docs(workspace): kustomize is canonical — stop the ghost-stack footgun - #1136
Merged
Conversation
…l, not the Helm chart The mail/cal/drive plane runs live in ns/socioprophet via ArgoCD (ApplicationSet workspace-services, kustomize infra/k8s/workspace-*), off registry.socioprophet.ai (zot). charts/prophet-workspace is a richer design reference (opt-in TLS/DKIM/relay/LB) but is deployed by nothing. The runbook + build script told operators to 'helm install ... -n workspace', which stands up a SECOND, GHCR-imaged stack next to the live one. - Runbook: banner making kustomize/ArgoCD canonical; chart = design reference, do not helm-install. - build-push-workspace.sh: replace the helm-install echo with the GitOps (zot + kustomize) path. - Relay guidance reframed to sovereign-default: direct-to-MX, external smarthost opt-in/time-boxed only. No live change — docs + script echo only. TLS/DKIM/LB port into kustomize is the follow-up.
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Updates workspace mail deployment guidance to prevent accidental parallel Helm-based installs by making ArgoCD+kustomize the canonical path, and adjusts deliverability/relay recommendations accordingly.
Changes:
- Update build/push script output to describe GitOps deployment flow (zot registry → bump kustomize refs → ArgoCD sync).
- Add a prominent runbook banner stating kustomize/ArgoCD is canonical and the Helm chart is design-reference only.
- Reframe outbound relay guidance so “direct-to-MX” is the default and relays are explicit, temporary opt-ins.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| scripts/build-push-workspace.sh | Replaces Helm deployment echo with GitOps/kustomize+ArgoCD instructions and footgun warning. |
| docs/PROPHET_WORKSPACE_MAIL_RUNBOOK.md | Adds canonical-deploy banner and revises outbound deliverability/relay guidance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| build_push workspace-caldav workspace-caldav | ||
| echo "✓ pushed all three. Deploy: helm upgrade --install prophet-workspace charts/prophet-workspace -n workspace --create-namespace -f <your-values>.yaml" | ||
| echo "✓ pushed all three." | ||
| echo "Deploy is GitOps: push to the sovereign registry (REGISTRY=registry.socioprophet.ai) and bump the image" |
Comment on lines
+22
to
+23
| echo "Deploy is GitOps: push to the sovereign registry (REGISTRY=registry.socioprophet.ai) and bump the image" | ||
| echo "digests in infra/k8s/workspace-*/base — ArgoCD (ApplicationSet workspace-services) syncs them into ns/socioprophet." |
| > `values.yaml`/`helm` references as the *design intent*, and apply the equivalent config through the kustomize overlays. | ||
|
|
||
| ## 0. Prereqs | ||
| - GKE cluster + `kubectl`/`helm`; the platform Postgres reachable in-cluster as `postgres` with secret `postgres-credentials`. |
Comment on lines
+57
to
+60
| A brand-new cloud IP has near-zero sending reputation; direct-to-MX mail will be junked or rejected. Sovereign-default | ||
| policy: **stay decoupled, local-first, and treat any external smarthost as opt-in only.** | ||
| - **Default (sovereign):** direct-to-MX from our own IP, after PTR is set + IP warm-up + clean RBL checks. No third | ||
| party sees our mail. Ramp send volume gradually to build reputation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the workspace convergence (one source of truth). Docs + script echo only — no live change.
Problem
The mail/cal/drive daemons run live in
ns/socioprophetvia ArgoCD (workspace-services, kustomizeinfra/k8s/workspace-*), offregistry.socioprophet.ai(zot). Butdocs/PROPHET_WORKSPACE_MAIL_RUNBOOK.mdandscripts/build-push-workspace.shboth instructhelm install charts/prophet-workspace -n workspace— which would stand up a second, GHCR-imaged stack inns/workspacenext to the running one.charts/prophet-workspaceis a richer design reference (it carries the opt-in TLS/DKIM/relay/LB wiring) but ArgoCD deploys nothing from it.Change
helm install. Provisioning steps (static IPs, PTR, TLS, DKIM, DNS) still apply, via the kustomize overlays.helm upgrade --installecho with the GitOps path (push to zot → bump digests ininfra/k8s/workspace-*/base→ ArgoCD syncs).Follow-up (separate, gated)
Port the chart's opt-in TLS + DKIM + LoadBalancer + relay into the kustomize base, then the live mail can go from internal-only skeleton → externally-reachable, TLS'd, DKIM-signed. That needs static-IP + DNS provisioning (tracked; needs sign-off).
🤖 Generated with Claude Code