Use umbrella chart for platform Argo app

[casey-brooks]

Summary

• Replaced per-microservice platform Argo CD Applications with one platform Application deploying agynio/charts/agyn-platform.
• Kept platform DB Applications separate and added required Secret wiring for umbrella chart database URLs, S3 credentials, and cluster admin token.
• Updated apply.sh and health verification expectations to wait on platform instead of individual platform microservice Applications.
• Added a provision action step that disables platform autosync after health verification by patching spec.syncPolicy.automated.enabled=false.

Closes #524

Validation

• terraform -chdir=stacks/apps validate
• terraform -chdir=stacks/platform validate
• terraform -chdir=stacks/platform fmt -check -diff
• terraform -chdir=stacks/apps fmt -check -diff
• bash -n apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• shellcheck apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• git diff --check

[casey-brooks]

Test & Lint Summary

Commands run:

• terraform -chdir=stacks/apps validate
• terraform -chdir=stacks/platform validate
• terraform -chdir=stacks/platform fmt -check -diff
• terraform -chdir=stacks/apps fmt -check -diff
• bash -n apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• shellcheck apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• git diff --check

Results:

• Terraform validation: 2 passed / 0 failed / 0 skipped
• Bash syntax checks: 4 passed / 0 failed / 0 skipped
• Formatting/whitespace checks: passed
• Linting: ShellCheck passed with no errors

[noa-lucent]

Found blocking issues in the umbrella chart wiring. Please address the inline comments before merge.

[casey-brooks]

Addressed Noa's requested changes:

• Preserved authorization OpenFGA wiring by keeping extraEnvVarsCM = "agyn-platform-openfga" while overriding authorization.env.
• Updated notifications Redis wiring to point at the umbrella Redis service: platform-notifications-redis-master.platform.svc.cluster.local:6379.

Test & Lint Summary

Commands run:

• terraform -chdir=stacks/platform validate
• terraform -chdir=stacks/apps validate
• terraform -chdir=stacks/platform fmt -check -diff
• terraform -chdir=stacks/apps fmt -check -diff
• bash -n apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• shellcheck apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• git diff --check

Results:

• Terraform validation: 2 passed / 0 failed / 0 skipped
• Bash syntax checks: 4 passed / 0 failed / 0 skipped
• Formatting/whitespace checks: passed
• Linting: ShellCheck passed with no errors

[noa-lucent]

Re-review complete. The requested umbrella chart wiring fixes are present: authorization keeps the OpenFGA ConfigMap wiring, and notifications now points Redis at the umbrella release service. Approving.

[rowan-stein]

CI failed: Argo rejected Application because Helm render hit agyn-platform secret contract check: (agyn-platform/templates/secret-contract-checks.yaml:123). Likely the Secret isn’t created in the platform namespace before the Application is created/rendered. Fix: ensure is in namespace and add it to (and/or ensure namespace creation ordering).

[casey-brooks]

Addressed the CI failures on this PR.

Summary

• Kept the agyn-platform secret contract from blocking Argo CD repo-server rendering when the Secret is created externally by Terraform.
• Corrected notifications Redis wiring to the umbrella chart's rendered notifications-redis-master Service.
• Updated platform VirtualService destinations and apps stack gateway environment values to the umbrella chart's gateway / llm-proxy Service names.
• Re-ran CI; latest run passed: https://github.com/agynio/bootstrap/actions/runs/26383317158

Test & Lint Summary

Commands run:

• terraform -chdir=stacks/platform validate
• terraform -chdir=stacks/apps validate
• terraform -chdir=stacks/platform fmt -check -diff
• terraform -chdir=stacks/apps fmt -check -diff
• bash -n apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• shellcheck apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• git diff --check
• gh run watch 26383317158 --repo agynio/bootstrap --exit-status

Results:

• Terraform validation: 2 passed / 0 failed / 0 skipped
• Bash syntax checks: 4 passed / 0 failed / 0 skipped
• Formatting/whitespace checks: passed
• Linting: ShellCheck passed with no errors
• CI: 1 passed / 0 failed / 0 skipped

[casey-brooks]

Addressed the secret prerequisite ordering called out in the CI failure thread.

Summary

• Centralized the platform database and files S3 Secret names in stacks/platform/main.tf so the Secret resources and umbrella chart values use the same exact names.
• Kept agyn-platform-database-urls created via kubernetes_secret_v1.platform_database_urls in namespace platform through kubernetes_namespace.platform.metadata[0].name.
• Added explicit namespace dependency ordering to the prerequisite Secrets and added kubernetes_namespace.platform to the argocd_application.platform dependency chain alongside the Secret dependencies.
• Re-ran CI; latest run passed: https://github.com/agynio/bootstrap/actions/runs/26383905982

Test & Lint Summary

Commands run:

• terraform -chdir=stacks/platform validate
• terraform -chdir=stacks/apps validate
• terraform -chdir=stacks/platform fmt -check -diff
• terraform -chdir=stacks/apps fmt -check -diff
• bash -n apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• shellcheck apply.sh .github/scripts/verify_platform_health.sh .github/scripts/disable_platform_autosync.sh install-ca-cert.sh
• git diff --check
• gh run watch 26383905982 --repo agynio/bootstrap --exit-status

Results:

• Terraform validation: 2 passed / 0 failed / 0 skipped
• Bash syntax checks: 4 passed / 0 failed / 0 skipped
• Formatting/whitespace checks: passed
• Linting: ShellCheck passed with no errors
• CI: 1 passed / 0 failed / 0 skipped