Documentation
≡

Press Esc to close · ↑↓ to navigate

  • brac poc
    • Overview
    • Requirements email
    • Demo scope (v2)
    • Demo plan
    • SPA architecture
    • Bank Payment app
    • JBoss Chat app
  • greenfield ocp deployment
    • Overview
    • installation manual
      • 01 MinIO object storage
      • 02 PDNS installation
      • 03 HAProxy installation
      • 04 GitLab installation
      • vault
        • 05a Snapshot backups
        • 05b Isolated restore drill
        • 05c Leader failover drill
        • 05d Snapshot retention
      • 05 Vault installation
      • 06 NetBox installation
      • 07 Quay registry
      • 08 oc-mirror
      • 09 Nexus artifact repository
      • 10 Bootstrap artifacts
      • 100 Spoke Gatekeeper operand preflight
      • 101 Spoke Gatekeeper live canary rollback
      • 11 Bootstrap VM and install inputs
      • 12 Hub cluster installation
      • 13 Hub GitOps bootstrap
      • 14 Hub LVMS storage
      • 15 Hub cert-manager
      • 16 Hub External Secrets and Vault auth
      • 17 Hub ACM and MCE
      • 18 Hub RHACS
      • 19 HTPasswd Admin Identity
      • 20 Spoke Day-Zero Hardening
      • 21 Spoke FIPS And Disk Inventory
      • 22 Spoke ODF RAID0 Disk Prep
      • 23 Spoke LSO ODF Install
      • 24 Spoke ACM Import Pull GitOps
      • 25 Spoke cert-manager, ESO, and Vault auth
      • 26 Spoke RHACS secured cluster
      • 27 Spoke compliance baseline
      • 28 Spoke compliance findings triage
      • 29 Spoke low-risk compliance config
      • 30 Spoke logging and file integrity
      • 31 Spoke manual attestation evidence pack
      • 32 Spoke master banner MachineConfig hardening
      • 33 Spoke logging drainability and GitHub source
      • 34 Spoke worker banner MachineConfig hardening
      • 35 Spoke ODF NooBaa drainability gate
      • 36 Spoke NooBaa primary relocation
      • 37 Spoke worker-2 live drain validation
      • 38 Spoke worker coredump hardening preflight
      • 39 Spoke worker coredump hardening rollout
      • 40 Spoke worker coredump compliance evidence
      • 41 Spoke worker disable users coredumps preflight
      • 42 Spoke worker disable users coredumps rollout
      • 43 Spoke worker disable users coredumps compliance evidence
      • 44 Spoke worker coredump remaining controls comparison
      • 45 Spoke worker sysctl kernel core pattern rollout
      • 46 Spoke worker systemd-coredump service mask rollout
      • 47 Spoke operator readiness and next selection
      • 48 OADP backup preflight
      • 49 OADP operator install
      • 50 OADP DPA blocker
      • 51 Vault replacement start
      • 52 Vault replacement allocation
      • 53 Vault R1 build
      • 54 OADP Vault R1 DPA
      • 55 OADP ad hoc backup
      • 56 OADP schedules
      • 57 OADP scheduled backup validation
      • 58 OADP restore validation
      • 59 Vault R1 ESO smoke
      • 60 Vault R1 RHACS
      • 61 Vault DNS readiness
      • 62 Vault DNS promotion
      • 63 Vault soak cleanup
      • 64 Vault platform store cleanup
      • 65 OADP post-cleanup scheduled backup validation
      • 66 Old Vault retirement readiness
      • 67 Old Vault stage 1 retirement cleanup
      • 68 Old Vault stage 1 early backup validation
      • 69 Old Vault VM power-off
      • 70 Old Vault cold-retention soak
      • 71 OADP post-Vault-poweroff backup validation
      • 72 Old Vault final retention deletion
      • 73 Old Vault stale DNS cleanup
      • 74 Vault replacement phase closeout
      • 75 Hub CIS API/config hardening
      • 76 Hub audit log forwarding decision
      • 77 Hub audit log forwarding implementation
      • 78 Hub NetworkPolicy namespace classification
      • 79 Hub NetworkPolicy remediation preflight
      • 80 Hub low-risk NetworkPolicy apply
      • 81 Hub operator ACM NetworkPolicy design
      • 82 Hub lower-risk NetworkPolicy apply
      • 83 Hub webhook NetworkPolicy canary
      • 84 Hub ACM MCE NetworkPolicy canary
      • 85 Hub CIS manual check classification
      • 86 Hub CIS manual evidence pack
      • 87 Hub RBAC least-privilege inventory
      • 88 Hub RBAC exception register design
      • 89 Hub system:deployers cleanup preflight
      • 90 Hub platform-bootstrap system:deployers canary
      • 91 Hub ACM addon metrics Secret-read validation
      • 92 Post-compliance operator readiness selection
      • 93 Disconnected catalog hygiene
      • 94 Gatekeeper preflight and dry-run design
      • 95 Hub Gatekeeper operator-only install
      • 96 Spoke Gatekeeper operator-only install
      • 97 Hub Gatekeeper operand preflight
      • 98 Hub Gatekeeper operand canary
      • 99 Hub Gatekeeper rollback drill
  • openshift platform
    • Welcome
    • foundations
      • Overview
      • Naming Conventions
      • Domain and Network Map
      • Credential Custody
      • Glossary
      • BFSI readiness review
    • lab infrastructure
      • Overview
      • vm platform
        • Cloud-init base image
        • libvirt and br30
        • IP and MAC allocation
      • dns
        • PDNS architecture
        • Zone content
        • Recursor and forwarders
        • Failure modes and recovery
      • edge ingress haproxy
        • Architecture overview
        • Frontends and binds
        • SNI passthrough + loopback re-decrypt
        • Backend conventions
        • TLS and certificates
        • Edit procedure
      • object storage minio
        • Deployment
        • Bucket inventory
        • IAM users and policies
        • CI evidence lifecycle
      • vault vm
        • Deployment and storage
        • TLS and listener
        • Auth methods and policies
        • Secret engines and path conventions
        • App secret namespacing
        • Rotation and DR
        • Monitoring and audit
      • image supply nexus
        • Three-Endpoint Split
        • mirror-registry (install)
        • docker-group (dev pull)
        • app-registry (CI push)
        • Blob Stores & Lifecycle
        • Trivy Scanning
      • ci platform vms
        • Jenkins VM
        • Jenkins Agents
        • Trivy VM
        • DefectDojo
      • observability vms
        • SigNoz Overview
        • ClickHouse Storage
        • Auth Quirk (v0.122)
        • Monitoring VM
      • other platform vms
        • Docker Runtime VM
        • Redis Sentinel
        • Keycloak / OIDC
        • Terrakube
        • AWX
        • WSO2 APIM + IS
        • Kafka brokers
      • gitlab self hosted
        • Deployment & Runners
        • Federated Monorepo
        • Protected Runners
        • Tokens & Bots
    • openshift platform
      • Fleet Overview
      • cluster install
        • Prerequisites
        • Bootstrap VM
        • Network CIDRs
        • Version and Channel Pinning
        • Post-Install Tasks
      • cluster topology
        • hub-dc-v6
        • spoke-dc-v6
        • Control Plane and Machine Sets
        • Decommissioned Pre-v6 Clusters
      • acm multicluster
        • MultiClusterHub
        • ManagedCluster Registration
        • Policies and Placement
        • ACM Cluster Backup
      • gitops operating model
        • Pull Model Architecture
        • ApplicationSet
        • Sync-Wave Conventions
        • Pull vs Hub-Render + ignoreDifferences
        • Spoke RBAC Extensions
        • platform-gitops Layout + MR Workflow
        • Hub RBAC + Routes-CRD Guardrail
      • disconnected image supply
        • Architecture
        • oc-mirror workflow
        • IDMS / ITMS
        • CatalogSource & ICSP
        • Allowlist (VAP + RHACS)
        • Air-gap rebuild
      • operator lifecycle
        • OLM overview
        • Version pinning
        • Dev / eval bundle
        • OperatorPolicy via ACM
        • Upgrades & channels
      • storage
        • Overview
        • LSO & local volumes
        • ODF on spoke
        • NooBaa & OBC
        • CNPG Postgres pattern
        • StorageClass defaults
      • networking
        • Overview
        • OVN-K & IPv6
        • Ingress & Routes
        • EgressFirewall
        • NetworkPolicy baseline
        • Lab CA trust + Proxy
      • secrets eso
        • Architecture
        • Operator & policies
        • ClusterSecretStore
        • Tenant SecretStore
        • ExternalSecret
        • OBC bridge
        • Rotation & revocation
      • security
        • Overview
        • Central on hub
        • Sensor on spoke
        • Init-bundle via ESO
        • Scanner V4 & image policies
        • Admission controller
        • App-team policy set
        • VAP image allowlist
        • NetworkPolicy defaults
      • compliance
        • Overview
        • Compliance Operator
        • ScanSetting & bindings
        • PCI-DSS profile
        • Remediation
        • Evidence & storage
        • Exceptions & waivers
        • Audit readiness
      • backup oadp
        • Operator install
        • DPA credentials via ESO
        • MinIO bucket + IAM
        • CSI snapshots + Kopia
        • Drill + Schedules + DR
        • ACM cluster-backup
      • platform services
        • Overview + cert-manager
        • Tekton: TektonConfig + Triggers
        • Cluster Logging + LokiStack
        • TempoStack
        • OpenTelemetry Collector + push-image-quay
        • OSSM 3 ambient
        • Kiali
        • COO + UIPlugins
        • NetObserv + Trivy Task
        • Descheduler + update-overlay-digest
        • Gatekeeper / OPA
        • CloudNativePG
        • Open Liberty Operator
        • Quay Registry
        • Kafka monitoring
        • Perses dashboards
        • Tekton templates + tasks
    • application delivery
      • Overview
      • federated gitlab
        • Repo Architecture
        • Tenant Monorepo Contract
        • Branch and MR Conventions
        • Runners, Roles, Webhooks, Credentials
      • build paths
        • Path A — Jenkins
        • Path B — Tekton
        • Shared Trivy Policy
        • MinIO Evidence Schema
        • Build-Once / Promote-by-Digest
        • Path Decision Matrix
      • gitops consume
        • Overview
        • ApplicationSet generator
        • Overlay contract
      • tenant onboarding
        • Overview
        • Vault path and role
        • Project + RoleBinding
        • ESO + pullSecret
        • RHACS exceptions
        • Quota + LimitRange
        • Tenant template
        • Cluster pull-secret fan-out
        • Quay robot token
      • golden path samples
        • Overview
        • Liberty hello-world
        • CNPG-backed app
        • Path-A end-to-end
        • Path-B end-to-end
        • Mesh + Tempo trace
    • operations
      • Overview
      • Day-1 handoff
      • MR mechanics
      • incidents and runbooks
        • Overview
        • Routes CRD (#153)
        • ESO egress to Vault
        • IPv6 disable / OVN (#135)
        • OBC operand bridge
        • SigNoz v0.122 auth
        • WSO2 APIM JMS URL encoding
        • Break-glass procedure
        • DefectDojo Jenkins import
        • Jenkins pollSCM bootstrap
        • MCO stuck-node recovery
        • Secrets custody drift
        • PCI-DSS remediation
      • routine tasks
        • Overview
        • Rotate secrets
        • Bump operator version
        • Add a cluster
        • Roll out a policy
        • Backfill evidence
        • Rotate kubeadmin
        • Rotate RHACS Central admin
        • Add a division
        • Loki OBC bridge
      • On-call and escalation
      • Known gotchas
    • architecture decisions
      • Overview
      • ADR Index
      • 0001 — Operator workspace
      • 0004 — Storage-light hubs
      • 0005 — Network / Ingress / PKI
      • 0006 — Redis hardening
      • 0008 — WSO2 standalone
      • 0009 — Jenkins single VM
      • 0010 — SigNoz standalone VM
      • 0012 — Monitoring VM
      • 0013 — DefectDojo
      • 0015 — Federated GitOps
      • blog
        • Blog ADRs — Overview
        • ADR 0001 — Multi-collection
        • ADR 0002 — ReactFlow over Mermaid
        • ADR 0003 — Category sidebar
        • ADR 0004 — Learn section
        • ADR 0005 — SEO baseline
        • ADR 0006 — Brac POC collection
        • ADR 0007 — Docs master section
      • 0016 — Execution governance
      • 0018 — ACM pull model v6
      • 0019 — Nexus-only supply chain
      • 0020 — PCI-DSS baseline
      • 0022 — v6 fleet membership
      • 0017 — Parallel worktree isolation
      • 0023 — GitLab ownership model
      • 0024 — Platform GitOps boundary
      • 0025 — GitOps-only + break-glass
      • 0026 — IPv6 on OVN-K
    • references
      • Lab Endpoints and Hosts
      • HAProxy Frontends
      • PDNS Records
      • Object Storage Buckets
      • Nexus Endpoints
      • Vault Paths
      • Operator Version Lock
      • Cluster Domains and CIDRs
      • Credential Custody
      • Glossary
    • history and replay
      • Rebuild Timeline
      • Failed Installs & cloud-init
      • Pre-v6 to v6 Transition
      • Site Replication Readiness
      • Day-Wrap Archive
      • REPRO-HUB-1 Hub Adoption
      • 2026-05-09 v6 Install Day
  • security lab
    • Overview
    • Current inventory
    • Operating workflow
    • Cisco Nexus track
    • Software download rules
    • Roadmap and sprints
    • Cisco BFSI portfolio map
    • Cisco certifications 2026 map
    • Cisco download checklist
    • NetApp DC/DR storage
    • StorageGRID DC/DR object
    • Regional cloud networking stack
    • GitOps-managed networking
    • SOC and Nexus closeout
    • Operations dashboard
    • Reproducibility guide
    • Project walkthrough

Documentation

Long-form documentation, organised by module. The platform module is the operating manual for the comptech OpenShift fleet; engagement modules carry the proof-of-concept work for specific clients. Pick a module to enter its sidebar and table of contents.

4 modules · 382 pages total.

Full Platform Documentation

Operating manual for the comptech OpenShift platform — fleet topology, GitOps, image supply, observability, security, compliance, backup, and the ADRs behind it all.

252 pages · last reviewed 2026-05-12

BRAC Bank POC

Engagement-specific documentation for the BRAC Bank proof of concept — eight-panel SPA, payment microservice, jboss-chat, demo scope, and the operational decisions made for this engagement.

7 pages · last reviewed 2026-05-12

Greenfield OCP Deployment

A source-of-truth guide for building a greenfield OpenShift platform with GitOps, automated VM provisioning, DNS, edge, registry, CI, observability, and operational documentation from day one.

106 pages · last reviewed 2026-05-19

Security Lab

Operating notes for the private security and networking lab — Kali, purple-team tooling, SIEM, vulnerability management, EVE-NG, and the Cisco NX-OS fabric learning track.

17 pages · last reviewed 2026-05-15

built with astro on cloudflare pages · blog · RSS