gitops-tenant-onboardinglisted

Onboard a new tenant application onto a Flux-based GitOps platform: scaffold the tenant repo's deploy manifests, wire OpenBao/Vault secrets via External Secrets, fit the cluster's Kyverno/PodSecurity and default-deny network policies, expose the app through a shared Gateway API gateway, and register the tenant on the platform with signed-OCI Flux resources. Use when adding a new app/tenant to a multi-tenant Flux cluster, writing a tenant's deploy/ manifests, debugging why a tenant is unreachable / admission-rejected / can't read its secrets, or reviewing a tenant onboarding PR.
devantler-tech/agent-skills · ★ 3 · Code & Development · score 72

Install: claude install-skill devantler-tech/agent-skills

# GitOps Tenant Onboarding Onboarding a **tenant** — an application that runs on a shared, multi-tenant [Flux](https://fluxcd.io/) cluster from its **own repository** — follows the same recurring shape every time. The tenant repo builds a container image and publishes its Kubernetes manifests as a **signed OCI artifact**; the platform pulls that artifact with a Flux `OCIRepository` + `Kustomization` and runs it in a dedicated, locked-down namespace. This skill is the agent-facing companion to that pattern: the decisions, the conventions, and — most usefully — the **gotchas that make a fresh tenant fail** if you miss them. It is built around an opinionated but industry-standard stack — Flux, [External Secrets Operator](https://external-secrets.io/) backed by OpenBao/Vault, [Kyverno](https://kyverno.io/) + PodSecurity, Cilium / [Gateway API](https://gateway-api.sigs.k8s.io/), [cosign](https://www.sigstore.dev/) — so the steps transfer to any cluster wired the same way; adapt the resource names to your platform. ## The two halves Onboarding always spans **two repos**, and a tenant is not live until both land: 1. **The tenant repo** — created from a tenant template. Ships the shared, framework-agnostic CI/CD plumbing (build → signed publish → release) plus a `deploy/` directory of Kubernetes manifests you own and customise. 2. **The platform registration** — a small directory in the platform repo (`apps/<tenant>/`) that grants the tenant a namespace, an identity (a