Core42 Deployment¶

End-to-end runbook for deploying the ASK platform into the Core42 air-gapped environment — from image mirroring to a fully running production-grade Kubernetes workload.

What this section covers

This section records every step in execution order so it can be followed from scratch in a future deployment. Each page is a self-contained runbook — complete the steps top-to-bottom, paste output for verification, and proceed to the next page.

Deployment Sequence¶

Phase 1 — Mirror Images & Charts
       ↓
Phase 2 — Harbor Project Setup
       ↓
Phase 3 — imagePullSecret & Registry Auth (ESO + ClusterExternalSecret)
       ↓
Phase 4 — Platform Components (cert-manager, Vault, ArgoCD, Reloader, ESO, CNPG)
       ↓
Phase 5 — PostgreSQL Clusters (CNPG — core-pg, hatchet-pg, knowledge-pg)
       ↓
Phase 6 — ASK Application Deployment (core-service, Zitadel, Hatchet, Knowledge, Assistant, Frontend)

Pages in this section¶

Phase	Page	Status
1	Image Mirroring — Harbor	✅ Complete
2	Storage Validation	✅ Complete
3	Registry Auth — imagePullSecret	✅ Complete
4	Platform Components	✅ Complete
5	PostgreSQL Clusters (CNPG)	✅ Complete
6	ASK Core Service Deployment	🟡 In Progress

Environment Reference¶

Item	Value
Harbor Registry	`harbor.cl1.sq4.aegis.internal`
Bastion	`bastion1.cl1.sq4`
Mirror script	`scripts/harbor-mirror/core42-mirror-image.py`
Mirror config	`scripts/harbor-mirror/mirror-config.yaml`
Proxy	`http://10.96.137.37:3128`

Registry Division of Responsibilities¶

Two registries serve different roles — Harbor for images, GitLab for everything else.

Artifact type	Registry	URL pattern	Notes
Container images	Harbor	`harbor.cl1.sq4.aegis.internal/<project>/<image>:<tag>`	All images mirrored here from public sources (GHCR, Docker Hub, etc.)
Helm charts (ArgoCD)	GitLab HTTP Package Registry	`https://gitlab.cl1.sq4.aegis.internal/api/v4/projects/14/packages/helm/stable`	ArgoCD uses HTTP — not Harbor OCI (see note below)
Helm charts (manual `helm pull`)	GitLab OCI or HTTP	Either GitLab endpoint	Both work for local use
Git repos (manifests, values)	GitLab	`https://gitlab.cl1.sq4.aegis.internal/ai71/ask71/mod-ask-devops.git`	ArgoCD `ref: values` source
imagePullSecret	—	`harbor-pull-secret` in each namespace	ESO `ClusterExternalSecret` distributes to labeled namespaces

Why not Harbor OCI for Helm charts in ArgoCD?

ArgoCD v3.4.2 double-encodes the JWT auth scope for multi-level OCI paths (oci://harbor/project/chart). This causes GitLab to return 403 Forbidden. GitLab HTTP Package Registry (/api/v4/projects/14/packages/helm/stable) works correctly and is the production pattern for this deployment. Harbor OCI remains valid for direct helm pull from the CLI.

ArgoCD Application Pattern — core42¶

Item	Reference Deployment	core42
Helm chart source	`https://gitlab.cl1.sq4.aegis.internal/api/v4/projects/<id>/packages/helm/stable`	`https://gitlab.cl1.sq4.aegis.internal/api/v4/projects/14/packages/helm/stable`
Container images	Azure ACR / GHCR	`harbor.cl1.sq4.aegis.internal/<project>/<image>:<tag>`
Git repo	`https://gitlab.cl1.sq4.aegis.internal/...`	`https://gitlab.cl1.sq4.aegis.internal/...`
Image pull secret	`harbor-registry-secret`	`harbor-pull-secret`

ArgoCD Application template (core42)¶

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: <app-name>
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.io
spec:
  project: <project>
  sources:
    - repoURL: 'https://gitlab.cl1.sq4.aegis.internal/api/v4/projects/14/packages/helm/stable'
      chart: <chart-name>
      targetRevision: "<chart-version>"
      helm:
        valueFiles:
          - $values/applications/<app>/values-mod-auh1-dev-ask.yaml
    - repoURL: 'https://gitlab.cl1.sq4.aegis.internal/ai71/ask71/mod-ask-devops.git'
      targetRevision: main
      ref: values
  destination:
    server: 'https://kubernetes.default.svc'
    namespace: <namespace>
  syncPolicy:
    automated:
      prune: true
    syncOptions:
      - CreateNamespace=true
    managedNamespaceMetadata:
      labels:
        harbor-pull-secret: "true"   # ESO injects harbor-pull-secret into this namespace

Production mandate

Every step in this section is designed to be production-grade — no shortcuts. Deviations (resource limits, replica counts) are explicitly marked with # PROD: comments so they can be reverted when deploying to a full-sized environment.