L7 — Applications & workloads

What runs on top: demo apps + service mesh + tracing on wl, plus the middleware VM estate.

Demo apps (wl, GitOps `spoke/base/demo-app`)

App	What
demo-app	backend/frontend/postgres + Route + `demo-db` ExternalSecret + tracing
JBoss EAP demo	EAP 8 JAX-RS, built on rhel-app-vm → Quay, deployed via Tekton. Live: `eap-demo-eap-demo.apps.wl.airgap.lab/api/hello`

Sail-operator Istio default profile=ambient (ztunnel DaemonSet, istio-cni), GitOps spoke/base/ossm.
Enroll a namespace: label istio.io/dataplane-mode=ambient (L4 mTLS, no sidecar).
Validated end-to-end: ztunnel mTLS/SPIFFE identity (AuthorizationPolicy by SA principal), HBONE (:15008), STRICT PeerAuthentication, L7 waypoint (method+path authz).
Kiali at kiali-istio-system.apps.wl.airgap.lab.

Auto-inject via Instrumentation CR (annotation instrumentation.opentelemetry.io/inject-java).
App → otel-collector.tracing-system:4318 (HTTP, not :4317) → TempoStack tracing.
⚠️ Air-gap: the default java agent image is ghcr.io/... (unreachable) — mirror it and set Instrumentation.spec.java.image to the mirrored copy.

Fedora/RHEL VMs from mirrored boot sources on ocs-storagecluster-ceph-rbd-virtualization (RWX).
Node-failure auto-recovery validated: RWX storage + runStrategy: Always + NHC+SNR (out-of-service taint) → VM reschedules + re-attaches in ~9 min.

Middleware	VMs	Notes
Postgres HA	pg-0/1/2 (.47–.49)	Patroni + PG16, etcd DCS, sync standby, VIP `pg.airgap.lab`, PgBouncer, pgBackRest→MinIO. 3 failover drills passed, zero-loss
Kafka	kafka-ctrl/broker (.31–.36)	—
Redis	redis-0..5 (.37–.42)	failover (`redis-failover-drill.sh`)
Artemis	artemis-0/1 (.50–.51)	replication HA, TLS acceptors
APISIX	.43–.44/.46	API gateway — see Identity
Wazuh	.52	SIEM (alert + audit sink)

Build/staging host: rhel-app-vm (.30, Java/Maven/podman, has internet).

wl in-cluster apps are GitOps (spoke/base/*). Middleware VMs are provisioned on the host (not GitOps); their secrets live in Vault apps/*.