Quick start

Welcome to Namespace-as-a-Service (NaaS)! You commit Kubernetes manifests to your Git repo, and ArgoCD syncs them into your isolated namespace - no servers to babysit, no manual kubectl apply. Git always wins: anything changed by hand in the cluster is restored to match your repo.

By the end of this page your app is live - roughly 10 minutes. Every step links to a documentation page if you need more depth.

What you received

An app repo - https://gitlab.inf.ethz.ch/k8s/<customer>/<app>, your GitOps repo, pre-seeded with some base files.
An isolated namespace - <customer>-<app>, your own sealed space on the cluster. It can't be reached from or reach into anything outside itself.
Deploy access - the LDAP group k8s-<customer>-<app> controls login on the clusters, ArgoCD and maintainer access to the repo.

Before you start

You're a member of your app's deploy group (if not, ask your ITC, or open a ticket at support@inf.ethz.ch).
You have git, kubectl, sops and age installed locally (for the latter two see Secrets & encryption).

1. Log in to the cluster

curl -fsSL https://home.k8s-moredev.inf.ethz.ch/login.sh | bash

It installs anything missing, adds the context oidc@k8s-moredev to your kubeconfig and logs you in with your ETH account. The downloadable kubeconfig and the ArgoCD link are on Cluster login.

2. Get your repo

git clone https://gitlab.inf.ethz.ch/k8s/<customer>/<app>
cd <app>

Depending on what you've ordered, you'll find a prod/ and maybe a test/ and/or a dev/ folder - each is synced to its own cluster.

If the folders contain a kustomization.yaml, ArgoCD parses this file with kustomize (files not referenced in kustomization.yaml are ignored). Otherwise, *.yaml (all yaml files in the root of the folder) are loaded and expected to be Kubernetes manifests.

3. Create your manifests

Start by copying the required manifests from isg-example (at minimum deployment.yaml, service.yaml and ingress.yaml). Then adjust them to use your container image (deployment.yaml), define the port as a service (service.yaml), expose it with a hostname (ingress.yaml) and potentially more (e.g. configmap.yaml for the configuration, pvc.yaml for persistent storage - see Storage, ...). The comments walk you through each field.

Leave the securityContext and resource requests/limits in place - they're what keeps your pods within the platform's cluster policies and resource quotas.

4. Add your secrets - encrypted

Never commit plaintext secrets.

If your app needs secrets, follow the steps in Secrets & encryption.

5. Commit and push

git add test/
git commit -m "feat: Configured my app for test"
git push

6. Watch it deploy

ArgoCD picks up your commit within a minute and syncs it into your namespace. Watch it either way:

ArgoCD UI - log in at https://argocd.k8s-moredev.inf.ethz.ch and open your app; you'll see each resource go healthy.
kubectl - kubectl get pods -n <your-namespace> -w

When your pods are Running and the Ingress shows your hostname, you're live. 🎉

7. Promote to production

Happy with test/? Repeat the same edits in prod/ and push - ArgoCD on k8s-isg syncs it from there.

If a deploy is blocked

A failed sync or a rejected resource is almost always one of the platform's guardrails:

a resource kind or securityContext outside the cluster policies,
an Ingress, Gateway or Middleware outside the routing rules (e.g. a missing hostname),
a resource quota you've hit, or
an isolation rule that needs an exception.

Fix the manifest, or open a ticket.

Need help, or something only the platform can set up?

Anything platform-managed (quota changes, network exceptions, new resource kinds, deploy-group changes, LoadBalancer IPs, …) is a quick request. Open a ticket at support@inf.ethz.ch and include:

Cluster - e.g. k8s-moredev, the one this page runs on (see cluster login).
Namespace / app - your namespace name (it matches your app).
What you need - e.g. "raise memory quota to X", "allow egress to example.com:443", "add user xyz to our deploy group", "a LoadBalancer IP for service foo".
Why - one line; exceptions to isolation or hardening are reviewed before they're granted.

Log in

Kubeconfig