feat(applicationsets): apply portal-committed tenant manifests (portal-tenants)

applicationsets/portal-tenants.yaml

@@ -0,0 +1,58 @@
+# Applies the tenant boundary manifests the portal commits to the tenants
+# GitOps repo. The portal's write path renders charts/tenant (Platform +
+# BudgetPolicy + Tenant + agent-plane CRs) and commits one manifest per tenant
+# to tenants/<cluster>/<tenant>.yaml; without this ApplicationSet nothing
+# applies those commits, so portal-created tenants never reach the cluster.
+#
+# A git directory generator discovers each per-cluster directory and recurses
+# its manifests (robust — no per-file content parsing). repoURL MUST equal the
+# portal worker's GITOPS_TENANTS_REPO_URL.
+#
+# NOTE: static-validated only (no live EKS run yet). Verify on first use, and
+# consider two refinements: per-tenant granularity (a git files generator over
+# tenants/*/*.yaml for one Application per tenant) and multi-cluster routing
+# (match the <cluster> path segment to a registered cluster via a
+# matrix+clusters generator) instead of applying to the in-cluster destination.
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: portal-tenants
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "100"
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+    - git:
+        repoURL: https://github.com/nanohype/tenants.git # == portal GITOPS_TENANTS_REPO_URL
+        revision: main
+        directories:
+          - path: tenants/*
+  template:
+    metadata:
+      name: 'portal-tenants-{{ .path.basename }}'
+      annotations:
+        argocd.argoproj.io/sync-wave: "100"
+    spec:
+      project: platform
+      source:
+        repoURL: https://github.com/nanohype/tenants.git
+        targetRevision: main
+        path: '{{ .path.path }}'
+        directory:
+          recurse: true
+      destination:
+        server: https://kubernetes.default.svc
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - ServerSideApply=true
+        retry:
+          limit: 5
+          backoff:
+            duration: 5s
+            factor: 2
+            maxDuration: 3m