mrcharles
327ffd16b7
ci / audit (push) Successful in 41s
Decision from Discourse t/336 posts 3-5 (2026-09-05): option B now, C layered later, flux approved. Four tenant classes with isolation requirements recorded (RackRental hostile/ContainerLab, SLP/Rogue job-confidential, Suborbital CUI/ITAR, HFNOC ERP). https://projects.knownelement.com/issues/699
2.7 KiB
2.7 KiB
ADR 0001: K8S platform = Rancher (B) + vcluster per tenant-class (C) later
Status: accepted (2026-09-05, founder ruling on Discourse t/336 post 3-5). Ticket: #699 · related #700 #701 #702 · thread: https://community.turnsys.com/t/336
Decision
- Stage 1 — Rancher as the single management plane on the pfv-k8s k3s cluster: Cloudron OIDC, project-level RBAC, audit. Soak on sectestbed 51013 / preprod 53102 first per lane soak rules.
- GitOps = flux (approved; #702). Git is source of truth; Rancher UI = observation, not mutation.
- Stage 2 — vcluster per tenant-class where isolation must be hard (#701). KNEL infra workloads (AWX, monitoring relays) stay on the host cluster.
Tenant classes (founder-defined, 2026-09-05)
| # | tenant | workloads | access model | isolation requirement |
|---|---|---|---|---|
| 1 | RackRental | ContainerLab | PRESUMED HOSTILE — customers get DIRECT access | each customer workload = own instance / sub-tenant (vcluster-per-customer); full egress/ingress isolation, assume compromise |
| 2 | Starting Line / Rogue Technologies | short/medium/long-term modeling + simulation for customers | customers receive OUTPUTS only, never job access; internal staff submit jobs + move artifacts | job confidentiality (vcluster per tenant-class; artifact broker service) |
| 3 | Suborbital Systems | hardware engineering simulation/modeling | internal only | CUI minimum, Secret/Top Secret/SCI, ITAR + export controlled — highest bar; feeds CMMC program (#452); likely dedicated nodes + vcluster, air-gap discipline, no shared kernels with other classes |
| 4 | HFNOC | GIS ETL, balloon path modeling, complex quote-to-cash ERP | internal | data-sensitivity; normal Rancher project isolation + vcluster if growth demands |
Consequences
- Rancher becomes a crown-jewel dependency (gates cluster access) — treat with prod change discipline + DR plan.
- RackRental's hostile-tenant requirement lifts design work beyond default Rancher RBAC: network policies, node pool separation, and per-customer vclusters are MANDATORY before first external customer.
- Suborbital class MUST NOT land until the CMMC/ITAR controls (#452) have an approved design for that bucket.
Implementation tracking
- [#700] Rancher deploy + Cloudron OIDC + RBAC (next action: design doc on Discourse t/336 + soak deployment on 51013)
- [#701] vcluster design per tenant-class (blocked until #700 lands)
- [#702] flux gitops bootstrap (can start immediately on the host cluster)