will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
516 Commits 10 Branches 0 Tags
44fc2579e302ffeda1031e6f4c8f2f26ebd9212a
Commit Graph

60 Commits

Author SHA1 Message Date
Will Anderson 93358505fc Harden prod: security, autoscaling, observability, BuildKit CI 
Security:
- Drop ALL capabilities, enforce non-root, RuntimeDefault seccomp on
  neuron-mcp, neuron-rest, neuron-marketing pods
- Add startup probes (150s window for JVM) so liveness doesn't fire early
- Replace docker-sock hostPath with BuildKit rootless TCP endpoint
  (moby/buildkit:v0.19.0-rootless) — removes node root access from CI
- Document full ESO AppRole migration path in cluster-secret-store.yaml

Autoscaling & availability:
- HPAs on mcp (1–6), rest (1–4), marketing (2–8) at 65–70% CPU
- PodDisruptionBudgets (minAvailable: 1) on all three services
- NetworkPolicy: default-deny-all in neuron-prod, explicit allow rules
  for Traefik ingress, intra-namespace, and egress to DNS/platform/vault

Observability:
- ServiceMonitors for mcp, rest, marketing (cross-namespace enabled in
  kube-prometheus-stack with serviceMonitorSelectorNilUsesHelmValues:false)
- PrometheusRules: high error rate, high latency, crash loops, replica
  shortage, Postgres down/connections, backup failure, backup staleness

Chart version pinning:
- kube-prometheus-stack, loki, tempo, redis, alloy, postgres — all pinned
  to major-version ranges to block silent breaking upgrades

Backup hardening:
- restic:latest → restic:0.17.3 (deterministic image)
- Weekly backup-verify CronJob: restores latest snapshot and validates
  SQL dump structure (≥5 CREATE TABLE, pg_dump header check)

ArgoCD:
- neuron-prod AppProject: scopes deploys to neuron-prod + platform ns,
  blacklists ClusterRole/ClusterRoleBinding/Namespace creation,
  automated sync window 2–6am UTC, manual always allowed
 2026-04-25 22:54:18 -05:00
Neuron CI 8de866a8b9 ci(neuron-prod): update rest+license to v0.15.3 2026-04-25 20:06:27 +00:00
Neuron CI 950f00586f ci(neuron-prod): update rest+license to v0.15.2 2026-04-25 19:53:53 +00:00
Neuron CI 8e5320c7b3 ci(neuron-prod): update rest+license to v0.15.1 2026-04-25 19:39:31 +00:00
Neuron CI 14f0663e28 ci(neuron-prod): update rest+license to v0.15.0 2026-04-25 19:20:40 +00:00
Neuron CI 39050bfde4 ci(neuron-prod): update rest+license to v0.14.12 2026-04-25 10:18:30 +00:00
Neuron CI 5c9ea05631 ci(neuron-prod): update rest+license to v0.14.11 2026-04-25 10:08:15 +00:00
Neuron CI 491d00fd1a ci(neuron-prod): update rest+license to v0.14.10 2026-04-25 10:02:23 +00:00
Neuron CI bdd2033d78 ci(neuron-prod): update rest+license to v0.14.9 2026-04-25 09:47:48 +00:00
Neuron CI 2793799532 ci(neuron-prod): update rest+license to v0.14.8 2026-04-25 09:14:24 +00:00
Neuron CI 1ee6dc2804 ci(neuron-prod): update rest+license to v0.14.7 2026-04-25 09:08:20 +00:00
Neuron CI 8d0faae070 ci(neuron-prod): update rest+license to v0.14.6 2026-04-25 09:03:36 +00:00
Neuron CI 1edcbeaed3 ci(neuron-prod): update rest+license to v0.14.5 2026-04-25 08:50:36 +00:00
Neuron CI a0961004e7 ci(neuron-prod): update rest+license to v0.14.4 2026-04-25 08:36:19 +00:00
Neuron CI cfa38013c6 ci(neuron-prod): update rest+license to v0.14.3 2026-04-25 08:20:20 +00:00
Neuron CI 7cbcb9e8c2 ci(neuron-prod): update rest+license to v0.14.2 2026-04-25 07:59:18 +00:00
Neuron CI f831da7f17 ci(neuron-prod): deploy neuron@v0.13.1 2026-04-25 06:44:48 +00:00
Neuron CI 11e9962431 ci(neuron-prod): deploy neuron@v0.12.2 2026-04-25 06:25:49 +00:00
Neuron CI c76eb09aa5 ci(neuron-prod): deploy neuron@v0.12.1 2026-04-25 06:11:44 +00:00
Neuron CI 5ff525e1c8 ci(neuron-prod): deploy neuron@v0.12.0 2026-04-25 05:50:26 +00:00
Neuron CI ec66233644 ci(neuron-prod): deploy neuron@v0.11.1 2026-04-25 05:33:25 +00:00
Neuron CI abf3453d8d ci(neuron-prod): deploy neuron@v0.10.0 2026-04-25 04:53:36 +00:00
Neuron CI c9ffa55863 ci(neuron-prod): deploy neuron@v0.9.1 2026-04-25 03:35:33 +00:00
Neuron CI 67de9ac463 ci(neuron-prod): deploy neuron@v0.9.0 2026-04-25 03:17:56 +00:00
Neuron CI b411f2a7b0 ci(neuron-prod): deploy neuron@v0.8.3 2026-04-25 01:35:26 +00:00
Neuron CI 719c66ea82 ci(neuron-prod): deploy neuron@v0.8.2 2026-04-25 01:13:52 +00:00
Neuron CI 6160e8e6b8 ci(neuron-prod): deploy neuron@v0.8.1 2026-04-25 00:57:54 +00:00
Neuron CI af8a178b8c ci(neuron-prod): deploy neuron@v0.8.0 2026-04-25 00:36:02 +00:00
Neuron CI cc489e4047 ci(neuron-prod): deploy neuron@v0.7.7 2026-04-25 00:22:52 +00:00
Neuron CI 851e64a561 ci(neuron-prod): deploy neuron@v0.7.6 2026-04-24 23:22:38 +00:00
Neuron CI cf6f390756 ci(neuron-prod): deploy neuron@v0.7.5 2026-04-24 22:26:03 +00:00
Neuron CI 2befcc088a ci(neuron-prod): deploy neuron@v0.7.4 2026-04-24 22:07:54 +00:00
Neuron CI b36de8190e ci(neuron-prod): deploy neuron@v0.7.3 2026-04-24 21:59:07 +00:00
Neuron CI 060995e762 ci(neuron-prod): deploy neuron@v0.7.2 2026-04-24 21:26:01 +00:00
Neuron CI 2a0011c479 ci(neuron-prod): deploy neuron@v0.7.1 2026-04-24 20:57:42 +00:00
Neuron CI 477af9b673 ci(neuron-prod): deploy neuron@v0.7.0 2026-04-24 18:32:40 +00:00
Neuron CI befbc006be ci(neuron-prod): deploy neuron@v0.6.1 2026-04-24 17:35:59 +00:00
Neuron CI 5eb18b6e7c ci(neuron-prod): deploy neuron@v0.6.0 2026-04-24 17:20:57 +00:00
Neuron CI fb17a37bea ci(neuron-prod): deploy neuron@v0.5.0 2026-04-24 15:42:48 +00:00
Neuron CI 6f349a21b9 ci(neuron-prod): deploy neuron@v0.4.4 2026-04-24 12:44:46 +00:00
Neuron CI 8e27d7e069 ci(neuron-prod): deploy neuron@v0.4.3 2026-04-24 12:05:43 +00:00
Neuron CI 5f99d10839 ci(neuron-prod): deploy neuron@v0.4.2 2026-04-24 11:47:42 +00:00
Neuron CI ec2ee48ae5 ci(neuron-prod): deploy neuron@v0.4.1 2026-04-24 11:42:27 +00:00
Neuron CI 0f77faea81 ci(neuron-prod): deploy neuron@v0.4.0 2026-04-24 10:22:56 +00:00
Will Anderson add9d92fd0 chore(neuron-prod): restart pods to pick up NEURON_DATA_DIR configmap change 2026-04-24 04:57:11 -05:00
Will Anderson 883c4afd50 ci(neuron-prod): restart mcp and rest pods to reload DB state 2026-04-24 04:47:33 -05:00
Neuron CI 87d11aa87c ci(neuron-prod): deploy neuron@v0.3.2 2026-04-24 09:21:57 +00:00
Neuron CI 129dd0d606 ci(neuron-prod): deploy neuron@v0.3.1 2026-04-24 08:58:38 +00:00
Neuron CI d66062b4cc ci(neuron-prod): deploy neuron@v0.3.0 2026-04-24 08:12:04 +00:00
Neuron CI 7a47e0cbf9 ci(neuron-prod): deploy neuron@v0.2.0 2026-04-24 08:04:37 +00:00