Reference
Key terms
The vocabulary the five chapters assume. Read this first if any chapter sends you back here.
BSN
App identifier: "app" plus four digits, exactly 7 characters (e.g. app1001). The BSN names the namespace (app1001-dev), the IaC repo (rhels/IAC.app1001), and the Argo CD Application. Pick the next free number when you add an app.
IaC repo
Infrastructure-as-code repository. Each app gets one private repo (rhels/IAC.<bsn>) holding its manifests and its pinned image digest. The platform itself lives in rhels/local-k8s-gitops. Git is the source of truth — the cluster is never hand-edited.
GitOps
The operating model: desired cluster state is declared in Git, and Argo CD continuously converges the cluster to match it. If it is not in Git, it does not exist.
Tooling plane
The lab’s workshop: Kubernetes on the tooling host, running CI runners, the Harbor registry, Loki log aggregation, and Tempo tracing. It builds, signs, and ships software — it runs no demo workloads.
Workload cluster
The factory floor: an OpenShift (CRC) cluster where the demo apps actually run, managed by its own GitOps operator.
Argo CD
The GitOps engine. It watches the IaC repos and syncs the clusters to match — reporting each Application as Healthy/Synced or flagging drift.
ARC
Actions Runner Controller. Runs the lab’s GitHub Actions jobs on self-hosted runners (label self-hosted, mini-k8s), because public runners cannot reach the private lab network.
Harbor
Enterprise container image registry on the tooling plane. Every image the pipeline builds is pushed here before anything else happens to it.
Cosign
Signs container images keylessly using the CI job’s GitHub identity — no long-lived signing keys to leak or rotate. A signed image carries proof of who built it.
Kyverno
Policy engine on the workload cluster. Its reports show which images are signed; the plan is to enforce admission so unsigned images are rejected before they run.
Loki
Log aggregation on the tooling plane. Container logs from the lab land here, queryable with LogQL (e.g. {namespace="app1001-dev"} |= "ERROR").
Tempo
Distributed tracing on the tooling plane. Follows a single request across services so latency can be traced end to end once apps emit spans.
Deeper, agent-facing definitions live in the private agent docs. This page covers what a newcomer needs to follow the book — nothing here is load-bearing for operating the lab.