refactor(prod): make j26-scoutid-sync self-contained (isolate from dev base) - #48
Merged
Merged
Conversation
Convert the prod scoutid-sync overlay to a standalone package so no dev-side change can silently reach production. This is the highest-value isolation: the app's assignment config (config.yml, config-participants.yml) and the group-mapping CSVs drive ~18k prod Keycloak memberships, and were previously inherited verbatim from the dev base — a dev edit would flow straight to prod on the next sync with no review gate. Each prod file is now a copy: the two env ConfigMaps carry the prod Keycloak host + parent group directly (no configMapGenerator merge), the two SPCs use the prod KV objects, schedules are baked in (staff :15, participants :45), and the config/CSV bundles are prod-owned. Renders byte-identically to the previous overlay; matches the running cluster (only ArgoCD tracking-id annotations differ, which ArgoCD adds itself). Tradeoff: genuine dev fixes to these files must now be carried over deliberately (tracked via the dev-PR review routine). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR refactors the k8s/app-manifest-prod/j26-scoutid-sync production overlay to be fully self-contained (no longer inheriting from the dev base), preventing dev-side manifest/config changes—especially the assignment rules and CSV mappings that drive large-scale prod Keycloak memberships—from flowing into prod without an explicit prod change.
Changes:
- Replace the prod overlay’s
../../app-manifest/j26-scoutid-syncdependency with prod-owned copies of all manifests and config/CSV bundles. - Inline prod-specific schedules directly in the CronJob manifests (staff
:15, participants:45) and remove the schedule patches. - Replace SecretProviderClass patches with full prod-owned SecretProviderClass resources pointing at the intended KV objects.
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| k8s/app-manifest-prod/j26-scoutid-sync/kustomization.yaml | Removes dev-base reference; lists all prod-owned resources and generators. |
| k8s/app-manifest-prod/j26-scoutid-sync/cron-job.yaml | Adds standalone staff CronJob with prod schedule. |
| k8s/app-manifest-prod/j26-scoutid-sync/cron-job-participants.yaml | Adds standalone participants CronJob with prod schedule and config mount mapping. |
| k8s/app-manifest-prod/j26-scoutid-sync/configmap.yaml | Adds prod env ConfigMap for staff sync. |
| k8s/app-manifest-prod/j26-scoutid-sync/configmap-participants.yaml | Adds prod env ConfigMap for participants sync. |
| k8s/app-manifest-prod/j26-scoutid-sync/secret-provider-class.yaml | Adds prod-owned SecretProviderClass for staff sync secrets. |
| k8s/app-manifest-prod/j26-scoutid-sync/secret-provider-class-participants.yaml | Adds prod-owned SecretProviderClass for participants sync secrets. |
| k8s/app-manifest-prod/j26-scoutid-sync/secret-provider-class-patch.yaml | Removed: no longer patching dev-base SecretProviderClass. |
| k8s/app-manifest-prod/j26-scoutid-sync/secret-provider-class-participants-patch.yaml | Removed: no longer patching dev-base participants SecretProviderClass. |
| k8s/app-manifest-prod/j26-scoutid-sync/config.yml | Adds prod-owned staff assignment rules config. |
| k8s/app-manifest-prod/j26-scoutid-sync/config-participants.yml | Adds prod-owned participants assignment rules config. |
| k8s/app-manifest-prod/j26-scoutid-sync/function_slugs.csv | Adds prod-owned function slug mapping CSV. |
| k8s/app-manifest-prod/j26-scoutid-sync/group_mappings.csv | Adds prod-owned group→village/district mapping CSV. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address Copilot on #48: order the two env ConfigMaps as apiVersion/kind/metadata/data (they were extracted from rendered output, which alphabetizes keys). Cosmetic only — rendered manifests are unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 4, 2026
scriptcoded
approved these changes
Jul 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Converts the production j26-scoutid-sync overlay from a dev-base overlay into a standalone package, so a dev-side change can no longer silently reach production.
Why
Prod overlays inherit the dev base (
resources: ../../app-manifest/…) withtargetRevision: main. For scoutid-sync that meant the assignment config (config.yml,config-participants.yml) and the group-mapping CSVs — which drive ~18k prod Keycloak memberships — were inherited verbatim. A dev edit to those would flow straight to prod on the next sync, with no prod review gate. This is the highest-blast-radius instance of the coupling documented in issue #37.What
Every file the overlay used to inherit is now a prod-owned copy:
configMapGenerator … mergethat only covered named keys).:15, participants:45).../../app-manifestreference remains.Safety
kubectl kustomizediff is empty).kubectl diff -kdelta is ArgoCD's owntracking-idannotations, which ArgoCD injects. So this is a no-op for the cluster; ArgoCD sees nothing to change.Tradeoff (accepted)
Prod no longer auto-inherits dev fixes to these files. Genuine dev changes are carried over deliberately, tracked via the dev-PR review routine. This is the intended posture going into camp: prod changes only when prod is deliberately changed.
Companion change: platsbank + scoutin-2 get the same treatment in #39.
🤖 Generated with Claude Code