# ADR 0001: K8S platform = Rancher (B) + vcluster per tenant-class (C) later

Status: accepted (2026-09-05, founder ruling on Discourse t/336 post 3-5).
Ticket: [#699](https://projects.knownelement.com/issues/699) · related
[#700](https://projects.knownelement.com/issues/700) [#701](https://projects.knownelement.com/issues/701)
[#702](https://projects.knownelement.com/issues/702) · thread:
https://community.turnsys.com/t/336

## Decision

1. **Stage 1 — Rancher** as the single management plane on the pfv-k8s k3s
   cluster: Cloudron OIDC, project-level RBAC, audit. Soak on sectestbed
   51013 / preprod 53102 first per lane soak rules.
2. **GitOps = flux** (approved; #702). Git is source of truth; Rancher UI =
   observation, not mutation.
3. **Stage 2 — vcluster per tenant-class** where isolation must be hard
   (#701). KNEL infra workloads (AWX, monitoring relays) stay on the host
   cluster.

## Tenant classes (founder-defined, 2026-09-05)

| # | tenant | workloads | access model | isolation requirement |
|---|---|---|---|---|
| 1 | **RackRental** | ContainerLab | **PRESUMED HOSTILE** — customers get DIRECT access | each customer workload = own instance / sub-tenant (vcluster-per-customer); full egress/ingress isolation, assume compromise |
| 2 | **Starting Line / Rogue Technologies** | short/medium/long-term modeling + simulation for customers | customers receive OUTPUTS only, never job access; internal staff submit jobs + move artifacts | job confidentiality (vcluster per tenant-class; artifact broker service) |
| 3 | **Suborbital Systems** | hardware engineering simulation/modeling | internal only | **CUI minimum, Secret/Top Secret/SCI, ITAR + export controlled** — highest bar; feeds CMMC program (#452); likely dedicated nodes + vcluster, air-gap discipline, no shared kernels with other classes |
| 4 | **HFNOC** | GIS ETL, balloon path modeling, complex quote-to-cash ERP | internal | data-sensitivity; normal Rancher project isolation + vcluster if growth demands |

## Consequences

- Rancher becomes a crown-jewel dependency (gates cluster access) — treat
  with prod change discipline + DR plan.
- RackRental's hostile-tenant requirement lifts design work beyond default
  Rancher RBAC: network policies, node pool separation, and per-customer
  vclusters are MANDATORY before first external customer.
- Suborbital class MUST NOT land until the CMMC/ITAR controls (#452) have
  an approved design for that bucket.

## Implementation tracking

- [#700] Rancher deploy + Cloudron OIDC + RBAC (next action: design doc on
  Discourse t/336 + soak deployment on 51013)
- [#701] vcluster design per tenant-class (blocked until #700 lands)
- [#702] flux gitops bootstrap (can start immediately on the host cluster)