diff --git a/k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml b/k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml new file mode 100644 index 0000000..55b1359 --- /dev/null +++ b/k8s/argocd/secrets/pi-sandbox-secrets.enc.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: pi-code-agent-api-keys + namespace: poimen-sandbox +stringData: + ANTHROPIC_API_KEY: ENC[AES256_GCM,data:TBcno/dzj3qykHjeX96UKZekuA/WMQT2E7a1ziPyYo5J6lWLPydgli84KeJZhH62/8CnnFtFOhVIe4FWCGPGjvqKH6M8WbiQHaP9y7FN0qQUpFHKNVAQ2R+s0wInhw0eUmANvd7bRx8aIZ2X,iv:oex19yVtWUevoJ0A3mkMLCfWu85o1gPSNp43x1iV0LE=,tag:BW3zQnwvagPceeNird9CZg==,type:str] + DEEPSEEK_API_KEY: ENC[AES256_GCM,data:vq/5gOsMVjlVMd0oXiBtHFHFEr+IF2YR2iP2OBFWx3ZFNoQ=,iv:QhLU/BRIJb/7QKDCRyw+HWPphZifVEhIOLywYDgOb20=,tag:BZdtXw+WsuK+P4E0caTa0Q==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqNm1LNE5nWktnd3c3STg3 + UlVWbWJxWElxUHMwa0JVMk81Z0c4d0JaQm1vCnpLQWJWV3hxOU00NzJIaG51Mmlr + ZWpNTFJWcmdtV0w4YndQeHpvSUx2MTAKLS0tIDVnNkNuVWhPUFZ5V2hFOEt1eitG + blVqRy8yNnYzSU1FNzZGNkxrRElvWVEKL3J77INje75+CvKXaJHC3CvONgHv7d0a + a10MITvfreFr6M4AN3Z/mno49SDMp15Q4oQRagHHxSTS1K54mWHo8g== + -----END AGE ENCRYPTED FILE----- + recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla + encrypted_regex: ^(data|stringData)$ + lastmodified: "2026-10-06T01:19:49Z" + mac: ENC[AES256_GCM,data:GpYl8IRefms36GvO3RW41c0US7SOgoOhd4rumxsCdEf5ME9kJ0eOxPx8klMgnlYrkBnwHmad8jj7C+HcA5Eim7mdUaYOZZWPFohvC6N4GLHX85aH78P09CelqG5tdm/Gm+1QfxYu0vANYGCAVjLK7YbBbZjbZmbvVfQvAbs3mOY=,iv:y3lglGu8FhTHQpO1poSIKgGYJFu5J9yjIaOjulda6fY=,tag:5Sgh4TbtNFMw7xOJjYRn0g==,type:str] + version: 3.13.2 diff --git a/k8s/argocd/secrets/secret-generator.yaml b/k8s/argocd/secrets/secret-generator.yaml index 4e42c4d..a3dc165 100644 --- a/k8s/argocd/secrets/secret-generator.yaml +++ b/k8s/argocd/secrets/secret-generator.yaml @@ -7,32 +7,33 @@ metadata: exec: path: ksops files: - - agent-pod-models.enc.yaml - - agent-pod-ssh-key.enc.yaml - - authentik-secrets.enc.yaml - - cloudflare-secrets.enc.yaml - - forgejo-registry-pat.enc.yaml - - forgejo-registry-pat-api.enc.yaml - - forgejo-registry-pull.enc.yaml - - forgejo-runner-token.enc.yaml - - forgejo-secrets.enc.yaml - - grafana-oidc-secrets.enc.yaml - - grafana-secrets.enc.yaml - - homarr-auth-oidc.enc.yaml - - homarr-db-encryption.enc.yaml - - homarr-secrets.enc.yaml - - homelab-ca-secrets.enc.yaml - - loki-secrets.enc.yaml - - minio-secrets.enc.yaml - - paperless-secrets.enc.yaml - - vault-secrets.enc.yaml - - vault-unseal-keys.enc.yaml - - portfolio-secrets.enc.yaml - - gotify-admin-secrets.enc.yaml - - gotify-tokens-secrets.enc.yaml - - gotify-smtp-secrets.enc.yaml - - forgejo-smtp-secrets.enc.yaml - - paperless-ai-secrets.enc.yaml + - agent-pod-models.enc.yaml + - agent-pod-ssh-key.enc.yaml + - authentik-secrets.enc.yaml + - cloudflare-secrets.enc.yaml + - forgejo-registry-pat.enc.yaml + - forgejo-registry-pat-api.enc.yaml + - forgejo-registry-pull.enc.yaml + - forgejo-runner-token.enc.yaml + - forgejo-secrets.enc.yaml + - grafana-oidc-secrets.enc.yaml + - grafana-secrets.enc.yaml + - homarr-auth-oidc.enc.yaml + - homarr-db-encryption.enc.yaml + - homarr-secrets.enc.yaml + - homelab-ca-secrets.enc.yaml + - loki-secrets.enc.yaml + - minio-secrets.enc.yaml + - paperless-secrets.enc.yaml + - vault-secrets.enc.yaml + - vault-unseal-keys.enc.yaml + - portfolio-secrets.enc.yaml + - gotify-admin-secrets.enc.yaml + - gotify-tokens-secrets.enc.yaml + - gotify-smtp-secrets.enc.yaml + - forgejo-smtp-secrets.enc.yaml + - paperless-ai-secrets.enc.yaml - memory-agent-oidc.enc.yaml - oauth2-credentials.enc.yaml - forgejo-registry-token.enc.yaml + - pi-sandbox-secrets.enc.yaml diff --git a/k8s/infra/minio/minio-tenant.yaml b/k8s/infra/minio/minio-tenant.yaml index e756d30..810821e 100644 --- a/k8s/infra/minio/minio-tenant.yaml +++ b/k8s/infra/minio/minio-tenant.yaml @@ -11,7 +11,12 @@ metadata: prometheus.io/port: "9000" prometheus.io/scrape: "true" spec: - image: minio/minio:RELEASE.2025-07-23T15-54-02Z + # Was minio/minio:RELEASE.2025-07-23T15-54-02Z — that Docker Hub repository no longer + # exists (404 for every tag), so the tenant sat in ImagePullBackOff and Vault's S3 + # backend could not resolve minio-cluster-hl. Official images now need registry auth + # (quay.io/minio/minio returns 401), so this pins a public mirror of the same upstream + # release; swap it for the official image once MinIO registry credentials exist. + image: coollabsio/minio:RELEASE.2025-10-15T17-29-55Z # Disable operator auto-TLS: MinIO serves plain HTTP internally on 9000. # External TLS is terminated at nginx ingress (wildcard riotpiao-com-tls cert). diff --git a/k8s/infra/poimen/kustomization.yaml b/k8s/infra/poimen/kustomization.yaml index 32fdd35..ae6ad04 100644 --- a/k8s/infra/poimen/kustomization.yaml +++ b/k8s/infra/poimen/kustomization.yaml @@ -9,3 +9,4 @@ resources: - poimen-sandbox-namespace.yaml - poimen-sandbox-quota.yaml - pi-session-netpol.yaml + - pi-agent-workspace-pv.yaml diff --git a/k8s/infra/poimen/pi-agent-workspace-pv.yaml b/k8s/infra/poimen/pi-agent-workspace-pv.yaml new file mode 100644 index 0000000..1ba6bf0 --- /dev/null +++ b/k8s/infra/poimen/pi-agent-workspace-pv.yaml @@ -0,0 +1,57 @@ +apiVersion: v1 +kind: PersistentVolume +metadata: + finalizers: + - kubernetes.io/pv-protection + labels: + app: pi-coding-agent-sandbox + part-of: poimen-toolkit + name: pi-agent-workspace-pv + annotations: + argocd.argoproj.io/sync-wave: '-1' +spec: + accessModes: + - ReadWriteOnce + capacity: + storage: 10Gi + claimRef: + apiVersion: v1 + kind: PersistentVolumeClaim + name: pi-agent-workspace + namespace: poimen-sandbox + hostPath: + path: /var/lib/pi-agent-sandbox + type: DirectoryOrCreate + nodeAffinity: + required: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/hostname + operator: In + values: + - talos-cp-2 + persistentVolumeReclaimPolicy: Retain + volumeMode: Filesystem +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + annotations: + pv.kubernetes.io/bind-completed: 'yes' + argocd.argoproj.io/sync-wave: '-1' + finalizers: + - kubernetes.io/pvc-protection + labels: + app: pi-coding-agent-sandbox + part-of: poimen-toolkit + name: pi-agent-workspace + namespace: poimen-sandbox +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Gi + storageClassName: '' + volumeMode: Filesystem + volumeName: pi-agent-workspace-pv diff --git a/terraform/files/coredns/Corefile b/terraform/files/coredns/Corefile index b1b0380..dbdcb7c 100644 --- a/terraform/files/coredns/Corefile +++ b/terraform/files/coredns/Corefile @@ -39,6 +39,7 @@ rewrite name comfy.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local rewrite name comfyui.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local rewrite name gotify.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local + rewrite name pi.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local rewrite name igotify.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local