RHELS LAB
Contents · the agent book

Start here

  1. RHELS Lab — Agent Docs
  2. Service Directory
  3. Lab Overview

Planes

  1. Tooling Plane — the Mac mini cluster
  2. Workload Cluster — CRC / OpenShift
  3. Networking

Tool pages

  1. OpenLDAP — Identity & Access
  2. Vault & Secrets Delivery
  3. Certificates — cert-manager & Let's Encrypt
  4. Tailscale & Cloudflare — the name layer
  5. Agent onboarding — how an agent joins the team
  6. Argo CD — GitOps on both planes
  7. Harbor — container registry
  8. Grafana — dashboards & Explore
  9. Logging pipeline — Vector, Loki, Logstash
  10. Prometheus & Alertmanager — metrics and alerts
  11. GitHub Actions — self-hosted runners
  12. ServiceNow PDI & the MCP servers
  13. StackRox — security platform on pro
  14. This documentation system
  15. Namespace as a Service — the MCP front door
  16. Vault PKI

Operations

  1. CI/CD
  2. Observability — deep dive
  3. Disaster Recovery & Rebuild
  4. SRE: IaC, DR, Upgrades, SLO/SLA
  5. Runbooks
  6. The Agent-Run Lab — A Working Showcase

QA Use Cases

  1. QA Use Cases — how this section works
  2. QA — Vault
  3. QA — Argo CD
  4. QA — Identity (OpenLDAP + Dex)
  5. QA — Grafana, Prometheus, Alertmanager
  6. QA — Logging (Loki, Tempo, Logstash)
  7. QA — ACS (StackRox)
  8. QA — Kyverno
  9. QA — MCP server (Namespace as a Service)
  10. QA — CI runners (ARC)
  11. QA — Front door (ingress, cert-manager, Tailscale operator)
  12. QA — Alert bridge
  13. QA — ServiceNow PDI, sims, group-sync
  14. QA — Lab docs
  15. QA — CRC / OpenShift

Reference

  1. Glossary
  2. Agent Protocol

Agent book · QA Use Cases

QA Use Cases — Argo CD

Tool page: tools/argocd.md. Two independent installs: the mini’s Argo CD (the lab’s single control plane — it also drives pro as an external cluster and hosts the CRC tree) and CRC’s OpenShift GitOps. “If it is not in git, it does not run; if Argo did not sync it, it is drift to be explained” (source: argocd.md).

Admin stories

ARG-A1 — App census: everything Synced/Healthy [config/API]

  • Persona: Platform admin. Goal: no app is silently degraded.
  • Steps: list every Application on the mini install (including root-pro and the pro child apps); repeat for CRC’s install when CRC is running.
  • Expected: all apps Synced/Healthy; any other state is named with its app (source: argocd.md Part B, “Check an app”).
  • Assert: kubectl -n argocd get applications -o json → every item: status.sync.status == "Synced" and status.health.status == "Healthy"; the diff report names any app whose pair changed since the previous run.

ARG-A2 — Repository and cluster credentials present [config/API]

  • Persona: Platform admin. Goal: the secrets Argo itself depends on are in place, sourced from Vault.
  • Steps: confirm repository Secrets for the private repos exist in argocd; confirm the pro cluster Secret authenticates.
  • Expected: presence and function only — no credential value is ever read out (source: argocd.md; stackrox.md, “Cluster identity”).
  • Assert: count of Secrets labelled argocd.argoproj.io/secret-type=repository >= the git-declared repo set; the pro cluster’s entry in GET /api/v1/clusters reports a successful connection status.

ARG-A3 — AppProject scoping holds [config/API]

  • Persona: Platform admin. Goal: destination whitelists — “the real permission boundary” — match git.
  • Steps: for each AppProject (mini: local-lab, pro-lab, per-BSN projects; CRC: crc-gitops, crc-agentops), diff live destinations against the GitOps source.
  • Expected: live == git; a widened destination not in git is drift (source: argocd.md — project changes are “commented, deliberate”).
  • Assert: normalized spec.destinations + spec.sourceRepos of each live AppProject == the same fields rendered from its git source (the twin-diff pattern the request-floor guard already uses).

ARG-A4 — Automated sync actually automates [config/API]

  • Persona: Platform admin. Goal: prove the sync model, not just the current state.
  • Preconditions: the next real change to an automated app’s path (the suite observes; it does not manufacture changes).
  • Steps: after a push lands, watch the app’s revision and sync state without touching it.
  • Expected: OutOfSync → Synced/Healthy at the new revision, unaided; the revision SHA is the evidence (source: argocd.md — prune + self-heal; “that revision SHA is the evidence a change landed”).
  • Assert: within the poll window after a repo push, app.status.sync.revision == repo HEAD and state pair == Synced/Healthy, with zero manual sync operations recorded.

User stories

ARG-U1 — Dex/LDAP login [browser]

  • Persona: svc-smoketest. Goal: the directory login path into the mini’s Argo CD works end to end.
  • Steps: open argo.rhels.com, “Log in via OpenLDAP”, authenticate as the fixture user.
  • Expected: session on /applications; userinfo shows the bare-uid username (Dex emailAttr: uid) and app1001-nonprod among groups. Already proven hourly by the health suite’s mini-argocd-ldap-login check (source: health-suite README).
  • Assert: GET /api/v1/session/userinfo → username == "svc-smoketest", groups contains app1001-nonprod.

ARG-U2 — Dev-support user sees their own platform’s apps [browser]

  • Persona: dev1. Goal: RBAC maps directory groups to useful visibility.
  • Steps: log in via Dex; list applications.
  • Expected: the app1001 platform apps are visible — the recorded RBAC maps app1001-devsupport to role:admin on this install, default role readonly (source: lab platform record — Dex RBAC).
  • Assert: GET /api/v1/applications as dev1 → result contains the agentops-* app set; the same call as dev2 returns a strictly smaller set.

ARG-U3 — Readonly default cannot write (negative) [config/API]

  • Persona: svc-smoketest (default role).
  • Steps: attempt a repository-create POST with the fixture session.
  • Expected: 403. Already proven hourly — a write is the discriminating probe because readonly grants repository get (source: health-suite README).
  • Assert: POST /api/v1/repositories → 403.

ARG-U4 — A user cannot sync another team’s app (negative) [browser]

  • Persona: dev2.
  • Steps: log in; open an application outside dev2’s groups; attempt a sync.
  • Expected: the action is unavailable or refused; the app’s sync state does not change (source: argocd.md — project whitelists are the permission boundary).
  • Assert: POST /api/v1/applications/<other-app>/sync as dev2 → 403; app.status.operationState unchanged after the attempt.

Gaps

  • Known structural gap: the mini install’s own argocd/ source tree has no live root Application and its root.yaml points at a fork (found 2026-10-29). ARG-A1/A3 therefore census live Applications; “the mini’s own tree is Argo-managed” is TBD — no documented expectation until that cleanup is decided.
  • CRC’s install version differs between the book (operator 1.21) and the ops record (1.22.1) — doc drift, immaterial here.
  • Manual-only: none — every story in this set is code-expressible.