{"generated_at":"2026-10-02T04:19:30.275541Z","source":"recorded","tooling_plane":{"label":"Tooling plane","platform":"Docker Desktop Kubernetes","nodes":[{"name":"argocd","workload":"Argo CD","detail":"GitOps engine for the tooling plane"},{"name":"actions-runner-system","workload":"Actions Runner Controller","detail":"org runner labels self-hosted mini-k8s"},{"name":"vault","workload":"HashiCorp Vault 2.0.4","detail":"the lab's secrets store — sign in with your LDAP account"},{"name":"cert-manager","workload":"cert-manager","detail":"TLS certificate automation"},{"name":"local-path-storage","workload":"local-path provisioner","detail":"default storage"},{"name":"cursor-agents","workload":"cursor worker","detail":"agent worker pod"},{"name":"harbor","workload":"Harbor registry","detail":"live — enterprise image registry (rhels/team#107)"},{"name":"observability","workload":"Loki + Tempo","detail":"live — log aggregation and distributed tracing (rhels/team#107)"}],"planned":[{"name":"vector","workload":"Vector","detail":"proposed — CRC log forwarding to Loki, not deployed"}],"notes":["~61 GiB disk free","memory is tight — cap concurrent ARC runners at 1"]},"workload_cluster":{"label":"Workload cluster","platform":"OpenShift 4.22 (CRC)","operators":[{"name":"OpenShift GitOps","version":"1.21","detail":"Argo CD 3.4.7, manages all namespaces via AppProjects/ApplicationSets"}],"apps":[{"bsn":"app1001","language":"Java","namespace":"app1001-dev","iac_repo":"rhels/IAC.app1001","health":"Healthy"},{"bsn":"app1002","language":"Python","namespace":"app1002-dev","iac_repo":"rhels/IAC.app1002","health":"Healthy"},{"bsn":"app1003","language":"Redis-backed","namespace":"app1003-dev","iac_repo":"rhels/IAC.app1003","health":"Healthy"}],"monitoring":["Prometheus (kube-prometheus-stack)","Grafana"],"conventions":["BSN format: app + 4 digits (7 chars, e.g. app1004)","one namespace per app-env, e.g. app1001-dev","one private IAC repo per app: rhels/IAC.app1001"]},"networking":{"pattern":"Tooling host reachable from the workload cluster over a private tailnet; SSH tunnel exposes the CRC API locally."},"supply_chain":{"status":"partial","evidence":["rhels/team#107","rhels/local-k8s-gitops Actions run 36876895467 (headSha c5d749f586d43640a61591f0bcdb94ac04d98e0d) — failed at Pin digest in IAC repo after build/push, Cosign, and Trivy succeeded","GitOps main c5d749f586d43640a61591f0bcdb94ac04d98e0d clusters/crc/security/require-signed-images-policy.yaml — validationFailureAction: Audit (not Enforce)"],"steps":[{"name":"git push","status":"live"},{"name":"GitHub Actions (self-hosted mini-k8s)","status":"live"},{"name":"build + push to Harbor","status":"live","note":"rhels/team#107"},{"name":"Cosign sign (keyless, GitHub OIDC)","status":"live","note":"run 36876895467 succeeded"},{"name":"Trivy scan","status":"live","note":"run 36876895467 succeeded"},{"name":"digest written to IAC repo","status":"blocked","note":"failed at Pin digest in IAC repo — rhels/local-k8s-gitops Actions run 36876895467"},{"name":"Argo CD syncs to CRC","status":"live","note":"syncs current IAC refs; signed-digest pin is the blocked predecessor"},{"name":"Kyverno verifyImages in app* namespaces","status":"audit","note":"validationFailureAction: Audit (not Enforce) — GitOps c5d749f586d43640a61591f0bcdb94ac04d98e0d require-signed-images-policy.yaml"}]}}