Migrate all app deployments from Terraform to Argo CD

Move gitea, github-runner, neuron, cloudflared, ollama, verdaccio, devpi, registry, and registry-ui deployments+services to apps/*.yaml so Argo CD manages the app layer. Terraform retains namespaces, PVCs, ConfigMaps, Secrets, and Ingresses. New Secrets in Terraform: - kubernetes_secret.github_runner_secret (ci/github-runner-secret) - kubernetes_secret.cloudflared_secret (neuron/cloudflared-secret) Hardcoded service names in ingress.tf and neuron.tf to remove dependency on removed kubernetes_service resources.
2026-03-23 08:15:17 -05:00
parent b2b04c231c
commit afe01d2ad9
13 changed files with 588 additions and 885 deletions
@@ -0,0 +1,132 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: neuron
+  namespace: neuron
+  labels:
+    app: neuron
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: neuron
+  template:
+    metadata:
+      labels:
+        app: neuron
+    spec:
+      containers:
+        - name: neuron
+          image: registry.nook.family/neural-platform/neuron:latest
+          imagePullPolicy: Always
+          command:
+            - bash
+            - -c
+            - mkdir -p /root/.neuron && ln -sf /data/neuron.db /root/.neuron/neuron.db && python -m synapse platform serve --mcp-host 0.0.0.0 --mcp-port 8001 --webhook-port 3847
+          ports:
+            - name: mcp
+              containerPort: 8001
+            - name: webhook
+              containerPort: 3847
+          envFrom:
+            - configMapRef:
+                name: neuron-config
+            - secretRef:
+                name: neuron-secrets
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: app-config
+              mountPath: /app/config/default.yaml
+              subPath: default.yaml
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 100m
+            limits:
+              memory: 1Gi
+              cpu: 500m
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: mcp
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: mcp
+            initialDelaySeconds: 5
+            periodSeconds: 10
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: neuron-data
+        - name: app-config
+          configMap:
+            name: neuron-config
+            items:
+              - key: default.yaml
+                path: default.yaml
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: neuron
+  namespace: neuron
+spec:
+  selector:
+    app: neuron
+  ports:
+    - name: mcp
+      port: 8001
+      targetPort: 8001
+    - name: webhook
+      port: 3847
+      targetPort: 3847
+  type: ClusterIP
+---
+# cloudflared — Cloudflare tunnel for external Axon webhook access
+# Routes: axon.neuralplatform.ai → neuron:3847
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cloudflared
+  namespace: neuron
+  labels:
+    app: cloudflared
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cloudflared
+  template:
+    metadata:
+      labels:
+        app: cloudflared
+    spec:
+      containers:
+        - name: cloudflared
+          image: cloudflare/cloudflared:latest
+          args: ["tunnel", "--no-autoupdate", "run"]
+          env:
+            - name: TUNNEL_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: cloudflared-secret
+                  key: TUNNEL_TOKEN
+          resources:
+            requests:
+              memory: 64Mi
+              cpu: 50m
+            limits:
+              memory: 128Mi
+              cpu: 200m
+          livenessProbe:
+            httpGet:
+              path: /ready
+              port: 20241
+            initialDelaySeconds: 10
+            periodSeconds: 30