will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(swarm): add swarm self-improvement loop infrastructure

Browse Source 
Adds complete k8s manifests, ArgoCD app, and Terraform namespace
resources for the Neuron swarm self-improvement loop system.

Each variant (alpha, beta, gamma) gets its own isolated namespace,
PVC, MCP/REST deployments, ExternalSecrets from Vault, RBAC for CI,
and a SQLite clone Job template for session startup.
This commit is contained in:
Will Anderson
2026-04-26 00:58:43 -05:00
parent 89a0209637
commit 74dd054a36
22 changed files with 1420 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/legion/k8s/neuron-technologies/swarm/rbac.yaml
+97
View File
@@ -0,0 +1,97 @@
# RBAC for swarm variant namespaces
# Grants the CI runner ServiceAccount permission to deploy to swarm-* namespaces.
# Mirrors the pattern used for neuron-dev/stage deployments.
# The CI runner runs in the `ci` namespace as the `default` ServiceAccount.
---
# swarm-alpha
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: swarm-deployer
namespace: swarm-alpha
rules:
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
- apiGroups: [""]
resources: ["configmaps", "services", "pods", "pods/log"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ci-runner-swarm-alpha
namespace: swarm-alpha
subjects:
- kind: ServiceAccount
name: default
namespace: ci
roleRef:
kind: Role
name: swarm-deployer
apiGroup: rbac.authorization.k8s.io
---
# swarm-beta
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: swarm-deployer
namespace: swarm-beta
rules:
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
- apiGroups: [""]
resources: ["configmaps", "services", "pods", "pods/log"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ci-runner-swarm-beta
namespace: swarm-beta
subjects:
- kind: ServiceAccount
name: default
namespace: ci
roleRef:
kind: Role
name: swarm-deployer
apiGroup: rbac.authorization.k8s.io
---
# swarm-gamma
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: swarm-deployer
namespace: swarm-gamma
rules:
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "watch", "create", "update", "patch"]
- apiGroups: [""]
resources: ["configmaps", "services", "pods", "pods/log"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ci-runner-swarm-gamma
namespace: swarm-gamma
subjects:
- kind: ServiceAccount
name: default
namespace: ci
roleRef:
kind: Role
name: swarm-deployer
apiGroup: rbac.authorization.k8s.io