fix: make the addon catalog installable — valid label values + tenant appset in the default path

.github/workflows/ci.yml

@@ -335,6 +335,15 @@ jobs:
       - name: Sync-wave ordering gate
         run: ./scripts/check-sync-waves.py
 
+      # An ApplicationSet's spec.template.metadata.labels is a plain string map
+      # in the CRD schema, so kubeconform admits any value there. It only
+      # becomes a label when the controller renders an Application, and an
+      # invalid value fails that Application at admission — which fails the
+      # app-of-apps sync task, which stops the entire addon catalog from
+      # installing. Valid manifest, passing schema gate, nothing deployed.
+      - name: Label-value gate
+        run: ./scripts/check-label-values.py
+
       # Offline half of the chart-provenance gate: every pinned chart has a
       # record and every record a pin. Deliberately does not touch the network —
       # whether a chart went deprecated overnight is not a function of this

CLAUDE.md

@@ -26,7 +26,11 @@ catalog/               → Platform-specific workloads (Druid)
 ## Key Conventions
 
 ### Sync Waves
-Components deploy in order: bootstrap (0, 2) → networking (1) → karpenter (5) → security (10-12) → argo-workflows CRDs (13) → policies (20-23) → observability (29-34) / gateway-api CRDs (30) → operations (40-44) / ai-platform (40-42) → argo-platform (50-52).
+Components deploy in order: bootstrap (0, 2) → networking (1) → karpenter (5) → security (10-12) → argo-workflows CRDs (13) → policies (20-23) → observability (29-34) / gateway-api CRDs (30) → operations (40-44) / ai-platform (40-42) → argo-platform (50-52) → tenants (100).
+
+The tenants band sits alone at the end: `portal-tenants` applies the tenant boundary
+manifests the portal commits to the tenants repo, and those declare CRs that need both
+the operator's CRDs and a running operator to reconcile them.
 
 CRD-only Applications sit immediately ahead of the first thing that renders one of their kinds, not inside a consumer's band. `scripts/check-sync-waves.py` asserts that precedence directly: an ApplicationSet rendering a manifest whose CRD another ApplicationSet installs must sync strictly after it. A controller that merely *watches* a CRD is not a consumer for this purpose — it retries until the kind exists.
 

README.md

@@ -74,7 +74,7 @@ repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
 └─────────────────────────────────────────────────────────────────────┘
 
 Plus opt-in ApplicationSets under `applicationsets/opt-in/` (`apps-tenants`,
-`clusters-appset`, `portal-tenants`) — not applied by a default install; see
+`clusters-appset`) — not applied by a default install; see
 [`applicationsets/opt-in/README.md`](applicationsets/opt-in/README.md).
 ```
 
@@ -90,6 +90,8 @@ eks-gitops/
 │   ├── gateway-api-crds.yaml
 │   ├── secret-stores.yaml
 │   ├── dashboards.yaml
+│   ├── portal-tenants.yaml           # tenant boundary CRs from the tenants repo
+│   │                                 #   (label-gated; repo URL from the cluster Secret)
 │   └── opt-in/                          # NOT applied by default (apps/clusters/portal)
 │
 ├── addons/                             # Addon configurations

Taskfile.yaml

@@ -80,6 +80,11 @@ tasks:
     cmds:
       - ./scripts/check-sync-waves.py
 
+  validate:label-values:
+    desc: "Label-value gate — every k8s label value satisfies the API server's grammar"
+    cmds:
+      - ./scripts/check-label-values.py
+
   validate:appset-render:
     desc: "Appset render gate — render the Karpenter EC2NodeClass patch template against fixture cluster Secrets"
     dir: applicationsets/rendertest
@@ -102,13 +107,14 @@ tasks:
       - ./scripts/check-athena-panel-columns.py
 
   validate:
-    desc: Run all validations (lint, build, helm-render, appset schema, sync waves, appset render, policy admission, externalsecret keys, athena panel columns, dashboard/fork-safety)
+    desc: Run all validations (lint, build, helm-render, appset schema, sync waves, label values, appset render, policy admission, externalsecret keys, athena panel columns, dashboard/fork-safety)
     deps:
       - lint:yaml
       - kustomize:build
       - validate:helm-render
       - validate:appset-schema
       - validate:sync-waves
+      - validate:label-values
       - validate:appset-render
       - validate:policy-admission
       - validate:externalsecret-keys

applicationsets/addons-agent-operator.yaml

@@ -37,7 +37,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: eks-agent-platform-operator
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "21"

applicationsets/addons-ai-platform-kustomize.yaml

@@ -38,7 +38,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-ai-platform.yaml

@@ -57,7 +57,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-argo-platform.yaml

@@ -44,7 +44,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-argo-workflows.yaml

@@ -55,7 +55,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: argo-workflows
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "52"

applicationsets/addons-bootstrap-kustomize.yaml

@@ -36,7 +36,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-bootstrap.yaml

@@ -59,7 +59,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-external-dns.yaml

@@ -40,7 +40,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: external-dns
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "1"

applicationsets/addons-karpenter.yaml

@@ -47,7 +47,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: karpenter
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "5"

applicationsets/addons-loki.yaml

@@ -31,7 +31,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: loki
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "30"

applicationsets/addons-networking.yaml

@@ -44,7 +44,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-observability.yaml

@@ -52,7 +52,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-opencost.yaml

@@ -36,7 +36,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: opencost
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "33"

applicationsets/addons-operations-helm.yaml

@@ -61,7 +61,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-operations-kustomize.yaml

@@ -34,7 +34,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-otel-agent.yaml

@@ -31,7 +31,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: otel-agent
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "32"

applicationsets/addons-otel-gateway-floor.yaml

@@ -32,7 +32,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: otel-gateway-floor
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "32"

applicationsets/addons-otel-gateway.yaml

@@ -29,7 +29,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: otel-gateway
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "32"

applicationsets/addons-security.yaml

@@ -51,7 +51,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/addons-tempo.yaml

@@ -28,7 +28,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: tempo
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "31"

applicationsets/addons-velero.yaml

@@ -41,7 +41,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: velero
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "40"

applicationsets/agent-platform.yaml

@@ -47,7 +47,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/argo-workflows-crds.yaml

@@ -73,7 +73,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/dashboards.yaml

@@ -37,7 +37,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/gateway-api-crds.yaml

@@ -60,7 +60,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/kyverno-policies.yaml

@@ -47,7 +47,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .appName }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: '{{ .syncWave }}'

applicationsets/opt-in/README.md

@@ -14,26 +14,39 @@ that could never generate, leaving them permanently `ErrorOccurred` and dragging
 | ApplicationSet | Requires |
 |---|---|
 | `clusters-appset.yaml` | The private clusters repo over SSH, **and the hub cluster** — it applies eks-fleet `Cluster` CRs, which only exist where the Cluster API + Crossplane run. On a workload/spoke cluster it can never be correct. |
-| `portal-tenants.yaml` | The private tenants repo over SSH, plus an ArgoCD SSH repo credential (a read-only deploy key) registered for that URL. |
 | `apps-tenants.yaml` | One `AppProject` per tenant app (the template sets `project: {{ .app }}`), plus read access to each app's source repo. |
 
+The tenant boundary appset is not one of these — it ships in the default path at
+[`../portal-tenants.yaml`](../portal-tenants.yaml). It reads its repo URL from a
+cluster annotation and gates on a cluster label, so on a cluster that has not
+opted in the clusters generator matches nothing, its child git generator never
+runs, and the appset sits healthy with no children. Nothing reaches for a
+private repo it cannot see, which is the condition this folder exists to avoid.
+An appset a label can make inert does not need to be withheld from the default
+path.
+
 ## Enabling them
 
 They are ordinary ApplicationSets — nothing about them is special beyond the
 prerequisites above. To turn them on for an install that genuinely has the
 portal, the private repos, and (for `clusters-appset`) the hub:
 
-1. Register the SSH repo credentials in ArgoCD for the clusters/tenants repos
-   (a read-only deploy key per repo). `cluster-bootstrap` does this when
-   `tenants_repo_url` is set.
+1. Register the SSH repo credential in ArgoCD for the clusters repo (a read-only
+   deploy key).
 2. Create the per-app `AppProject`s that `apps-tenants` references.
 3. Point an Application at this path — either add a second app-of-apps whose
    source `path` is `applicationsets/opt-in`, or set `directory.recurse` on the
    existing one (which pulls in everything here, so prefer the explicit path).
 
 ## Before enabling, re-check the hardcoded repo URLs
 
-`clusters-appset.yaml` and `portal-tenants.yaml` hardcode `git@github.com:` URLs,
-and `apps-tenants.yaml` hardcodes its four app source repos. An install in a
+`clusters-appset.yaml` hardcodes a `git@github.com:` URL, and
+`apps-tenants.yaml` hardcodes its four app source repos. An install in a
 different GitHub org must repoint these — they are not templated from the cluster
 Secret today.
+
+That is the difference between these two and `portal-tenants`: naming an org in
+the manifest is what forces an appset to be withheld from the default install,
+because there is no per-cluster value that can make it correct. Templating the
+URL off the cluster Secret, the way `gitops/repo-url` already works, is the way
+out of this folder.

applicationsets/opt-in/apps-tenants.yaml

@@ -47,7 +47,7 @@ spec:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: '{{ .app }}'
         platform.nanohype.dev/environment: '{{ index .metadata.labels "environment" }}'
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "100"

applicationsets/opt-in/clusters-appset.yaml

@@ -62,7 +62,7 @@ spec:
       labels:
         app.kubernetes.io/managed-by: argocd
         app.kubernetes.io/component: cluster
-        platform.nanohype.dev/repository: nanohype/eks-gitops
+        platform.nanohype.dev/repository: nanohype.eks-gitops
         platform.nanohype.dev/team: platform-engineering
       annotations:
         argocd.argoproj.io/sync-wave: "100"