Skip to content

Kubernetes

Tomoda runs on a single GKE cluster (gke-tomoda in us-central1-a). Dev and prod are namespaces in the same control plane, not separate clusters. The full three-tier story (platform / dev / prod, what's shared vs split, sizing) lives in Overview → Environments — read that first if you need the why.

This section is the operator entry point for the how: what gets deployed, where it lives in the repo, and which Argo CD Application owns it.

Namespace layout

tomoda ns dev tenant
prod ns prod tenant
↘   ↙ name-segregated
data ns shared — postgres-{dev,prod}, redis-{dev,prod}
Two tenants in one cluster, sharing the data namespace. Platform services (argocd, traefik, cert-manager, monitoring, …) sit alongside; they're documented under Platform services.

Same cluster, two tenants

tomoda runs the dev build; prod runs the production build. Both tenants share Traefik, cert-manager, monitoring, and Photon. Postgres and Redis are duplicated by name in the shared data namespace (postgres-dev vs postgres-prod, redis vs redis-prod) so a dev workload can't degrade prod's queue depth.

Bootstrap

One file kicks off the entire cluster:

kubectl apply -f k8s/envs/bootstrap.yaml

It creates three Argo CD Applications — platform, dev, prod — each recursing into the matching directory under k8s/envs/. After that, Argo CD owns reconciliation; don't kubectl apply anything else by hand. See Argo CD for the sync workflow, Image Updater config, and OAuth gating on the UI.

How to navigate this section

  • Argo CD

    GitOps control plane. Bootstrap manifest, Application CRs, sync workflow, Image Updater, OAuth on the UI.

  • Apps

    The tomoda workload (Go backend + Expo frontend) and the platform-tier singletons (Photon, photon-indexer). Kustomize bases under k8s/apps/<name>/.

  • Middleware

    Stateful tenant data plane in the data namespace: Postgres (CNPG), Redis, pgAdmin, RedisInsight. One instance per tenant, separated by name.

  • System

    Cluster-wide infrastructure: Traefik, cert-manager, External-DNS, ESO, oauth2-proxy, kube-prometheus-stack, Loki, Tempo. Installed once via the platform Argo Application.

Reading the repo

Repo path What lives there
k8s/envs/bootstrap.yaml App-of-apps root. Creates the platform, dev, and prod Argo Applications.
k8s/envs/platform/<service>/ One subfolder per system service (Traefik, cert-manager, monitoring, Photon, etc.). Each contains an application.yaml and, where relevant, a values.yaml.
k8s/envs/dev/<service>/ Dev tenant data plane: postgres-dev, redis, pgadmin, redis-insight, plus the tomoda Argo Application pointing at the dev overlay.
k8s/envs/prod/<service>/ Prod tenant data plane: postgres-prod, redis-prod, pgadmin, redis-insight, plus the tomoda Argo Application pointing at the prod overlay.
k8s/apps/tomoda/{base,overlays/{dev,prod}}/ The tomoda app itself. Base is env-neutral; overlays do namespace assignment, image rewrites, secrets, and ingress hosts. Referenced by the env-tier Argo Applications.

Cluster provisioning itself (node pools, networking, Workload Identity) is in Infrastructure → GCP → GKE.