From 9c11fc6a73cfd58ed0b4e9dc74805d1e0ba48735 Mon Sep 17 00:00:00 2001 From: Tech Garden Date: Wed, 12 Aug 2026 10:29:04 +0100 Subject: [PATCH] docs(argocd): amend WS-02 public-flip seam contract to dual-parentRef MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pinned contract said the public flip would be "a NEW route, never a retarget". Cycle 3 landed it as a second parentRef on the three existing routes instead — nothing removed, internal validation path intact, so the intent holds and the letter does not. Records why, and the consequence that follows. A route-level policy now spans two gateways with different threat models, so a per-edge difference is only expressible via mergeType on the route-level policy. Comment-only; renders no manifest change. --- .../1276-core/argocd/apps/values.yaml | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/kubernetes/clusters/1276-core/argocd/apps/values.yaml b/kubernetes/clusters/1276-core/argocd/apps/values.yaml index 7f314d08..d4fecec2 100644 --- a/kubernetes/clusters/1276-core/argocd/apps/values.yaml +++ b/kubernetes/clusters/1276-core/argocd/apps/values.yaml @@ -136,10 +136,26 @@ applicationsets: # Prod twin of techgarden-dev above — WS-02's internal flip (ADR-0060). Deliberately # byte-identical to it with dev -> prod, so the two stay diffable by eye. # - # This makes prod RUN AND SERVE, IN-CLUSTER ONLY. It reaches nothing publicly: the web - # prod overlay keeps base's `eg-internal` parentRef and adds no `dns.kian.sh/provider` - # annotation, so no route lands on eg-public and no record is created. The public flip - # is a separate, additive act — a second HTTPRoute — never a retarget of this one. + # This made prod RUN AND SERVE, IN-CLUSTER ONLY: the web prod overlay kept base's + # `eg-internal` parentRef and added no `dns.kian.sh/provider` annotation, so no route + # landed on eg-public and no record was created. + # + # THE PUBLIC FLIP IS ADDITIVE, BUT AS A SECOND parentRef — NOT A SECOND ROUTE. + # The original contract said "a NEW route, never a retarget". Cycle 3 renegotiated the + # letter and kept the intent: the three routes gain `eg-public` alongside `eg-internal`, + # nothing is removed and the internal validation path still works. A duplicate public + # route set would mean mirroring eleven protected path prefixes by hand, and forgetting + # the twelfth would drop a new product surface into the public catch-all, served and + # ungated — a failure on the ROUTINE act, versus dual-parent's failure on the RARE one. + # + # CONSEQUENCE, LOAD-BEARING. A route-level policy now spans TWO gateways with different + # threat models, so a per-edge difference can no longer be expressed by attaching a + # policy to the public route alone — it exists ONLY via `mergeType` on the route-level + # policy. See 1276-prod/techgarden-web/auth-gateway/securitypolicy.yaml: with mergeType + # unset the most specific policy wins outright, and the protected routes silently lose + # eg-public's Deny-by-default allowlist while the unprotected catch-all keeps it. + # Restating the allowlist inline is NOT an equivalent fix — one policy, two gateways, so + # it would also apply on eg-internal and deny every LAN client. # # `project: 1276-prod` is load-bearing: with `default` the AppProject sourceRepos entry # above is inert and the Applications would sync anyway, silently ungated.