riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 2 Actions Packages Projects 1 Releases Wiki Activity

feat(argocd): reconcile azhi-infra from its private GitHub repo #60

Merged
rock merged 1 commits from feat/azhi-riotpiao-argocd into main 2026-10-12 12:54:45 +00:00
Conversation 0 Commits 1 Files Changed 2
+42
rock commented 2026-10-12 12:54:13 +00:00
Owner
Copy Link
Copy Source

Why

The homelab AppProject allowlist held no azhi repository, so an Application
pointing at ToyoGlobal/azhi-infra is rejected with repository not permitted.

What

  1. k8s/argocd/projects/homelab-project.yaml — add the azhi-infra URL.
  2. k8s/argocd/apps/72-azhi-riotpiao.yaml — the Application itself.

The Application targets the repository's default branch
(harness/staging-slice) and path k8s/overlays/azi-riotpiao, with automated
sync, prune and selfHeal.

What stays out of Git

acr-pull and azhi-riotpiao-app-env in namespace azi-riotpiao, plus the
read-only GitHub credential azhi-infra-github in namespace argocd. All three
are credentials and are created out-of-band.

## Why The homelab `AppProject` allowlist held no azhi repository, so an Application pointing at `ToyoGlobal/azhi-infra` is rejected with `repository not permitted`. ## What 1. `k8s/argocd/projects/homelab-project.yaml` — add the azhi-infra URL. 2. `k8s/argocd/apps/72-azhi-riotpiao.yaml` — the Application itself. The Application targets the repository's default branch (`harness/staging-slice`) and path `k8s/overlays/azi-riotpiao`, with automated sync, prune and selfHeal. ## What stays out of Git `acr-pull` and `azhi-riotpiao-app-env` in namespace `azi-riotpiao`, plus the read-only GitHub credential `azhi-infra-github` in namespace `argocd`. All three are credentials and are created out-of-band.
rock added 1 commit 2026-10-12 12:54:20 +00:00
feat(argocd): let ArgoCD reconcile azhi-infra from its private GitHub repo 949ae5cb38 
The homelab AppProject allowlist had no azhi repository, so an Application
pointing at ToyoGlobal/azhi-infra fails admission with 'repository not
permitted'. Adding the URL is the whole gate.

The Application itself targets the repository default branch
(harness/staging-slice), not main, and path k8s/overlays/azi-riotpiao. That
overlay renders postgres and the API into namespace azi-riotpiao.

The two Secrets the namespace needs stay out of Git: acr-pull carries the ACR
pull credential and azhi-riotpiao-app-env carries the database credentials,
the JWT secrets and the AES key.
rock merged commit 0666715a5e into main 2026-10-12 12:54:45 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/event-bus
Event routing and notification pipeline
 area/gateway
API gateway code (homelab-frontend)
 area/notifications
Gotify, SMTP, push notifications
 area/observer
Poimen goal-driven observation and pattern detection
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#60