feat: add Redpanda and wp-deploy-coordinator to Legion

- Redpanda single-node StatefulSet in platform namespace
- wp-coordinator deployment consuming wp.deploy topic
- RBAC for coordinator to exec into harmonic-wordpress pods
- R2 credentials via ExternalSecret (no SSH key needed on coordinator)
- Sites config as ConfigMap — add new WP sites without code changes

servers/legion/apps/redpanda.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: redpanda
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.neuralplatform.ai/will/infrastructure.git
+    targetRevision: main
+    path: servers/legion/k8s/redpanda
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: platform
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

servers/legion/apps/wp-coordinator.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: wp-coordinator
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.neuralplatform.ai/will/infrastructure.git
+    targetRevision: main
+    path: servers/legion/k8s/wp-coordinator
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: platform
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

servers/legion/k8s/redpanda/deployment.yaml

@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: redpanda
+  namespace: platform
+  labels:
+    app: redpanda
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redpanda
+  serviceName: redpanda
+  template:
+    metadata:
+      labels:
+        app: redpanda
+    spec:
+      containers:
+        - name: redpanda
+          image: docker.redpanda.com/redpandadata/redpanda:latest
+          command:
+            - rpk
+            - redpanda
+            - start
+            - --smp=1
+            - --memory=512M
+            - --reserve-memory=0M
+            - --overprovisioned
+            - --kafka-addr=PLAINTEXT://0.0.0.0:9092
+            - --advertise-kafka-addr=PLAINTEXT://redpanda.platform.svc.cluster.local:9092
+            - --pandaproxy-addr=0.0.0.0:8082
+            - --advertise-pandaproxy-addr=redpanda.platform.svc.cluster.local:8082
+            - --set=redpanda.enable_transactions=true
+            - --set=redpanda.enable_idempotence=true
+          ports:
+            - name: kafka
+              containerPort: 9092
+            - name: admin
+              containerPort: 9644
+            - name: proxy
+              containerPort: 8082
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/redpanda/data
+          resources:
+            requests:
+              memory: 512Mi
+              cpu: 100m
+            limits:
+              memory: 1Gi
+              cpu: 500m
+          readinessProbe:
+            exec:
+              command: ["rpk", "cluster", "info", "--brokers=localhost:9092"]
+            initialDelaySeconds: 20
+            periodSeconds: 10
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: redpanda-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redpanda
+  namespace: platform
+spec:
+  selector:
+    app: redpanda
+  ports:
+    - name: kafka
+      port: 9092
+      targetPort: 9092
+    - name: admin
+      port: 9644
+      targetPort: 9644
+    - name: proxy
+      port: 8082
+      targetPort: 8082
+  type: ClusterIP

servers/legion/k8s/redpanda/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redpanda-data
+  namespace: platform
+spec:
+  storageClassName: local-path
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi

servers/legion/k8s/wp-coordinator/configmap.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: wp-coordinator-sites
+  namespace: platform
+data:
+  sites.yaml: |
+    sites:
+      harmonic-wordpress:
+        namespace: harmonic-wordpress
+        wordpress_selector: app=wordpress
+        mysql_selector: app=mysql
+        mysql_db: wordpress
+        git_repo: https://git.neuralplatform.ai/harmonic-framework/harmonic-framework.com.git
+        themes_src_path: wp-content/themes
+        themes_dst_path: /var/www/html/wp-content/themes
+        dev_url: https://dev.harmonic-framework.com
+        smoke_test_url: https://dev.harmonic-framework.com
+        db_sources:
+          staging:
+            host: "159.65.222.142"
+            db_name: wordpress_hf_hf_staging
+          production:
+            host: "159.65.222.142"
+            db_name: wordpress_hf
+        url_map:
+          staging: https://staging.harmonic-framework.com
+          production: https://harmonic-framework.com

servers/legion/k8s/wp-coordinator/deployment.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wp-coordinator
+  namespace: platform
+  labels:
+    app: wp-coordinator
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: wp-coordinator
+  template:
+    metadata:
+      labels:
+        app: wp-coordinator
+    spec:
+      serviceAccountName: wp-coordinator
+      containers:
+        - name: wp-coordinator
+          image: registry.neuralplatform.ai/neural-platform/wp-deploy-coordinator:latest
+          imagePullPolicy: Always
+          env:
+            - name: REDPANDA_BROKERS
+              value: redpanda.platform.svc.cluster.local:9092
+            - name: DEPLOY_TOPIC
+              value: wp.deploy
+            - name: CONSUMER_GROUP
+              value: wp-coordinator
+            - name: GITEA_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: wp-coordinator-secrets
+                  key: gitea_token
+            - name: R2_ENDPOINT
+              value: https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com
+            - name: R2_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: wp-coordinator-secrets
+                  key: r2_access_key
+            - name: R2_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: wp-coordinator-secrets
+                  key: r2_secret_key
+            - name: R2_BUCKET
+              value: wp-deploys
+            - name: SITES_CONFIG
+              value: /config/sites.yaml
+          volumeMounts:
+            - name: config
+              mountPath: /config
+          resources:
+            requests:
+              memory: 128Mi
+              cpu: 50m
+            limits:
+              memory: 256Mi
+              cpu: 200m
+      volumes:
+        - name: config
+          configMap:
+            name: wp-coordinator-sites

servers/legion/k8s/wp-coordinator/external-secrets.yaml

@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: wp-coordinator-secrets
+  namespace: platform
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: wp-coordinator-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: gitea_token
+      remoteRef:
+        key: secret/data/gitea
+        property: api_token
+    - secretKey: r2_access_key
+      remoteRef:
+        key: secret/data/r2
+        property: access_key_id
+    - secretKey: r2_secret_key
+      remoteRef:
+        key: secret/data/r2
+        property: secret_access_key

servers/legion/k8s/wp-coordinator/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wp-coordinator
+  namespace: platform
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - wp-deploy.neuralplatform.ai
+      secretName: wp-coordinator-tls
+  rules:
+    - host: wp-deploy.neuralplatform.ai
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wp-coordinator
+                port:
+                  number: 8000

servers/legion/k8s/wp-coordinator/rbac.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: wp-coordinator
+  namespace: platform
+---
+# Allow wp-coordinator to exec into pods and list pods in harmonic-wordpress
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: wp-coordinator
+  namespace: harmonic-wordpress
+rules:
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get, list]
+  - apiGroups: [""]
+    resources: [pods/exec]
+    verbs: [create]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: wp-coordinator
+  namespace: harmonic-wordpress
+subjects:
+  - kind: ServiceAccount
+    name: wp-coordinator
+    namespace: platform
+roleRef:
+  kind: Role
+  name: wp-coordinator
+  apiGroup: rbac.authorization.k8s.io