feat(canary): bootstrap r001 namespace on sol

.gitea/workflows/deploy-trade-r001-canary.yaml

@@ -0,0 +1,63 @@
+name: deploy-trade-r001-canary
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - environments/sol/trade-r001-canary/**
+      - .gitea/workflows/deploy-trade-r001-canary.yaml
+  workflow_dispatch:
+
+jobs:
+  apply:
+    runs-on: k3s-deploy
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Materialize kubeconfig
+        env:
+          K3S_KUBECONFIG_B64: ${{ secrets.K3S_KUBECONFIG_B64 }}
+        run: |
+          test -n "$K3S_KUBECONFIG_B64"
+          printf '%s' "$K3S_KUBECONFIG_B64" | base64 -d >/tmp/kubeconfig
+          chmod 600 /tmp/kubeconfig
+
+      - name: Install kubectl
+        run: |
+          curl -fsSL -o /tmp/kubectl https://dl.k8s.io/release/v1.34.6/bin/linux/amd64/kubectl
+          install -m 0755 /tmp/kubectl /usr/local/bin/kubectl
+          kubectl version --client
+
+      - name: Apply canary namespace
+        env:
+          KUBECONFIG: /tmp/kubeconfig
+        run: |
+          kubectl apply -k environments/sol/trade-r001-canary
+          kubectl get ns trade-r001-canary --show-labels
+          kubectl -n trade-r001-canary get resourcequota,limitrange
+
+      - name: Verify canary namespace connectivity
+        env:
+          KUBECONFIG: /tmp/kubeconfig
+        run: |
+          kubectl -n trade-r001-canary delete pod canary-netcheck --ignore-not-found=true
+          kubectl -n trade-r001-canary run canary-netcheck \
+            --image=python:3.12-alpine \
+            --restart=Never \
+            --command -- sleep 600
+          kubectl -n trade-r001-canary wait --for=condition=Ready pod/canary-netcheck --timeout=180s
+          kubectl -n trade-r001-canary exec canary-netcheck -- python - <<'PY'
+          import socket
+
+          targets = [
+              ("postgres-host.trade-infra.svc.cluster.local", 5432),
+              ("redis-host.trade-infra.svc.cluster.local", 6379),
+          ]
+
+          for host, port in targets:
+              with socket.create_connection((host, port), timeout=5):
+                  print(f"OK {host}:{port}")
+          PY
+          kubectl -n trade-r001-canary delete pod canary-netcheck --wait=true

README.md

@@ -6,8 +6,13 @@ GitOps bootstrap and cluster runtime for the `trade-next` migration target on `m
 
 - `bootstrap/gitea-actions`: organization-scoped Gitea Actions runner for `trade-next`, including deployer RBAC and operator scripts.
 
+## Environments
+
+- `environments/sol/trade-r001-canary`: minimal canary namespace for migration baseline `R001`, including namespace guardrails and deployment smoke checks.
+
 ## Current Scope
 
 - Bootstrap a single-node `k3s` control plane on `sol`.
 - Expose host-level `Postgres` and `Redis` into the cluster through `trade-infra`.
 - Run an organization-scoped Gitea Actions runner that can execute deployment workflows against `sol`.
+- Establish a guarded canary namespace on `sol` before application components are promoted.

environments/sol/trade-r001-canary/README.md

@@ -0,0 +1,36 @@
+# trade-r001-canary
+
+Minimal canary namespace for migration baseline `R001` on `sol`.
+
+## Purpose
+
+- Reserve a dedicated namespace for the first reconstructed trade deployment.
+- Put hard upper bounds on namespace-level CPU, memory, object count, and PVC growth before application manifests land.
+- Verify that workloads in the namespace can resolve and reach the shared `trade-infra` services for `Postgres` and `Redis`.
+
+## Current Guardrails
+
+- Namespace: `trade-r001-canary`
+- ResourceQuota:
+  - `requests.cpu=2`
+  - `limits.cpu=6`
+  - `requests.memory=4Gi`
+  - `limits.memory=12Gi`
+  - `pods=20`
+  - `services=10`
+  - `configmaps=20`
+  - `secrets=30`
+  - `persistentvolumeclaims=4`
+  - `requests.storage=100Gi`
+- LimitRange:
+  - default request: `100m`, `128Mi`
+  - default limit: `1`, `1Gi`
+  - per-container maximum: `2`, `4Gi`
+
+## Notes
+
+- This namespace is intentionally conservative until item `14` and the validator protection envelope are fully defined.
+- The namespace does not yet recreate `gitea-registry`; that remains a separate migration prerequisite.
+- Current shared infrastructure endpoints expected by canary workloads:
+  - `postgres-host.trade-infra.svc.cluster.local:5432`
+  - `redis-host.trade-infra.svc.cluster.local:6379`

environments/sol/trade-r001-canary/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - resourcequota.yaml
+  - limitrange.yaml

environments/sol/trade-r001-canary/limitrange.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: trade-r001-canary-defaults
+  namespace: trade-r001-canary
+spec:
+  limits:
+    - type: Container
+      min:
+        cpu: 50m
+        memory: 64Mi
+      defaultRequest:
+        cpu: 100m
+        memory: 128Mi
+      default:
+        cpu: "1"
+        memory: 1Gi
+      max:
+        cpu: "2"
+        memory: 4Gi

environments/sol/trade-r001-canary/namespace.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: trade-r001-canary
+  labels:
+    app.kubernetes.io/name: trade-r001-canary
+    app.kubernetes.io/part-of: trade
+    trade.mpabi.pl/environment: canary
+    trade.mpabi.pl/migration-revision: R001

environments/sol/trade-r001-canary/resourcequota.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: trade-r001-canary-quota
+  namespace: trade-r001-canary
+spec:
+  hard:
+    requests.cpu: "2"
+    limits.cpu: "6"
+    requests.memory: 4Gi
+    limits.memory: 12Gi
+    requests.storage: 100Gi
+    persistentvolumeclaims: "4"
+    pods: "20"
+    services: "10"
+    configmaps: "20"
+    secrets: "30"