The RHELS Lab · a guided tour

Two planes. One GitOps spine.

Welcome — a place to build, run, and protect your work, the way we do it here, so you can ship faster with zero trust. Everything is delivered from git, and this site is its book.

Run by an agent-first platform engineering team.

Start reading →

New here? Start here Find a service Something's broken

Scroll — there is more

What happens when you use the lab

Build Run Protect

From a request to a running app — everything here starts as a pull request, and git is the only door in.

Get a namespaceAsk for one and it arrives ready: its project, its delivery app, its access, its secrets wiring. Ship by gitPush, and Argo CD puts it on a cluster and keeps it there — no hand-applied changes. Store the imageOne registry for every image the lab runs — Harbor is where builds land. Run CI hereGitHub Actions on our own runners, inside the lab, not in the cloud.

One account opens every tool, and everything is watched — day two is a discipline here, not an afterthought.

Sign in onceOne LDAP account for Argo CD, Grafana, Harbor, StackRox, and the forge — groups are the access. See everythingMetrics, logs, and traces in one place — Grafana is the lab's window. Every service has a nameThe directory lists what runs, where it lives, and who it serves — nothing is a mystery box. When something breaksRunbooks written before the incident, and alerts that reach someone who can act.

Guardrails are code here, not good intentions — the safe way is the only way the machinery allows.

Keep a secretVault holds the secrets and issues the certificates — nothing sensitive ever lives in git. Signed and scannedImages are signed when built and scanned before they run — provenance is checked, not believed. Watched on every clusterStackRox watches mini, pro, and OpenShift alike — one security picture for the whole lab. Access by group, never by favorPermissions go to LDAP groups, never to individuals — every grant is a membership you can audit.