bcgov · alex-struk · Jul 2, 2026 · Jul 2, 2026 · Jul 2, 2026 · Jul 2, 2026
@@ -797,12 +797,12 @@ docker run \
 
 ### OpenShift/Kubernetes
 
-Kubernetes manifests are provided in `deployments/openshift/kustomize/`:
-
-```bash
-# Apply to cluster
-kubectl apply -k deployments/openshift/kustomize/overlays/dev
-```
+Kubernetes manifests are provided in `deployments/openshift/kustomize/`. Deployments are
+driven by the **Deploy Instance** GitHub Actions workflow, which renders an instance-specific
+overlay from `overlays/instance-template` and applies it (pushes to `develop` deploy to
+`fd34fb-test`, pushes to `main` deploy to `fd34fb-prod`). See
+[docs-md/openshift-deployment/AUTO_DEPLOY.md](docs-md/openshift-deployment/AUTO_DEPLOY.md) and
+[docs-md/openshift-deployment/KUSTOMIZE_INSTANCE_TEMPLATE.md](docs-md/openshift-deployment/KUSTOMIZE_INSTANCE_TEMPLATE.md).
 
 **Features:**
 - Database migration init containers

@@ -10,18 +10,11 @@ metadata:
     # The haproxy.router.openshift.io/deny list uses path-based ACLs
     # to return 403 for matching request paths.
     haproxy.router.openshift.io/deny-list: /metrics
-    # Only allow clients whose source IP matches one of the entries below (space-separated).
-    # VPN:      142.16.0.0/11      (BC Gov VPN range)
-    # Silver:   142.34.194.121–124 (NAT pool egress IPs)
-    # Gold:     142.34.229.6–9     (NAT pool egress IPs)
-    # Gold DR:  142.34.64.6–9      (NAT pool egress IPs)
-    # Emerald:  no fixed egress IPs — each namespace has a dedicated /26 private range;
-    #           add your namespace's /26 CIDR here if cross-cluster access from Emerald is needed.
-    haproxy.router.openshift.io/ip_allowlist: >-
-      142.16.0.0/11
-      142.34.194.121 142.34.194.122 142.34.194.123 142.34.194.124
-      142.34.229.6 142.34.229.7 142.34.229.8 142.34.229.9
-      142.34.64.6 142.34.64.7 142.34.64.8 142.34.64.9
+    # No source-IP allowlist here on purpose: base is open so ephemeral PR and
+    # test/dev instances are reachable without VPN. The production-only source-IP
+    # allowlist (haproxy.router.openshift.io/ip_allowlist) is applied by the
+    # components/prod-resources component, which scripts/lib/generate-overlay.sh
+    # includes automatically when the target namespace ends in -prod.
     haproxy.router.openshift.io/proxy-body-size: 100m
 spec:
   to:

@@ -4,19 +4,11 @@ metadata:
   name: frontend
   labels:
     app: frontend
-  annotations:
-    # Only allow clients whose source IP matches one of the entries below (space-separated).
-    # VPN:      142.16.0.0/11      (BC Gov VPN range)
-    # Silver:   142.34.194.121–124 (NAT pool egress IPs)
-    # Gold:     142.34.229.6–9     (NAT pool egress IPs)
-    # Gold DR:  142.34.64.6–9      (NAT pool egress IPs)
-    # Emerald:  no fixed egress IPs — each namespace has a dedicated /26 private range;
-    #           add your namespace's /26 CIDR here if cross-cluster access from Emerald is needed.
-    haproxy.router.openshift.io/ip_allowlist: >-
-      142.16.0.0/11
-      142.34.194.121 142.34.194.122 142.34.194.123 142.34.194.124
-      142.34.229.6 142.34.229.7 142.34.229.8 142.34.229.9
-      142.34.64.6 142.34.64.7 142.34.64.8 142.34.64.9
+  # No source-IP allowlist here on purpose: base is open so ephemeral PR and
+  # test/dev instances are reachable without VPN. The production-only source-IP
+  # allowlist (haproxy.router.openshift.io/ip_allowlist) is applied by the
+  # components/prod-resources component, which scripts/lib/generate-overlay.sh
+  # includes automatically when the target namespace ends in -prod.
 spec:
   to:
     kind: Service

@@ -8,12 +8,20 @@ kind: Component
 # runs heavier, sustained document-processing workloads, so the main
 # application containers need more memory headroom to avoid OOMKills.
 #
+# It also applies the production-only source-IP allowlist to the public Routes:
+# the base Routes are intentionally open (so test/dev/PR instances need no VPN),
+# and prod restricts ingress to the BC Gov 142.x range via the patches below.
+#
 # This component is included by scripts/lib/generate-overlay.sh automatically
-# when the target namespace is *-prod. It only raises the memory *limit*
-# (requests are unchanged) so it has no effect on the namespace request quota.
+# when the target namespace is *-prod. The memory patches only raise the memory
+# *limit* (requests are unchanged) so they have no effect on the namespace
+# request quota.
 patches:
   - path: backend-services-memory.yml
   - path: temporal-worker-memory.yml
+  # Production-only source-IP allowlist on the public Routes (see each file).
+  - path: route-allowlist-backend.yml
+  - path: route-allowlist-frontend.yml
   # Prod's temporal Postgres data volume was expanded in-place to 5Gi. The base
   # manifest keeps 1.5Gi for ephemeral/test instances; match the live prod size
   # here so the Crunchy operator stops trying to reconcile it down to 1.5Gi

@@ -0,0 +1,21 @@
+# Production-only source-IP allowlist for the backend Route.
+#
+# Merged in only for *-prod namespaces (see components/prod-resources/kustomization.yml,
+# included by scripts/lib/generate-overlay.sh when the namespace ends in -prod). Test/dev
+# and ephemeral PR instances inherit the open base Route and stay reachable without VPN.
+#
+# Value is the full BC Gov public 142.x allocation (ARIN org PBC-51-Z): 142.22.0.0/16–
+# 142.36.0.0/16. This covers VPN egress and the Silver/Gold/Gold-DR NAT pools (all within
+# 142.34.0.0/16). Ref: https://whois.arin.net/rest/org/PBC-51-Z/nets
+#
+# Uses the ip_allowlist annotation key (renamed from ip_whitelist in PR #218 / AI-1341
+# for inclusive naming; honored by the Silver cluster's OpenShift HAProxy router).
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: backend-services
+  annotations:
+    haproxy.router.openshift.io/ip_allowlist: >-
+      142.22.0.0/16 142.23.0.0/16 142.24.0.0/16 142.25.0.0/16 142.26.0.0/16
+      142.27.0.0/16 142.28.0.0/16 142.29.0.0/16 142.30.0.0/16 142.31.0.0/16
+      142.32.0.0/16 142.33.0.0/16 142.34.0.0/16 142.35.0.0/16 142.36.0.0/16
@@ -0,0 +1,21 @@
+# Production-only source-IP allowlist for the frontend Route.
+#
+# Merged in only for *-prod namespaces (see components/prod-resources/kustomization.yml,
+# included by scripts/lib/generate-overlay.sh when the namespace ends in -prod). Test/dev
+# and ephemeral PR instances inherit the open base Route and stay reachable without VPN.
+#
+# Value is the full BC Gov public 142.x allocation (ARIN org PBC-51-Z): 142.22.0.0/16–
+# 142.36.0.0/16. This covers VPN egress and the Silver/Gold/Gold-DR NAT pools (all within
+# 142.34.0.0/16). Ref: https://whois.arin.net/rest/org/PBC-51-Z/nets
+#
+# Uses the ip_allowlist annotation key (renamed from ip_whitelist in PR #218 / AI-1341
+# for inclusive naming; honored by the Silver cluster's OpenShift HAProxy router).
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: frontend
+  annotations:
+    haproxy.router.openshift.io/ip_allowlist: >-
+      142.22.0.0/16 142.23.0.0/16 142.24.0.0/16 142.25.0.0/16 142.26.0.0/16
+      142.27.0.0/16 142.28.0.0/16 142.29.0.0/16 142.30.0.0/16 142.31.0.0/16
+      142.32.0.0/16 142.33.0.0/16 142.34.0.0/16 142.35.0.0/16 142.36.0.0/16
@@ -1,16 +1,26 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: fd34fb-test
-resources:
-- ../../base
-images:
-- name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/backend-services
-  newTag: develop-latest
-- name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/temporal
-  newTag: develop-latest
-- name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/frontend
-  newTag: develop-latest
-commonLabels:
-  env: dev
-
-
+# =============================================================================
+# PENDING / NOT WIRED IN — fixed-overlay deploy path for dev.
+#
+# Kept as a legible reference for a possible future "hybrid" deploy model:
+# fixed, committed overlays alongside the generate-overlay.sh +
+# overlays/instance-template script that is required for ephemeral branch
+# instances. Nothing in the pipeline builds this file today. Left fully
+# commented out on purpose so it stays inert until the decision is made.
+#
+#   AI-1687 — https://citz-do.atlassian.net/browse/AI-1687
+# =============================================================================
+#
+# apiVersion: kustomize.config.k8s.io/v1beta1
+# kind: Kustomization
+# namespace: fd34fb-test
+# resources:
+# - ../../base
+# images:
+# - name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/backend-services
+#   newTag: develop-latest
+# - name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/temporal
+#   newTag: develop-latest
+# - name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/frontend
+#   newTag: develop-latest
+# commonLabels:
+#   env: dev
@@ -1,11 +1,19 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: backend-services-config
-data:
-  FRONTEND_URL: "https://frontend-fd34fb-prod.apps.silver.devops.gov.bc.ca"
-  BACKEND_URL: "https://backend-services-fd34fb-prod.apps.silver.devops.gov.bc.ca"
-  SSO_REDIRECT_URI: "https://frontend-fd34fb-prod.apps.silver.devops.gov.bc.ca/api/auth/callback"
-  SSO_AUTH_SERVER_URL: "https://loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect"
-  SSO_REALM: "standard"
-  SSO_CLIENT_ID: "ai-adoption-document-intelligence-6162"
+# =============================================================================
+# PENDING / NOT WIRED IN — configmap patch consumed by the fixed prod overlay
+# (overlays/prod/kustomization.yml). Kept as a legible reference for the future
+# hybrid deploy model; nothing builds it today. Left commented out on purpose.
+#
+#   AI-1687 — https://citz-do.atlassian.net/browse/AI-1687
+# =============================================================================
+#
+# apiVersion: v1
+# kind: ConfigMap
+# metadata:
+#   name: backend-services-config
+# data:
+#   FRONTEND_URL: "https://frontend-fd34fb-prod.apps.silver.devops.gov.bc.ca"
+#   BACKEND_URL: "https://backend-services-fd34fb-prod.apps.silver.devops.gov.bc.ca"
+#   SSO_REDIRECT_URI: "https://frontend-fd34fb-prod.apps.silver.devops.gov.bc.ca/api/auth/callback"
+#   SSO_AUTH_SERVER_URL: "https://loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect"
+#   SSO_REALM: "standard"
+#   SSO_CLIENT_ID: "ai-adoption-document-intelligence-6162"
@@ -1,28 +1,37 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: fd34fb-prod
-resources:
-- ../../base
-patches:
-- path: backend-services-configmap.yml
-  target:
-    kind: ConfigMap
-    name: backend-services-config
-- path: route-allowlist-patch.yml
-  target:
-    kind: Route
-    name: backend-services
-- path: route-allowlist-patch.yml
-  target:
-    kind: Route
-    name: frontend
-images:
-- name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/backend-services
-  newTag: main-latest
-- name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/temporal
-  newTag: main-latest
-- name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/frontend
-  newTag: main-latest
-commonLabels:
-  env: prod
-
+# =============================================================================
+# PENDING / NOT WIRED IN — fixed-overlay deploy path for prod.
+#
+# Kept as a legible reference for a possible future "hybrid" deploy model:
+# fixed, committed overlays for the stable test/prod environments alongside the
+# generate-overlay.sh + overlays/instance-template script that is required for
+# ephemeral branch instances. Nothing in the pipeline builds this file today —
+# the live deploy path renders EVERY environment (incl. test/prod) from
+# overlays/instance-template. Left fully commented out on purpose so it stays
+# inert until the decision is made.
+#
+#   AI-1687 — https://citz-do.atlassian.net/browse/AI-1687
+#
+# If adopting this for prod: seed it from the CURRENTLY RENDERED object
+# names/labels (a static namePrefix matching today's instance name + the same
+# commonLabels) so it lands as an in-place `oc apply`, NOT a rename/migration.
+# =============================================================================
+#
+# apiVersion: kustomize.config.k8s.io/v1beta1
+# kind: Kustomization
+# namespace: fd34fb-prod
+# resources:
+# - ../../base
+# patches:
+# - path: backend-services-configmap.yml
+#   target:
+#     kind: ConfigMap
+#     name: backend-services-config
+# images:
+# - name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/backend-services
+#   newTag: main-latest
+# - name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/temporal
+#   newTag: main-latest
+# - name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/frontend
+#   newTag: main-latest
+# commonLabels:
+#   env: prod
@@ -1,11 +1,19 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: backend-services-config
-data:
-  FRONTEND_URL: "https://frontend-fd34fb-test.apps.silver.devops.gov.bc.ca"
-  BACKEND_URL: "https://backend-services-fd34fb-test.apps.silver.devops.gov.bc.ca"
-  SSO_REDIRECT_URI: "https://frontend-fd34fb-test.apps.silver.devops.gov.bc.ca/api/auth/callback"
-  SSO_AUTH_SERVER_URL: "https://test.loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect"
-  SSO_REALM: "standard"
-  SSO_CLIENT_ID: "ai-adoption-document-intelligence-6162"
+# =============================================================================
+# PENDING / NOT WIRED IN — configmap patch consumed by the fixed test overlay
+# (overlays/test/kustomization.yml). Kept as a legible reference for the future
+# hybrid deploy model; nothing builds it today. Left commented out on purpose.
+#
+#   AI-1687 — https://citz-do.atlassian.net/browse/AI-1687
+# =============================================================================
+#
+# apiVersion: v1
+# kind: ConfigMap
+# metadata:
+#   name: backend-services-config
+# data:
+#   FRONTEND_URL: "https://frontend-fd34fb-test.apps.silver.devops.gov.bc.ca"
+#   BACKEND_URL: "https://backend-services-fd34fb-test.apps.silver.devops.gov.bc.ca"
+#   SSO_REDIRECT_URI: "https://frontend-fd34fb-test.apps.silver.devops.gov.bc.ca/api/auth/callback"
+#   SSO_AUTH_SERVER_URL: "https://test.loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect"
+#   SSO_REALM: "standard"
+#   SSO_CLIENT_ID: "ai-adoption-document-intelligence-6162"
@@ -1,31 +1,39 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: fd34fb-test
-resources:
-- ../../base
-patches:
-- path: backend-services-configmap.yml
-  target:
-    kind: ConfigMap
-    name: backend-services-config
-- path: route-allowlist-patch.yml
-  target:
-    kind: Route
-    name: backend-services
-- path: route-allowlist-patch.yml
-  target:
-    kind: Route
-    name: frontend
-images:
-# Pin digest so cluster pulls the image currently in Artifactory (avoids stale tag cache)
-- name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/backend-services
-  newTag: develop-latest1
-  # digest: sha256:282be39343c2f570f21ee76f0a81e8af8f5726d59c0820a86228d39d4fa513b1
-- name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/temporal
-  newTag: develop-latest
-- name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/frontend
-  newTag: develop-latest
-commonLabels:
-  env: dev
-
-
+# =============================================================================
+# PENDING / NOT WIRED IN — fixed-overlay deploy path for test.
+#
+# Kept as a legible reference for a possible future "hybrid" deploy model:
+# fixed, committed overlays for the stable test/prod environments alongside the
+# generate-overlay.sh + overlays/instance-template script that is required for
+# ephemeral branch instances. Nothing in the pipeline builds this file today —
+# the live deploy path renders EVERY environment (incl. test/prod) from
+# overlays/instance-template. Left fully commented out on purpose so it stays
+# inert until the decision is made.
+#
+#   AI-1687 — https://citz-do.atlassian.net/browse/AI-1687
+#
+# If adopting this for test: seed it from the CURRENTLY RENDERED object
+# names/labels (a static namePrefix matching today's instance name + the same
+# commonLabels) so it lands as an in-place `oc apply`, NOT a rename/migration.
+# =============================================================================
+#
+# apiVersion: kustomize.config.k8s.io/v1beta1
+# kind: Kustomization
+# namespace: fd34fb-test
+# resources:
+# - ../../base
+# patches:
+# - path: backend-services-configmap.yml
+#   target:
+#     kind: ConfigMap
+#     name: backend-services-config
+# images:
+# # Pin digest so cluster pulls the image currently in Artifactory (avoids stale tag cache)
+# - name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/backend-services
+#   newTag: develop-latest1
+#   # digest: sha256:282be39343c2f570f21ee76f0a81e8af8f5726d59c0820a86228d39d4fa513b1
+# - name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/temporal
+#   newTag: develop-latest
+# - name: artifacts.developer.gov.bc.ca/kfd3-fd34fb-local/frontend
+#   newTag: develop-latest
+# commonLabels:
+#   env: dev