high risk.** Always cut a green sibling first; never edit the live release directly.

## Decision summary

| Singleton | Layer | Review policy |
|-----------|-------|---------------|
| `manifests/storageclass/*.yaml` | 1 high-risk | Two reviewers, one cluster BU owner |
| `manifests/priorityclass/<cluster>/*.yaml` | 1 high-risk | Two reviewers, one cluster BU owner |
| `repository.yaml` | 3 | Refuse; redirect to `registry-bootstrap` |
| `manifests/{jenkins,jfrog}-…/{dev,prd}/` | 1 high-risk | Two reviewers; resize-only edits |
| Versioned-sibling chart deletion | 1 high-risk | Confirm sister-repo zero references |
| `helm-templates/<chart>/templates/` edits | 1 high-risk | README must document the fork |
| Kyverno enforce-mode policy | 1 high-risk | Audit-mode rollout first |
| Argo CD self-managed values | 1 high-risk | Cut a green sibling first |

## See also

- [`./01-repo-structure.md`](./01-repo-structure.md)
- [`../docs/platform/schemas/storageclass-priorityclass-schema.md`](../docs/platform/schemas/storageclass-priorityclass-schema.md)
- [`../docs/global/SANCTITY_RULES.md`](../docs/global/SANCTITY_RULES.md)
- [`../docs/global/escalation-matrix.md`](../docs/global/escalation-matrix.md)