71 lines
5.4 KiB
Markdown
71 lines
5.4 KiB
Markdown
> Per AI Blitz Plan §claude. Layer: 1. Repo: devops-infra-helm-charts.
|
|
|
|
# 01 — Repository structure
|
|
|
|
Directory walkthrough with the *why* attached. The root `CLAUDE.md` *Repository layout* table is the canonical short version; this page extends it with rationale and links into the rest of the tree.
|
|
|
|
## `helm-templates/<chart>/` — cached / forked upstream charts
|
|
|
|
About 74 chart directories. Three flavours:
|
|
|
|
1. **Vanilla upstream cache** — pulled via `helm pull <repo>/<chart>` and committed verbatim. Edits to `templates/` here silently fork the chart and get clobbered on the next refresh. Most charts are this flavour. See [`../wiki/analyses/ADR-A1-cache-vs-upstream-charts.md`](../wiki/analyses/ADR-A1-cache-vs-upstream-charts.md).
|
|
2. **Thin wrapper** — `Chart.yaml` declares `dependencies:`, `templates/` is small or empty, and the real content lives in the subchart. Used to bind multiple sub-charts as one Argo Application.
|
|
3. **Intentional fork** — `templates/` is meaningfully edited. Each fork should explain itself in that chart's `README.md`. Forks are rare and need explicit owner approval. See [`../docs/platform/procedures/fork-upstream-chart.md`](../docs/platform/procedures/fork-upstream-chart.md).
|
|
|
|
Why cache at all? Network/ingress robustness for Argo CD on every cluster, and a stable target for the values to bind against. Trade-off and alternatives in [`../wiki/analyses/ADR-A1-cache-vs-upstream-charts.md`](../wiki/analyses/ADR-A1-cache-vs-upstream-charts.md).
|
|
|
|
## `helm-overrides/<cluster>/<app>/custom-values.yaml`
|
|
|
|
The day-to-day editing surface. Path encodes the destination:
|
|
|
|
- `<cluster>` → directory name matches the GKE cluster name (`k8s-central-prd-ase1`, `k8s-shared-int-ase1`, `k8s-aurva-prd-ase1`, `db-<id>-…`).
|
|
- `<app>` → directory name matches the Argo Application name in the sister repo (and usually matches the chart name in `helm-templates/`, but doesn't have to — many apps target a versioned-sibling chart).
|
|
|
|
The content is a Helm values overlay merged onto `helm-templates/<chart>/values.yaml` at render time. Schema: [`../docs/platform/schemas/custom-values-schema.md`](../docs/platform/schemas/custom-values-schema.md). Composition rules: [`./04-override-hierarchy.md`](./04-override-hierarchy.md).
|
|
|
|
## `helm-overrides/<cluster>/<app>/<extra>.yaml`
|
|
|
|
Raw Kubernetes manifests dropped alongside the Helm release. They are NOT consumed by Helm — Argo applies them directly. Common patterns:
|
|
|
|
- `computeclass/*-cc.yaml` — GKE Autopilot `ComputeClass` objects.
|
|
- `elastic-cluster/argo-launch.yaml` — Elasticsearch Operator CR.
|
|
- `external-dns-services/*.yaml` — `Service` objects with `external-dns` annotations to publish DNS records.
|
|
|
|
Schema and conventions: [`../docs/platform/schemas/raw-manifest-sidecar-schema.md`](../docs/platform/schemas/raw-manifest-sidecar-schema.md). Why they live here rather than in dedicated manifest dirs: [`../wiki/analyses/ADR-A4-raw-manifest-sidecars-in-helm-overrides.md`](../wiki/analyses/ADR-A4-raw-manifest-sidecars-in-helm-overrides.md).
|
|
|
|
## `manifests/storageclass/` and `manifests/priorityclass/<cluster>/`
|
|
|
|
Cluster-wide singletons. A wrong StorageClass affects every PVC; a wrong PriorityClass changes scheduling priority for every pod that references it. Two-reviewer policy. Schema: [`../docs/platform/schemas/storageclass-priorityclass-schema.md`](../docs/platform/schemas/storageclass-priorityclass-schema.md). Blast-radius detail: [`./07-singletons-and-blast-radius.md`](./07-singletons-and-blast-radius.md).
|
|
|
|
## `manifests/{jenkins-filestore-caching,jenkins-gcs-caching,jfrog-filestore-data}/{dev,prd}/`
|
|
|
|
Per-env one-shot PV / PVC manifests for stateful systems that pre-date a Helm-managed model. Treated as immutable once bound; resize via PVC `resources.requests.storage` rather than re-creating.
|
|
|
|
## `pre-commit-scripts/`
|
|
|
|
- **TruffleHog secret scan** — active, blocking. NEVER bypass. See [`./08-pre-commit-and-hooks.md`](./08-pre-commit-and-hooks.md) and [`../docs/global/SANCTITY_RULES.md`](../docs/global/SANCTITY_RULES.md).
|
|
- **CAC, Yaak hooks** — gated on file paths this repo doesn't have, so they no-op here. Same scripts run for real in service repos.
|
|
|
|
## `post-commit-scripts/`
|
|
|
|
- **Cursor AI commit metric collector** — background, non-blocking. Posts metric pings to `observe.meeshogcp.in`. This is platform-managed infrastructure, not agent-initiated.
|
|
|
|
## `repository.yaml`
|
|
|
|
Owners + secondary owners. Managed by the `registry-bootstrap` automation. Editing by hand is on the don't-touch list — see [`../docs/global/escalation-matrix.md`](../docs/global/escalation-matrix.md) row 4.
|
|
|
|
## `contour-nodeselector-tolerations-summary.md`
|
|
|
|
Per-cluster Contour scheduling matrix at the repo root. **Read this before any Contour values edit.** Multi-Contour pattern (`contour-external`, `contour-external-1`, `contour-internal-{0,1}`, `contour-internal-intra-{0,1}`) is detailed in [`./03-chart-inventory.md`](./03-chart-inventory.md).
|
|
|
|
## `docs/`, `claude/`, `skills/`, `wiki/`
|
|
|
|
The Blitz documentation tree. Entry points:
|
|
|
|
- [`../docs/architecture.md`](../docs/architecture.md) — full deploy lifecycle and gotchas.
|
|
- [`../docs/global/`](../docs/global/) — agent boundaries, sanctity rules, escalation, coding guidelines.
|
|
- [`../docs/platform/`](../docs/platform/) — procedures, runbooks, schemas.
|
|
- [`../skills/infra/`](../skills/infra/) — task playbooks.
|
|
- [`../wiki/`](../wiki/) — entity model and ADRs.
|
|
- [`./00-overview.md`](./00-overview.md) — top of this `claude/` index.
|