5.2 KiB
Per AI Blitz Plan §claude. Layer: 1. Repo: devops-infra-helm-charts.
07 — Singletons and blast radius
Most files in this repo affect one cluster × one application. A small number of files affect everything on a cluster (or every cluster). These are the singletons. They get a different review bar.
manifests/storageclass/*.yaml
Cluster-wide StorageClass objects. Every PVC on the cluster either references one of these by name or relies on the default annotation (storageclass.kubernetes.io/is-default-class: "true").
Wrong here means:
- New PVCs bind to a different disk type (cost, latency, IOPS change).
volumeBindingModechange (Immediate ↔ WaitForFirstConsumer) changes scheduling semantics for every stateful workload.- Default-class flip changes behaviour of every chart that doesn't pin a class explicitly.
Layer-1 high risk. Two reviewers, one of whom must be a cluster BU owner. Schema: ../docs/platform/schemas/storageclass-priorityclass-schema.md.
manifests/priorityclass/<cluster>/*.yaml
Cluster-wide PriorityClass objects, partitioned by cluster directory. Every pod that sets spec.priorityClassName: <name> resolves against this set.
Wrong here means:
- A
value:change can swap which workloads preempt others under capacity pressure. - A
globalDefault: trueflip changes behaviour of every pod that omitspriorityClassName. - Removing a
PriorityClassreferenced by a live workload causes admission failure on next pod create.
Layer-1 high risk. Same review policy as StorageClass. Schema: same file as above.
repository.yaml
Owners, secondary owners, repo metadata. Owned by the registry-bootstrap automation, not by humans. Hand edits will be reverted on the next registry-bootstrap run.
Layer-3 — refuse. If asked to edit, redirect to registry-bootstrap. See ../docs/global/escalation-matrix.md row 4.
manifests/{jenkins-filestore-caching,jenkins-gcs-caching,jfrog-filestore-data}/{dev,prd}/
Per-env, one-shot PV / PVC manifests for stateful systems (Jenkins build cache, JFrog binary store). Bound to GCP Filestore or GCS. Once a PVC is bound to a PV with a real backend, you cannot move it without data migration.
Layer-1 high risk. Resize via resources.requests.storage only; do not recreate.
Versioned-sibling chart deletion
Deleting a chart directory under helm-templates/ (e.g., removing argo-cd-green after a successful migration) is irreversible from Argo CD's point of view — any cluster whose Application still points at it will fail to render.
Layer-1 high risk. Confirm zero references in Meesho/devops-infra-argo-config first. See ../wiki/analyses/ADR-A2-blue-green-sibling-pattern.md and ../docs/global/escalation-matrix.md row 10.
Chart templates/ edits
Editing helm-templates/<chart>/templates/ or values.yaml of a vanilla-pulled chart silently forks it. The next refresh clobbers the edit, but until then it ships to every cluster that consumes the chart.
Layer-1 high risk. Allowed only if the fork is intentional and documented in the chart's README.md. See ../docs/platform/procedures/fork-upstream-chart.md.
Kyverno cluster policies
helm-overrides/<cluster>/kyverno/custom-values.yaml configures admission policies. A new enforce-mode ClusterPolicy can block every pod admission on a cluster.
Layer-1 high risk. Roll out in audit mode first, observe PolicyReports, then flip to enforce.
Argo CD itself (argo-cd / argo-cd-green)
Argo CD self-manages — it deploys itself from this repo. A bad values change can break the control plane that would otherwise heal it. Recovery requires kubectl access to apply a hand-rendered manifest.
Layer-1 high risk. Always cut a green sibling first; never edit the live release directly.
Decision summary
| Singleton | Layer | Review policy |
|---|---|---|
manifests/storageclass/*.yaml |
1 high-risk | Two reviewers, one cluster BU owner |
manifests/priorityclass/<cluster>/*.yaml |
1 high-risk | Two reviewers, one cluster BU owner |
repository.yaml |
3 | Refuse; redirect to registry-bootstrap |
manifests/{jenkins,jfrog}-…/{dev,prd}/ |
1 high-risk | Two reviewers; resize-only edits |
| Versioned-sibling chart deletion | 1 high-risk | Confirm sister-repo zero references |
helm-templates/<chart>/templates/ edits |
1 high-risk | README must document the fork |
| Kyverno enforce-mode policy | 1 high-risk | Audit-mode rollout first |
| Argo CD self-managed values | 1 high-risk | Cut a green sibling first |