Running workloads

How to run workloads on Kestrel using the GitOps-first happy path, with kubectl for debugging and a narrow escape hatch when you need it.

ArgoCD on Kestrel Where the UI lives, how OIDC login works, what tenants can see, and where to find sync history.

User-brings-repo model Repo structure expectations and recommended sync policy defaults for tenants — greenfield today, template fork once it ships.

kubectl on Kestrel Read-only and debugging commands, how each mutating verb interacts with ArgoCD and cluster policy, and the pause-mutate-capture escape hatch.

Monitoring Tenant Grafana access, where dashboards live, and how to expose metrics from your own pods so they are scraped.

Priority classes What each uber-user-* priority class means for tenant workloads and when to pick which one.

Sealed Secrets Encrypt Kubernetes Secrets with kubeseal into SealedSecrets you can safely commit to Git — the RCS-managed controller decrypts them into your namespace.

Workload recipes Long-running services, batch Jobs and CronJobs, and short-lived dev pods — each with a tenant-prefixed example.