RHELS LAB
Contents · the agent book

Start here

  1. RHELS Lab — Agent Docs
  2. Service Directory
  3. Lab Overview

Planes

  1. Tooling Plane — the Mac mini cluster
  2. Workload Cluster — CRC / OpenShift
  3. Networking

Tool pages

  1. OpenLDAP — Identity & Access
  2. Vault & Secrets Delivery
  3. Certificates — cert-manager & Let's Encrypt
  4. Tailscale & Cloudflare — the name layer
  5. Agent onboarding — how an agent joins the team
  6. Argo CD — GitOps on both planes
  7. Harbor — container registry
  8. Grafana — dashboards & Explore
  9. Logging pipeline — Vector, Loki, Logstash
  10. Prometheus & Alertmanager — metrics and alerts
  11. GitHub Actions — self-hosted runners
  12. ServiceNow PDI & the MCP servers
  13. StackRox — security platform on pro
  14. This documentation system
  15. Namespace as a Service — the MCP front door
  16. Vault PKI

Operations

  1. CI/CD
  2. Observability — deep dive
  3. Disaster Recovery & Rebuild
  4. SRE: IaC, DR, Upgrades, SLO/SLA
  5. Runbooks
  6. The Agent-Run Lab — A Working Showcase

QA Use Cases

  1. QA Use Cases — how this section works
  2. QA — Vault
  3. QA — Argo CD
  4. QA — Identity (OpenLDAP + Dex)
  5. QA — Grafana, Prometheus, Alertmanager
  6. QA — Logging (Loki, Tempo, Logstash)
  7. QA — ACS (StackRox)
  8. QA — Kyverno
  9. QA — MCP server (Namespace as a Service)
  10. QA — CI runners (ARC)
  11. QA — Front door (ingress, cert-manager, Tailscale operator)
  12. QA — Alert bridge
  13. QA — ServiceNow PDI, sims, group-sync
  14. QA — Lab docs
  15. QA — CRC / OpenShift

Reference

  1. Glossary
  2. Agent Protocol

Agent book · Start here

Lab Overview

The RHELS lab is a two-plane platform built for agentic platform-engineering work: agents plan infrastructure changes as GitHub issues, a peer reviews them, and a human authorizes execution.

The two planes

  • Tooling plane — Docker Desktop Kubernetes on a Mac mini tooling host. Hosts the CI agents (self-hosted runners), Argo CD for the tooling plane itself, HashiCorp Vault, cert-manager, and Harbor / Loki / Tempo (live, rhels/team#107) — plus the lab’s one identity store (OpenLDAP) and the front doors that give every service its name. See tooling-plane.md, identity.md, certificates.md.
  • Workload cluster — OpenShift 4.22 (CRC). Runs demo workloads in per-app namespaces, managed entirely by Argo CD via ApplicationSets from per-app IAC repos — plus the agent platform (MCP server, group-sync, PDI-backed request apps) and the log pipeline’s aggregator tier. See workload-cluster.md.

State as of 2026-10-24: every login in the lab resolves to the one LDAP directory; Vault is the secrets source of truth, with the Secrets Operator delivering into CRC; logs deliver to two Loki backends with a recurring, self-checking proof; certificates are Let’s Encrypt via DNS-01. The dedicated chapters (vault.md, observability.md, disaster-recovery.md) carry the detail.

Conventions

  • BSN (Build Serial Number): every app is named appDDDD, e.g. app1001. Seven characters, fixed format. See glossary.md.
  • One namespace per app-env: app1001-dev, app1002-dev, …
  • One private IAC repo per app: rhels/IAC.app1001, rhels/IAC.app1002, …
  • GitOps-only changes: the cluster is never hand-edited. Changes go through the app’s IAC repo; Argo CD reconciles.
  • Issue-driven work: every work item is a GitHub issue; the agent drafts a plan, a peer agent reviews it, execution waits on the human’s authorization. See agent-protocol.md.

Where things come from

SurfaceSourcePublished?
Showcase sitesite/ built to audited dist/ from private sourceLive inside the lab at the docs front door; the public GitHub Pages path is gated off, not live
Agent deep referencesite/src/content/docs/ (this collection)Private — served only inside the lab, at /agent-docs/ on the same host, rendered in the showcase’s own theme

Both surfaces are built from a sanitized, audited bundle and deployed in-lab as one image (Argo CD app tooling-lab-docs; the publish path is in cicd.md). Nothing in the private source tree may leak into the showcase except through that pipeline (build-deploy.yml → gitleaks → audit-bundle.py). The public GitHub Pages path (gh-pages of rhels/lab-docs, https://rhels.github.io/lab-docs/) is not live: the repo is private, the org is on the Free plan, Pages is disabled, and the URL returns 404. Do not treat a public site as published.

Current state snapshot

Machine-readable state lives in inventory.json, regenerated by inventory/generate-inventory.py. It lists tooling-plane nodes, any remaining planned items, workload-cluster operators and apps, monitoring, conventions, the networking pattern, and the supply-chain stages (per-step status live/blocked/audit; overall may be partial). Trust generated_at and source (live or recorded) as freshness markers.