open-platform/mitosis
3
0
Fork 0
Code Issues 27 Pull requests 9 Releases 4 Packages 1 Wiki Activity Actions

germinate: ship Grafana observability to daughters (#6) #8

Open
plat wants to merge 1 commit from feat/observability-grafana into main
pull from: feat/observability-grafana
merge into: open-platform:main
Conversation 0 Commits 1 Files changed 4 +78 -6
plat commented 2026-06-23 20:03:56 +00:00
Owner
Copy link

Threads the new gitops observability stack (plat/gitops feat/observability-grafana) through germination, so a sovereign daughter can ship Prometheus + Grafana. Closes the toolkit side of #6.

What

  • MONITORING=1 (env; surfaced in up + germinate usage) keeps the observability stack in a lean daughter; the full profile always ships it.
  • trim_gitops_lean: keep monitoring/ and emit its Flux Kustomization when opted in; drop it otherwise (lean stays minimal).
  • fork_regen_secrets: reseal grafana-oauth to the sovereign key with a fresh break-glass admin password — otherwise fork_verify_all_sealed rejects the genesis-sealed placeholder. Emits FORK_GRAFANA_ADMIN_PASSWORD.
  • fork_register_grafana_oauth (new): post-handoff, register a sovereign Forgejo OAuth app for Grafana and seal its client id/secret (no-op when monitoring is absent), mirroring the existing fork_register_oauth for plat-mcp.
  • The YOUR PLATFORM card shows the Grafana URL + break-glass admin when shipped.

Validation (unit-tested the functions on a real gitops clone)

  • trim_gitops_lean opt-in keeps monitoring/ + emits the Kustomization (8 total, valid YAML); opt-out drops both.
  • Fork forge → fork_verify_all_sealed passes: "all 10 forged secrets sovereign-sealed" (9 originals + grafana), grafana secret decrypts with the fork key.
  • rewrite_identity_domain rewrites grafana.<old>→grafana.<new> and the OAuth git.<old>→git.<new> with zero stale hosts and the dot-escape-sensitive plat-local-ca-tls intact.
  • bash -n clean on all scripts.
Threads the new gitops observability stack (`plat/gitops` `feat/observability-grafana`) through germination, so a sovereign daughter can ship Prometheus + Grafana. Closes the toolkit side of #6. ## What - **`MONITORING=1`** (env; surfaced in `up` + `germinate` usage) keeps the observability stack in a **lean** daughter; the full profile always ships it. - **`trim_gitops_lean`**: keep `monitoring/` and emit its Flux Kustomization when opted in; drop it otherwise (lean stays minimal). - **`fork_regen_secrets`**: reseal `grafana-oauth` to the sovereign key with a fresh break-glass admin password — otherwise `fork_verify_all_sealed` rejects the genesis-sealed placeholder. Emits `FORK_GRAFANA_ADMIN_PASSWORD`. - **`fork_register_grafana_oauth`** (new): post-handoff, register a sovereign Forgejo OAuth app for Grafana and seal its client id/secret (no-op when monitoring is absent), mirroring the existing `fork_register_oauth` for plat-mcp. - The **YOUR PLATFORM** card shows the Grafana URL + break-glass admin when shipped. ## Validation (unit-tested the functions on a real gitops clone) - `trim_gitops_lean` opt-in keeps `monitoring/` + emits the Kustomization (8 total, valid YAML); opt-out drops both. - Fork forge → **`fork_verify_all_sealed` passes: "all 10 forged secrets sovereign-sealed"** (9 originals + grafana), grafana secret decrypts with the fork key. - `rewrite_identity_domain` rewrites `grafana.<old>`→`grafana.<new>` and the OAuth `git.<old>`→`git.<new>` with zero stale hosts and the dot-escape-sensitive `plat-local-ca-tls` intact. - `bash -n` clean on all scripts. 
Thread the new gitops monitoring stack through germination.

- MONITORING=1 (env, surfaced in up + germinate usage) keeps the
  observability stack in a LEAN daughter; the full profile always ships it.
- trim_gitops_lean: keep monitoring/ and emit its Flux Kustomization when
  opted in; drop it otherwise (lean stays minimal).
- fork_regen_secrets: reseal grafana-oauth to the sovereign key with a fresh
  break-glass admin password (else fork_verify_all_sealed rejects the
  genesis-sealed placeholder); emits FORK_GRAFANA_ADMIN_PASSWORD.
- fork_register_grafana_oauth: post-handoff, register a sovereign Forgejo
  OAuth app for Grafana and seal its client id/secret (no-op when absent).
- YOUR PLATFORM card shows the Grafana URL + break-glass admin when shipped.

Validated by unit-testing the functions: trim opt-in/out, reseal +
fork_verify_all_sealed ("all 10 forged secrets sovereign-sealed"), and the
identity rewrite of grafana/git hosts (dot-escape-safe).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This pull request has changes conflicting with the target branch.
  • bin/germinate
  • bin/lib.sh
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/observability-grafana:feat/observability-grafana
git switch feat/observability-grafana
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
discussion
An idea that is still being discussed

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
goal

   
help wanted
Need some help

  
horizon:backlog

   
horizon:governance

   
horizon:mvp

   
invalid
Something is wrong

  
operator-decision
Blocked on the owner's call — no agent work until decided

  
question
More information is needed

  
roadmap

   
wontfix
This won't be fixed

No labels
bug
discussion
duplicate
enhancement
goal
help wanted
horizon:backlog
horizon:governance
horizon:mvp
invalid
operator-decision
question
roadmap
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
open-platform/mitosis!8
No description provided.