riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity
391 Commits 9 Branches 0 Tags
4b5ecfcd49f8f2c1250f469ada2fe67d571ca396
Commit Graph
21 Commits
Author SHA1 Message Date
rock 7a5d0a83d5 fix: vendor Tekton release.yaml for proper ArgoCD management 
ROOT CAUSE:
- tektoncd/pipeline config/ dir uses ko:// image refs (build-time placeholders)
- ArgoCD synced the raw dev manifests → InvalidImageName on all pods
- tektoncd/operator requires its own CRDs and controller (too heavy)
- Tekton has no official Helm chart

FIX:
- Vendor the pre-built release.yaml (v0.68.0) into k8s/infra/tekton/
- Point ArgoCD Application at our own repo (forgejo)
- Release contains real container images (ghcr.io/tektoncd/pipeline/*)
- Remove external tektoncd repo from AppProject (not needed)

TO UPGRADE TEKTON:
  1. Download new release from github.com/tektoncd/pipeline/releases
  2. Replace k8s/infra/tekton/release.yaml
  3. Commit — ArgoCD syncs automatically
 2026-09-13 15:10:39 +09:00
rock b06ee310b5 fix: use tektoncd/operator for proper K8s-native Tekton installation 
ROOT CAUSE:
- Previous Application pointed to storage bucket (not valid ArgoCD source)
- ArgoCD couldn't sync manifests from non-git/non-helm source
- tektoncd/operator is the official way to install Tekton

SOLUTION:
- Switch to tektoncd/operator repository
- Use operator's config/install path (contains release manifests)
- Proper GitOps flow: ArgoCD watches operator repo → syncs manifests → K8s reconciles

BENEFITS:
✓ Official Tekton approach
✓ Proper K8s Operator pattern
✓ ArgoCD-compatible (git source)
✓ Automatic updates from upstream
✓ Full GitOps workflow
 2026-09-13 15:10:39 +09:00
poimenandrock 5f16d5c6a3 feat: add Tekton Pipelines for CI/CD orchestration (#46) 
Install Tekton Pipelines (CNCF CI/CD) via ArgoCD for pre-merge integration testing.

## What This Does

Adds Tekton Pipelines to the homelab cluster infrastructure for orchestrating CI/CD workflows:

1. **Tekton Pipelines Installation**
   - Kubernetes-native CI/CD (CNCF project)
   - Task and Pipeline CRDs for workflow definitions
   - PipelineRun for ephemeral test execution
   - Webhook support for event-driven triggers

2. **ArgoCD Management**
   - ArgoCD Application manages Tekton installation
   - Automatic updates from upstream
   - GitOps-driven (everything in git)
   - Wave 06 deployment (after networking, before apps)

3. **Integration with homelab-frontend**
   - CI creates Tekton PipelineRun
   - Tests execute in cluster
   - Results flow back to CI
   - Image promotion only on pass

## Architecture

```
Cluster Infrastructure (homelab):
  └── Tekton Pipelines (Wave 06 - CI/CD)
      ├── Task: Run integration tests
      ├── Pipeline: Orchestrate workflows
      └── PipelineRun: Execute on demand

Application: homelab-frontend
  └── CI Workflow (.gitea/workflows/ci.yaml)
      ├── Build image
      ├── Create PipelineRun
      ├── Wait for completion
      └── Promote to :latest (if pass)
```

## Files Added

- `k8s/infra/tekton/namespace.yaml` - Tekton namespace
- `k8s/infra/tekton/kustomization.yaml` - Release manifest reference
- `k8s/argocd/apps/06-ci-cd.yaml` - ArgoCD Application (Wave 06)
- `k8s/argocd/projects/homelab-project.yaml` - Added Tekton repos

## Wave Ordering

Wave 06 (CI/CD) is deployed in proper order:
- Wave 00-01: ArgoCD bootstrap
- Wave 05: Networking (ingress, etc.)
- **Wave 06: CI/CD (Tekton Pipelines)** ← NEW
- Wave 10+: Storage, logging, monitoring
- Wave 40+: Data services (databases)
- Wave 50+: Applications (API gateway, etc.)

## Benefits

✓ **Kubernetes-Native**: Uses standard K8s CRDs (Task, Pipeline, PipelineRun)
✓ **GitOps**: Everything in git, managed by ArgoCD, no manual kubectl
✓ **Pre-Merge Testing**: Tests must pass before code deploys
✓ **Observable**: Logs, status, results tracking
✓ **Secure**: Non-root containers, resource limits, RBAC
✓ **CNCF-Standard**: Industry-proven Tekton project
✓ **Scalable**: Can add more tests/tasks without complexity

## Integration with PR #25

This homelab PR works with homelab-frontend PR #25:
- homelab (this): Installs Tekton infrastructure
- homelab-frontend #25: Integrates tests with Tekton

Together they form complete GitOps CI/CD pipeline.

## Testing After Merge

1. ArgoCD syncs this repo
2. Wave 06 deployment triggered
3. Tekton Pipelines installed to cluster
4. homelab-frontend PR #25 can merge
5. First code push triggers integration tests

## Review Checklist

- [ ] Tekton namespace created properly
- [ ] ArgoCD Application configuration correct
- [ ] Wave 06 ordering makes sense
- [ ] Project repos include Tekton
- [ ] Integration with homelab-frontend understood
- [ ] No hardcoded values
- [ ] Documentation is clear

---------

Co-authored-by: rock <[email protected]>
Reviewed-on: #46
Co-authored-by: poimen <[email protected]>
 2026-09-13 05:48:06 +00:00
rock 436c7d8d42 fix(argocd): update git repoURLs for org transfer rock -> riotpiao-poimen 
Repos transferred: homelab-frontend, kmsvc-manage, poimen, poimen-memory,
poimen-workflows, poimen-frontend. Old URLs return 301 which ArgoCD
doesn't follow.

NOT changed: container image registry paths (rock/ is correct for registry),
riotpiao.com (still under rock org).

Also adds poimen-frontend to AppProject sourceRepos allowlist.
 2026-09-10 10:49:30 +09:00
rock b571d518e0 fix(argocd): update repoURL after org transfer (#29) 
Co-authored-by: rock <[email protected]>
 2026-09-10 01:41:37 +00:00
rock 7e9ef86826 appproject: allow argo-helm repo for image-updater 2026-09-02 20:32:28 -07:00
rock 77683ec7c6 fix: add poimen-memory and poimen-workflows Forgejo repos to sourceRepos 2026-09-02 09:52:41 -07:00
rock be55d68571 feat(argocd): add portfolio app, explicit sourceRepos, coredns rewrite for riotpiao.com 
- Add Application for rock/riotpiao.com repo (portfolio site)
- Replace wildcard sourceRepos with explicit repo list
- Add CoreDNS rewrite for root domain riotpiao.com
 2026-08-31 14:18:57 -07:00
Story Crater Bot 80cafed201 Track all poimen-* repos in AppProject for flexible service onboarding 2026-08-22 23:20:58 -07:00
Story Crater Bot 9eb5c8ea1a Remove separate memory app, bundle into wave 2 databases 2026-08-22 23:16:40 -07:00
Story Crater Bot aa6b2ae9c3 Add Poimen Memory to ArgoCD wave 2 deployment (namespace: poimen) 2026-08-22 23:09:02 -07:00
Story Crater Bot c938a58544 stage1: A1-A2 AppProject and projects Application 
A1: Replace per-repo Forgejo entries with https://forgejo.riotpiao.com/rock/*
    wildcard so onboarding never requires touching AppProject.

A2: Add wave -1 Application for k8s/argocd/projects/ so it syncs before
    any Application references the AppProject.

Also add kustomization.yaml to k8s/argocd/projects/ to make it renderable.

Enabled by Stage 1 (A1, A2).
 2026-08-20 21:31:05 -07:00
Story Crater Bot 720181c900 feat: let the runner build and the cluster pull from the Forgejo registry 
- Runner egress: allow 192.168.1.160/32:443. forgejo.riotpiao.com resolves to
  the ingress LB, inside the 192.168.1.0/24 block the NetworkPolicy denies, so
  docker push hung until timeout.
- dind CA: also mount homelab-ca at /etc/docker/certs.d/forgejo.riotpiao.com/,
  the path dockerd actually reads for per-registry trust.
- Pull secret: dockerconfigjson for the api namespace; /v2/ answers 401.
- AppProject: allow the Forgejo repo as a source for api-gw.
 2026-08-19 21:48:01 -07:00
Story Crater Bot 5f16f16f0f fix(argocd): clone the public GitHub seed anonymously over HTTPS and delete the SSH deploy-key Secret — its private half had been committed in plaintext to a public remote, and a public repo needs no credential at all 2026-08-18 15:08:04 -07:00
Story Crater Bot efb9389093 feat(argocd): migrate all applications from Forgejo to GitHub 
- Replace all forgejo.riotpiao.com repo URLs with [email protected] SSH URLs
- Enables immediate GitOps sync without waiting for Forgejo mirror setup
- Includes ingress-nginx now fully ArgoCD-managed (wave 0)
- SOPS secrets can now sync and decrypt TLS certificates
 2026-08-18 15:08:04 -07:00
Story Crater Bot ab2f1eeeb3 feat(homarr): bring up chart (repo/sourceRepos, image tag, minimal values schema) 2026-08-18 15:08:03 -07:00
Story Crater Bot d0c150eab9 fix(argocd): repoURL http://forgejo.riotpiao.com:3000 -> https://forgejo.riotpiao.com 
Root cause of widespread 'Unknown' sync status / Skipping auto-sync across
almost every Application: CoreDNS rewrites forgejo.riotpiao.com to the nginx
ingress controller service (rewrite name forgejo.riotpiao.com -> ingress-nginx-
controller...), which only listens on 80/443, not 3000. Every git fetch from
argocd-repo-server to the :3000 repoURL was timing out (context deadline
exceeded), so ArgoCD couldn't compare desired vs live state for any app.

Fix: use https://forgejo.riotpiao.com (no port, TLS via nginx + wildcard cert)
consistent with the 'all external endpoints HTTPS' requirement. Verified git
smart-http response 200 on the new URL before committing.
 2026-08-18 15:08:02 -07:00
Story Crater Bot d9ae0a6c44 feat(substrate): deploy cert-manager/ingress-nginx/reloader + privileged PodSecurity for ingress-nginx 2026-08-18 15:08:02 -07:00
Story Crater Bot a6465f7158 fix(minio): correct operator chart source + rewrite Tenant to v5 schema + config.env creds — tenant now boots 2026-08-18 15:08:02 -07:00
Story Crater Bot 8f86a03828 refactor(argocd): replace wave/layer/phase schemes with two-phase bootstrap + app-of-apps and document both CD scopes — fixes self-hosted-git chicken-egg and stale paths 2026-08-18 15:08:02 -07:00
Story Crater Bot 54bfb5ade6 feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications 2026-08-18 15:08:02 -07:00