GitOps Model - BRAC POC OCP Wiki

Repositories

Boundaries

Path	Role	Notes
`lab-gitops/`	Platform desired state	Operators, storage, ACM, OADP, service mesh, ESO wiring, policies, dashboards, cluster overlays, and platform cleanup commits.
`lab-workloads/`	Application workload source	Non-platform app bases. Source-only bases are inert until a cluster overlay references them.
`lab-gitops/`	Bootstrap context	Bootstrap-only reference copied from `ocp-bootstrap`. Do not treat it as the live desired-state source.

Argo CD

Recorded app model

Root app

Root application on hub-dc reconciles the platform repo and ApplicationSets.

Cluster config apps

Each cluster has a cluster-config Application. Local spoke Argo status is authoritative for managed-pull spoke apps.

Workload app

hub-dc-workloads points at lab-workloads and deploys only referenced workload overlays. The ApplicationSet matches spoke-dc only — spoke-dr is platform standby (decision 2026-05-07) and opts in deliberately via the activation runbook. Workload Applications use traditional push-based delivery (hub Argo on hub-dc registers spoke-dc as a destination cluster and pushes via RHACM cluster-proxy) per ADR-0006, which supersedes ADR-0003 for the POC. Argo CD Agent is the documented future-migration path.

Current repo facts

Recent boundaries enforced

demo-orders was removed from lab-workloads; inactive non-core app middleware fixtures were removed from OpenShift desired state.
Hub storage-light work removed ODF/NooBaa, Pipelines, logging, tracing, MinIO/Loki/Tempo, and app observability test stacks from hubs while retaining LVMS and RHACS.
ACM Observability was added back as a hub management service through components/platform/acm-observability; its object-store Secret remains local-only.
The ACS Critical-fixable admission policy now excludes open-cluster-management-observability and openshift-image-prepull as trusted platform namespaces.
ACM Observability-managed mutations to cluster-monitoring-config are ignored by Argo so the operator can own Alertmanager/external label wiring while GitOps still disables hub user workload monitoring.
Backup health ServiceMonitors and PrometheusRules are now part of the OADP and ACM backup bases.
components/platform/hub-image-prepull warms selected hub recovery images but does not replace durable image mirroring.
components/platform/external-secrets-vault defines the non-secret OpenShift side of the external Vault integration: service accounts, TokenReview RBAC, SecretStore/rke2-vault, and the smoke ExternalSecret.
Vault tokens, TokenReview JWTs, app secret values, and full Secret manifests remain outside Git.
The manual Jenkins-to-Nexus-to-OpenShift workload delivery flow is documented in Manual CI/CD.
lab-gitops/CHANGELOG.md must be updated when desired-state changes occur.

Validation

Expected checks after changes

oc kustomize lab-gitops/clusters/hub-dc
oc kustomize lab-gitops/clusters/hub-dr
oc kustomize lab-gitops/clusters/spoke-dc
oc kustomize lab-gitops/clusters/spoke-dr
oc kustomize lab-workloads/clusters/spoke-dc
oc kustomize lab-workloads/clusters/spoke-dr

For live validation, check Argo CD sync and health on the specific cluster that owns the Application. Avoid assuming the hub-side status artifact is authoritative for managed-pull spokes.

Next: hub-dc