feat:Fix the bootstrap to be deploy key application

2026-07-23 19:07:39 -07:00
parent eba9f2144c
commit 1c7395d9e1
37 changed files with 1216 additions and 1202 deletions
@@ -0,0 +1,55 @@
+# Continuous smoke — runs the full WebKit suite every 15 min. A failed run means
+# something users touch broke; alert on it (Job failure → kube-state-metrics
+# kube_job_status_failed → Alertmanager). Same image/env as the deploy-gate Job.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: e2e-smoke
+  namespace: platform
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+spec:
+  schedule: "*/15 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      ttlSecondsAfterFinished: 86400
+      template:
+        spec:
+          restartPolicy: Never
+          tolerations:
+            - key: node-role.kubernetes.io/control-plane
+              operator: Exists
+              effect: NoSchedule
+          containers:
+            - name: e2e
+              image: forgejo-gitea-http.cicd.svc.cluster.local:3000/riotpiao.com/homelab-e2e:latest
+              imagePullPolicy: Always
+              env:
+                - name: BASE_DOMAIN
+                  value: riotpiao.com
+                - name: E2E_IGNORE_TLS
+                  value: "0"
+                - name: CI
+                  value: "1"
+                - name: AK_ADMIN_USER
+                  value: akadmin
+                - name: AK_ADMIN_PASSWORD
+                  valueFrom:
+                    secretKeyRef: { name: e2e-credentials, key: authentik-admin-password }
+                - name: MINIO_ENDPOINT
+                  value: http://minio.storage.svc.cluster.local:9000
+                - name: MINIO_BUCKET
+                  value: e2e-artifacts
+                - name: MINIO_ACCESS_KEY
+                  valueFrom:
+                    secretKeyRef: { name: e2e-credentials, key: minio-access-key }
+                - name: MINIO_SECRET_KEY
+                  valueFrom:
+                    secretKeyRef: { name: e2e-credentials, key: minio-secret-key }
+              resources:
+                requests: { cpu: 200m, memory: 512Mi }
+                limits: { cpu: "1", memory: 2Gi }
@@ -0,0 +1,59 @@
+# One-shot E2E smoke — run as a deploy verification gate.
+# Wire as an ArgoCD PostSync hook (annotation below) OR call from an Argo Rollouts
+# AnalysisTemplate. Job success == the app is actually viewable in Safari's engine;
+# failure fails the sync/rollout.
+#
+# NOTE: not yet added to any kustomization / app-of-apps. Wiring = migration phase 7.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: e2e-smoke
+  namespace: platform
+  annotations:
+    # Uncomment to make this a deploy gate on the owning Application:
+    # argocd.argoproj.io/hook: PostSync
+    # argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-options: Prune=false
+spec:
+  backoffLimit: 1
+  ttlSecondsAfterFinished: 86400
+  template:
+    spec:
+      restartPolicy: Never
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+      containers:
+        - name: e2e
+          # Built + pushed by CI from tests/e2e/Dockerfile. Pin a digest in prod.
+          image: forgejo-gitea-http.cicd.svc.cluster.local:3000/riotpiao.com/homelab-e2e:latest
+          imagePullPolicy: Always
+          env:
+            - name: BASE_DOMAIN
+              value: riotpiao.com
+            # strict TLS by default; set "1" only during staging-cert bootstrap
+            - name: E2E_IGNORE_TLS
+              value: "0"
+            - name: CI
+              value: "1"
+            - name: AK_ADMIN_USER
+              value: akadmin
+            - name: AK_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: e2e-credentials
+                  key: authentik-admin-password
+            - name: MINIO_ENDPOINT
+              value: http://minio.storage.svc.cluster.local:9000
+            - name: MINIO_BUCKET
+              value: e2e-artifacts
+            - name: MINIO_ACCESS_KEY
+              valueFrom:
+                secretKeyRef: { name: e2e-credentials, key: minio-access-key }
+            - name: MINIO_SECRET_KEY
+              valueFrom:
+                secretKeyRef: { name: e2e-credentials, key: minio-secret-key }
+          resources:
+            requests: { cpu: 200m, memory: 512Mi }
+            limits: { cpu: "1", memory: 2Gi }