rock
227839c27a
- Merge poimen-workflows + poimen-memory + db + frontend into one app - Delete duplicate apps: poimen-workflows, poimen-memory-app (kubectl done) - Delete poimen-memory ArgoCD app file (replaced by multi-source source 2) - Delete poimen-memory-database (replaced by source 3 → k8s/infra/poimen/) - Move memory-db CNPG cluster to k8s/infra/poimen/ (isolated from other tenants) - Remove memory-db from k8s/infra/databases/kustomization.yaml - Add frontend manifests (Deployment, Service, Ingress) to k8s/apps/poimen/ - Add frontend NetworkPolicy: egress to api-gw (api:8080), memory (poimen:8080), Gotify (notifications:80), Authentik (iam:9000/9443), DNS (kube-system:53) - Sync-wave -1 on CNPG cluster ensures DB ready before app pods (wave 0) - Image updater: workflows + memory + frontend tracked in one annotation block - poimen-toolkit stays separate (CRD management, independent rollback)
88 lines
3.7 KiB
YAML
88 lines
3.7 KiB
YAML
# Poimen — unified ArgoCD Application (wave 7).
|
|
#
|
|
# Consolidates what was previously five separate apps:
|
|
# poimen → source 1 (poimen-workflows workers)
|
|
# poimen-workflows → duplicate of source 1 (deleted)
|
|
# poimen-memory → source 2 (memory service + redis)
|
|
# poimen-memory-app → duplicate of source 2 (deleted)
|
|
# poimen-memory-database → source 3 (CNPG cluster, moved to k8s/infra/poimen)
|
|
#
|
|
# poimen-toolkit is intentionally kept as a separate Application because it
|
|
# manages cluster-scoped CRDs (ToolDefinition). A bad CRD can affect the
|
|
# whole cluster; keeping it separate means it has its own sync history,
|
|
# independent rollback, and can be paused without touching app workloads.
|
|
#
|
|
# Sync ordering via argocd sync-wave annotations:
|
|
# wave -1 → DB (CNPG Cluster) — must be Ready before app pods start
|
|
# wave 0 → all application Deployments (default)
|
|
#
|
|
# Image Updater tracks all four images. Write-back via argocd (in-cluster
|
|
# annotation patch — no git commit per image update).
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: poimen
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/part-of: poimen
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "7"
|
|
# ── Image Updater ─────────────────────────────────────────────────────────
|
|
argocd-image-updater.argoproj.io/image-list: |
|
|
workflows=forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows
|
|
memory=forgejo.riotpiao.com/riotpiao-poimen/poimen-memory
|
|
frontend=forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend
|
|
argocd-image-updater.argoproj.io/workflows.update-strategy: digest
|
|
argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^latest$
|
|
argocd-image-updater.argoproj.io/memory.update-strategy: digest
|
|
argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
|
|
argocd-image-updater.argoproj.io/frontend.update-strategy: digest
|
|
argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^latest$
|
|
argocd-image-updater.argoproj.io/write-back-method: argocd
|
|
spec:
|
|
project: homelab
|
|
# Multi-source: each repo owns its own k8s manifests.
|
|
# ArgoCD syncs all sources in parallel; sync-wave annotations on individual
|
|
# resources control ordering within the sync operation.
|
|
sources:
|
|
# 1. Workers — Temporal activity + workflow workers, pi-worker pool
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows.git
|
|
targetRevision: main
|
|
path: k8s
|
|
|
|
# 2. Memory service — poimen-memory API, Redis cache, NetworkPolicies
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-memory.git
|
|
targetRevision: main
|
|
path: k8s/app
|
|
|
|
# 3. Database infrastructure — CNPG Postgres cluster (wave -1)
|
|
# Moved from k8s/infra/databases to isolate poimen DB from other tenants.
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/poimen
|
|
|
|
# 4. Frontend — poimen.riotpiao.com (Deployment, Service, Ingress)
|
|
# Manifests live in homelab so all infra is in one place (Q4: C).
|
|
# Image tag managed by Image Updater above.
|
|
- repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
|
|
targetRevision: main
|
|
path: k8s/apps/poimen
|
|
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: poimen
|
|
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
- SkipDryRunOnMissingResource=true
|
|
retry:
|
|
limit: 5
|
|
backoff:
|
|
duration: 5s
|
|
factor: 2
|
|
maxDuration: 3m
|