Region Deployment — Overview
Status: living document. This section is the canonical record of how a Cogrion region is actually deployed, kept current as regions are stood up and reworked. It links out to the repos that own each piece rather than duplicating their detail — when something here and the linked repo disagree, the repo is correct and this section needs an update. It describes current behavior and known gaps, not a session-by-session log of changes — for progress/status on any item, see the open items index or the linked tracking issue.
Who this is for: anyone standing up a new region, debugging why an existing one is unhealthy, or trying to understand which repo owns which piece of a running cluster.
What a region is
A region is a fully self-contained Cogrion deployment: its own AWS account, its own control-plane instance, its own Keycloak, its own OpenBao/Vault, its own database, its own EKS cluster, its own Route53 DNS zone. No component is shared across regions. See cogrion-terraform's Region Deployment Overview for the full rationale (blast radius isolation, data residency, no shared-CA problem).
The three repos involved
| Repo | Owns | Docs |
|---|---|---|
cogrion-terraform | AWS/Cloudflare primitives — VPC, EKS, RDS, Route53/ACM, ArgoCD installation + bootstrap | Region Deployment docs |
cogrion-gitops | Everything ArgoCD reconciles inside Kubernetes — Applications, Helm values, shared local charts | Region Deployment docs |
control-plane | The cplane application itself — API, workers, UI, agent, dns-webhook; also owns Keycloak realm seeding (server/src/seeds/seed.keycloak.ts) and OpenBao secrets-management design | docs.internals |
The handoff between the first two is exactly three Terraform variables: gitops_repo_url, gitops_repo_path (e.g. argocd/apps/dev-sgp), gitops_repo_target_revision. Once those point at a valid argocd/apps/{cluster} path, cogrion-terraform is done and cogrion-gitops takes over everything inside the cluster.