refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming #6

2026-06-30T20:15:15Z

sharang commented

2026-06-30 20:15:15 +00:00

Summary

Restructures the IaC draft to reflect the 2026-06-30 cluster decision: 3 Orca clusters, 1 cluster per plane, breakpilot- repo naming*, single-VM core, app cluster gets prod + stage VMs in one cluster.

The decision

Cluster	Future repo	VMs	Plane
`breakpilot-edge`	`platform/breakpilot-edge`	`vm-edge` (1)	Identity + Infra
`breakpilot-control`	`platform/breakpilot-control`	`vm-control` (1)	Control
`breakpilot-app`	`platform/breakpilot-app`	`vm-app-prod` + `vm-app-stage` (2)	App (was "Data")

Key model points encoded in the manifests + READMEs:

Identity stays in the core cluster (Keycloak co-tenant with PowerDNS/Infisical/Gitea on vm-edge). JVM heap pinned so it cannot starve infra. Will revisit splitting only if the heap fight actually shows up in alerts.
Repurpose the existing CERTifAI Keycloak for breakpilot-edge instead of standing up a fresh one — same realm export.
Stage + prod share one cluster, two VMs. Same Orca config (no config drift), different physical workloads (no "oops touched prod"). Stage authenticates via prod Keycloak under tenant.kind = "stage"; no duplicated identity, no duplicated control plane (per INFRASTRUCTURE.md §5).
Multi-VM rollout gated on the legal entity being established so we can sign SysEleven / Hetzner business contracts. Until then, single-VM ops continues via ~/workspace/orca-infra; this repo stays design-only.

Changes

manifests/{vm-edge,vm-control,vm-data,stage}/ → clusters/breakpilot-{edge,control,app/services/{prod,stage}}/services/
node = "vm-data" → vm-app-prod (9 manifests); node = "stage" → vm-app-stage (11 manifests)
overlays/{stage,prod}/overlay.toml re-point at the new cluster paths
scripts/validate.sh now enforces a per-cluster node whitelist (breakpilot-edge → vm-edge, breakpilot-control → vm-control, breakpilot-app → {vm-app-prod, vm-app-stage}) instead of dir-name equality
New READMEs at clusters/, clusters/breakpilot-{edge,control,app}/ documenting scope, SLA targets, co-tenant notes, and the future-repo split
Top-level README.md rewritten to lead with the cluster-split decision and the legal-entity gate; per-milestone fill-in table re-pathed

Validation

make validate → 38 files OK (35 manifests + 3 overlays)
make plan ENV=stage → 11 resolved manifests in .orca-out/stage/
make plan ENV=prod → 24 resolved manifests in .orca-out/prod/

Not in scope

Creating the 3 future Gitea repos — that happens at migration time when the legal entity lands
Provisioning any VMs — gated on the same
Updating ~/workspace/orca-infra (single-VM ops) — stays as-is until the cluster split executes

🤖 Generated with Claude Code

## Summary Restructures the IaC draft to reflect the 2026-06-30 cluster decision: **3 Orca clusters, 1 cluster per plane, breakpilot-* repo naming**, single-VM core, app cluster gets prod + stage VMs in one cluster. ## The decision | Cluster | Future repo | VMs | Plane | |---|---|---|---| | `breakpilot-edge` | `platform/breakpilot-edge` | `vm-edge` (1) | Identity + Infra | | `breakpilot-control` | `platform/breakpilot-control` | `vm-control` (1) | Control | | `breakpilot-app` | `platform/breakpilot-app` | `vm-app-prod` + `vm-app-stage` (2) | App (was "Data") | Key model points encoded in the manifests + READMEs: - **Identity stays in the core cluster** (Keycloak co-tenant with PowerDNS/Infisical/Gitea on `vm-edge`). JVM heap pinned so it cannot starve infra. Will revisit splitting only if the heap fight actually shows up in alerts. - **Repurpose the existing CERTifAI Keycloak** for `breakpilot-edge` instead of standing up a fresh one — same realm export. - **Stage + prod share one cluster, two VMs.** Same Orca config (no config drift), different physical workloads (no "oops touched prod"). Stage authenticates via prod Keycloak under `tenant.kind = "stage"`; no duplicated identity, no duplicated control plane (per `INFRASTRUCTURE.md §5`). - **Multi-VM rollout gated on the legal entity** being established so we can sign SysEleven / Hetzner business contracts. Until then, single-VM ops continues via `~/workspace/orca-infra`; this repo stays design-only. ## Changes - `manifests/{vm-edge,vm-control,vm-data,stage}/` → `clusters/breakpilot-{edge,control,app/services/{prod,stage}}/services/` - `node = "vm-data"` → `vm-app-prod` (9 manifests); `node = "stage"` → `vm-app-stage` (11 manifests) - `overlays/{stage,prod}/overlay.toml` re-point at the new cluster paths - `scripts/validate.sh` now enforces a per-cluster node whitelist (`breakpilot-edge → vm-edge`, `breakpilot-control → vm-control`, `breakpilot-app → {vm-app-prod, vm-app-stage}`) instead of dir-name equality - New READMEs at `clusters/`, `clusters/breakpilot-{edge,control,app}/` documenting scope, SLA targets, co-tenant notes, and the future-repo split - Top-level `README.md` rewritten to lead with the cluster-split decision and the legal-entity gate; per-milestone fill-in table re-pathed ## Validation - [x] `make validate` → 38 files OK (35 manifests + 3 overlays) - [x] `make plan ENV=stage` → 11 resolved manifests in `.orca-out/stage/` - [x] `make plan ENV=prod` → 24 resolved manifests in `.orca-out/prod/` ## Not in scope - Creating the 3 future Gitea repos — that happens at migration time when the legal entity lands - Provisioning any VMs — gated on the same - Updating `~/workspace/orca-infra` (single-VM ops) — stays as-is until the cluster split executes 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 1 commit 2026-06-30 20:15:16 +00:00

refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming

ci / shared (pull_request) Successful in 23s

Details

ci / validate (pull_request) Successful in 4s

Details

8971152da0

Restructures the draft to reflect the 2026-06-30 cluster decision:

Three Orca clusters, each becoming its own Gitea repo at migration time:
- breakpilot-edge   → vm-edge       (Identity + Infra: KC, Gitea, Infisical, PowerDNS, Orca-Proxy)
- breakpilot-control → vm-control   (Portal, tenant-registry, ERPNext, MariaDB, Stalwart)
- breakpilot-app    → vm-app-prod + vm-app-stage (CERTifAI, compliance-*, Mongo, MinIO, Qdrant, LiteLLM)

Key model points encoded:
- Identity (Keycloak) co-tenant with Infra on vm-edge (1 VM core), per
  INFRASTRUCTURE.md §6 — heap pinned so it cannot starve PowerDNS/Infisical
- Stage and prod live in the same breakpilot-app cluster on different
  VMs. Stage authenticates via prod Keycloak under tenant.kind = "stage";
  no duplicated identity, no duplicated control plane (per §5).
- The existing CERTifAI Keycloak will be repurposed for breakpilot-edge
  rather than standing up a fresh one — same realm, same users.
- Multi-VM rollout gated on legal entity being established so we can sign
  SysEleven / Hetzner business contracts. Until then, single-VM ops
  continues via ~/workspace/orca-infra; this repo is design-only.

Mechanical changes:
- manifests/{vm-edge,vm-control,vm-data,stage}/ → clusters/{breakpilot-edge,breakpilot-control,breakpilot-app/services/{prod,stage}}/services/
- vm-data → vm-app-prod, stage → vm-app-stage in node references and headers
- overlays/{stage,prod}/overlay.toml point at the new cluster paths
- scripts/validate.sh now enforces a per-cluster node whitelist
  (breakpilot-edge → vm-edge, breakpilot-control → vm-control,
  breakpilot-app → {vm-app-prod, vm-app-stage}) instead of dir-name equality
- New READMEs at clusters/, clusters/breakpilot-edge/,
  clusters/breakpilot-control/, clusters/breakpilot-app/ documenting
  scope, SLA targets, co-tenant notes, and the future-repo split
- Top README rewritten to lead with the cluster-split decision and the
  legal-entity gate; per-milestone fill-in table re-pathed

Validation:
- make validate → 38 files OK (35 manifests + 3 overlays)
- make plan ENV=stage → 11 resolved manifests in .orca-out/stage/
- make plan ENV=prod  → 24 resolved manifests in .orca-out/prod/

CODEOWNERS rules requested review from Benjamin_Boenisch 2026-06-30 20:15:16 +00:00

sharang merged commit 6be727d404 into main

2026-06-30 20:30:17 +00:00

sharang deleted branch refactor/cluster-split

2026-06-30 20:30:18 +00:00

sharang referenced this pull request from platform/docs

2026-06-30 21:10:46 +00:00

docs(impl-plan): reflect 2026-06-30 cluster split decision #6

sharang referenced this pull request from platform/docs

2026-06-30 21:29:58 +00:00

docs(arch): align INFRASTRUCTURE + PLATFORM_ARCHITECTURE to cluster split #7

Sign in to join this conversation.