rock
b6e317b34c
Adds the pi coding-agent sandbox's cluster side: - `k8s/infra/poimen/pi-agent-workspace-pv.yaml` — static hostPath PV + PVC for the sandbox /workspace (Longhorn cannot attach new volumes in this cluster; this gives real persistence and survived a pod delete/recreate test: marker file + 38 KB session.jsonl intact, the session answered from its own history afterwards). - `k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml` — the sandbox's API-key Secret, SOPS-encrypted (recipient from .sops.yaml, payload only: `encrypted_regex ^(data|stringData)$`), registered in the ksops generator. Round-trip verified against the live Secret. - `terraform/files/coredns/Corefile` — `rewrite name pi.riotpiao.com ingress-nginx-controller...` so the hostname resolves in-cluster. Note: the keys currently in that Secret are the ones leaked earlier and must be rotated; re-encrypt with `sops -e -i` after rotating.Reviewed-on: #54 Co-authored-by: rock <[email protected]>
13 lines
450 B
YAML
13 lines
450 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# Poimen infrastructure — CNPG Postgres for memory service.
|
|
# Part of the `poimen` ArgoCD Application (multi-source, source 3).
|
|
# Sync-wave -1 ensures the DB cluster is healthy before application
|
|
# deployments (wave 0) are applied.
|
|
resources:
|
|
- memory-db.yaml
|
|
- poimen-sandbox-namespace.yaml
|
|
- poimen-sandbox-quota.yaml
|
|
- pi-session-netpol.yaml
|
|
- pi-agent-workspace-pv.yaml
|