0051. UI and CLI writes refuse a CR that Argo CD or Flux tracks

Status: Superseded by ADR 0101 · Date: 2026-10-26 · Design section: GitOps and Argo CD Decided: Every write to an existing CR in internal/uiapi (so the UI and the CLI, backend or fallback) goes through one Server.requireUntracked, which runs gitopstracking.IsTracked and prmode.Decide(trackedBy, false) and refuses anything but ModeDirectWrite with FailedPrecondition; a failed check refuses too; Create is not gated; the RBAC is two cluster-scoped rules, one narrowed by resourceNames

Context

pkg/gitopstracking and pkg/prmode (ADR 0037, 0038, 0044) were complete but nothing imported them, so the backend wrote CRs that Argo CD or Flux owns. Architecture: a tracked CR without a repository connection is read-only with an export button. No repository connection exists in the CRDs yet, so for now every tracked CR is read-only; opening the PR for ModeOpenPR is a later unit.

Decisions

1. One gate. Server.requireUntracked(ctx, obj) in internal/uiapi/server.go, called right after the object is read in ApproveMachine, RejectMachine, UpdatePatch and DeletePatch (the only Update/Delete sites). It passes hasRepoConnection=false; any mode other than ModeDirectWrite (including a ModeOpenPR that cannot occur yet) is refused. The CLI fallback builds the same Server, so it is covered without extra code.

2. Refusal. connect.CodeFailedPrecondition: "<ns/name>" is tracked by Argo CD|Flux, so it is read-only here: run ichor gitops export to put it in Git and change it with a pull request.

3. A failed check refuses. An IsTracked error returns CodeUnavailable and writes nothing: "cannot tell" is never "may write" (ADR 0044).

4. Create is not gated. A CR that does not exist has no Argo CD annotation or label, no Flux field manager and no inventory entry, so IsTracked can only answer "not tracked". Whether the new CR lands in a path or namespace a tool will later own is not knowable from the cluster; that belongs to the PR-mode unit, which decides where a new file goes. Creating the CR directly is the same as kubectl apply today.

5. RBAC. Two rules added to the UI ClusterRole (rbac_markers.go, config/rbac/ichor-ui/, the chart): get on configmaps with resourceNames: [argocd-cm], and list on kustomizations.kustomize.toolkit.fluxcd.io. They are cluster-scoped because Argo CD's namespace is not fixed and a Role/RoleBinding into a namespace that does not exist fails the chart install (ADR 0050 made the same call for Longhorn). resourceNames keeps the ConfigMap read to one name, so there is no cluster-wide ConfigMap or Secret read. The namespace comes from Server.ArgoCDNamespace (ICHOR_ARGOCD_NAMESPACE in ichor-ui), default argocd.

Consequences

• The namespace is configurable end to end: the chart sets ichorUI.argocdNamespace (default argocd) as ICHOR_ARGOCD_NAMESPACE on the ichor-ui Deployment, and the CLI's --argocd-namespace (default argocd, the same flag ichor gitops export has) sets the namespace the --local fallback reads. Before this, a non-default Argo CD namespace silently let a tracked CR be written directly.
• Flux has no PR path (ADR 0037), so a Flux-tracked CR stays read-only even once a repository connection exists.