Runbook: Onboarding a Client

Status: Draft — implementation pending

Purpose

Step-by-step instructions for onboarding a new client to the Inari platform.

Prerequisites

• Client identifier (client-id) assigned
• Cloud account(s) provisioned or provided by client
• Management plane observability stack is operational
• Client overlay template exists in clients/_templates/

Steps

1. Create the client overlay directory from the template.
2. Configure the client dex-connectors.yaml for the client's IdP.
3. Configure alloy-config.yaml with management-plane endpoints and client certificate references.
4. Configure client-local Crossplane ProviderConfigs for the client's cloud accounts.
5. Configure management-plane Crossplane ProviderConfig with the limited infra-provisioning credential.
6. Provision the client EKS cluster using management-plane Crossplane.
7. Install External Secrets Operator in the client cluster and create the bootstrap secret.
8. Verify ESO can read from the client's secret store.
9. Install and configure client-local ArgoCD to pull from github.com/7kgroup/7k-inari.
10. Create the initial ArgoCD Application pointing to clients/<client-id>/overlays/<env>/.
11. Validate that client ArgoCD syncs the baseline from Git.
12. Validate SSO, observability, and Crossplane claim flow.
13. Create read-only ServiceAccount and deliver kubeconfig to client.
14. Verify Backstage read experience for the client.

TODO

• Add exact CLI commands and example manifests when scaffolding begins.
• Link to disaster-recovery runbook for rollback procedures.