SyRF Cloud Infrastructure Reference¶
Canonical values for the GCP project, DNS zones, secret storage and third-party accounts SyRF
depends on. Relocated here from the root CLAUDE.md so there is one in-repo home for them.
Related: GitOps Architecture ·
Required Kubernetes Secrets ·
GKE Cluster Configuration Reference
(published from the camaradesuk/camarades-infrastructure repository).
Project and region¶
| Resource | Value | Notes |
|---|---|---|
| GCP Project ID | camarades-net |
Used for all GCP resources |
| GCP Region | europe-west2 (London) |
Primary region for all services |
| GKE Zone | europe-west2-a |
Single-zone cluster |
| GKE Cluster Name | camaradesuk |
Main Kubernetes cluster |
| GitHub Org | camaradesuk |
GitHub organization for repos and GHCR |
Cloud service accounts¶
| Service | Account/Resource |
|---|---|
| MongoDB Atlas | Cluster0 (M20) — production only; Preview cluster — staging + PR previews |
| AWS Region | eu-west-1 (Ireland) - for S3 and Lambda |
| AWS Lambda | syrfAppUploadS3Notifier |
DNS zones (Cloud DNS)¶
| Zone | Domain | Purpose |
|---|---|---|
syrf-org-uk-zone |
syrf.org.uk |
Application services |
camarades-net-zone |
camarades.net |
Infrastructure (ArgoCD) |
Never create DNS records by hand. External-DNS owns them through its TXT registry; a manually created record has no TXT ownership record and will never be updated automatically. Configure a Kubernetes Ingress/Service and let External-DNS create the record.
Secret management¶
- GCP Secret Manager - Primary secrets store (project:
camarades-net) - External Secrets Operator - Syncs GCP secrets to Kubernetes
- ClusterSecretStore:
gcpsm-secret-store(cluster-wide; theextra-secretschart also renders namespacedSecretStores namedgcpsm-secret-store-<env>)
Key secrets in GCP Secret Manager¶
| Secret Name | Purpose |
|---|---|
syrf-prod-mongodb |
Production MongoDB credentials |
syrf-staging-mongodb |
Staging MongoDB credentials |
atlas-operator-api-key |
MongoDB Atlas Operator API key (PR previews) |
github-app-credentials |
GitHub App for deployment notifications |
The per-service Kubernetes secret inventory, the external services each one authenticates against, and the ExternalSecret examples live in Required Kubernetes Secrets for SyRF Services.