Skip to content

docs: clarify GitOps reconciliation and ARC recovery #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xnoto merged 1 commit into from
Aug 14, 2026
Merged

docs: clarify GitOps reconciliation and ARC recovery #50

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,8 @@ There is no in-cluster ingress controller and no public IP. Every external entry
- `argocd` — ArgoCD, KSOPS plugin, `sops-age-keys` Secret
- `cert-manager` — cert-manager controllers + Cloudflare API token
- `cloudflare-operator-system` — cloudflare-operator, tunnel deployment, Cloudflare API secret
- `arc-system` — ARC controller (Actions Runner Controller)
- `arc-systems` — ARC controller (Actions Runner Controller)
- `arc-runners` — ARC scale sets, listeners, and ephemeral runner pods

## Certificate Management

Expand Down Expand Up @@ -179,6 +180,7 @@ pre-commit run --all-files
4. **Tor secret format** — Use `data` with raw binary base64; `stringData` double-encodes.
5. **KSOPS needs the age key in the repo-server pod** — Without `sops-age-keys` mounted, manifest generation fails before any sync.
6. **DNS-01 requires external resolvers** — cluster DNS cannot validate Let's Encrypt challenges; the cert-manager controller args above are required.
7. **ARC upgrades can leave a stale listener** — because pruning is disabled for controller-generated listener resources, a chart upgrade can leave a listener referencing a deleted `EphemeralRunnerSet`. The listener then restarts with `ephemeralrunnersets.actions.github.com "<name>" not found`, and `arc-tf` jobs remain queued. Inspect the listener pod's owner and current ARC custom resources before deleting the stale `AutoscalingListener`; deleting only its pod recreates the same broken listener.

## Useful Commands

Expand Down
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,12 +163,12 @@ The age public key is committed in `.sops.yaml`. The matching private key is loa

## CI/CD

`.github/workflows/ci.yml`:
The repository uses `.github/workflows/test.yml` and `.github/workflows/sync.yml`:

1. **test** (`ubuntu-latest`) — runs pre-commit (yamllint, kube-linter, conventional-commit, etc.)
2. **sync** (`arc` runner, `main` only) — `kubectl patch` each App-of-Apps root (`bootstrap-secrets`, `gitops-operators`, `gitops-workloads`) to trigger an ArgoCD sync at the new SHA
2. **sync** (`arc-tf` runner, `main` only) — after tests pass, patches each App-of-Apps root (`bootstrap-secrets`, `gitops-operators`, `gitops-workloads`) to initiate an ArgoCD sync at the tested SHA

The in-cluster ARC runner uses its ServiceAccount token to talk to the API directly.
The in-cluster ARC runner uses its ServiceAccount token to talk to the API directly. The sync workflow initiates reconciliation but does not wait for it to finish. Afterward, confirm each affected Application reports the target revision, `Synced`, and `Healthy`. Use `workflow_dispatch` on `sync.yml` to retry the selected ref when necessary.

## Resource Sizing

Expand Down
Loading