Deliver the Kubernetes configuration of Cisco Secure AI Datacenter through Argo CD. This repository holds cluster selections, application resources and Helm charts for networking, storage, observability and nested Kubernetes: tenant clusters with hosted control-plane pods and KubeVirt VM workers on management OpenShift.
| What you want to do | Where to start |
|---|---|
| See what a cluster selects | Cluster inventory, then its cluster root |
| Understand how configuration reaches the right API | Reconciliation architecture |
| Import a new Datacenter composition or change site values | Customization and generated-file ownership |
| Add a workload or platform component | Add an application or add an operator |
| Prepare credentials or diagnose sync failures | Secret management and troubleshooting |
Start with example-management/kustomization.yaml. It selects shared core/Isovalent Applications through a management type, plus the site's parent Applications.
Each Argo CD Application identifies where its resources come from (spec.source) and which Kubernetes API receives them (spec.destination). Follow those fields through an actual example:
| Component | Application selected by the root | Resource source |
|---|---|---|
| Management networking | hcp-parent-network.yaml | Network overlay: host networking, attachments, DHCP and BGP |
| Persistent storage | storage-portworx.yaml | Portworx overlay: StorageCluster and shared StorageClass |
| Nested tenant lifecycle | hcp-hosted-clusters.yaml | Lifecycle overlay: HostedCluster and NodePool |
| Tenant networking | Tenant networking Application | Follow its source and tenant API destination; the tenant root shows the tenant's own selection |
Hosted control-plane pods and worker VM objects are management-cluster workloads. Applications targeting a registered tenant API configure that separate tenant Kubernetes cluster.
The cluster root selects these Applications and overlays. Their values determine which features are enabled for each cluster; the table maps configuration, not an assertion that every feature is active.
| Component | What is configured | Configuration |
|---|---|---|
| Cilium networking | CiliumConfig, address management and cluster networking | Cilium Application → Cilium configuration chart |
| BGP and route import | Management peer sessions, advertisements, import policy and BFD | Management BGP objects |
| Service exposure and policy | LoadBalancer address pools, L2 announcements, Gateway API, egress policy and DNS visibility | Cilium chart templates and selected root values |
| Tenant networking | Guest-cluster CNI and routing configuration | Tenant networking Application → tenant overlay |
| Isovalent Load Balancer | Router T1 and T2 node placement | Router T1 Application, T2 Application and placement overlays |
| Hubble Timescape | Flow ingestion, ClickHouse storage, Kubernetes metadata and UI | Timescape Application and ClickHouse operator |
| Flow export | Vector sources, transforms and delivery to Timescape; tenant S3 export | Vector Application and tenant exporter |
| Tetragon | Operator subscription, runtime configuration and tracing policies | Tetragon Application → Tetragon resources |
| Location | Purpose |
|---|---|
| clusters/ | Cluster roots and Application selections; _base and _types compose shared selections |
| apps/ | Kubernetes resources, reusable bases and site overlays |
| charts/ | Helm templates and values used by selected Applications |
| scripts/ and workflows | Validation and configured site execution helpers |
Change Datacenter-owned site intent upstream, render it and import the generated files. Renderer markers and the artifact manifest identify generated ownership, including some shared selections. Maintain reusable resources and chart behavior here. The customization guide explains both cases.
- Prepare the root and child sources. Review repository, revision, path, values and destination. Local checks cover Kustomize/Helm builds; build the selected children as well as the root.
- Supply private dependencies. Follow Secret management for trust, encrypted credentials and cluster registration. The lifecycle example references target-owned registry CA material and encrypted telemetry secrets; guest CNI also needs its entitled bootstrap process.
- Bootstrap Argo CD. Use Compute's post-install procedure with the reviewed root. The standalone Compute starter needs a matching site-owned root.
- Inspect reconciliation. Argo CD reports sync and health for each Application and destination; use troubleshooting to follow failures into child resources.
Optional image-cache configuration follows image delivery and cache lifecycle ordering. For telemetry sources and destinations, see observability architecture.
See LICENSE, retained file notices and the shared contribution/help guide. Isovalent software is obtained separately under entitlement.