pulp3¶

Metadata¶

Field	Value
Service	pulp3
Purpose	Content distribution platform for Debian and RPM repositories
Criticality	Tier 1
Owner	Platform / Content supply owner
Clusters	homelab, ozilab (Ozilab)
Namespace	pulp3
Exposure	internet
Stateful	yes
Backup class	app-native
RPO / RTO	Daily backup target, 4 to 8 hours to restore
Last reviewed	2026-07-28

Pulp 3 provides repository mirroring, publication, and distribution workflows for Debian and RPM content with internal signing integration.

If Pulp 3 fails, mirrored repositories and package publication workflows stop until operator, storage, and service state are restored.

Dependency	Type	Why it matters
Pulp Operator	control plane	Creates and manages the Pulp custom resource
Traefik	ingress	Exposes the Pulp web and content endpoints
PostgreSQL and Redis	state	Support Pulp application runtime

[Mirror sync scripts]
  -> [Pulp API / content]
  -> [PostgreSQL / Redis / PVC-backed storage]
  -> [Traefik]
  -> [Repository consumers]

Item	Value
Source path	pulp3/base, pulp3/operator, and pulp3/overlays/*
Deployment model	Operator bootstrap plus Kustomize overlays
Namespace	pulp3
Workload kind	Operator Deployment plus Pulp custom resource
Chart or image version	Pulp Operator 2.0.0, application image tags from the Pulp CR
Config files	base/kustomization.yaml, operator/kustomization.yaml, overlays/homelab, overlays/ozilab, fleet.yaml

Cluster	Overlay path	Notes
homelab	pulp3/overlays/homelab	Current homelab deployment
ozilab	pulp3/overlays/ozilab	Manual Kustomize and the dedicated Ozilab Fleet GitRepo use the same application overlay

Variable	Source	Purpose	Secret?
Pulp settings and signing inputs	overlay secrets, Pulp settings files, and CR values	API behavior, signing, and external URL settings	mixed

Resource	Path	Purpose
Pulp settings resources	pulp3/base and overlay-specific settings	Control application runtime and external URLs

Secret names: pulp-admin-password, debian-signing-key, rpm-signing-key, debian-signing-passphrase, and rpm-signing-passphrase in namespace pulp3
Required keys: password for the admin Secret, signing_service.gpg for each signing-key Secret, and gpg_passphrase for each passphrase Secret
Source of truth: Ozilab uses operator-owned local inputs applied out of band with pulp3/overlays/ozilab/bootstrap-secrets.sh. Neither Fleet nor the application Kustomization reads sensitive files during rendering.
Rotation trigger: signing key changes, admin credential rotation, or migration work
Recovery note: restore all five stable-name Secrets before reconciling the Ozilab application overlay. The committed signing-scripts Secret contains scripts only and remains generated by Kustomize.
Fleet boundary: the Ozilab Pulp bundle owns the application overlay. The Pulp operator/CRDs and five sensitive Secrets are explicit cluster prerequisites.

Path	URL or endpoint	Audience	Auth	TLS terminates at
Internal	Pulp web and API services in the pulp3 namespace	Cluster workloads and operators	Pulp auth	Traefik / service
External	Overlay-specific Pulp hostnames exposed through Traefik	Repository consumers and operators	Pulp auth and signing trust	Traefik

Primary health indicators: Pulp CR healthy, operator healthy, content and API pods Ready, and ingress responsive.
Dashboards or alerts: shared cluster monitoring plus app-level health checks.
Log locations: operator logs and Pulp workload logs in the pulp3 namespace.
Known failure modes: operator reconciliation issues, bad secrets, failed content sync, or storage problems.

Backup method: application backup, database backup, and snapshot of content storage.
Restore prerequisites: restored operator, signing secrets, and persistent content state.
Related runbook: ../runbooks/pulp3.md

Current deployed app version: see the Pulp CR and operator overlay.
Current chart version: N/A.
Last significant change: decoupled the Ozilab overlay from local admin, private-key, and passphrase inputs so manual Kustomize and Fleet use the same render path with out-of-band Secret prerequisites.
Rollback reference: previous operator or overlay revision in Git.