GitOps configuration for EKS cluster addons, managed by ArgoCD. The EKS ArgoCD addon catalog for the nanohype platform.
AI clients / agents start here: AGENTS.md. For the stack-wide view, see the Platform Reference.
- App-of-Apps pattern with ArgoCD ApplicationSets for multi-cluster deployment
- ArgoCD multi-source Helm values — base values with flat environment-specific deltas
- Matrix generators — environment selection from cluster secret labels
- Sync wave ordering — deterministic deployment order across addon categories
- Three environments — development, staging, production with appropriate sizing and policies
- CI validation — automated YAML lint and Kustomize build on every PR
This repository is the EKS ArgoCD addon catalog. Infrastructure is provisioned by landing-zone (OpenTofu/Terragrunt), which deploys ArgoCD and creates the App-of-Apps Application pointing to this repository.
This catalog is vended: you fork it, point your own hub at your fork, and your edits take effect. No source changes are needed to repoint it.
How it works. Every applied ApplicationSet reads its Git source from the cluster, not a hardcoded URL:
repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'cluster-bootstrap (in landing-zone) stamps gitops/repo-url on the ArgoCD cluster Secret. Set it to your fork and every Application follows. A CI gate (Fork-safety gate, scripts/check-hardcoded-org.py --blocking) fails the build if a catalog repoURL is ever hardcoded — a hardcoded ref would silently keep a fork syncing from upstream while its own edits sat unread.
Intentionally NOT templated — these are consumed, not forked, so they correctly point at upstream:
nanohype/eks-agent-platform— the operator's own source/chart. You consume the product; you don't fork it.ghcr.io/nanohype/*images andoci://charts — pulled like any registry.- The Kyverno keyless-signing identity (
subjectRegExp) — a signing identity to verify against, not a source to sync from. - Everything under
applicationsets/opt-in/— not applied by a default install; its org-specific URLs are a documented repoint-before-enabling step (seeapplicationsets/opt-in/README.md).
To fork: fork this repo → set gitops/repo-url on your cluster Secret (via landing-zone) to your fork → optionally repoint the opt-in/ appsets if you enable them.
┌─────────────────────────────────────────────────────────────────────┐
│ ArgoCD (deployed by landing-zone) │
├─────────────────────────────────────────────────────────────────────┤
│ App-of-Apps Application │
│ (points to this repository) │
└─────────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────┐
│ ApplicationSets │
├─────────────────────────────────────────────────────────────────────┤
│ ├── addons-bootstrap (cert-manager, external-secrets, ...) │
│ ├── addons-bootstrap-kustomize (storage-classes, priority-classes) │
│ ├── addons-networking (Cilium, ALB Controller, External DNS) │
│ ├── addons-security (Kyverno, Trivy, Falco) │
│ ├── addons-observability (Loki, Tempo, Alloy, OpenCost) │
│ ├── addons-operations-helm (Velero, VPA, Goldilocks, ...) │
│ ├── addons-operations-kustomize (Karpenter Resources) │
│ ├── addons-accelerators-helm (gpu-operator, nvidia-dra) │
│ ├── addons-accelerators-kustomize (aws-neuron-device-plugin) │
│ ├── addons-argo-platform (Rollouts, Events, Workflows) │
│ ├── addons-ai-platform (kagent, agentgateway, operator) │
│ ├── kyverno-policies (PSS, Best Practices) │
│ └── druid-tenants │
└─────────────────────────────────────────────────────────────────────┘
eks-gitops/
├── applicationsets/ # ArgoCD ApplicationSets
│ ├── addons-bootstrap.yaml
│ ├── addons-bootstrap-kustomize.yaml
│ ├── addons-networking.yaml
│ ├── addons-security.yaml
│ ├── addons-observability.yaml
│ ├── addons-operations-helm.yaml
│ ├── addons-operations-kustomize.yaml
│ ├── addons-accelerators-helm.yaml
│ ├── addons-accelerators-kustomize.yaml
│ ├── addons-argo-platform.yaml
│ ├── addons-ai-platform.yaml
│ ├── kyverno-policies.yaml
│ └── druid-tenants.yaml
│
├── addons/ # Addon configurations
│ ├── bootstrap/{cert-manager,external-secrets,metrics-server,
│ │ prometheus-operator-crds,reloader,storage-classes,
│ │ priority-classes}/
│ ├── networking/{cilium,aws-load-balancer-controller,external-dns}/
│ ├── security/{kyverno,trivy-operator,falco}/
│ ├── observability/{loki,tempo,alloy,opencost}/
│ ├── operations/{velero,vpa,goldilocks,descheduler,karpenter,
│ │ karpenter-resources,keda}/
│ ├── accelerators/{gpu-operator,nvidia-dra-driver,aws-neuron-device-plugin}/
│ ├── argo-platform/{argo-rollouts,argo-events,argo-workflows}/
│ └── ai-platform/{kagent,kagent-crds,agentgateway,agentgateway-crds,operator}/
│
├── policies/ # Kyverno policies (pure Kustomize)
│ └── kyverno/{pod-security-standards,best-practices}/
│
├── environments/ # Cluster-config ConfigMaps
│ ├── development/
│ ├── staging/
│ └── production/
│
├── catalog/ # Platform-specific workloads
│ └── druid/
│
└── docs/ # Documentation
| Wave | Components | Rationale |
|---|---|---|
| -1 | App-of-Apps | Root application |
| 0 | Bootstrap Helm (cert-manager, external-secrets, prometheus-operator-crds) | Foundational CRDs |
| 1 | Networking (Cilium, ALB Controller, External DNS); Secret Stores (ClusterSecretStores) | CNI/ingress + secret backends |
| 2 | Bootstrap continued (metrics-server, reloader, storage-classes, priority-classes) | Cluster essentials |
| 5 | Karpenter | Nodes must be ready before workloads |
| 6 | Accelerators (gpu-operator, aws-neuron-device-plugin, nvidia-dra-driver) | GPU/Neuron device plugins advertised before workloads |
| 10 | Security (Kyverno, Trivy, Falco) | Policy engine before policies |
| 20 | Kyverno Policies | After Kyverno is ready |
| 21 | Agent Operator (eks-agent-platform) | Operator + CRDs before the agent platform consumes them |
| 30 | Observability (Loki, Tempo, Alloy), Gateway API CRDs; OpenCost (33) | After security |
| 40 | AI Platform (kagent, agentgateway); Operations (Velero, VPA, Goldilocks, Descheduler, KEDA) | After operator + observability |
| 42 | Operations kustomize (Karpenter Resources) | After operations Helm |
| 44 | Agent Platform CRs | After the AI-platform runtime is up |
| 50 | Argo Platform (Rollouts, Events, Workflows); Druid tenants | Application layer |
| 60 | Dashboards | After the systems they chart exist |
| Setting | Development | Staging | Production |
|---|---|---|---|
| Replicas | 1 | 2-3 | 2-3 |
| Kyverno Mode | Audit | Enforce | Enforce |
| Velero | Disabled | Enabled | Enabled |
| Karpenter CPU | 50 | 75 | 200 |
| Loki Retention | 7d | 14d | 90d |
| Falco Memory Limit | 1Gi | 2Gi | 4Gi |
Tools required for local development:
Infrastructure prerequisites (deployed by landing-zone):
- ArgoCD and App-of-Apps root Application
- EKS cluster with IRSA and cluster secret labels
task # Show all available tasks
task lint:yaml # Lint all YAML files
task kustomize:build # Build all overlays (all environments)
task kustomize:build:env # Build overlays for ENVIRONMENT (default: development)
task validate # Run all validations (lint + build)
task render # Render manifests to rendered/ directory
task clean # Remove rendered output