Track A0 Tenant Application Runtime Guide

Purpose

Track A0 is the frozen application-runtime contract for GWEB Cloud.

It gives tenant applications a supported control-plane path for configuration, secrets, runtime binding, rollback, diagnostics and lifecycle operations without requiring tenant Kubernetes administration.

Runtime state model

Each application/environment can have:

application
  ├── config revisions
  ├── secret revisions
  └── runtime binding

The runtime binding selects the config and secret revisions currently consumed by the application Deployment.

Config vs secret

Use config for non-sensitive values.

Use secret for passwords, API keys, tokens and other sensitive runtime data.

Do not put sensitive values into normal config simply because the application can read them from environment variables.

Config workflow

gwebc config show <app> --environment <env>
gwebc config set <app> --environment <env> ...
gwebc app configure <app> --environment <env>
gwebc app diagnostics <app> --environment <env>

Secret workflow

gwebc secret show <app> --environment <env>
gwebc secret set <app> --environment <env> ...
gwebc app configure <app> --environment <env>
gwebc app diagnostics <app> --environment <env>

For rotation:

gwebc secret rotate <app> --environment <env> ...
gwebc app configure <app> --environment <env>

For rollback:

gwebc app rollback <app> --environment <env>

Kubernetes materialization

The GWEB deployment controller materializes accepted runtime revisions into revisioned Kubernetes objects.

A Deployment can reference:

ConfigMap: gweb-<application>-config-r<N>
Secret:    gweb-<application>-runtime-r<N>

The application does not need to know how those Kubernetes objects are created.

Rollback behavior

Rollback changes the authoritative runtime binding.

A newer revision may remain present for history/rollback/audit purposes while an older revision is active.

Therefore:

latest revision != necessarily active bound revision

Do not delete revision objects manually just because they are not currently bound.

Diagnostics

Use:

gwebc app diagnostics <app> --environment <env>
gwebc app logs <app> --environment <env>

before reaching for lower-level administrative tools.

Service and domain lifecycle

Runtime binding and public exposure are separate operations.

Application runtime:

config / secret -> app configure

Application exposure:

service expose -> domain bind/attach -> DNS/TLS

This separation allows private/internal applications to use the same runtime configuration model without public ingress.

Tenant vs platform responsibilities

Tenant:

• owns application intent;
• provides non-sensitive configuration;
• provides/rotates secret values;
• initiates supported lifecycle operations;
• inspects bounded diagnostics/logs.

Platform:

• authorizes tenant/environment access;
• stores only secret metadata in broker persistence;
• materializes revisioned runtime objects;
• patches workload references;
• manages Service/HTTPRoute/DNS/TLS;
• enforces RBAC, NetworkPolicy and environment mutation policy;
• records audit/history.

Production

Direct production mutation is intentionally restricted.

Production changes follow the platform promotion/authorization model rather than the ordinary dev/preprod mutation path.

Runtime reporting

gwebc 1.22.33 reports the currently bound runtime revisions through gwebc app show.

runtime_state=BOUND
config_revision=<revision>
config_state=BOUND
secret_revision=<revision>
secret_state=BOUND

Secret values remain non-disclosing. gwebc secret show returns metadata, not plaintext values.