| Doc | What it covers |
|---|---|
| install.md | The full build runbook, from empty subscription to running cluster — one continuous session, dependency-ordered (prerequisites → provision → cluster-derived wiring → ArgoCD). Non-obvious pitfalls called out inline. |
| onboarding.md | How a project gets namespace(s) and developer access, and the two routes for its own workload: by hand, or from the project's own GitOps repo. |
| gitops.md | How a commit becomes a change in the cluster: the app-of-apps root, the 22 common-service Applications and their sync-wave order, the two project ApplicationSets, and where to look when something does not appear. |
| argocd.md | Lathund for driving ArgoCD with kubectl — no CLI, no GUI: read state, refresh, sync, and what each symptom means. |
| maintenance.md | Version pins, upgrade cadences, and how to keep the platform current. |
| postgres.md | The shared PostgreSQL design: why one server, what isolation it gives, and when a project should get its own instance. |
| certificates.md | How TLS is issued (HTTP-01 today), and the proposal to add DNS-01 per zone for wildcards — with the credential question that decides it. |
| decisions.md | The choices that shape the cluster, why each was made, and what was rejected — read this before reopening a settled question. |
| security.md | Namespace isolation: why pod egress to Azure IMDS is denied and why project namespaces enforce baseline Pod Security — plus what neither covers. |
| cluster-access.md | Who can be cluster-admin: the SSO path, why the static admin certificate cannot be retired on this cluster, and the Azure-side controls that constrain it instead. |
A shared Scouterna Kubernetes cluster (AKS, swedencentral), budget-sized
(single node, manual scaling), portable-by-intent (few Azure-specific pieces).
The infra group owns the cluster + common services via ArgoCD + Helm; projects
own their namespaces. See the top-level README for the full
design rationale.