RHELS LAB

Plane 01 · control & build

The tooling plane

Docker Desktop Kubernetes — everything the lab needs to build, sign, store, and deliver software, kept off the workload cluster so apps get the whole cluster to themselves.

Inside this chapter

  1. 1 · The jobs The six things you come to this plane to do — each one a door.
  2. 2 · What runs here The machinery, in plain words — what it does today and what landed lately.
  3. 3 · The data The running workloads as a table, at the back where reference belongs.

Start here

The jobs this plane does for you

Welcome to the workshop. You don't need to know how it's built — pick the job you came to do, and the card takes you to the page that walks you through it.

Get access One LDAP account opens every tool on this plane — access comes from group membership, never one-off grants. Deliver a change Push to git and Argo CD makes the cluster match — this is the page for watching a sync land. Store and pull images Harbor is the one registry every image in the lab lives in — push yours, pull everyone else's. Run CI on the lab's runners GitHub Actions jobs run on self-hosted runners here, not in the cloud — here's how they're set up. Get a namespace Namespaces are requested, never hand-made — the namespace service is the front door for one. Get a certificate Vault's PKI issues the lab's internal certificates — how they work and how to ask for one.

Concepts

What runs here, and why

What it does today

  • ▸ Argo CD is the GitOps engine for this plane.
  • ▸ Actions Runner Controller runs org-level GitHub Actions runners on pro (2026-11-01, lab-monorepo#102).
  • ▸ cert-manager automates TLS certificates.
  • ▸ local-path provisioner is the default storage class.
  • ▸ HashiCorp Vault 2.0.4 — the lab's secrets store; you sign in with the same LDAP account as everywhere else.

Landed · rhels/team#107

  • ▸ Harbor — enterprise image registry; the single place images live.
  • ▸ Loki — log aggregation on this plane.
  • ▸ Tempo — distributed tracing on this plane.

Resources are tight — see the capacity notes on the plane card.

Reference

The running workloads, as data

Running workloads

Docker Desktop Kubernetes

Argo CD argocd
name
argocd
purpose
GitOps engine for the tooling plane
Actions Runner Controller actions-runner-system
name
actions-runner-system
purpose
org runner labels self-hosted mini-k8s
HashiCorp Vault 2.0.4 vault
name
vault
purpose
the lab's secrets store — sign in with your LDAP account
cert-manager cert-manager
name
cert-manager
purpose
TLS certificate automation
local-path provisioner local-path-storage
name
local-path-storage
purpose
default storage
cursor worker cursor-agents
name
cursor-agents
purpose
agent worker pod
Harbor registry harbor
name
harbor
purpose
live — enterprise image registry (rhels/team#107)
Loki + Tempo observability
name
observability
purpose
live — log aggregation and distributed tracing (rhels/team#107)

Planned (rhels/team#107)

Vector planned vector
name
vector
purpose
proposed — CRC log forwarding to Loki, not deployed
  • ~61 GiB disk free
  • memory is tight — cap concurrent ARC runners at 1

Next chapter

2. Workload cluster

The tooling plane builds and ships. But software has to land somewhere — next, the workload cluster, where it all runs.