uBixSys
Manual

Guides.

Pipelines, Kubernetes deployment, and strategies that use the projects together. Each guide names the released version it draws on, and says what need the feature exists for, not only the commands. Runnable versions live in the examples repository.

Guides marked "planned" are listed so you can see the shape of the manual; they are written once the example behind each has been run.

Building blocks

  1. Hand a job one secret, and nothing else uBixVault v1.5 · Initialize and unseal a vault, store a secret, and give an automated job a short-lived, read-only token for exactly that path.
  2. Keep shared config in sync across namespaces Replikate v1.4 · Annotate one ConfigMap and let Replikate copy it into every team namespace, update it on change and remove it on delete.

Pipelines

  1. The uBixCore CI pipeline template and its jobs uBixCore v0.47.0 · Include one shared GitLab pipeline pinned to a release tag, what each job does, and how to tune, change or drop a job.
  2. A gated pipeline: test, build, deploy, promote (planned) uBixKelpie v0.1.0-beta.1, uBixCore v0.46.1 · One branch per environment, a green deploy fast-forwards the next branch, and a failed rollout stops the line.
  3. Secrets in a pipeline (planned) uBixVault v1.5, uBixKelpie v0.1.0-beta.1 · Scoped, short-lived tokens for jobs, a ceiling on how long a login can live, and one secret path per environment.
  4. Require a human sign-off without paid approval rules uBixCore v0.46.1, uBixKelpie v0.1.0-beta.1 · Why the sign-off is a pipeline job, why GitLab will not re-run it on approval, and how Kelpie retries it when someone approves.

Kubernetes

  1. Run uBixVault on Kubernetes (planned) uBixVault v1.6.0 · The Helm chart, file and MySQL storage, active/standby HA, and Raft, which is experimental in 1.6.0.
  2. Run Replikate on Kubernetes (planned) Replikate v1.4.0 · Install with Helm, select namespaces by label, replicate across clusters, and migrate from config-syncer.
  3. One app, three environments (planned) uBixKelpie v0.1.0-beta.1 · Per-branch namespaces, per-environment manifests and a deploy script that waits for the rollout.

Using them together

  1. Secrets from the vault to every namespace (planned) uBixVault v1.6.0, Replikate v1.4.0 · uBixVault as the source of truth and Replikate as the carrier into each team namespace.
  2. Agents inside the pipeline (planned) uBixShepherd v0.5.0-beta.2, uBixVault v1.5 · A Shepherd lane and its scope, the gate every merge request passes, and a scoped token for the agent.