Running workloads

How to run workloads on Kestrel using the GitOps-first happy path, with read-only kubectl escape hatches when you need them.

ArgoCD on Kestrel Where the UI lives, how OIDC login works, what tenants can see, and where to find sync history.

User-brings-repo model Repo structure expectations and recommended sync policy defaults for tenants — greenfield today, template fork once it ships.

Sealed Secrets Encrypt Kubernetes Secrets with kubeseal into SealedSecrets you can safely commit to Git — the RCS-managed controller decrypts them into your namespace.

Priority classes What each uber-user-* priority class means for tenant workloads and when to pick which one.

Monitoring Tenant Grafana access, where dashboards live, and how to expose metrics from your own pods so they are scraped.

Workload recipes Long-running services, batch Jobs and CronJobs, and short-lived dev pods — each with a tenant-prefixed example.