Skip to content

refactor(gitops): regroup services under services/<bucket>/<name>/ - #21

Merged
nbrieussel merged 10 commits into
mainfrom
feature/gitops-services-restructure
Jul 29, 2026
Merged

refactor(gitops): regroup services under services/<bucket>/<name>/#21
nbrieussel merged 10 commits into
mainfrom
feature/gitops-services-restructure

Conversation

@nbrieussel

@nbrieussel nbrieussel commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Replaces the apps/ + platform/ + clusters/<env>/ split with services/platform/<name>/ and services/products/<name>/ — every piece of a service (vendor chart, in-house charts, ArgoCD Applications) now lives in one directory, for both clusters.
  • Two discovery mechanisms per env, both created directly by bootstrap/templates/<env>.yaml (no more intermediate clusters/<env>/ chart):
    • services-vendor-<env> — a directory-recurse Application applying hand-written *.vendor.yaml manifests for external Helm charts as-is.
    • services-app-<env> — an ApplicationSet (goTemplate: true, git files generator) expanding small *.app.yaml params into Applications for our own charts, keeping gitops_revision propagation working without a hand-maintained per-Application file.
  • charts/sso-guard/ holds the shared library chart (moved out of apps/).
  • Removes .specify/ speckit scaffolding, the completed specs/001-replace-infisical-oss-secrets/ feature docs, the stale TODO.md, and the now-obsolete infisical-absent CI job.
  • Updates CLAUDE.md/README.md for the new layout and fixes CI (helm lint/helm template paths that referenced the removed apps//clusters/ dirs).

Validated

  • Full mise run reset && mise run dev smoke test on the local cluster: all Applications Synced/Healthy.
  • Full destroy/redeploy cycle on the scaleway cluster: all 21 Applications Synced/Healthy, including a clean second run with no manual intervention (first run surfaced and fixed two real bugs, see commits f91dc88 and dfb03e9; also required the operator to reseed one OpenBao secret unrelated to this refactor).

Test plan

  • helm lint/helm template on every moved chart and bootstrap/ for both envs
  • Local cluster: mise run reset && mise run dev, kubectl get applications -n argocd all Synced/Healthy
  • Scaleway cluster: destroy/redeploy, all 21 Applications Synced/Healthy on a clean run

🤖 Generated with Claude Code

https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43

Nicolas Brieussel and others added 10 commits July 29, 2026 12:08
Nicolas Brieussel @claude Nicolas Brieussel
refactor(gitops): regroup local-cluster services under services/<buck…
dd9dd6a 
…et>/<name>/

Replace the apps/ + platform/ + clusters/<env>/ split (which scattered a
single service's files across three top-level dirs) with one services/
tree, grouping every piece of a service (vendor chart, in-house charts,
ArgoCD Applications) together per environment.

- services/platform/<name>/ and services/products/demo/ hold the moved
  charts (init/config/chart subfolders), unchanged internally.
- charts/sso-guard/ is the shared library chart consumed by demo.
- Each service's services/.../applications/<env>/ folder now
  self-describes its own ArgoCD Applications:
  - *.vendor.yaml: hand-written Application manifests loading external
    Helm charts, discovered by a directory-recurse Application
    (services-vendor-<env>) — same trick platform/ used, just widened.
  - *.app.yaml: small params consumed by an ApplicationSet
    (services-app-<env>) for Applications loading our own charts, so
    gitops_revision keeps propagating without a hand-maintained
    clusters/<env>/templates/<name>.yaml per Application.
- clusters/local/ and platform/local/ removed (fully superseded by the
  above for the local cluster). scaleway migration follows in a
  subsequent commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
Nicolas Brieussel @claude Nicolas Brieussel
fix(bootstrap): enable goTemplate on the services ApplicationSet
f91dc88 
Without goTemplate: true, ApplicationSet defaults to the legacy
fasttemplate engine (`{{name}}`, no dot) instead of Go templates
(`{{.name}}`). Confirmed live: every generated Application ended up
literally named "{{.name}}", colliding into a single duplicate-name
error and producing zero Applications from *.app.yaml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
Nicolas Brieussel @claude Nicolas Brieussel
fix(openbao): backport ignoreDifferences for the webhook CA bundle to…
9db56da 
… local

The local cluster's openbao Application never had this block (only
scaleway did), leaving it permanently OutOfSync on the agent-injector's
MutatingWebhookConfiguration caBundle, which ArgoCD can never match
since it's injected at runtime by the chart's own cert generation.
Confirmed live on a fresh local cluster.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
Nicolas Brieussel @claude Nicolas Brieussel
refactor(gitops): regroup scaleway-cluster services under services/<b…
e945b47 
…ucket>/<name>/

Same reorg as the local cluster (previous commits), applied to scaleway:
9 vendor charts moved into services/platform/<name>/applications/scaleway/
*.vendor.yaml, and 11 in-house Applications (openbao-init/config,
cert-manager-webhook-init, gateway-config, dex-init, external-dns-init,
velero-init, grafana-config, argocd-config, secrets-sync, demo) now
described by small *.app.yaml params consumed by the services-app-scaleway
ApplicationSet.

bootstrap/templates/scaleway.yaml creates services-vendor-scaleway
(directory-recurse Application) and services-app-scaleway (ApplicationSet)
directly, replacing clusters/scaleway/. clusters/, platform/, and apps/
are now fully removed — everything lives under services/.

Sync-wave ordering (-1 -> 0 -> 1 -> 2 -> 3 -> 4 -> 5) preserved exactly as
documented in the original per-file comments.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
Nicolas Brieussel @claude Nicolas Brieussel
docs(gitops): update CLAUDE.md, README.md, TODO.md, CI for the servic…
afec729 
…es/ layout

Rewrite the architecture docs to describe the new services/<bucket>/<name>/
structure and the two discovery mechanisms (directory-recurse for vendor
charts, ApplicationSet for in-house charts), replacing the old apps/ +
platform/ + clusters/<env>/ description.

Also fix .github/workflows/ci.yml, which still referenced the removed
apps/openbao-init and clusters/<env>/ paths — would have failed on the
next PR against this branch otherwise.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
Nicolas Brieussel @claude Nicolas Brieussel
docs(gitops): fix two remaining stale apps/platform path comments
ea59665 
Missed by the earlier scaleway rename pass: sso-guard's comment pointing
at the old platform/scaleway/dex.yml, and the cert-manager webhook
Application's comment pointing at the old apps/cert-manager-webhook-init.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
Nicolas Brieussel @claude Nicolas Brieussel
chore: remove speckit scaffolding, completed feature specs, and stale…
04b8d4f 
… TODO

Drop .specify/ (speckit tooling, no longer used) and
specs/001-replace-infisical-oss-secrets/ (the OpenBao-replaces-Infisical
feature is fully implemented and deployed). Also remove TODO.md, whose
remaining items were already stale.

Also drop CLAUDE.md's SPECKIT-managed "Active Feature" block, which
pointed at the now-removed specs/ files.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
Nicolas Brieussel @claude Nicolas Brieussel
chore(ci): drop the infisical-absent job
8c7df8c 
Its only purpose was guarding the Infisical->OpenBao migration window;
that migration is complete and its specs are gone. No Infisical
references remain anywhere in the repo (confirmed via git grep -rli).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
Nicolas Brieussel @claude Nicolas Brieussel
fix(scaleway): point cert-manager-webhook-init/dex-init/external-dns-…
dfb03e9 
…init/velero-init at values.yaml

These four charts only ever had a single values.yaml (no values-scaleway.yaml
override existed pre-reorg — their original clusters/scaleway/templates/*.yaml
had no helm.valueFiles block at all). I incorrectly set valueFile:
values-scaleway.yaml on all *.app.yaml uniformly without checking each
chart's actual files. Confirmed live: ArgoCD failed with "no such file or
directory" for the nonexistent values-scaleway.yaml on all four.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
Nicolas Brieussel @claude Nicolas Brieussel
docs(gateway-config): document how to manually trigger a cert-restore…
a4b579e 
…-eligible backup

Confirmed live: cert-restore only accepts backups labeled
velero.io/schedule-name=velero-cert-secrets. Plain `velero backup create`
(no --from-schedule) doesn't get that label and silently never unblocks
the restore hook -- already caused confusion once (pre-existing manual-test
and velero-bucket-test backups from earlier sessions weren't eligible).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
@nbrieussel
nbrieussel merged commit 66b6438 into main Jul 29, 2026
1 check passed
@nbrieussel
nbrieussel deleted the feature/gitops-services-restructure branch July 29, 2026 15:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nbrieussel