Track the practice cluster's Helm values in Git

2026-08-17 13:59:39 +07:00
parent a1de4715a4
commit c778f7e9cc
8 changed files with 484 additions and 0 deletions
@@ -0,0 +1,40 @@
+# Claude claim — 2026-08-17 (afternoon)
+
+Continuing the Codex ArgoCD migration thread at the owner's instruction. Codex's
+own worktree `D:\VSF-DUOCTHU-codex-argocd` was clean at `1684e10` with nothing
+in flight when this claim was taken.
+
+## Owned by Claude in this session
+
+- `infra/helm/medical-chatbot/values-practice.yaml` (new)
+- `infra/helm/medical-chatbot/values-practice-data.yaml` (new)
+- `.github/workflows/helm-chart.yml` (practice render + assertions)
+- The two personal practice ArgoCD Application specs
+  (`medical-chatbot-app`, `medical-chatbot-data`) — moving inline values into
+  the tracked files above.
+
+Worktree: `D:\VSF-DUOCTHU-claude-gitops`, branch `agent/gitops-tracked-values`.
+
+## Not touched
+
+- `git.vinmec.tech`, team ArgoCD/k3s, team repos — hard boundary, unchanged.
+- The Compose production EC2 and `realvuxbaro.me`. `infra/helm/**` is not in
+  `deploy.yml`'s path filters, so pushing this work cannot restart production.
+- The uncommitted AWS-static-credentials Helm diff in the main worktree
+  `D:\VSF-DUOCTHU` (branch `agent/query-history`). Left exactly as found.
+
+## Which migration risk this closes
+
+Open risk 1 in `ARGOCD_PRODUCTION_MIGRATION_STATE_2026-08-17.md`: the live
+practice Applications carried their entire configuration in untracked inline
+`spec.source.helm.values`, so the cluster could drift from the repository with
+no commit recording it — the same class of failure that left practice on
+DeepSeek with reranking off while production ran Qwen with reranking on.
+
+Image tags stay inline deliberately: `.github/scripts/sync_practice_argocd.py`
+regex-rewrites them on every push, so a tag committed to Git would be stale by
+design. Nothing secret was inline, so nothing secret moves.
+
+Equivalence was checked before the Application specs were edited: both tracked
+files parse to structures identical to the live inline values with only the
+`aiService.image` / `web.image` blocks removed.