diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml deleted file mode 100644 index 22edeef..0000000 --- a/.github/workflows/secret-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: secret-scan -# Enforces D5: no secret values in this public repo. Blocks pushes/PRs that add them. -on: - push: - branches: ["**"] - pull_request: - workflow_dispatch: -permissions: - contents: read -jobs: - gitleaks: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - name: gitleaks - uses: gitleaks/gitleaks-action@v2 - env: - GITLEAKS_CONFIG: .gitleaks.toml - GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false" diff --git a/.gitleaks.toml b/.gitleaks.toml deleted file mode 100644 index f1fe78c..0000000 --- a/.gitleaks.toml +++ /dev/null @@ -1,16 +0,0 @@ -# gitleaks config — enforces "no secret values in this public repo" (D5). -# Uses the default ruleset; allowlist only placeholders/examples as they appear. -[extend] -useDefault = true - -[allowlist] -description = "Intentional placeholders / examples (never real values)" -paths = [ - '''.*\.example$''', - '''terraform/terraform\.tfvars\.example''', -] -regexes = [ - '''__[A-Z0-9_]+__''', # template placeholders - '''<[A-Z0-9_-]+>''', # style - '''CHANGE_?ME''', -] diff --git a/docs/decisions.md b/docs/decisions.md index f995b50..6f0dded 100644 --- a/docs/decisions.md +++ b/docs/decisions.md @@ -45,7 +45,9 @@ encrypted. **Rejected:** **Sealed Secrets / SOPS** — they still commit *cipher to permanent public history (and sealed values are useless to anyone cloning the repo). In **connected** mode ESO may optionally be backed by AWS Secrets Manager — still only references in git; in **air‑gap** mode ESO generators (or an in‑cluster -Vault) keep it dependency‑free. A `gitleaks` CI gate enforces "no secrets in git." +Vault) keep it dependency‑free. Enforcement uses **GitHub‑native secret scanning ++ push protection** (repo setting), consistent with the rest of the Coder org — +no CI secret‑scanner action is maintained in‑repo. ## D6 — Coder Agents demoed in‑product ✅ **Picked:** the headline flow is Coder Agents (Tasks/chat) in the Coder UI. The @@ -70,7 +72,7 @@ else gets folded in or dropped. **Why:** the prior repo drifted to 33 markdown f ### Logistics (locked 2026‑11‑02) - Repo: `greg-the-coder/PDE-OpenShift-Reference-Beta` (public fork). - AWS sandbox **342934376218**, us‑east‑1. New DNS drops `rhsummit`: - `base_domain = pde.coderdemo.io` → apps at `*.apps.cluster.pde.coderdemo.io` + `base_domain = rh-pde.coderdemo.io` → apps at `*.apps.cluster.rh-pde.coderdemo.io` (confirm exact base domain before cluster provisioning). - Air‑gap: **simulated‑on‑connected first**; fully‑disconnected path documented. - Cloud LLM: **Bedrock kept as an optional connected‑mode provider**; air‑gap = RHOAI only. diff --git a/docs/deploy.md b/docs/deploy.md index 662f560..8914753 100644 --- a/docs/deploy.md +++ b/docs/deploy.md @@ -8,7 +8,7 @@ - `oc`, `aws`, `terraform` on PATH (`make preflight` checks). - A **Red Hat pull secret** (for RHOAI/RHBK operator images). - A **Coder license** key (needed at the air‑gap/Agents phase). -- `base_domain` for the new DNS (default `pde.coderdemo.io`; see `terraform/terraform.tfvars.example`). +- `base_domain` for the new DNS (default `rh-pde.coderdemo.io`; see `terraform/terraform.tfvars.example`). ## Deploy ```bash diff --git a/gitops/apps/cert-manager.yaml b/gitops/apps/cert-manager.yaml new file mode 100644 index 0000000..8de1461 --- /dev/null +++ b/gitops/apps/cert-manager.yaml @@ -0,0 +1,30 @@ +# ClusterIssuers (ACME connected / internal CA air-gap). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + project: default + source: + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git + targetRevision: main + path: manifests/cert-manager + destination: + server: https://kubernetes.default.svc + namespace: cert-manager + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 8 + backoff: + duration: 30s + factor: 2 + maxDuration: 5m diff --git a/gitops/apps/cluster-config.yaml b/gitops/apps/cluster-config.yaml new file mode 100644 index 0000000..2dcf7e1 --- /dev/null +++ b/gitops/apps/cluster-config.yaml @@ -0,0 +1,30 @@ +# Cluster-wide config: OAuth/Keycloak IdP, Argo RBAC (committed so SSO admins work), namespaces/RBAC. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cluster-config + namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "-2" +spec: + project: default + source: + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git + targetRevision: main + path: manifests/cluster-config + destination: + server: https://kubernetes.default.svc + namespace: openshift-gitops + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 8 + backoff: + duration: 30s + factor: 2 + maxDuration: 5m diff --git a/gitops/apps/coder.yaml b/gitops/apps/coder.yaml new file mode 100644 index 0000000..8f6df77 --- /dev/null +++ b/gitops/apps/coder.yaml @@ -0,0 +1,30 @@ +# Coder (Helm via GitOps): OIDC->Keycloak, AI Gateway, routes/TLS. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: coder + namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + project: default + source: + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git + targetRevision: main + path: manifests/coder + destination: + server: https://kubernetes.default.svc + namespace: coder + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 8 + backoff: + duration: 30s + factor: 2 + maxDuration: 5m diff --git a/gitops/apps/external-secrets.yaml b/gitops/apps/external-secrets.yaml new file mode 100644 index 0000000..7b38065 --- /dev/null +++ b/gitops/apps/external-secrets.yaml @@ -0,0 +1,30 @@ +# ESO ClusterSecretStore + Password generators + ExternalSecrets (D5: secrets generated in-cluster, none in git). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets + namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + project: default + source: + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git + targetRevision: main + path: manifests/external-secrets + destination: + server: https://kubernetes.default.svc + namespace: external-secrets + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 8 + backoff: + duration: 30s + factor: 2 + maxDuration: 5m diff --git a/gitops/apps/keycloak.yaml b/gitops/apps/keycloak.yaml new file mode 100644 index 0000000..abb353e --- /dev/null +++ b/gitops/apps/keycloak.yaml @@ -0,0 +1,30 @@ +# RHBK Keycloak + realm 'demo' (secret-free template; creds injected from ESO-generated Secret). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: keycloak + namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + project: default + source: + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git + targetRevision: main + path: manifests/keycloak + destination: + server: https://kubernetes.default.svc + namespace: keycloak + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 8 + backoff: + duration: 30s + factor: 2 + maxDuration: 5m diff --git a/gitops/apps/model-serving.yaml b/gitops/apps/model-serving.yaml new file mode 100644 index 0000000..28438c9 --- /dev/null +++ b/gitops/apps/model-serving.yaml @@ -0,0 +1,30 @@ +# RHOAI DataScienceCluster (KServe RawDeployment) + vLLM ServingRuntime + InferenceService (Qwen2.5-7B on A10G). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: model-serving + namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + project: default + source: + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git + targetRevision: main + path: manifests/model-serving + destination: + server: https://kubernetes.default.svc + namespace: rhoai-serving + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 8 + backoff: + duration: 30s + factor: 2 + maxDuration: 5m diff --git a/gitops/apps/observability.yaml b/gitops/apps/observability.yaml new file mode 100644 index 0000000..0403a0b --- /dev/null +++ b/gitops/apps/observability.yaml @@ -0,0 +1,30 @@ +# Minimal: enable OCP user-workload monitoring + 1-2 console dashboards (D8). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: observability + namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "3" +spec: + project: default + source: + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git + targetRevision: main + path: manifests/observability + destination: + server: https://kubernetes.default.svc + namespace: openshift-monitoring + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 8 + backoff: + duration: 30s + factor: 2 + maxDuration: 5m diff --git a/gitops/apps/postgres.yaml b/gitops/apps/postgres.yaml new file mode 100644 index 0000000..aa80ae6 --- /dev/null +++ b/gitops/apps/postgres.yaml @@ -0,0 +1,30 @@ +# CNPG Cluster CRs for Coder + Keycloak (secrets auto-generated by the operator). +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: postgres + namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + project: default + source: + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git + targetRevision: main + path: manifests/postgres + destination: + server: https://kubernetes.default.svc + namespace: coder + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 8 + backoff: + duration: 30s + factor: 2 + maxDuration: 5m diff --git a/gitops/apps/scm.yaml b/gitops/apps/scm.yaml new file mode 100644 index 0000000..a17cf6a --- /dev/null +++ b/gitops/apps/scm.yaml @@ -0,0 +1,30 @@ +# In-cluster Git (Gitea / GitLab-operator) for the demo repos. +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: scm + namespace: openshift-gitops + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + project: default + source: + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git + targetRevision: main + path: manifests/scm + destination: + server: https://kubernetes.default.svc + namespace: scm + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true + retry: + limit: 8 + backoff: + duration: 30s + factor: 2 + maxDuration: 5m diff --git a/gitops/bootstrap/root-app.yaml b/gitops/bootstrap/root-app.yaml index 1555812..77a274b 100644 --- a/gitops/bootstrap/root-app.yaml +++ b/gitops/bootstrap/root-app.yaml @@ -16,7 +16,7 @@ metadata: spec: project: default source: - repoURL: https://github.com/greg-the-coder/PDE-OpenShift-Reference-Beta.git + repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git targetRevision: main path: gitops/apps directory: diff --git a/gitops/operators/00-openshift-gitops.yaml b/gitops/operators/00-openshift-gitops.yaml new file mode 100644 index 0000000..eb1e80e --- /dev/null +++ b/gitops/operators/00-openshift-gitops.yaml @@ -0,0 +1,14 @@ +# OpenShift GitOps (Argo CD). Bootstrap: installs the operator that then runs Argo in +# namespace openshift-gitops. Argo cannot install the operator that provides Argo, so +# this Subscription is applied directly by `make deploy`, not by Argo. +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: openshift-gitops-operator + namespace: openshift-operators +spec: + channel: latest + name: openshift-gitops-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + installPlanApproval: Automatic diff --git a/gitops/operators/10-cert-manager.yaml b/gitops/operators/10-cert-manager.yaml new file mode 100644 index 0000000..8834a21 --- /dev/null +++ b/gitops/operators/10-cert-manager.yaml @@ -0,0 +1,24 @@ +# cert-manager (Red Hat). Issues TLS (ACME in connected mode, internal CA in air-gap). +apiVersion: v1 +kind: Namespace +metadata: { name: cert-manager-operator } +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: cert-manager-operator + namespace: cert-manager-operator +spec: + targetNamespaces: [cert-manager-operator] +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: openshift-cert-manager-operator + namespace: cert-manager-operator +spec: + channel: stable-v1 + name: openshift-cert-manager-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + installPlanApproval: Automatic diff --git a/gitops/operators/20-cloudnative-pg.yaml b/gitops/operators/20-cloudnative-pg.yaml new file mode 100644 index 0000000..2a9da5a --- /dev/null +++ b/gitops/operators/20-cloudnative-pg.yaml @@ -0,0 +1,12 @@ +# CloudNativePG (EDB-engineered, RH-certified). In-cluster Postgres for Coder + Keycloak. +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: cloudnative-pg + namespace: openshift-operators # global OperatorGroup (AllNamespaces) +spec: + channel: stable-v1 + name: cloudnative-pg + source: certified-operators + sourceNamespace: openshift-marketplace + installPlanApproval: Automatic diff --git a/gitops/operators/30-external-secrets.yaml b/gitops/operators/30-external-secrets.yaml new file mode 100644 index 0000000..f20513f --- /dev/null +++ b/gitops/operators/30-external-secrets.yaml @@ -0,0 +1,24 @@ +# External Secrets Operator (Red Hat). Drives D5: secrets generated in-cluster +# (Password generators) or synced from a store — never committed to this public repo. +apiVersion: v1 +kind: Namespace +metadata: { name: external-secrets-operator, labels: { app.kubernetes.io/part-of: pde-openshift-reference } } +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: external-secrets-operator + namespace: external-secrets-operator +spec: {} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: openshift-external-secrets-operator + namespace: external-secrets-operator +spec: + channel: stable-v1 + name: openshift-external-secrets-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + installPlanApproval: Automatic diff --git a/gitops/operators/40-openshift-ai.yaml b/gitops/operators/40-openshift-ai.yaml new file mode 100644 index 0000000..e08547f --- /dev/null +++ b/gitops/operators/40-openshift-ai.yaml @@ -0,0 +1,25 @@ +# OpenShift AI (RHOAI). Provides KServe + vLLM ServingRuntime for in-cluster model +# serving (D3). The DataScienceCluster (KServe RawDeployment, no Serverless/ServiceMesh) +# is created by the model-serving Argo app, not here. +apiVersion: v1 +kind: Namespace +metadata: { name: redhat-ods-operator } +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: rhods-operator + namespace: redhat-ods-operator +spec: {} +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: rhods-operator + namespace: redhat-ods-operator +spec: + channel: stable-3.x + name: rhods-operator + source: redhat-operators + sourceNamespace: openshift-marketplace + installPlanApproval: Automatic diff --git a/gitops/operators/50-node-feature-discovery.yaml b/gitops/operators/50-node-feature-discovery.yaml new file mode 100644 index 0000000..f27c003 --- /dev/null +++ b/gitops/operators/50-node-feature-discovery.yaml @@ -0,0 +1,25 @@ +# Node Feature Discovery — labels nodes with GPU features so the GPU operator + RHOAI +# can schedule the vLLM ServingRuntime on the A10G node. +apiVersion: v1 +kind: Namespace +metadata: { name: openshift-nfd } +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: openshift-nfd + namespace: openshift-nfd +spec: + targetNamespaces: [openshift-nfd] +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: nfd + namespace: openshift-nfd +spec: + channel: stable + name: nfd + source: redhat-operators + sourceNamespace: openshift-marketplace + installPlanApproval: Automatic diff --git a/gitops/operators/60-nvidia-gpu.yaml b/gitops/operators/60-nvidia-gpu.yaml new file mode 100644 index 0000000..f1c0066 --- /dev/null +++ b/gitops/operators/60-nvidia-gpu.yaml @@ -0,0 +1,24 @@ +# NVIDIA GPU Operator — drivers + device plugin for the A10G (g5.2xlarge) node. +apiVersion: v1 +kind: Namespace +metadata: { name: nvidia-gpu-operator } +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: nvidia-gpu-operator + namespace: nvidia-gpu-operator +spec: + targetNamespaces: [nvidia-gpu-operator] +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: gpu-operator-certified + namespace: nvidia-gpu-operator +spec: + channel: "v26.7" + name: gpu-operator-certified + source: certified-operators + sourceNamespace: openshift-marketplace + installPlanApproval: Automatic diff --git a/gitops/operators/README.md b/gitops/operators/README.md index e81a7d0..063abbe 100644 --- a/gitops/operators/README.md +++ b/gitops/operators/README.md @@ -1,5 +1,14 @@ # gitops/operators/ -OLM Subscriptions applied at bootstrap (before Argo syncs `gitops/apps/`), because -their CRDs must exist first. Planned (P1): **OpenShift GitOps**, **cert-manager**, -**OpenShift AI (RHOAI)**, **External Secrets Operator**, **CloudNativePG**. -No secret values here (D5). +OLM Subscriptions applied by the bootstrap step of `make deploy` **before** the Argo +root app, because their CRDs must exist before `gitops/apps/` can sync. Order-prefixed. +No secret values here (D5). Channels pinned to the live catalog (verified 2026-11-02). + +| File | Operator | Source | Channel | +|---|---|---|---| +| 00 | OpenShift GitOps (Argo CD) | redhat-operators | latest | +| 10 | cert-manager | redhat-operators | stable-v1 | +| 20 | CloudNativePG | certified-operators | stable-v1 | +| 30 | External Secrets Operator | redhat-operators | stable-v1 | +| 40 | OpenShift AI (RHOAI, rhods-operator) | redhat-operators | stable-3.x | +| 50 | Node Feature Discovery | redhat-operators | stable | +| 60 | NVIDIA GPU Operator | certified-operators | v26.7 | diff --git a/manifests/cert-manager/README.md b/manifests/cert-manager/README.md new file mode 100644 index 0000000..a90c60e --- /dev/null +++ b/manifests/cert-manager/README.md @@ -0,0 +1,4 @@ +# manifests/cert-manager + +Resources for the `cert-manager` Argo app (`gitops/apps/cert-manager.yaml`). Populated in a later phase. +No secret values here (D5). diff --git a/manifests/cluster-config/README.md b/manifests/cluster-config/README.md new file mode 100644 index 0000000..112a780 --- /dev/null +++ b/manifests/cluster-config/README.md @@ -0,0 +1,4 @@ +# manifests/cluster-config + +Resources for the `cluster-config` Argo app (`gitops/apps/cluster-config.yaml`). Populated in a later phase. +No secret values here (D5). diff --git a/manifests/coder/README.md b/manifests/coder/README.md new file mode 100644 index 0000000..be006a6 --- /dev/null +++ b/manifests/coder/README.md @@ -0,0 +1,4 @@ +# manifests/coder + +Resources for the `coder` Argo app (`gitops/apps/coder.yaml`). Populated in a later phase. +No secret values here (D5). diff --git a/manifests/external-secrets/README.md b/manifests/external-secrets/README.md new file mode 100644 index 0000000..3b5a29d --- /dev/null +++ b/manifests/external-secrets/README.md @@ -0,0 +1,4 @@ +# manifests/external-secrets + +Resources for the `external-secrets` Argo app (`gitops/apps/external-secrets.yaml`). Populated in a later phase. +No secret values here (D5). diff --git a/manifests/keycloak/README.md b/manifests/keycloak/README.md new file mode 100644 index 0000000..9c01528 --- /dev/null +++ b/manifests/keycloak/README.md @@ -0,0 +1,4 @@ +# manifests/keycloak + +Resources for the `keycloak` Argo app (`gitops/apps/keycloak.yaml`). Populated in a later phase. +No secret values here (D5). diff --git a/manifests/model-serving/README.md b/manifests/model-serving/README.md new file mode 100644 index 0000000..d4c8bd6 --- /dev/null +++ b/manifests/model-serving/README.md @@ -0,0 +1,4 @@ +# manifests/model-serving + +Resources for the `model-serving` Argo app (`gitops/apps/model-serving.yaml`). Populated in a later phase. +No secret values here (D5). diff --git a/manifests/observability/README.md b/manifests/observability/README.md new file mode 100644 index 0000000..1d89a3b --- /dev/null +++ b/manifests/observability/README.md @@ -0,0 +1,4 @@ +# manifests/observability + +Resources for the `observability` Argo app (`gitops/apps/observability.yaml`). Populated in a later phase. +No secret values here (D5). diff --git a/manifests/postgres/README.md b/manifests/postgres/README.md new file mode 100644 index 0000000..83f1887 --- /dev/null +++ b/manifests/postgres/README.md @@ -0,0 +1,4 @@ +# manifests/postgres + +Resources for the `postgres` Argo app (`gitops/apps/postgres.yaml`). Populated in a later phase. +No secret values here (D5). diff --git a/manifests/scm/README.md b/manifests/scm/README.md new file mode 100644 index 0000000..827f32a --- /dev/null +++ b/manifests/scm/README.md @@ -0,0 +1,4 @@ +# manifests/scm + +Resources for the `scm` Argo app (`gitops/apps/scm.yaml`). Populated in a later phase. +No secret values here (D5). diff --git a/terraform/terraform.tfvars.example b/terraform/terraform.tfvars.example index 7a75f77..95d8ef3 100644 --- a/terraform/terraform.tfvars.example +++ b/terraform/terraform.tfvars.example @@ -8,8 +8,8 @@ aws_profile = "342934376218_AWSAdministratorAccess" # AWS sandbox 342934376218 # --- DNS / naming (new names, no longer referencing rhsummit) --- # Parent public zone is coderdemo.io (delegated). The cluster installs under # .; apps at *.apps... -base_domain = "pde.coderdemo.io" # CONFIRM before provisioning -cluster_name = "cluster" # -> apps.cluster.pde.coderdemo.io +base_domain = "rh-pde.coderdemo.io" # CONFIRM before provisioning +cluster_name = "cluster" # -> apps.cluster.rh-pde.coderdemo.io # --- Run mode --- # deploy_mode = "connected" # connected | airgap (also settable via `make deploy MODE=...`)