Will Anderson
55a38bb693
Legion hardware died April 27, 2026. New GCP k3s instance at 104.197.5.199. Gitea now at gitea.git.svc.cluster.local:3000 within cluster.
90 lines
2.4 KiB
YAML
90 lines
2.4 KiB
YAML
---
|
|
# ArgoCD AppProject — neuron-prod
|
|
# Restricts which repos can deploy to which namespaces.
|
|
# Prevents misconfigured apps from deploying cluster-admin RBAC or
|
|
# accidentally targeting personal/hobby namespaces.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: AppProject
|
|
metadata:
|
|
name: neuron-prod
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
description: "Neuron Technologies production services"
|
|
|
|
# Only allow deployments sourced from the infrastructure repo.
|
|
sourceRepos:
|
|
- "http://gitea.git.svc.cluster.local:3000/will/infrastructure.git"
|
|
- "https://code.forgejo.org"
|
|
- "registry.neuralplatform.ai"
|
|
|
|
# Only allow deploying to neuron-prod and platform namespaces.
|
|
destinations:
|
|
- server: https://kubernetes.default.svc
|
|
namespace: neuron-prod
|
|
- server: https://kubernetes.default.svc
|
|
namespace: platform
|
|
|
|
# Cluster-scoped resources this project may NOT create.
|
|
clusterResourceBlacklist:
|
|
- group: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
- group: rbac.authorization.k8s.io
|
|
kind: ClusterRoleBinding
|
|
- group: ""
|
|
kind: Namespace
|
|
|
|
# Namespace-scoped resources this project may create.
|
|
namespaceResourceWhitelist:
|
|
- group: "apps"
|
|
kind: Deployment
|
|
- group: "apps"
|
|
kind: ReplicaSet
|
|
- group: "batch"
|
|
kind: CronJob
|
|
- group: "batch"
|
|
kind: Job
|
|
- group: ""
|
|
kind: Service
|
|
- group: ""
|
|
kind: ConfigMap
|
|
- group: ""
|
|
kind: Secret
|
|
- group: ""
|
|
kind: PersistentVolumeClaim
|
|
- group: ""
|
|
kind: ServiceAccount
|
|
- group: "networking.k8s.io"
|
|
kind: Ingress
|
|
- group: "networking.k8s.io"
|
|
kind: NetworkPolicy
|
|
- group: "policy"
|
|
kind: PodDisruptionBudget
|
|
- group: "autoscaling"
|
|
kind: HorizontalPodAutoscaler
|
|
- group: "traefik.io"
|
|
kind: IngressRoute
|
|
- group: "external-secrets.io"
|
|
kind: ExternalSecret
|
|
- group: "monitoring.coreos.com"
|
|
kind: ServiceMonitor
|
|
- group: "monitoring.coreos.com"
|
|
kind: PrometheusRule
|
|
|
|
# Sync windows: only allow automated syncs during low-traffic hours.
|
|
# Manual syncs allowed any time.
|
|
syncWindows:
|
|
- kind: allow
|
|
schedule: "0 2-6 * * *" # 2am-6am UTC (off-peak)
|
|
duration: 4h
|
|
applications:
|
|
- "*"
|
|
manualSync: true
|
|
- kind: allow
|
|
schedule: "* * * * *"
|
|
duration: "1m"
|
|
manualSync: true # Always allow manual deploys
|
|
applications:
|
|
- "*"
|