fix ci-base: install Node 20 via binary tarball instead of nodesource apt

nodesource setup_20.x on Ubuntu 24.04 installs Ubuntu's nodejs 18 (no npm) instead of Node 20. Binary tarball is reliable and includes npm.
fix: drop bogus letsencrypt certResolver from dharma IngressRoute
2026-05-04 15:48:12 -05:00 · 2026-05-04 14:37:32 -05:00
2 changed files with 1 additions and 32 deletions
@@ -82,12 +82,7 @@ spec:
    apiVersion: apps/v1
    kind: Deployment
    name: neuron-marketing
-  # minReplicas=1 to match the file's own convention (see header comment).
+  minReplicas: 0
  # Kubernetes only allows minReplicas=0 when at least one Object or External
  # metric is configured (queue depth, custom signal, etc.); with only a
  # Resource (CPU) metric, scale-to-zero is rejected and the whole HPA is
  # invalid — which was blocking neuron-prod's Argo CD sync.
  minReplicas: 1
  maxReplicas: 8
  metrics:
    - type: Resource
@@ -117,32 +117,6 @@ spec:
            matchLabels:
              kubernetes.io/metadata.name: neuron-prod
 ---
 # ── dharma: accept from Traefik (kube-system) and neuron-prod namespace ──────
 # The dharma pod was healthy and the IngressRoute was correct, but cross-
 # namespace ingress from kube-system (Traefik) was denied by default-deny-all,
 # so every external request landed at Traefik and bounced back as 502. This
 # allow rule mirrors `allow-mcp-ingress` and brings dharma into line with the
 # other neuron-prod services.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: allow-dharma-ingress
  namespace: neuron-prod
 spec:
  podSelector:
    matchLabels:
      app: dharma
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: neuron-prod
 ---
 # ── Egress: all prod pods may reach platform (postgres/redis), vault,
 #            monitoring (alloy OTLP), kube-dns, and the internet (external APIs) ─
 apiVersion: networking.k8s.io/v1