# RHELS Lab — Agent Docs

> Private deep-reference docs for the RHELS lab. Never published publicly; served only inside the lab (showcase at /, this book at /agent-docs/). Public GitHub Pages path gated off, pending rhels/team#108.

## Pages

- [RHELS Lab — Agent Docs](/agent-docs/): The book's front page: what lives here, the tool-page index, and how agents should use these docs.
- [Service Directory](/agent-docs/service-directory/): Every lab front door on one page: the URL, how you log in, and a Vault UI link to the exact secret that holds the credential.
- [Lab Overview](/agent-docs/overview/): The big picture: two planes, BSN conventions, where each surface comes from, state as of 2026-10-24.
- [Tooling Plane — the Mac mini cluster](/agent-docs/tooling-plane/): Docker Desktop Kubernetes on the tooling host: Part A how the cluster is set up, Part B how to use it.
- [Workload Cluster — CRC / OpenShift](/agent-docs/workload-cluster/): OpenShift (CRC): Part A how the cluster is set up and operated, Part B how to use it day to day.
- [Networking](/agent-docs/networking/): The connectivity pattern: tailnet, the persistent CRC tunnel, front doors, and what is deliberately not recorded.
- [OpenLDAP — Identity & Access](/agent-docs/identity/): The lab's one identity store: Part A how it is set up (seed, sync, group machinery), Part B how to use it — including the verified add-a-user flow.
- [Vault & Secrets Delivery](/agent-docs/vault/): HashiCorp Vault: Part A deployment, seal model, KV layout, VSO delivery, backup summary; Part B how to use it.
- [Certificates — cert-manager & Let's Encrypt](/agent-docs/certificates/): Part A the issuer and the DNS-01 constraint; Part B how to get, check, and renew a certificate, and add a front door.
- [Tailscale & Cloudflare — the name layer](/agent-docs/tools/tailscale-cloudflare/): Part A: the tailnet that carries the lab and the Cloudflare zones that name it. Part B: resolving names, adding a front door, and the token renewals.
- [Agent onboarding — how an agent joins the team](/agent-docs/tools/agent-onboarding/): Part A: how agent identity works — LDAP login to Vault, group-mapped policies, per-service credentials. Part B: the agent's own runbook — the one bootstrap secret, the login commands, and which Vault path unlocks which system.
- [Argo CD — GitOps on both planes](/agent-docs/tools/argocd/): Part A: the two Argo CD installs, their app layout and sync model. Part B: checking health, syncing, rolling back, adding an app.
- [Harbor — container registry](/agent-docs/tools/harbor/): Part A: chart install, storage, LDAP auth and the admin-credential story. Part B: logging in, pulling/pushing, robot accounts, scan results.
- [Grafana — dashboards & Explore](/agent-docs/tools/grafana/): Part A: the three Grafana surfaces and how each is provisioned and authenticated. Part B: signing in, finding dashboards, querying logs and metrics.
- [Logging pipeline — Vector, Loki, Logstash](/agent-docs/tools/logging-pipeline/): Part A: collection, the aggregator and its one-file-per-sink layout, the two Loki backends. Part B: querying logs and proving delivery. Deep lessons live in the Observability chapter.
- [Prometheus & Alertmanager — metrics and alerts](/agent-docs/tools/prometheus-alertmanager/): Part A: the three metrics tiers, the two Pushgateways, retention truth, and the alerting rules. Part B: querying, checking alerts, adding targets and rules.
- [GitHub Actions — self-hosted runners](/agent-docs/tools/github-actions-runners/): Part A: the ARC scale sets on pro, the mini-k8s runner set, and the runner image's quirks. Part B: targeting the runners, checking capacity, debugging stuck jobs.
- [ServiceNow PDI & the MCP servers](/agent-docs/tools/servicenow-pdi/): Part A: the developer instance as the lab's external backend, its catalog-to-git group flow, the keep-alive, and the MCP servers it backs. Part B: requesting a group, checking a request, using the MCP endpoint.
- [StackRox — security platform on pro](/agent-docs/tools/stackrox/): Part A: the dedicated Intel host, the mini-Argo external-cluster pattern, Vault-held credentials. Part B: open Central, check the sensor, re-register, recover.
- [This documentation system](/agent-docs/tools/docs-system/): Part A: one Astro site for showcase and book, the content collection, the gates, and the publish loop. Part B: editing, adding a page, previewing, publishing.
- [Namespace as a Service — the MCP front door](/agent-docs/tools/namespace-service/): Part A: the agent-first namespace flow — MCP server, LDAP-bind identity, server-side validation, the PR-only path from request file to Argo CD, and the security model. Part B: the nine tools, a worked request, status and lifecycle, and how to contribute from day one.
- [Vault PKI](/agent-docs/vault-pki/): BUILT 2026-10-25: Vault is the lab's internal CA (health.lab), issued through cert-manager's Vault issuer on CRC; public names stay on Let's Encrypt.
- [CI/CD](/agent-docs/cicd/): The IAC flow, the partial signed pipeline (Harbor/Cosign/Trivy), and the docs pipeline.
- [QA Use Cases — how this section works](/agent-docs/qa/): One story set per lab tool: admin and user stories with steps, expected results cited from the tool's own docs, and a verification-mode tag — written so an executable QA suite can be built from each set 1:1.
- [QA — Vault](/agent-docs/qa/vault/): Stories for the secrets store: seal state, KV integrity, the internal-CA PKI mount, backup freshness, policy scoping — and the tenant who can read exactly one path and nothing else.
- [QA — Argo CD](/agent-docs/qa/argocd/): Stories for the GitOps control plane: app census on both installs, repo and cluster credential presence, AppProject scoping — and the user who can see their own apps but cannot sync anyone else's.
- [QA — Identity (OpenLDAP + Dex)](/agent-docs/qa/identity/): Stories for the lab's one identity store: seed fidelity, the LDAPS certificate, group-sync freshness — and the bind tests every other tool's login stories stand on.
- [QA — Grafana, Prometheus, Alertmanager](/agent-docs/qa/observability/): Stories for the metrics tier that now lives on pro: datasources, the agentops-main dashboard, scrape targets, Pushgateway freshness — and the viewer who reads but cannot administer.
- [QA — Logging (Loki, Tempo, Logstash)](/agent-docs/qa/logging/): Stories for the log pipeline's pro stack: ingestion fronts, retention, the dual-delivery proof state — and the user who finds one known marker line and one trace.
- [QA — ACS (StackRox)](/agent-docs/qa/acs/): Stories for Red Hat Advanced Cluster Security (StackRox) on pro: Central health, the pro and mini secured clusters, CRC's staged enrollment — and who gets in, who gets nothing.
- [QA — Kyverno](/agent-docs/qa/kyverno/): Stories for the policy engine: the minimal request floor on all three clusters, the twin-drift guard, signed-image verification — proven by pods that mutate, and one that must be refused.
- [QA — MCP server (Namespace as a Service)](/agent-docs/qa/mcp/): Stories for the agent front door: the nine tools, LDAP-bind identity, server-side validation, the PR-only lifecycle — and the non-member who gets a refusal and no commit.
- [QA — CI runners (ARC)](/agent-docs/qa/ci-runners/): Stories for the self-hosted Actions runners, now scale sets on pro: registration, the label contract, queue behavior — and the job with a wrong label that must queue visibly, never vanish.
- [Observability — deep dive](/agent-docs/observability/): Metrics, the dual-Loki log pipeline, delivery verification, the health suite, alerting, and the 2026-10-11 trial lessons.
- [QA — Front door (ingress, cert-manager, Tailscale operator)](/agent-docs/qa/front-door/): Stories for the lab's single front door: every rhels.com certificate healthy and far from expiry, the DNS-01-only issuer, every public name answering — from a browser, not just a probe.
- [QA — Alert bridge](/agent-docs/qa/alert-bridge/): Stories for the webhook that turns CRC alerts into GitHub issues: reachability, exactly-one-issue semantics, dedup — the on-call persona's only machine-delivered signal.
- [QA — ServiceNow PDI, sims, group-sync](/agent-docs/qa/servicenow/): Stories for the lab's external backend: the PDI's registry and catalog-to-git loop, the mid.lab posture, keep-alive freshness — and the catalog request that ends as a real LDAP group.
- [QA — Lab docs](/agent-docs/qa/docs/): Stories for this book itself: the publish pipeline's gates, the pinned image, the generated indexes — and the reader who searches the book and finds the Service Directory.
- [QA — CRC / OpenShift](/agent-docs/qa/crc/): Stories for the workload cluster, framed 'when CRC is running': console and OAuth, the group-sync projection, GitOps health, signed images, Vault auth — and the 27-minute recovery that is the DR story.
- [Disaster Recovery & Rebuild](/agent-docs/disaster-recovery/): The stateful inventory classified, the Vault backup discipline, the cold-rebuild order, and every manual seam.
- [SRE: IaC, DR, Upgrades, SLO/SLA](/agent-docs/sre-assessment/): The 2026-10-29 SRE assessment: IaC coverage 60% fully git-defined, the DR matrix with proven and unproven restores, the upgrade inventory, and the lab's first SLOs, error budgets, and internal SLA.
- [Runbooks](/agent-docs/runbooks/): Numbered operations agents can run, with exact steps.
- [The Agent-Run Lab — A Working Showcase](/agent-docs/lab-showcase/): How one engineer runs a three-cluster platform with AI agents doing the routine work: the thesis, the measured numbers, six things you can watch it do, the guardrails that make mistakes cheap, the honest limits, and the pilot this page ends by asking for.
- [Glossary](/agent-docs/glossary/): BSN, AppProject, verifyImages, SBOM, Cosign, Dex, fixture user, and friends.
- [Agent Protocol](/agent-docs/agent-protocol/): One thread per issue, review is not authorization, human-only secrets steps, secrets hygiene.

## Data

- [inventory.json](/agent-docs/inventory.json): machine-readable inventory — tooling-plane nodes, workload-cluster operators/apps/monitoring/conventions, networking pattern, supply-chain stages with per-step status. `generated_at` + `source` (`live`|`recorded`) indicate freshness.