Use umbrella chart for platform Argo app

.github/actions/provision/action.yml

@@ -71,3 +71,8 @@ runs:
       shell: bash
       working-directory: bootstrap
       run: ./.github/scripts/verify_platform_health.sh
+
+    - name: Disable platform autosync
+      shell: bash
+      working-directory: bootstrap
+      run: ./.github/scripts/disable_platform_autosync.sh

.github/scripts/disable_platform_autosync.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ARGO_NAMESPACE=${ARGO_NAMESPACE:-argocd}
+PLATFORM_APPLICATION=${PLATFORM_APPLICATION:-platform}
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+REPO_ROOT=$(cd "$SCRIPT_DIR/../.." && pwd)
+readonly KUBECONFIG_PATH="$REPO_ROOT/stacks/k8s/.kube/agyn-local-kubeconfig.yaml"
+
+if [[ ! -f "$KUBECONFIG_PATH" ]]; then
+  printf 'Unable to locate kubeconfig at %s\n' "$KUBECONFIG_PATH" >&2
+  exit 1
+fi
+
+kubectl --kubeconfig "$KUBECONFIG_PATH" \
+  -n "$ARGO_NAMESPACE" patch application "$PLATFORM_APPLICATION" \
+  --type merge \
+  -p '{"spec":{"syncPolicy":{"automated":{"enabled":false}}}}'
+
+printf 'Disabled automated sync for Argo CD application %s/%s.\n' "$ARGO_NAMESPACE" "$PLATFORM_APPLICATION"

.github/scripts/verify_platform_health.sh

@@ -24,7 +24,7 @@ if [[ ! -f "$KUBECONFIG_PATH" ]]; then
   exit 1
 fi
 
-REQUIRED_APPS_JSON='["cert-manager","trust-manager","ziti-controller","ziti-management","registry-mirror","minio","platform-db","threads-db","chat-db","identity-db","runners-db","metering-db","identity","authorization","gateway","runners","notifications-redis","notifications","metering","threads","chat","k8s-runner"]'
+REQUIRED_APPS_JSON='["cert-manager","trust-manager","ziti-controller","platform","registry-mirror","minio","openfga-db","openfga","platform-db","threads-db","metering-db","chat-db","tracing-db","secrets-db","llm-db","agents-db","ziti-management-db","users-db","expose-db","organizations-db","agents-orchestrator-db","identity-db","runners-db","apps-db","reminders-db","reminders","telegram-connector-db","telegram-connector","k8s-runner"]'
 
 deadline=$((SECONDS + TOTAL_TIMEOUT))
 pod_terminal_failures_streak=0

apply.sh

@@ -487,44 +487,43 @@ run_stack "platform"
 step_end "stack:platform"
 
 echo "=== Waiting for platform ArgoCD applications to sync ==="
-for app in identity organizations gateway apps runners; do
-  echo "--- Waiting for ${app} ---"
-  synced=0
-  for i in $(seq 1 60); do
-    sync_status=$(kubectl --kubeconfig "${KUBECONFIG_PATH}" \
-      -n argocd get application "${app}" \
-      -o jsonpath='{.status.sync.status}' 2>/dev/null || echo "Unknown")
-    health_status=$(kubectl --kubeconfig "${KUBECONFIG_PATH}" \
-      -n argocd get application "${app}" \
-      -o jsonpath='{.status.health.status}' 2>/dev/null || echo "Unknown")
-
-    if [[ "${sync_status}" == "Synced" && "${health_status}" == "Healthy" ]]; then
-      echo "${app}: Synced and Healthy"
-      synced=1
-      break
-    fi
-    echo "  ${app}: sync=${sync_status} health=${health_status} (${i}/60)"
-    sleep 10
-  done
-
-  if [[ "${synced}" -ne 1 ]]; then
-    echo "ERROR: ${app} did not become Synced+Healthy within timeout"
-    echo "--- Full Application status ---"
-    kubectl --kubeconfig "${KUBECONFIG_PATH}" \
-      -n argocd get application "${app}" -o yaml 2>&1 || true
-    echo "--- ${app} namespace pods ---"
-    ns=$(kubectl --kubeconfig "${KUBECONFIG_PATH}" \
-      -n argocd get application "${app}" \
-      -o jsonpath='{.spec.destination.namespace}' 2>/dev/null || echo "unknown")
-    kubectl --kubeconfig "${KUBECONFIG_PATH}" \
-      -n "${ns}" get pods -o wide 2>&1 || true
-    echo "--- ${app} namespace events ---"
-    kubectl --kubeconfig "${KUBECONFIG_PATH}" \
-      -n "${ns}" get events --sort-by='.lastTimestamp' 2>&1 | tail -30 || true
-    exit 1
+app="platform"
+echo "--- Waiting for ${app} ---"
+synced=0
+for i in $(seq 1 60); do
+  sync_status=$(kubectl --kubeconfig "${KUBECONFIG_PATH}" \
+    -n argocd get application "${app}" \
+    -o jsonpath='{.status.sync.status}' 2>/dev/null || echo "Unknown")
+  health_status=$(kubectl --kubeconfig "${KUBECONFIG_PATH}" \
+    -n argocd get application "${app}" \
+    -o jsonpath='{.status.health.status}' 2>/dev/null || echo "Unknown")
+
+  if [[ "${sync_status}" == "Synced" && "${health_status}" == "Healthy" ]]; then
+    echo "${app}: Synced and Healthy"
+    synced=1
+    break
   fi
+  echo "  ${app}: sync=${sync_status} health=${health_status} (${i}/60)"
+  sleep 10
 done
 
+if [[ "${synced}" -ne 1 ]]; then
+  echo "ERROR: ${app} did not become Synced+Healthy within timeout"
+  echo "--- Full Application status ---"
+  kubectl --kubeconfig "${KUBECONFIG_PATH}" \
+    -n argocd get application "${app}" -o yaml 2>&1 || true
+  echo "--- ${app} namespace pods ---"
+  ns=$(kubectl --kubeconfig "${KUBECONFIG_PATH}" \
+    -n argocd get application "${app}" \
+    -o jsonpath='{.spec.destination.namespace}' 2>/dev/null || echo "unknown")
+  kubectl --kubeconfig "${KUBECONFIG_PATH}" \
+    -n "${ns}" get pods -o wide 2>&1 || true
+  echo "--- ${app} namespace events ---"
+  kubectl --kubeconfig "${KUBECONFIG_PATH}" \
+    -n "${ns}" get events --sort-by='.lastTimestamp' 2>&1 | tail -30 || true
+  exit 1
+fi
+
 echo "=== Waiting for gateway HTTP endpoint ==="
 gateway_base_url="https://gateway.${domain}:${port}"
 gateway_paths=("/healthz" "/health" "/readyz" "/version" "/")

stacks/apps/main.tf

@@ -92,7 +92,7 @@ locals {
       },
       {
         name  = "GATEWAY_URL"
-        value = "http://gateway-gateway.platform.svc.cluster.local:8080"
+        value = "http://gateway.platform.svc.cluster.local:8080"
       },
       {
         name = "SERVICE_TOKEN"
@@ -174,7 +174,7 @@ locals {
       },
       {
         name  = "GATEWAY_URL"
-        value = "http://gateway-gateway.platform.svc.cluster.local:8080"
+        value = "http://gateway.platform.svc.cluster.local:8080"
       },
       {
         name  = "ZITI_SERVICE_NAME"
@@ -228,7 +228,7 @@ locals {
       },
       {
         name  = "GATEWAY_ADDRESS"
-        value = "gateway-gateway:8080"
+        value = "gateway:8080"
       },
       {
         name = "CAPABILITY_IMPLEMENTATIONS"