refactor(k8s): Reorganize into 5-layer structure with production kustomizations

2026-08-18 15:08:01 -07:00
parent 563f720d09
commit 0f30d77288
214 changed files with 405 additions and 885 deletions
@@ -0,0 +1,139 @@
+# k8s/talos-ci-cd/argocd-values.yaml
+# Argo CD — single-replica homelab install (fits the 4-CPU / 32 GB RAM budget).
+# Deployed via helmfile (name=argocd) so it sits alongside Authentik, MinIO, etc.
+#
+# UI is exposed via the cluster Ingress (k8s/ingress/ingress.yaml,
+# argocd.riotpiao.homelab.com) over the WireGuard/LAN-only nginx ingress —
+# never as a LoadBalancer, since argocd-server holds cluster-admin
+# credentials and that Ingress isn't reachable from the WAN.
+#
+# OIDC + RBAC declared in configs.cm / configs.rbac below — applied by Helm directly.
+# Requires: oidc-secret K8s secret (created by helmfile argocd presync hook from env vars).
+# CA trust for Forgejo repo clones injected into argocd-tls-certs-cm by postsync hook.
+
+global:
+  domain: argocd.riotpiao.homelab.com
+
+configs:
+  params:
+    server.insecure: false   # keep TLS on argocd-server even behind the ingress
+
+  cm:
+    # Must match the Ingress host above and the redirect URI registered in
+    # Authentik (provision_oidc.py argocd_url) exactly — ArgoCD builds its
+    # OIDC redirect_uri as "{url}/auth/callback", so any mismatch here is
+    # what Authentik's "Invalid redirect URL" error means.
+    url: "https://argocd.riotpiao.homelab.com"
+    oidc.config: |
+      name: Authentik
+      issuer: https://authentik.riotpiao.homelab.com/application/o/argocd/
+      clientID: $oidc-secret:client-id
+      clientSecret: $oidc-secret:client-secret
+      requestedScopes: [openid, profile, email, groups]
+      rootCA: |
+        -----BEGIN CERTIFICATE-----
+        MIIBbTCCARSgAwIBAgIUNa409I6cGHye4YqeiphmWDaCEXUwCgYIKoZIzj0EAwIw
+        FTETMBEGA1UEAxMKaG9tZWxhYi1jYTAeFw0yNjA2MTcxNjUzMjVaFw0zNjA2MTQx
+        NjUzMjVaMBUxEzARBgNVBAMTCmhvbWVsYWItY2EwWTATBgcqhkjOPQIBBggqhkjO
+        PQMBBwNCAARwkubJPPdhgKcqr+3AEO2tr5I7MhC3zzeAqpmv8glngsweiGznaDhi
+        Dbf8JFfilbrLEJBSuwHZQPuoNx+3fbvYo0IwQDAOBgNVHQ8BAf8EBAMCAqQwDwYD
+        VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUod8iYq0+QyetnxfKDprIf3XbWkEwCgYI
+        KoZIzj0EAwIDRwAwRAIgQ4HOLs5DOqcfAMv8NSImxoYN7TyebnlQAQXSARnIqBMC
+        IB9RycFvG/rpJuz/LIKi4rf6RARjLcHM/zqhXQJvBw53
+        -----END CERTIFICATE-----
+
+  rbac:
+    policy.csv: |
+      g, homelab-admins, role:admin
+    policy.default: role:readonly
+
+server:
+  replicas: 1
+  deploymentStrategy:
+    type: Recreate
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  # No Service of type LoadBalancer — port-forward only
+  service:
+    type: ClusterIP
+  podAnnotations:
+    secret.reloader.stakater.com/reload: "oidc-secret"
+    configmap.reloader.stakater.com/reload: "argocd-tls-certs-cm,argocd-cm"
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+
+repoServer:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+
+applicationSet:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 200m
+      memory: 256Mi
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
+controller:
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 1000m
+      memory: 1Gi
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+
+redis:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 128Mi
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
+notifications:
+  enabled: false   # add back later if alert routing is needed