Documentation
← Welcome · Quick start
In-depth docs pages:
| Page | What's in it |
|---|---|
| Cluster login | The clusters, their ArgoCD UIs, login commands, and kubeconfigs. |
| Secrets & encryption | Your personal age key, .sops.yaml, editing encrypted files, using secrets in manifests. |
| Storage | Persistent volumes (PVCs), storage classes, S3 buckets, and backups. |
| Resource quotas | Your namespace's CPU/memory/storage limits, checking usage, requesting more. |
| Cluster policies | Which resource kinds you can create, and the workload hardening every pod must comply with. |
| Network policies | Namespace isolation, what's reachable out of the box, and requesting exceptions. |
| Availability | Surviving node reboots and drains: replicas, spread, graceful stop, the safe PDB shape. |
| Logs | Where your pods' usage data and logs go (Grafana), how to search them, tips. |
Who manages what
The split follows one simple rule:
- You own everything inside your namespace that defines your app - commit it to your repo and ArgoCD syncs it. No tickets, no waiting.
- The platform owns the namespace boundary and everything cluster-wide - you request these by opening a ticket.
| Resource / concern | Who | Notes |
|---|---|---|
| Workloads - Deployment, StatefulSet, DaemonSet, ReplicaSet, Job, CronJob | You | The pods that run your app. |
| Service (ClusterIP) | You | In-cluster address for your pods. |
| Ingress / HTTPRoute | You | Public hostname + HTTPS. Consumes platform DNS, the TLS issuer, and the ingress controller. |
| ConfigMap | You | Non-secret configuration. |
| Secret (SOPS-encrypted) | You | Encrypt with SOPS before committing - never commit plaintext. See Secrets & encryption. |
| PersistentVolumeClaim | You | Durable storage. See Storage. |
| ServiceAccount | You | The account is yours; its RBAC (Role/RoleBinding) is platform-managed. |
| HorizontalPodAutoscaler | You | Autoscale your workload. |
| PodDisruptionBudget | You | Protect availability during disruptions. |
| Namespace + resource quotas | Platform | Created when you're onboarded. See Resource quotas. |
| RBAC - Roles, RoleBindings, anything cluster-scoped | Platform | You can't create RBAC yourself, even namespace-scoped. See Cluster policies. |
| Deploy access (who may push to the cluster) | Platform | Tied to your access group. Add/remove people via ticket. |
| NetworkPolicies, cross-namespace or external-ingress exceptions | Platform | Namespaces are isolated and deny-by-default. See Network policies. |
| External / LoadBalancer IPs, custom L2 address pools | Platform | For traffic that bypasses the shared ingress. See Network policies. |
| DNS names, TLS issuers, ingress controller | Platform | You consume these from your Ingress; the platform operates them. |
| StorageClasses | Platform | Two are available - pick one in your PVC. See Storage. |
| Any cluster-scoped resource or platform add-on | Platform | Namespaces, CRDs, controllers, operators, etc. |