Infrastructure

Hardware and software systems powering VIRDX work and R&D: the Kubernetes cluster (Argo Workflows, Tekton, Kyverno), image registry, CI/CD, and the plumbing behind the data platform.

SOPs (read first)

See sops/ — grouped by cluster operations, vxData, and apps/packaging. Highest-value entry points:

• Executing jobs / images / runs on the cluster — pathways (kuberun, per-job Argo templates, raw Argo, off-the-shelf images), build systems, and the identity/label gotchas.
• vxData production DB restore + cluster storage gotchas — the production contract plus every cluster trap worth knowing before you deploy something new.
• vxData SDK + schema model and vxData jobs ingestion patterns — read both before writing anything against vxData.
• PHI-safe data handling — read before profiling or exporting platform content.

Access control

vxData access control (supersedes mono#90/#49) ships in two layers:

• v1, shipped: static bearer tokens only (API_PRINCIPALS config), policy-scoped reads/writes in api/access.py / api/auth.py. Read scoping is baked into build_query_statement (parquet-safe); write gating declares payload_type on upload presigns. NULL license/access_level fails closed.
• Keycloak/JWT hybrid, designed + built, deliberately parked (closed draft PRs, branches kept — reopening is “rebase”, not “redesign”). See vxData Keycloak/JWT extension (parked) for the full design and the exact PRs/order to reopen.

Notes

• vxData Keycloak/JWT extension (parked)
• Self-hosted LLM inference (historical) — the ollama deployment is gone; what remains is one concurrency-tuning result.

Related

• Agent skill argo-workflow-guide — low-level Argo/Kyverno mechanics.