The control-plane deploy: one governed container on the statecraft cluster
009-control-plane-deploy
Stand the control plane up on the spec 010 cluster as a platform-grade K8s deployment at app.statecraft.ing. Rewritten ground-up 2026-07-19 to the two-plane thesis (001 section 3), which unpauses it. The rewrite inverts the deploy's job: the published image is embedded-rauthy and self-seeds its own identity on first boot, so the shared-rauthy secret set is void, five of the eleven Encore secrets are discarded by the entrypoint if injected, and the /data volume becomes the identity anchor of the platform. What the deploy still owes the container: nine real secrets, the non-secret env, a Postgres URL, an ingress, and one seeder pass for the only thing first boot cannot seed (the upstream GitHub provider, which rauthy has no declarative bootstrap for). Operator surfaces gate on the custom statecraft_operator role, seeded here; rauthy_admin stays break-glass. Live bring-up is a human checkpoint.
- Establishes
- .github/workflows/image.yml
- .dockerignore
- infra/gitops/clusters/statecraft-hetzner/statecraft/ (directory)
- infra/gitops/clusters/statecraft-hetzner/statecraft-kustomization.yaml
- Sections
- 009: The control-plane deploy
- 1. Purpose
- 2. What the realignment changes
- 2.1 The image is embedded-rauthy and self-seeds
- 2.2 Five of the eleven Encore secrets are discarded if injected
- 2.3 The shared-rauthy secret set is void
- 2.4 `auth.statecraft.ing` does not return
- 2.5 The deferred Grafana OIDC item is void
- 3. Territory
- 4. Behavior
- 4.1 Image
- 4.2 Topology
- 4.3 The volume is the identity anchor
- 4.4 Environment
- 4.5 Identity seeding: what first boot cannot do
- 4.6 Break-glass
- 4.7 Observability
- 4.8 Upstream gaps this deploy surfaces
- 4.9 Ported CI
- 5. Acceptance
- 5.1 Bring-up outcome, 2026-07-21
- 6. Human checkpoints
- 7. Out of scope
- Source
- specs/009-control-plane-deploy/spec.md @ f136bf323cecas of 2026-07-21 ยท shard deb0cbac9f3a