From 327ffd16b746d7670b73fc5d4c7a7eaa986841d5 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Sat, 5 Sep 2026 12:02:22 -0500 Subject: [PATCH] [#699] ADR 0001: Rancher + vcluster-per-tenant-class, flux gitops; founder tenant buckets Decision from Discourse t/336 posts 3-5 (2026-09-05): option B now, C layered later, flux approved. Four tenant classes with isolation requirements recorded (RackRental hostile/ContainerLab, SLP/Rogue job-confidential, Suborbital CUI/ITAR, HFNOC ERP). https://projects.knownelement.com/issues/699 --- .../0001-platform-rancher-vcluster-tenants.md | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 docs/adr/0001-platform-rancher-vcluster-tenants.md diff --git a/docs/adr/0001-platform-rancher-vcluster-tenants.md b/docs/adr/0001-platform-rancher-vcluster-tenants.md new file mode 100644 index 0000000..f3398f7 --- /dev/null +++ b/docs/adr/0001-platform-rancher-vcluster-tenants.md @@ -0,0 +1,44 @@ +# ADR 0001: K8S platform = Rancher (B) + vcluster per tenant-class (C) later + +Status: accepted (2026-09-05, founder ruling on Discourse t/336 post 3-5). +Ticket: [#699](https://projects.knownelement.com/issues/699) · related +[#700](https://projects.knownelement.com/issues/700) [#701](https://projects.knownelement.com/issues/701) +[#702](https://projects.knownelement.com/issues/702) · thread: +https://community.turnsys.com/t/336 + +## Decision + +1. **Stage 1 — Rancher** as the single management plane on the pfv-k8s k3s + cluster: Cloudron OIDC, project-level RBAC, audit. Soak on sectestbed + 51013 / preprod 53102 first per lane soak rules. +2. **GitOps = flux** (approved; #702). Git is source of truth; Rancher UI = + observation, not mutation. +3. **Stage 2 — vcluster per tenant-class** where isolation must be hard + (#701). KNEL infra workloads (AWX, monitoring relays) stay on the host + cluster. + +## Tenant classes (founder-defined, 2026-09-05) + +| # | tenant | workloads | access model | isolation requirement | +|---|---|---|---|---| +| 1 | **RackRental** | ContainerLab | **PRESUMED HOSTILE** — customers get DIRECT access | each customer workload = own instance / sub-tenant (vcluster-per-customer); full egress/ingress isolation, assume compromise | +| 2 | **Starting Line / Rogue Technologies** | short/medium/long-term modeling + simulation for customers | customers receive OUTPUTS only, never job access; internal staff submit jobs + move artifacts | job confidentiality (vcluster per tenant-class; artifact broker service) | +| 3 | **Suborbital Systems** | hardware engineering simulation/modeling | internal only | **CUI minimum, Secret/Top Secret/SCI, ITAR + export controlled** — highest bar; feeds CMMC program (#452); likely dedicated nodes + vcluster, air-gap discipline, no shared kernels with other classes | +| 4 | **HFNOC** | GIS ETL, balloon path modeling, complex quote-to-cash ERP | internal | data-sensitivity; normal Rancher project isolation + vcluster if growth demands | + +## Consequences + +- Rancher becomes a crown-jewel dependency (gates cluster access) — treat + with prod change discipline + DR plan. +- RackRental's hostile-tenant requirement lifts design work beyond default + Rancher RBAC: network policies, node pool separation, and per-customer + vclusters are MANDATORY before first external customer. +- Suborbital class MUST NOT land until the CMMC/ITAR controls (#452) have + an approved design for that bucket. + +## Implementation tracking + +- [#700] Rancher deploy + Cloudron OIDC + RBAC (next action: design doc on + Discourse t/336 + soak deployment on 51013) +- [#701] vcluster design per tenant-class (blocked until #700 lands) +- [#702] flux gitops bootstrap (can start immediately on the host cluster)