spoke-dc - BRAC POC OCP Wiki

Status

Recorded current state

GitOps: spoke-dc-cluster-config recorded Synced/Healthy from local spoke Argo CD status.
Storage: ODF remains on intended localblock topology.
OADP: lab-dpa reconciled, BSL available, latest daily backup completed in the recorded run.
Identity: WSO2 IS was removed. OAuth IDP is Google only.
Local app middleware: Demo middleware was retired from spoke desired state. Non-core app middleware is not tracked as part of the OpenShift core operations scope.
User workload metrics: Enabled; user workload Prometheus, Thanos ruler, and the Prometheus operator should run here.
Vault / ESO: SecretStore/rke2-vault is Ready=True and ExternalSecret/eso-vault-smoke is synced through the kubernetes-spoke-dc Vault auth mount. Existing Argo drift is non-ESO drift in monitoring/Velero resources.

Service mesh

servicemeshoperator3.v3.3.2 and kiali-operator.v2.22.2 CSVs recorded Succeeded.
Istio/default, IstioCNI/default, and ZTunnel/default recorded healthy.
Ambient components are pinned to OSSM 3.3 version v1.28.5.
No application namespace has opted into ambient yet; use istio.io/dataplane-mode=ambient for app onboarding.
No Bookinfo, metrics-demo, otel-demo, liberty-canary, or demo-orders workload namespace exists on the spoke.

App readiness

Create a Java/JBoss app base in lab-workloads with deployment, service, config, health checks, and overlay placement.

Document external app dependencies only when they affect OpenShift routing, egress, secrets, monitoring, or backup policy.

Use the validated Vault/ESO pattern, but create app-specific Vault policy, role, and ExternalSecret resources before storing app credentials.

Opt the app namespace into ambient only after the workload manifests and routing intent are defined.

Decide whether the app also lands in spoke-dr as hot standby or remains active-only during initial validation.