greg-the-coder · Nov 2, 2026 · Nov 2, 2026 · Nov 2, 2026 · Nov 2, 2026
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
diff --git a/.gitleaks.toml b/.gitleaks.toml
diff --git a/docs/decisions.md b/docs/decisions.md
@@ -45,7 +45,9 @@ encrypted. **Rejected:** **Sealed Secrets / SOPS** — they still commit *cipher
 to permanent public history (and sealed values are useless to anyone cloning the
 repo). In **connected** mode ESO may optionally be backed by AWS Secrets Manager —
 still only references in git; in **air‑gap** mode ESO generators (or an in‑cluster
-Vault) keep it dependency‑free. A `gitleaks` CI gate enforces "no secrets in git."
+Vault) keep it dependency‑free. Enforcement uses **GitHub‑native secret scanning
++ push protection** (repo setting), consistent with the rest of the Coder org —
+no CI secret‑scanner action is maintained in‑repo.
 
 ## D6 — Coder Agents demoed in‑product ✅
 **Picked:** the headline flow is Coder Agents (Tasks/chat) in the Coder UI. The
@@ -70,7 +72,7 @@ else gets folded in or dropped. **Why:** the prior repo drifted to 33 markdown f
 ### Logistics (locked 2026‑11‑02)
 - Repo: `greg-the-coder/PDE-OpenShift-Reference-Beta` (public fork).
 - AWS sandbox **342934376218**, us‑east‑1. New DNS drops `rhsummit`:
-  `base_domain = pde.coderdemo.io` → apps at `*.apps.cluster.pde.coderdemo.io`
+  `base_domain = rh-pde.coderdemo.io` → apps at `*.apps.cluster.rh-pde.coderdemo.io`
   (confirm exact base domain before cluster provisioning).
 - Air‑gap: **simulated‑on‑connected first**; fully‑disconnected path documented.
 - Cloud LLM: **Bedrock kept as an optional connected‑mode provider**; air‑gap = RHOAI only.
diff --git a/docs/deploy.md b/docs/deploy.md
@@ -8,7 +8,7 @@
 - `oc`, `aws`, `terraform` on PATH (`make preflight` checks).
 - A **Red Hat pull secret** (for RHOAI/RHBK operator images).
 - A **Coder license** key (needed at the air‑gap/Agents phase).
-- `base_domain` for the new DNS (default `pde.coderdemo.io`; see `terraform/terraform.tfvars.example`).
+- `base_domain` for the new DNS (default `rh-pde.coderdemo.io`; see `terraform/terraform.tfvars.example`).
 
 ## Deploy
 ```bash

diff --git a/gitops/apps/cert-manager.yaml b/gitops/apps/cert-manager.yaml
@@ -0,0 +1,30 @@
+# ClusterIssuers (ACME connected / internal CA air-gap).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
+    targetRevision: main
+    path: manifests/cert-manager
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 8
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
diff --git a/gitops/apps/cluster-config.yaml b/gitops/apps/cluster-config.yaml
@@ -0,0 +1,30 @@
+# Cluster-wide config: OAuth/Keycloak IdP, Argo RBAC (committed so SSO admins work), namespaces/RBAC.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cluster-config
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
+    targetRevision: main
+    path: manifests/cluster-config
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: openshift-gitops
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 8
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
diff --git a/gitops/apps/coder.yaml b/gitops/apps/coder.yaml
@@ -0,0 +1,30 @@
+# Coder (Helm via GitOps): OIDC->Keycloak, AI Gateway, routes/TLS.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: coder
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
+    targetRevision: main
+    path: manifests/coder
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: coder
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 8
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
diff --git a/gitops/apps/external-secrets.yaml b/gitops/apps/external-secrets.yaml
@@ -0,0 +1,30 @@
+# ESO ClusterSecretStore + Password generators + ExternalSecrets (D5: secrets generated in-cluster, none in git).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
+    targetRevision: main
+    path: manifests/external-secrets
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 8
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
diff --git a/gitops/apps/keycloak.yaml b/gitops/apps/keycloak.yaml
@@ -0,0 +1,30 @@
+# RHBK Keycloak + realm 'demo' (secret-free template; creds injected from ESO-generated Secret).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: keycloak
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
+    targetRevision: main
+    path: manifests/keycloak
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: keycloak
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 8
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
diff --git a/gitops/apps/model-serving.yaml b/gitops/apps/model-serving.yaml
@@ -0,0 +1,30 @@
+# RHOAI DataScienceCluster (KServe RawDeployment) + vLLM ServingRuntime + InferenceService (Qwen2.5-7B on A10G).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: model-serving
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
+    targetRevision: main
+    path: manifests/model-serving
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: rhoai-serving
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 8
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
diff --git a/gitops/apps/observability.yaml b/gitops/apps/observability.yaml
@@ -0,0 +1,30 @@
+# Minimal: enable OCP user-workload monitoring + 1-2 console dashboards (D8).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: observability
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
+    targetRevision: main
+    path: manifests/observability
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: openshift-monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 8
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
diff --git a/gitops/apps/postgres.yaml b/gitops/apps/postgres.yaml
@@ -0,0 +1,30 @@
+# CNPG Cluster CRs for Coder + Keycloak (secrets auto-generated by the operator).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: postgres
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
+    targetRevision: main
+    path: manifests/postgres
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: coder
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 8
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
diff --git a/gitops/apps/scm.yaml b/gitops/apps/scm.yaml
@@ -0,0 +1,30 @@
+# In-cluster Git (Gitea / GitLab-operator) for the demo repos.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: scm
+  namespace: openshift-gitops
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
+    targetRevision: main
+    path: manifests/scm
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: scm
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 8
+      backoff:
+        duration: 30s
+        factor: 2
+        maxDuration: 5m
diff --git a/gitops/bootstrap/root-app.yaml b/gitops/bootstrap/root-app.yaml
@@ -16,7 +16,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://github.com/greg-the-coder/PDE-OpenShift-Reference-Beta.git
+    repoURL: https://github.com/coder/PDE-OpenShift-Reference-Beta.git
     targetRevision: main
     path: gitops/apps
     directory:

diff --git a/gitops/operators/00-openshift-gitops.yaml b/gitops/operators/00-openshift-gitops.yaml
@@ -0,0 +1,14 @@
+# OpenShift GitOps (Argo CD). Bootstrap: installs the operator that then runs Argo in
+# namespace openshift-gitops. Argo cannot install the operator that provides Argo, so
+# this Subscription is applied directly by `make deploy`, not by Argo.
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: openshift-gitops-operator
+  namespace: openshift-operators
+spec:
+  channel: latest
+  name: openshift-gitops-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace
+  installPlanApproval: Automatic
diff --git a/gitops/operators/10-cert-manager.yaml b/gitops/operators/10-cert-manager.yaml
@@ -0,0 +1,24 @@
+# cert-manager (Red Hat). Issues TLS (ACME in connected mode, internal CA in air-gap).
+apiVersion: v1
+kind: Namespace
+metadata: { name: cert-manager-operator }
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: cert-manager-operator
+  namespace: cert-manager-operator
+spec:
+  targetNamespaces: [cert-manager-operator]
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: openshift-cert-manager-operator
+  namespace: cert-manager-operator
+spec:
+  channel: stable-v1
+  name: openshift-cert-manager-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace
+  installPlanApproval: Automatic