feat(poimen): consolidate into single multi-source ArgoCD app

- Merge poimen-workflows + poimen-memory + db + frontend into one app - Delete duplicate apps: poimen-workflows, poimen-memory-app (kubectl done) - Delete poimen-memory ArgoCD app file (replaced by multi-source source 2) - Delete poimen-memory-database (replaced by source 3 → k8s/infra/poimen/) - Move memory-db CNPG cluster to k8s/infra/poimen/ (isolated from other tenants) - Remove memory-db from k8s/infra/databases/kustomization.yaml - Add frontend manifests (Deployment, Service, Ingress) to k8s/apps/poimen/ - Add frontend NetworkPolicy: egress to api-gw (api:8080), memory (poimen:8080), Gotify (notifications:80), Authentik (iam:9000/9443), DNS (kube-system:53) - Sync-wave -1 on CNPG cluster ensures DB ready before app pods (wave 0) - Image updater: workflows + memory + frontend tracked in one annotation block - poimen-toolkit stays separate (CRD management, independent rollback)
2026-09-28 08:51:31 +08:00
parent 8ed60c8b55
commit 227839c27a
10 changed files with 347 additions and 52 deletions
@@ -1,41 +0,0 @@
-# Wave 7 — poimen-memory k8s resources (namespace poimen).
-#
-# Manages: Deployment, Service, ConfigMap, Redis cache, NetworkPolicies,
-# ServiceMonitor, and any future k8s infra owned by the memory service.
-# Image updates handled by argocd-image-updater (digest strategy, :latest tag).
-#
-# Source: riotpiao-poimen/poimen-memory.git k8s/app/
-# Kustomization at k8s/app/kustomization.yaml lists all managed resources.
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: poimen-memory
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "7"
-    argocd-image-updater.argoproj.io/image-list: |
-      memory=forgejo.riotpiao.com/riotpiao-poimen/poimen-memory
-    argocd-image-updater.argoproj.io/memory.update-strategy: digest
-    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
-    argocd-image-updater.argoproj.io/write-back-method: argocd
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-memory.git
-    targetRevision: main
-    path: k8s/app
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: poimen
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: 5
-      backoff:
-        duration: 5s
-        factor: 2
-        maxDuration: 3m
@@ -1,37 +1,84 @@
+# Poimen — unified ArgoCD Application (wave 7).
+#
+# Consolidates what was previously five separate apps:
+#   poimen            → source 1 (poimen-workflows workers)
+#   poimen-workflows  → duplicate of source 1 (deleted)
+#   poimen-memory     → source 2 (memory service + redis)
+#   poimen-memory-app → duplicate of source 2 (deleted)
+#   poimen-memory-database → source 3 (CNPG cluster, moved to k8s/infra/poimen)
+#
+# poimen-toolkit is intentionally kept as a separate Application because it
+# manages cluster-scoped CRDs (ToolDefinition). A bad CRD can affect the
+# whole cluster; keeping it separate means it has its own sync history,
+# independent rollback, and can be paused without touching app workloads.
+#
+# Sync ordering via argocd sync-wave annotations:
+#   wave -1 → DB (CNPG Cluster) — must be Ready before app pods start
+#   wave  0 → all application Deployments (default)
+#
+# Image Updater tracks all four images. Write-back via argocd (in-cluster
+# annotation patch — no git commit per image update).
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: poimen
  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: poimen
  annotations:
    argocd.argoproj.io/sync-wave: "7"
-    # Image Updater: auto-update on new image push (SHA tag filter)
+    # ── Image Updater ─────────────────────────────────────────────────────────
    argocd-image-updater.argoproj.io/image-list: |
-      memory=forgejo.riotpiao.com/rock/poimen-memory
-      workflows=forgejo.riotpiao.com/rock/poimen-workflows
-      frontend=forgejo.riotpiao.com/rock/poimen-frontend
-    argocd-image-updater.argoproj.io/memory.update-strategy: digest
-    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
+      workflows=forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows
+      memory=forgejo.riotpiao.com/riotpiao-poimen/poimen-memory
+      frontend=forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend
    argocd-image-updater.argoproj.io/workflows.update-strategy: digest
    argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/memory.update-strategy: digest
+    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
    argocd-image-updater.argoproj.io/frontend.update-strategy: digest
    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^latest$
    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows.git
-    targetRevision: main
-    path: k8s
+  # Multi-source: each repo owns its own k8s manifests.
+  # ArgoCD syncs all sources in parallel; sync-wave annotations on individual
+  # resources control ordering within the sync operation.
+  sources:
+    # 1. Workers — Temporal activity + workflow workers, pi-worker pool
+    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows.git
+      targetRevision: main
+      path: k8s
+
+    # 2. Memory service — poimen-memory API, Redis cache, NetworkPolicies
+    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-memory.git
+      targetRevision: main
+      path: k8s/app
+
+    # 3. Database infrastructure — CNPG Postgres cluster (wave -1)
+    #    Moved from k8s/infra/databases to isolate poimen DB from other tenants.
+    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+      targetRevision: main
+      path: k8s/infra/poimen
+
+    # 4. Frontend — poimen.riotpiao.com (Deployment, Service, Ingress)
+    #    Manifests live in homelab so all infra is in one place (Q4: C).
+    #    Image tag managed by Image Updater above.
+    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+      targetRevision: main
+      path: k8s/apps/poimen
+
  destination:
    server: https://kubernetes.default.svc
    namespace: poimen
+
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
+      - SkipDryRunOnMissingResource=true
    retry:
      limit: 5
      backoff: