Skip to content

BD-4 Prerequisites Checklist

Sign-off document for BD-4.0. All items must be ticked with evidence before BD-4.1 starts. Run bash scripts/bd4-preflight.sh (covers items 1-13 + 18). Items 14-17 + 20 are manual one-shot checks.

Date signed off: pending Signed off by: pending

Scripted checks (bd4-preflight.sh)

# Check Pass/Fail Evidence
1 Argo CD platform Apps all Synced+Healthy
2 ClusterSecretStores Valid (3 Doppler stores)
3 Gateway listeners Accepted+ResolvedRefs
4 Tenant namespace labels (gateway.unipuka.app/tenant)
5 DOCR pull secret do-registry in all tenant ns
5b DOCR registry tier = basic (not starter)
6 ResourceQuota cpu=4 + LimitRange in all tenant ns
7 All 6 NetworkPolicies in all 3 tenant ns (18 total)
8 TLS Secrets in gateway ns (3 certs)
9 Doppler tenant configs >= 45 keys each
10 Class-1 keys present in all 3 Doppler envs
11 Class-3 keys present in all 3 Doppler envs
12 NetworkPolicy egress covers 25060+25061 in all tenant ns
13 Operator toolchain: helm/yq/kubectl/doppler/doctl (ct+kubeconform: CI)
18 GitHub Actions runner available

Manual checks

# Check Status Evidence / Notes
14 soa repo on master, Laravel 11, composer install clean
15 unipuka-infra-ops on master, apps/laravel does NOT yet exist
16 Linear tickets UNI-73..UNI-83 visible, milestone=BD-4, estimates set
17 No new Doppler keys required for BD-4 (Class-1+3 sufficient, confirmed)
19 Preflight script written at scripts/bd4-preflight.sh ✅ done
20 DOCR tier upgrade applied: registry.tf starter -> basic, TF plan clean

Item 5b / Item 20 - DOCR Starter -> Basic upgrade

Why: soa image is ~363 MB. DOCR Starter = 500 MiB hard cap (no overage, pushes FAIL). BD-5.5's 30-tag retention (~2.4 GB assuming heavy layer deduplication across successive builds - each new tag shares most layers with the previous one) is impossible on Starter. Basic = 5 GiB / 5 repos / $5/mo ($0.02/GiB overage). Basic sufficient for single oep/api repo + 30-tag retention.

Action: unipuka-infra-do/oep-infra/registry.tf line 3 changed starter -> basic. Apply with: direnv exec oep-infra terraform -chdir=oep-infra apply -target=digitalocean_container_registry.oep

Assert:

doctl registry get -o json | jq -r '.[0].subscription_tier_slug // "unknown"'
# expect: basic

BD-4 toolchain (operator workstation)

Required for BD-4 chart work. Install on macOS:

brew install helm chart-testing kubeconform yq composer php@8.2
# Set helm version via asdf:
asdf install helm 3.16.0
asdf local helm 3.16.0  # in unipuka-infra-ops/

Versions:

  • helm >= v3.16.0
  • ct >= 3.10.x (chart-testing)
  • kubeconform (any)
  • yq >= 4.x
  • php 8.2.x
  • composer 2.x

BD-4 secrets validation

BD-4 adds no new Doppler keys. All secrets required by the Laravel app chart come from:

  • Class-1 keys (BD-1.5): DB + Redis + Spaces credentials - validated by check 10
  • Class-3 keys (BD-1.5): App runtime (APP_KEY, REVERB_*, HORIZON_PREFIX, etc.) - validated by check 11

The ExternalSecret template (BD-4.7) bulk-pulls all keys via dataFrom.extract.key: "/" so key names are irrelevant at chart layer. No chart-level key enumeration needed.

Cross-link: secrets-audit.md

Ticks added as later BD-4 tickets land

Ticket Checklist item to tick
BD-4.7 ESO probe confirmed >= 45 keys synced
BD-4.9 Per-tenant values landed
BD-4.10 soa /health endpoint live (PR link)
BD-4.11 helm-lint CI green