rock
949ae5cb38
The homelab AppProject allowlist had no azhi repository, so an Application pointing at ToyoGlobal/azhi-infra fails admission with 'repository not permitted'. Adding the URL is the whole gate. The Application itself targets the repository default branch (harness/staging-slice), not main, and path k8s/overlays/azi-riotpiao. That overlay renders postgres and the API into namespace azi-riotpiao. The two Secrets the namespace needs stay out of Git: acr-pull carries the ACR pull credential and azhi-riotpiao-app-env carries the database credentials, the JWT secrets and the AES key.
37 lines
1.4 KiB
YAML
37 lines
1.4 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: azhi-riotpiao
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: '8'
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
# Private GitHub. The read-only credential is Secret azhi-infra-github in
|
|
# namespace argocd, created out-of-band.
|
|
repoURL: https://github.com/ToyoGlobal/azhi-infra.git
|
|
# The repository's default branch. It is not `main`: this repo's work
|
|
# happens on the staging slice branch, and `main` is behind it.
|
|
targetRevision: harness/staging-slice
|
|
# One directory, because ArgoCD reads a single path per source. That
|
|
# directory is a root kustomization over foundation, postgres and
|
|
# azhi-server.
|
|
path: k8s/overlays/azi-riotpiao
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: azi-riotpiao
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
# The two Secrets this namespace needs are credentials, so they are created
|
|
# by hand and NOT by this Application:
|
|
# acr-pull — the private Alibaba ACR pull credential
|
|
# azhi-riotpiao-app-env — DB credentials, JWT secrets, AES key
|
|
# A missing imagePullSecret fails the pod outright and a missing app-env
|
|
# Secret leaves it in CreateContainerConfigError, which is the intended
|
|
# loud failure rather than a pod that runs against unknown values.
|