---
title: "Infrastructure"
description: "Hardware and software systems powering VIRDX work and R&D — cluster, CI/CD, data platform plumbing."
image: "https://docs.virdx.dev/img/virdx-social-card.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.virdx.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Infrastructure

Hardware and software systems powering VIRDX work and R&D: the Kubernetes
cluster (Argo Workflows, Tekton, Kyverno), image registry, CI/CD, and the
plumbing behind the data platform.

## SOPs (read first)

See [sops/](/knowledge/wiki/workstreams/infrastructure/sops) — grouped by cluster operations, vxData, and
apps/packaging. Highest-value entry points:

- [Executing jobs / images / runs on the cluster](/knowledge/wiki/workstreams/infrastructure/sops/executing-jobs-on-the-cluster)
  — pathways (kuberun, per-job Argo templates, raw Argo, off-the-shelf
  images), build systems, and the identity/label gotchas.
- [vxData production DB restore + cluster storage gotchas](/knowledge/wiki/workstreams/infrastructure/sops/vxdata-db-restore-and-cluster-gotchas)
  — the production contract plus every cluster trap worth knowing before you
  deploy something new.
- [vxData SDK + schema model](/knowledge/wiki/workstreams/infrastructure/sops/vxdata-sdk-and-schema-model) and
  [vxData jobs ingestion patterns](/knowledge/wiki/workstreams/infrastructure/sops/vxdata-jobs-ingestion) — read both
  before writing anything against vxData.
- [PHI-safe data handling](/knowledge/wiki/workstreams/infrastructure/sops/phi-safe-data-handling) — read before
  profiling or exporting platform content.

## Access control

vxData access control (supersedes mono#90/#49) ships in two layers:

- **v1, shipped**: static bearer tokens only (`API_PRINCIPALS` config),
  policy-scoped reads/writes in `api/access.py` / `api/auth.py`. Read
  scoping is baked into `build_query_statement` (parquet-safe); write gating
  declares `payload_type` on upload presigns. `NULL` license/access_level
  fails closed.
- **Keycloak/JWT hybrid, designed + built, deliberately parked** (closed
  draft PRs, branches kept — reopening is "rebase", not "redesign"). See
  [vxData Keycloak/JWT extension (parked)](/knowledge/wiki/workstreams/infrastructure/vxdata-keycloak-extension) for
  the full design and the exact PRs/order to reopen.

## Notes

- [vxData Keycloak/JWT extension (parked)](/knowledge/wiki/workstreams/infrastructure/vxdata-keycloak-extension)
- [Self-hosted LLM inference (historical)](/knowledge/wiki/workstreams/infrastructure/self-hosted-inference) — the
  `ollama` deployment is gone; what remains is one concurrency-tuning result.

## Related

- Agent skill `argo-workflow-guide` — low-level Argo/Kyverno mechanics.

Source: https://docs.virdx.dev/knowledge/wiki/workstreams/infrastructure/index.mdx