86 lines
5.2 KiB
Markdown
86 lines
5.2 KiB
Markdown
> Per AI Blitz Plan §claude. Layer: 1. Repo: devops-infra-helm-charts.
|
||
|
||
# 07 — Singletons and blast radius
|
||
|
||
Most files in this repo affect one cluster × one application. A small number of files affect **everything** on a cluster (or every cluster). These are the singletons. They get a different review bar.
|
||
|
||
## `manifests/storageclass/*.yaml`
|
||
|
||
Cluster-wide `StorageClass` objects. Every PVC on the cluster either references one of these by name or relies on the default annotation (`storageclass.kubernetes.io/is-default-class: "true"`).
|
||
|
||
Wrong here means:
|
||
|
||
- New PVCs bind to a different disk type (cost, latency, IOPS change).
|
||
- `volumeBindingMode` change (Immediate ↔ WaitForFirstConsumer) changes scheduling semantics for every stateful workload.
|
||
- Default-class flip changes behaviour of every chart that doesn't pin a class explicitly.
|
||
|
||
**Layer-1 high risk.** Two reviewers, one of whom must be a cluster BU owner. Schema: [`../docs/platform/schemas/storageclass-priorityclass-schema.md`](../docs/platform/schemas/storageclass-priorityclass-schema.md).
|
||
|
||
## `manifests/priorityclass/<cluster>/*.yaml`
|
||
|
||
Cluster-wide `PriorityClass` objects, partitioned by cluster directory. Every pod that sets `spec.priorityClassName: <name>` resolves against this set.
|
||
|
||
Wrong here means:
|
||
|
||
- A `value:` change can swap which workloads preempt others under capacity pressure.
|
||
- A `globalDefault: true` flip changes behaviour of every pod that omits `priorityClassName`.
|
||
- Removing a `PriorityClass` referenced by a live workload causes admission failure on next pod create.
|
||
|
||
**Layer-1 high risk.** Same review policy as StorageClass. Schema: same file as above.
|
||
|
||
## `repository.yaml`
|
||
|
||
Owners, secondary owners, repo metadata. Owned by the **`registry-bootstrap` automation**, not by humans. Hand edits will be reverted on the next `registry-bootstrap` run.
|
||
|
||
**Layer-3 — refuse.** If asked to edit, redirect to `registry-bootstrap`. See [`../docs/global/escalation-matrix.md`](../docs/global/escalation-matrix.md) row 4.
|
||
|
||
## `manifests/{jenkins-filestore-caching,jenkins-gcs-caching,jfrog-filestore-data}/{dev,prd}/`
|
||
|
||
Per-env, one-shot PV / PVC manifests for stateful systems (Jenkins build cache, JFrog binary store). Bound to GCP Filestore or GCS. Once a PVC is bound to a PV with a real backend, you cannot move it without data migration.
|
||
|
||
**Layer-1 high risk.** Resize via `resources.requests.storage` only; do not recreate.
|
||
|
||
## Versioned-sibling chart deletion
|
||
|
||
Deleting a chart directory under `helm-templates/` (e.g., removing `argo-cd-green` after a successful migration) is irreversible from Argo CD's point of view — any cluster whose Application still points at it will fail to render.
|
||
|
||
**Layer-1 high risk.** Confirm zero references in [`Meesho/devops-infra-argo-config`](https://github.com/Meesho/devops-infra-argo-config) first. See [`../wiki/analyses/ADR-A2-blue-green-sibling-pattern.md`](../wiki/analyses/ADR-A2-blue-green-sibling-pattern.md) and [`../docs/global/escalation-matrix.md`](../docs/global/escalation-matrix.md) row 10.
|
||
|
||
## Chart `templates/` edits
|
||
|
||
Editing `helm-templates/<chart>/templates/` or `values.yaml` of a vanilla-pulled chart silently forks it. The next refresh clobbers the edit, but until then it ships to every cluster that consumes the chart.
|
||
|
||
**Layer-1 high risk.** Allowed only if the fork is intentional and documented in the chart's `README.md`. See [`../docs/platform/procedures/fork-upstream-chart.md`](../docs/platform/procedures/fork-upstream-chart.md).
|
||
|
||
## Kyverno cluster policies
|
||
|
||
`helm-overrides/<cluster>/kyverno/custom-values.yaml` configures admission policies. A new `enforce`-mode `ClusterPolicy` can block every pod admission on a cluster.
|
||
|
||
**Layer-1 high risk.** Roll out in `audit` mode first, observe `PolicyReport`s, then flip to `enforce`.
|
||
|
||
## Argo CD itself (`argo-cd` / `argo-cd-green`)
|
||
|
||
Argo CD self-manages — it deploys itself from this repo. A bad values change can break the control plane that would otherwise heal it. Recovery requires `kubectl` access to apply a hand-rendered manifest.
|
||
|
||
**Layer-1 high risk.** Always cut a green sibling first; never edit the live release directly.
|
||
|
||
## Decision summary
|
||
|
||
| Singleton | Layer | Review policy |
|
||
|-----------|-------|---------------|
|
||
| `manifests/storageclass/*.yaml` | 1 high-risk | Two reviewers, one cluster BU owner |
|
||
| `manifests/priorityclass/<cluster>/*.yaml` | 1 high-risk | Two reviewers, one cluster BU owner |
|
||
| `repository.yaml` | 3 | Refuse; redirect to `registry-bootstrap` |
|
||
| `manifests/{jenkins,jfrog}-…/{dev,prd}/` | 1 high-risk | Two reviewers; resize-only edits |
|
||
| Versioned-sibling chart deletion | 1 high-risk | Confirm sister-repo zero references |
|
||
| `helm-templates/<chart>/templates/` edits | 1 high-risk | README must document the fork |
|
||
| Kyverno enforce-mode policy | 1 high-risk | Audit-mode rollout first |
|
||
| Argo CD self-managed values | 1 high-risk | Cut a green sibling first |
|
||
|
||
## See also
|
||
|
||
- [`./01-repo-structure.md`](./01-repo-structure.md)
|
||
- [`../docs/platform/schemas/storageclass-priorityclass-schema.md`](../docs/platform/schemas/storageclass-priorityclass-schema.md)
|
||
- [`../docs/global/SANCTITY_RULES.md`](../docs/global/SANCTITY_RULES.md)
|
||
- [`../docs/global/escalation-matrix.md`](../docs/global/escalation-matrix.md)
|