Applications Overview

This slice documents the active application-layer GitOps entries declared under lumie-infra/applications/**. Optional day-2 tools such as Coder, Headlamp, and Umami are not part of the active app-of-apps set.

Scope and ownership

Source paths

Path	Role
lumie-infra/applications/application.yaml	ArgoCD app-of-apps entrypoint for the whole applications slice
lumie-infra/applications/kustomization.yaml	Enumerates active application Application resources
lumie-infra/applications/argocd/**	Self-management for ArgoCD after bootstrap
lumie-infra/applications/lumie/**	Product platform, backend, frontend, workers, and dev namespace
lumie-infra/applications/tekton/**	Checked-in CI/CD pipeline, trigger, dashboard, and cleanup manifests; disabled unless registered from applications/kustomization.yaml
lumie-infra/applications/lumie/document/**	Documentation site deployment
lumie-infra/applications/teleport-event-handler/**	Teleport audit-event export path

Boundaries

• ArgoCD owns desired state for the application namespaces and rendered workloads.
• Teleport owns browser access for selected internal tools such as ArgoCD and the documentation site.
• Shared platform services such as Vault Secrets Operator, infra-db, cert-manager, KEDA, and RabbitMQ live outside this slice and are consumed here.
• Optional operator tools can remain as checked-in artifacts, but they are not deployed unless referenced from applications/kustomization.yaml.

Runtime map

Access model

• argocd and lumie-document are exposed through Teleport app registrations.
• Tekton manifests remain checked in, but the Tekton ArgoCD applications are not part of the active app-of-apps set unless their entries are uncommented in applications/kustomization.yaml.
• Product ingress for Lumie workloads is owned by the product manifests and Traefik, not by this overview.
• Disabled tools are intentionally absent from this page because they are not present in the active app-of-apps set.

Operational patterns shared by this slice

• Every ArgoCD Application in this slice enables automated sync, pruning, and self-healing.
• Some historical namespace metadata still carries goldilocks.fairwinds.com/enabled, but Goldilocks and VPA are no longer deployed.
• Secret material is either rendered by VaultStaticSecret resources or delegated to chart-owned secrets that ArgoCD intentionally ignores.
• The standing contract is what is deployed, how it is reached, and how to verify it from ArgoCD and Kubernetes.

Common failure modes

• Teleport access can break even when the workload is healthy, because the public access path is outside the application namespace.
• Vault secret refresh or transformation errors leave workloads running with stale or missing connection credentials.
• ArgoCD can stay Healthy while an application-level dependency is broken, such as a bad database password.
• Applications backed by upstream charts can drift in rendered defaults after a chart upgrade even when local values files are unchanged.

Verification

Use these commands to verify the slice without mutating cluster state:

kubectl get applications.argoproj.io -n argocd applications argocd lumie-document
kubectl get applications.argoproj.io -n argocd | rg 'lumie|teleport-event-handler'
kubectl get pods -n lumie-document
kubectl get pods -n lumie-backend
kubectl get pods -n lumie-frontend
kubectl get pods -n lumie-worker

Success means the active ArgoCD Applications are present and Synced/Healthy, and each active namespace has Ready pods.

Pages in this slice

• Security overview for the access and control-plane services these applications depend on