rock
949ae5cb38
The homelab AppProject allowlist had no azhi repository, so an Application pointing at ToyoGlobal/azhi-infra fails admission with 'repository not permitted'. Adding the URL is the whole gate. The Application itself targets the repository default branch (harness/staging-slice), not main, and path k8s/overlays/azi-riotpiao. That overlay renders postgres and the API into namespace azi-riotpiao. The two Secrets the namespace needs stay out of Git: acr-pull carries the ACR pull credential and azhi-riotpiao-app-env carries the database credentials, the JWT secrets and the AES key.
64 lines
2.9 KiB
YAML
64 lines
2.9 KiB
YAML
# k8s/argocd/projects/homelab-project.yaml
|
|
# AppProject referenced by every Application manifest under k8s/argocd/apps/
|
|
# (project: homelab) — was never committed, so 00-homelab-root.yaml and all
|
|
# layer/wave/phase apps fail admission with "application references project
|
|
# 'homelab' which does not exist" until this exists.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: AppProject
|
|
metadata:
|
|
name: homelab
|
|
namespace: argocd
|
|
spec:
|
|
description: Homelab GitOps — single-repo, in-cluster destinations only
|
|
sourceRepos:
|
|
- https://github.com/Riotpiaole/riotpiao.homelab.com.git
|
|
# Poimen services (GitHub)
|
|
- https://github.com/Riotpiaole/Poimen-memory.git
|
|
- https://github.com/Riotpiaole/Poimen-workflows.git
|
|
- https://github.com/Riotpiaole/poimen*.git
|
|
# ToyoGlobal (GitHub, private). The azhi-infra Application reads its
|
|
# manifests from here, so the URL must be listed or ArgoCD rejects the
|
|
# Application with "repository not permitted". A read-only credential for
|
|
# this repo lives in Secret azhi-infra-github in namespace argocd; it is
|
|
# created out-of-band and is not committed, because it is a credential.
|
|
- https://github.com/ToyoGlobal/azhi-infra.git
|
|
# In-cluster Forgejo repos — explicit allowlist (no wildcard)
|
|
- https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
- https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend.git
|
|
- https://forgejo.riotpiao.com/riotpiao-poimen/kmsvc-manage.git
|
|
- https://forgejo.riotpiao.com/riotpiao-poimen/poimen.git
|
|
- https://forgejo.riotpiao.com/riotpiao-poimen/poimen-memory.git
|
|
- https://forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows.git
|
|
- https://forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend.git
|
|
- https://forgejo.riotpiao.com/riotpiao-poimen/poimen-toolkit.git
|
|
- https://forgejo.riotpiao.com/rock/riotpiao.com.git
|
|
# Public Helm chart repos referenced by k8s/argocd/apps/* and bootstrap/*
|
|
- https://cloudnative-pg.github.io/charts
|
|
- https://dl.gitea.com/charts/
|
|
- https://charts.min.io/
|
|
- https://operator.min.io/
|
|
- https://prometheus-community.github.io/helm-charts
|
|
- https://grafana.github.io/helm-charts
|
|
- https://helm.releases.hashicorp.com
|
|
- https://charts.goauthentik.io
|
|
- https://strimzi.io/charts/
|
|
- https://charts.bitnami.com/bitnami
|
|
- https://homarr-labs.github.io/charts
|
|
- https://go.temporal.io/helm-charts
|
|
- https://portainer.github.io/k8s/
|
|
# Substrate charts (cert-manager, ingress-nginx, reloader) — app-of-apps owned
|
|
- https://charts.jetstack.io
|
|
- https://kubernetes.github.io/ingress-nginx
|
|
- https://stakater.github.io/stakater-charts
|
|
# ArgoCD ecosystem charts
|
|
- https://argoproj.github.io/argo-helm
|
|
destinations:
|
|
- server: https://kubernetes.default.svc
|
|
namespace: "*"
|
|
clusterResourceWhitelist:
|
|
- group: "*"
|
|
kind: "*"
|
|
namespaceResourceWhitelist:
|
|
- group: "*"
|
|
kind: "*"
|