# Appendix - The dependency ledger: GitHub, Azure Key Vault, zot

**Series position:** appendix to the delivery arc (VI-VIII) - sits after Course VIII,
beside the phrasebook. DOM-only page: a ledger, not a set-piece - no hero, no scrub
(art optional later; the arc's three scenes carry the visuals).
**Safety gate:** public site - technologies only, zero employer/industry framing.
Claims source from [[zot-registry]], [[homelab-pull-through-registry]],
[[eso-infisical-secrets]] (pattern generalised to the AKV example), [[argocd-stacks]],
public GitHub/Azure/zot docs.

## Title (thesis)
**Every toolchain stands on services it does not run.**

## Hook - the uncomfortable default
The delivery arc reads like a closed machine: repo to reconciler to registry to node.
It is not closed. Three of its load-bearing pieces live outside the cluster - one of
them outside the building entirely - and the honest move is to write that down. A
dependency you have not written down is a dependency you will rediscover during an
outage.

## The ledger
Three columns of truth per dependency: what it is, what leans on it, and - the one
everyone skips - what actually happens when it is down.

### GitHub - where the desired state lives
A hosted git service; here it is the system of record the whole loop watches. ArgoCD
holds a read-only deploy key and polls a repo + path + revision (Course VI); every
change to the cluster is a commit here first, and the audit trail is the commit log.
LEANS ON IT: ArgoCD sync, rollback (git revert), change review, the "who merged this"
answer.
WHEN IT IS DOWN: the cluster does not care. The reconciler keeps enforcing the last
synced state indefinitely - workloads run, drift is still corrected from cache. What
stops is CHANGE: nothing new can land, and rollback-via-revert waits with it. GitOps
degrades to read-only, which is the graceful half of the design.

### Azure Key Vault - where the secret values live
A managed secret store; here it is the vault half of the split from Course VI: git
carries the ExternalSecret REFERENCE (a logical name), the vault carries the VALUE,
and an operator inside the cluster exchanges one for the other and keeps it synced.
Rotation happens here, never as a commit.
LEANS ON IT: External Secrets sync, secret rotation, first deploy of anything that
needs a credential.
WHEN IT IS DOWN: already-synced Secrets keep working - the values are materialised
in-cluster, so running workloads feel nothing. What stops is rotation and NEW secrets:
a fresh app blocks at its ExternalSecret, and an expiring credential becomes a real
deadline. Down is survivable; down during a rotation window is an incident.

### zot - where the fleet pulls from
A self-hosted OCI registry running as a pull-through mirror (Course VII): the fleet
asks zot, zot asks the upstream managed registry (ACR in the arc's example) once, and
every later pull is local. It is the availability seam between the cluster and the
internet - and the control point where what enters the estate can be gated and audited.
LEANS ON IT: every image pull on every node - boot, reschedule, scale-up, node
recovery.
WHEN IT IS DOWN: the sharpest edge of the three. Upstream down + mirror up = nobody
notices, cache serves (that is the mirror's whole argument). Mirror down = nodes fall
back to upstream only if the pull-path config says they may - a disconnected or
mirror-only fleet CANNOT PULL, so running pods keep running but nothing new schedules
and a rebooting node may not come back whole. The mirror is the dependency the other
two get to lean on.

## Close
Write the ledger for your own stack and notice the asymmetry it exposes: none of these
outages stop what is already running - they stop CHANGE, ROTATION and RECOVERY, in that
order of pain. Design for the outage you will actually have: cache what you pull, split
references from values, and let the cluster hold its last known truth without asking
anyone's permission.

## Legend terms (DOM layer -> phrasebook additions)
system of record / deploy key / read-only degradation / ExternalSecret / reference vs
value / rotation window / pull-through cache / availability seam / mirror-only pull path

## Page shape (build note)
Ledger layout, not prose: three cards (or one three-row table on wide viewports), each
carrying the blurb + "leans on it" + "when it is down" strips - the amber FIELD-NOTE
treatment fits the "when it is down" strip. Cross-link each card to its owning course
(VI, VI, VII respectively). No slice scene; if art is ever wanted, a single small
still of three unconnected objects (crystal slab / vault cube / way-station) reusing
the arc heroes' silhouettes - do not generate anything new for this page now.

## Page footer - further reading (site convention)
GitHub docs (https://docs.github.com/); Azure Key Vault
(https://learn.microsoft.com/azure/key-vault/); zot registry
(https://zotregistry.dev/); and the arc's canon trio: Kubernetes
(https://kubernetes.io/docs/), Helm (https://helm.sh/docs/), Red Hat OpenShift
(https://docs.redhat.com/en/documentation/openshift_container_platform).
