Argo CD
GitOps controller — syncs every tooling-plane workload from Git.
Dex · OpenLDAP sign-in
Agent book: setup & usage →Back matter · Appendix
The lab at a glance
The book’s reference tables, kept in the back the way books keep them: the status snapshot, every service’s name, and the one front door they all share.
The lab at a glance
Status cards
Rendered at build time from inventory.json.
Snapshot: 2026-10-02T04:19:30.275541Z ·
source: recorded
Tooling plane
9
8 running · 1 planned
Docker Desktop Kubernetes
Workload cluster
3
apps deployed · 3 healthy
OpenShift 4.22 (CRC)
Operators
1
- OpenShift GitOps v1.21
Supply chain
partial
covered in Chapter 3
rhels/team#107
Applications
| BSN | Language | Namespace | IaC repo | Health |
|---|---|---|---|---|
| app1001 | Java | app1001-dev | rhels/IAC.app1001 | Healthy |
| app1002 | Python | app1002-dev | rhels/IAC.app1002 | Healthy |
| app1003 | Redis-backed | app1003-dev | rhels/IAC.app1003 | Healthy |
Service directory
Every service has a name
The lab’s front doors, as of the October 2026 ingress migration. This is a directory, not a status board — the cards don’t probe anything; every name resolves on the tailnet only.
Tooling plane · Mac mini
Every name below is one Ingress behind the single tailnet front door — see “The front door” below.
Harbor
Container registry — images, charts, and vulnerability scans.
LDAP auth · built-in admin is break-glass only
Agent book: setup & usage →Vault
Secrets — the lab KV store (internal PKI planned).
Token auth · unseal key lives in the owner’s Keychain
Agent book: setup & usage →Grafana
Dashboards for the tooling plane’s observability stack.
Viewer access open · local admin break-glass
Agent book: setup & usage →Prometheus
Metrics for the tooling plane.
No login · tailnet only
Agent book: setup & usage →AlertManager
Alert routing for the tooling plane.
No login · tailnet only
Agent book: setup & usage →Docs
This site — the showcase at /, the private agent book at /agent-docs/.
No login · tailnet only
Agent book: setup & usage →Agent platform · Mac mini
The namespace-provisioning POC: an MCP server in front of the lab’s one identity store.
MCP server
mcp.rhels.com/mcp
Agent-first namespace provisioning — an app team’s agent asks, the platform answers.
LDAP bind login · opaque session token
Agent book: setup & usage →OpenLDAP
ldap · TCP 389
The lab’s one identity store — users plus per-BSN groups for every service above.
Bind · directory users
Agent book: setup & usage →Workload cluster · CRC (OpenShift)
Reached over the lab tunnel; sign-in is OpenShift OAuth backed by the same OpenLDAP.
OpenShift console
The workload cluster’s web console.
OpenShift OAuth · LDAP identity provider
Agent book: setup & usage →Argo CD · CRC
OpenShift GitOps — delivers the agent platform onto CRC.
Log in via OpenShift
Agent book: setup & usage →Grafana · CRC
Dashboards on the workload cluster.
OpenShift OAuth · no anonymous access
Agent book: setup & usage →The front door
One door, many names
The port-forward sprawl is gone. A Tailscale operator fronts a single ingress controller on the tailnet; ingress-nginx routes by name; cert-manager issues a Let’s Encrypt certificate for every name (DNS-01 via Cloudflare — the home connection can’t take inbound HTTP challenges). Adding a service is now one Ingress plus one DNS record.
-
Browser / agent
tailnet client
-
Tailscale operator
one front door
-
ingress-nginx
routes by name
-
Service
*.rhels.com
Connectivity
How the planes talk
Tooling host reachable from the workload cluster over a private tailnet; SSH tunnel exposes the CRC API locally.
The directory above lists only the lab’s own rhels.com service names. By design, this site never publishes IP addresses, tailnet hostnames, tunnels, or credentials.