mNi installation

This repository defines the complete mNi production control plane. Each top-level directory under config/ owns one service responsibility and keeps its controller, UI, and service-specific infrastructure in child Kustomizations. The child boundary is intentional: upstream manifests commonly use generic image names such as controller:latest, so image transforms must not leak into sibling components.

Responsibilities

• platform: cert-manager, dependency-controller, and the shared Kata Helm values.
• auth: Anchorage, auth-controller, and auth-ui.
• api-gateway: api-gateway.
• vpc: Juneau, vpc-controller, and vpc-ui.
• bs: bs-controller and bs-ui.
• vm: KubeVirt, CDI, snapshot-controller, vm-controller, and vm-ui.
• ctr: ctr-controller and ctr-ui. Uses the shared Kata runtime.
• vpn: Kodiak, vpn-controller, and vpn-ui.
• cs: cs-controller and cs-ui. Uses the shared Kata runtime.
• lb: Envoy Gateway, lb-controller, lb-ui, and GatewayClass.
• k8s: Cluster API, Kamaji/CAPK, CAAPH, CAPMNI, CAA, k8s-controller, and k8s-ui. Serverless workers use the shared Kata runtime.
• bootstrap: CRs that must be applied after their owning CRDs/controllers.

config/default renders every Kustomize-managed service. Helm-managed Kata, Envoy Gateway, and Kamaji are represented by Argo CD Applications.

Argo CD

Install the pinned Argo CD release, wait for it to become ready, and register the Applications:

kubectl apply -k argocd/install
kubectl -n argocd rollout status deployment/argocd-server --timeout=10m
kubectl -n argocd rollout status statefulset/argocd-application-controller --timeout=10m
kubectl apply -k argocd

No Application has syncPolicy.automated; registering or updating an Application does not deploy workloads. Argo CD only calculates and displays the desired/live diff.

To deploy all services explicitly and wait for each dependency to become Healthy before continuing:

./argocd/sync.sh

The same Applications can be synced individually from the Argo CD UI. Keep the order used by sync.sh when upgrading platform or service dependencies.

Application sources track v2/main. For validation before merge, temporarily change targetRevision to the test branch and restore it before merging.

Cluster-specific inputs

This public repository is an environment-neutral base. It intentionally does not contain cluster host names, CORS origins, OAuth clients, certificates, BGP peers, SMTP settings, storage choices, or credentials. A deployment repository should reference an immutable commit of this repository from a cluster-specific Kustomize overlay and point its Argo CD Applications at that overlay.

Do not sync the reference Applications in argocd/applications into a production cluster without first supplying the cluster-specific configuration. They point directly at the environment-neutral bases and are provided for development, validation, and as templates for deployment repositories.

Secrets must not be committed in plaintext, including to a private deployment repository. Keep them in an external secret store, encrypt them for GitOps, or bootstrap them directly in the cluster.

Managed Kubernetes additionally requires the kamaji-system/management-kubeconfig Secret with kubeconfig data in the value key. Kata nodes must be labeled mnicloud.jp/kata=true and provide hardware virtualization.