23a122607d
- Argo workflow archive via PostgreSQL — persistent logs after pod GC - Allow Argo controller to reach PostgreSQL via network policy - Allow Argo server to reach MinIO for S3 log archival - Replace foxhunt-runtime with lightweight images (alpine:3.21, curlimages/curl) in orchestration steps: fetch-binary, upload-results, detect-changes, gpu-warmup - Use ci-builder for training steps (hyperopt, train-best, evaluate) — nvcc required - Fix --hyperopt-results → --hyperopt-params flag in train-best step - Remove invalid podGCGracePeriod from Argo Helm values - Archive RBAC, kustomization updates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
35 lines
872 B
YAML
35 lines
872 B
YAML
# RBAC for Argo workflow archive — grants controller and server access
|
|
# to the PostgreSQL archive secret and MinIO credentials.
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: argo-archive-secrets
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: argo-workflows
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
resourceNames: ["argo-postgres-config", "minio-credentials"]
|
|
verbs: ["get"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: argo-archive-secrets
|
|
namespace: foxhunt
|
|
labels:
|
|
app.kubernetes.io/part-of: argo-workflows
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: argo-archive-secrets
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: argo-workflows-workflow-controller
|
|
namespace: foxhunt
|
|
- kind: ServiceAccount
|
|
name: argo-workflows-server
|
|
namespace: foxhunt
|