Applications

Workloads that serve Tomoda traffic. Lives in k8s/apps/<name>/ as a Kustomize base plus per-environment overlays (dev, prod). The dev and prod Argo CD Applications point at the overlay path for their tier and reconcile the rendered Kustomize output into the cluster.

The pattern is the same in every case:

• Base — environment-neutral manifests (Deployments, Services, Ingress, NetworkPolicies). Image refs use the dev Artifact Registry path; prod overlays rewrite them.
• Overlay — namespace assignment, ExternalSecret pulls from GSM/AWS SM, ConfigMap with the env-specific DSNs, image rewrites, ingress hostnames, and any production-only resources (PDBs, stricter imagePullPolicy).
• Argo CD Application — points at the overlay directory. See Argo CD.

Tenant-scoped only

This section covers tenant workloads (Tomoda). Platform-tier singletons that aren't tenant code — Photon, oauth2-proxy, Traefik, etc. — live under Platform services.

• Tomoda

  ---

  The product — Go backend (tomoda-api for HTTP + WS, tomoda-async for worker + scheduler) and Expo/React frontend. Kustomize base under k8s/apps/tomoda/, deployed into tomoda (dev) and prod.

• Tomoda — WS pool split (planned)

  ---

  Design doc for splitting the WebSocket pool out of tomoda-api into its own Deployment so HTTP and WS pods can scale independently.