diff --git a/k8s/dev-tools/Chart.yaml b/k8s/applications/dev-tools/Chart.yaml similarity index 100% rename from k8s/dev-tools/Chart.yaml rename to k8s/applications/dev-tools/Chart.yaml diff --git a/k8s/dev-tools/Dockerfile b/k8s/applications/dev-tools/Dockerfile similarity index 100% rename from k8s/dev-tools/Dockerfile rename to k8s/applications/dev-tools/Dockerfile diff --git a/k8s/dev-tools/README.md b/k8s/applications/dev-tools/README.md similarity index 100% rename from k8s/dev-tools/README.md rename to k8s/applications/dev-tools/README.md diff --git a/k8s/dev-tools/build.sh b/k8s/applications/dev-tools/build.sh similarity index 100% rename from k8s/dev-tools/build.sh rename to k8s/applications/dev-tools/build.sh diff --git a/k8s/dev-tools/entrypoint.sh b/k8s/applications/dev-tools/entrypoint.sh similarity index 100% rename from k8s/dev-tools/entrypoint.sh rename to k8s/applications/dev-tools/entrypoint.sh diff --git a/k8s/applications/dev-tools/kustomization.yaml b/k8s/applications/dev-tools/kustomization.yaml new file mode 100644 index 0000000..907141b --- /dev/null +++ b/k8s/applications/dev-tools/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: dev-tools +resources: [] +# Helm chart deployed via ArgoCD Helm source diff --git a/k8s/dev-tools/templates/_helpers.tpl b/k8s/applications/dev-tools/templates/_helpers.tpl similarity index 100% rename from k8s/dev-tools/templates/_helpers.tpl rename to k8s/applications/dev-tools/templates/_helpers.tpl diff --git a/k8s/dev-tools/templates/deployment.yaml b/k8s/applications/dev-tools/templates/deployment.yaml similarity index 100% rename from k8s/dev-tools/templates/deployment.yaml rename to k8s/applications/dev-tools/templates/deployment.yaml diff --git a/k8s/dev-tools/templates/ingress.yaml b/k8s/applications/dev-tools/templates/ingress.yaml similarity index 100% rename from k8s/dev-tools/templates/ingress.yaml rename to k8s/applications/dev-tools/templates/ingress.yaml diff --git a/k8s/dev-tools/templates/pvc.yaml b/k8s/applications/dev-tools/templates/pvc.yaml similarity index 100% rename from k8s/dev-tools/templates/pvc.yaml rename to k8s/applications/dev-tools/templates/pvc.yaml diff --git a/k8s/dev-tools/templates/service.yaml b/k8s/applications/dev-tools/templates/service.yaml similarity index 100% rename from k8s/dev-tools/templates/service.yaml rename to k8s/applications/dev-tools/templates/service.yaml diff --git a/k8s/dev-tools/values.yaml b/k8s/applications/dev-tools/values.yaml similarity index 100% rename from k8s/dev-tools/values.yaml rename to k8s/applications/dev-tools/values.yaml diff --git a/k8s/duckdns/duckdns-corn.yaml b/k8s/applications/duckdns/duckdns-corn.yaml similarity index 100% rename from k8s/duckdns/duckdns-corn.yaml rename to k8s/applications/duckdns/duckdns-corn.yaml diff --git a/k8s/applications/duckdns/kustomization.yaml b/k8s/applications/duckdns/kustomization.yaml new file mode 100644 index 0000000..f81a4ff --- /dev/null +++ b/k8s/applications/duckdns/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: duckdns +resources: [] +# DuckDNS deployed via Helm chart or CronJob diff --git a/k8s/applications/forge/kustomization.yaml b/k8s/applications/forge/kustomization.yaml new file mode 100644 index 0000000..01bfa2e --- /dev/null +++ b/k8s/applications/forge/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: forge +resources: + - pki/ diff --git a/k8s/applications/forge/pki/kustomization.yaml b/k8s/applications/forge/pki/kustomization.yaml new file mode 100644 index 0000000..6dc0ef0 --- /dev/null +++ b/k8s/applications/forge/pki/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: [] +# PKI configuration, not K8s manifests diff --git a/k8s/forge/runner-gc-cronjob.yaml b/k8s/applications/forge/runner-gc-cronjob.yaml similarity index 100% rename from k8s/forge/runner-gc-cronjob.yaml rename to k8s/applications/forge/runner-gc-cronjob.yaml diff --git a/k8s/forge/runner.yaml b/k8s/applications/forge/runner.yaml similarity index 100% rename from k8s/forge/runner.yaml rename to k8s/applications/forge/runner.yaml diff --git a/k8s/applications/kustomization.yaml b/k8s/applications/kustomization.yaml new file mode 100644 index 0000000..976ceb8 --- /dev/null +++ b/k8s/applications/kustomization.yaml @@ -0,0 +1,18 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +metadata: + name: applications + +# Layer 5: Applications — user services, workloads +# Dependencies: all previous layers (bootstrap, platform, security) +# Order: Applied fifth + +resources: + - temporal/ + - sqs/ + - llm/ + - portainer/ + - forge/ + - shadowsocks/ + - dev-tools/ + - duckdns/ diff --git a/k8s/llm/README.md b/k8s/applications/llm/README.md similarity index 100% rename from k8s/llm/README.md rename to k8s/applications/llm/README.md diff --git a/k8s/llm/charts/ollama/Chart.yaml b/k8s/applications/llm/charts/ollama/Chart.yaml similarity index 100% rename from k8s/llm/charts/ollama/Chart.yaml rename to k8s/applications/llm/charts/ollama/Chart.yaml diff --git a/k8s/llm/charts/ollama/templates/deployment.yaml b/k8s/applications/llm/charts/ollama/templates/deployment.yaml similarity index 100% rename from k8s/llm/charts/ollama/templates/deployment.yaml rename to k8s/applications/llm/charts/ollama/templates/deployment.yaml diff --git a/k8s/llm/charts/ollama/templates/networkpolicy.yaml b/k8s/applications/llm/charts/ollama/templates/networkpolicy.yaml similarity index 100% rename from k8s/llm/charts/ollama/templates/networkpolicy.yaml rename to k8s/applications/llm/charts/ollama/templates/networkpolicy.yaml diff --git a/k8s/llm/charts/ollama/templates/preload-job.yaml b/k8s/applications/llm/charts/ollama/templates/preload-job.yaml similarity index 100% rename from k8s/llm/charts/ollama/templates/preload-job.yaml rename to k8s/applications/llm/charts/ollama/templates/preload-job.yaml diff --git a/k8s/llm/charts/ollama/templates/pvc.yaml b/k8s/applications/llm/charts/ollama/templates/pvc.yaml similarity index 100% rename from k8s/llm/charts/ollama/templates/pvc.yaml rename to k8s/applications/llm/charts/ollama/templates/pvc.yaml diff --git a/k8s/llm/charts/ollama/templates/service.yaml b/k8s/applications/llm/charts/ollama/templates/service.yaml similarity index 100% rename from k8s/llm/charts/ollama/templates/service.yaml rename to k8s/applications/llm/charts/ollama/templates/service.yaml diff --git a/k8s/llm/charts/ollama/templates/storageclass.yaml b/k8s/applications/llm/charts/ollama/templates/storageclass.yaml similarity index 100% rename from k8s/llm/charts/ollama/templates/storageclass.yaml rename to k8s/applications/llm/charts/ollama/templates/storageclass.yaml diff --git a/k8s/llm/charts/ollama/values.yaml b/k8s/applications/llm/charts/ollama/values.yaml similarity index 100% rename from k8s/llm/charts/ollama/values.yaml rename to k8s/applications/llm/charts/ollama/values.yaml diff --git a/k8s/applications/llm/kustomization.yaml b/k8s/applications/llm/kustomization.yaml new file mode 100644 index 0000000..a5e6fe2 --- /dev/null +++ b/k8s/applications/llm/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: llm +resources: + - scripts/ +# Helm charts deployed via ArgoCD Helm source diff --git a/k8s/applications/llm/scripts/kustomization.yaml b/k8s/applications/llm/scripts/kustomization.yaml new file mode 100644 index 0000000..73988a5 --- /dev/null +++ b/k8s/applications/llm/scripts/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: [] +# Shell scripts, not K8s manifests diff --git a/k8s/llm/scripts/setup-minio-bucket.sh b/k8s/applications/llm/scripts/setup-minio-bucket.sh similarity index 100% rename from k8s/llm/scripts/setup-minio-bucket.sh rename to k8s/applications/llm/scripts/setup-minio-bucket.sh diff --git a/k8s/portainer/bootstrap.sh b/k8s/applications/portainer/bootstrap.sh similarity index 100% rename from k8s/portainer/bootstrap.sh rename to k8s/applications/portainer/bootstrap.sh diff --git a/k8s/applications/portainer/kustomization.yaml b/k8s/applications/portainer/kustomization.yaml new file mode 100644 index 0000000..fdb6d93 --- /dev/null +++ b/k8s/applications/portainer/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: portainer +resources: [] +# Portainer deployed via Helm chart or existing manifests diff --git a/k8s/portainer/portainer-values.yaml b/k8s/applications/portainer/portainer-values.yaml similarity index 100% rename from k8s/portainer/portainer-values.yaml rename to k8s/applications/portainer/portainer-values.yaml diff --git a/k8s/applications/shadowsocks/kustomization.yaml b/k8s/applications/shadowsocks/kustomization.yaml new file mode 100644 index 0000000..5a57675 --- /dev/null +++ b/k8s/applications/shadowsocks/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: shadowsocks +resources: [] diff --git a/k8s/shadowsocks/shadowsocks.yaml b/k8s/applications/shadowsocks/shadowsocks.yaml similarity index 100% rename from k8s/shadowsocks/shadowsocks.yaml rename to k8s/applications/shadowsocks/shadowsocks.yaml diff --git a/k8s/sqs/argocd/apps/00-strimzi-operator.yaml b/k8s/applications/sqs/argocd/apps/00-strimzi-operator.yaml similarity index 100% rename from k8s/sqs/argocd/apps/00-strimzi-operator.yaml rename to k8s/applications/sqs/argocd/apps/00-strimzi-operator.yaml diff --git a/k8s/sqs/argocd/apps/01-kafka-cluster.yaml b/k8s/applications/sqs/argocd/apps/01-kafka-cluster.yaml similarity index 100% rename from k8s/sqs/argocd/apps/01-kafka-cluster.yaml rename to k8s/applications/sqs/argocd/apps/01-kafka-cluster.yaml diff --git a/k8s/sqs/argocd/apps/02-redis.yaml b/k8s/applications/sqs/argocd/apps/02-redis.yaml similarity index 100% rename from k8s/sqs/argocd/apps/02-redis.yaml rename to k8s/applications/sqs/argocd/apps/02-redis.yaml diff --git a/k8s/sqs/argocd/apps/03-queue-crd.yaml b/k8s/applications/sqs/argocd/apps/03-queue-crd.yaml similarity index 100% rename from k8s/sqs/argocd/apps/03-queue-crd.yaml rename to k8s/applications/sqs/argocd/apps/03-queue-crd.yaml diff --git a/k8s/sqs/argocd/apps/04-management-service.yaml b/k8s/applications/sqs/argocd/apps/04-management-service.yaml similarity index 100% rename from k8s/sqs/argocd/apps/04-management-service.yaml rename to k8s/applications/sqs/argocd/apps/04-management-service.yaml diff --git a/k8s/applications/sqs/argocd/apps/kustomization.yaml b/k8s/applications/sqs/argocd/apps/kustomization.yaml new file mode 100644 index 0000000..b0588a9 --- /dev/null +++ b/k8s/applications/sqs/argocd/apps/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: sqs +resources: + - 02-redis.yaml + - 03-queue-crd.yaml + - 04-management-service.yaml diff --git a/k8s/applications/sqs/argocd/kustomization.yaml b/k8s/applications/sqs/argocd/kustomization.yaml new file mode 100644 index 0000000..d867168 --- /dev/null +++ b/k8s/applications/sqs/argocd/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: sqs +resources: + - project.yaml + - root.yaml + - apps/ diff --git a/k8s/sqs/argocd/project.yaml b/k8s/applications/sqs/argocd/project.yaml similarity index 100% rename from k8s/sqs/argocd/project.yaml rename to k8s/applications/sqs/argocd/project.yaml diff --git a/k8s/sqs/argocd/root.yaml b/k8s/applications/sqs/argocd/root.yaml similarity index 100% rename from k8s/sqs/argocd/root.yaml rename to k8s/applications/sqs/argocd/root.yaml diff --git a/k8s/sqs/charts/kafka-cluster/Chart.yaml b/k8s/applications/sqs/charts/kafka-cluster/Chart.yaml similarity index 100% rename from k8s/sqs/charts/kafka-cluster/Chart.yaml rename to k8s/applications/sqs/charts/kafka-cluster/Chart.yaml diff --git a/k8s/sqs/charts/kafka-cluster/templates/kafka-cluster.yaml b/k8s/applications/sqs/charts/kafka-cluster/templates/kafka-cluster.yaml similarity index 100% rename from k8s/sqs/charts/kafka-cluster/templates/kafka-cluster.yaml rename to k8s/applications/sqs/charts/kafka-cluster/templates/kafka-cluster.yaml diff --git a/k8s/sqs/charts/kafka-cluster/templates/kafka-nodepool.yaml b/k8s/applications/sqs/charts/kafka-cluster/templates/kafka-nodepool.yaml similarity index 100% rename from k8s/sqs/charts/kafka-cluster/templates/kafka-nodepool.yaml rename to k8s/applications/sqs/charts/kafka-cluster/templates/kafka-nodepool.yaml diff --git a/k8s/sqs/charts/kafka-cluster/templates/storageclass.yaml b/k8s/applications/sqs/charts/kafka-cluster/templates/storageclass.yaml similarity index 100% rename from k8s/sqs/charts/kafka-cluster/templates/storageclass.yaml rename to k8s/applications/sqs/charts/kafka-cluster/templates/storageclass.yaml diff --git a/k8s/sqs/charts/kafka-cluster/values.yaml b/k8s/applications/sqs/charts/kafka-cluster/values.yaml similarity index 100% rename from k8s/sqs/charts/kafka-cluster/values.yaml rename to k8s/applications/sqs/charts/kafka-cluster/values.yaml diff --git a/k8s/sqs/charts/management-service/Chart.yaml b/k8s/applications/sqs/charts/management-service/Chart.yaml similarity index 100% rename from k8s/sqs/charts/management-service/Chart.yaml rename to k8s/applications/sqs/charts/management-service/Chart.yaml diff --git a/k8s/sqs/charts/management-service/templates/configmap.yaml b/k8s/applications/sqs/charts/management-service/templates/configmap.yaml similarity index 100% rename from k8s/sqs/charts/management-service/templates/configmap.yaml rename to k8s/applications/sqs/charts/management-service/templates/configmap.yaml diff --git a/k8s/sqs/charts/management-service/templates/deployment.yaml b/k8s/applications/sqs/charts/management-service/templates/deployment.yaml similarity index 100% rename from k8s/sqs/charts/management-service/templates/deployment.yaml rename to k8s/applications/sqs/charts/management-service/templates/deployment.yaml diff --git a/k8s/sqs/charts/management-service/templates/hpa.yaml b/k8s/applications/sqs/charts/management-service/templates/hpa.yaml similarity index 100% rename from k8s/sqs/charts/management-service/templates/hpa.yaml rename to k8s/applications/sqs/charts/management-service/templates/hpa.yaml diff --git a/k8s/sqs/charts/management-service/templates/ingress-grpc.yaml b/k8s/applications/sqs/charts/management-service/templates/ingress-grpc.yaml similarity index 100% rename from k8s/sqs/charts/management-service/templates/ingress-grpc.yaml rename to k8s/applications/sqs/charts/management-service/templates/ingress-grpc.yaml diff --git a/k8s/sqs/charts/management-service/templates/ingress.yaml b/k8s/applications/sqs/charts/management-service/templates/ingress.yaml similarity index 100% rename from k8s/sqs/charts/management-service/templates/ingress.yaml rename to k8s/applications/sqs/charts/management-service/templates/ingress.yaml diff --git a/k8s/sqs/charts/management-service/templates/service.yaml b/k8s/applications/sqs/charts/management-service/templates/service.yaml similarity index 100% rename from k8s/sqs/charts/management-service/templates/service.yaml rename to k8s/applications/sqs/charts/management-service/templates/service.yaml diff --git a/k8s/sqs/charts/management-service/values.yaml b/k8s/applications/sqs/charts/management-service/values.yaml similarity index 100% rename from k8s/sqs/charts/management-service/values.yaml rename to k8s/applications/sqs/charts/management-service/values.yaml diff --git a/k8s/sqs/charts/queue-crd/Chart.yaml b/k8s/applications/sqs/charts/queue-crd/Chart.yaml similarity index 100% rename from k8s/sqs/charts/queue-crd/Chart.yaml rename to k8s/applications/sqs/charts/queue-crd/Chart.yaml diff --git a/k8s/sqs/charts/queue-crd/templates/crd.yaml b/k8s/applications/sqs/charts/queue-crd/templates/crd.yaml similarity index 100% rename from k8s/sqs/charts/queue-crd/templates/crd.yaml rename to k8s/applications/sqs/charts/queue-crd/templates/crd.yaml diff --git a/k8s/sqs/charts/queue-crd/templates/operator-deployment.yaml b/k8s/applications/sqs/charts/queue-crd/templates/operator-deployment.yaml similarity index 100% rename from k8s/sqs/charts/queue-crd/templates/operator-deployment.yaml rename to k8s/applications/sqs/charts/queue-crd/templates/operator-deployment.yaml diff --git a/k8s/sqs/charts/queue-crd/templates/rbac.yaml b/k8s/applications/sqs/charts/queue-crd/templates/rbac.yaml similarity index 100% rename from k8s/sqs/charts/queue-crd/templates/rbac.yaml rename to k8s/applications/sqs/charts/queue-crd/templates/rbac.yaml diff --git a/k8s/sqs/charts/queue-crd/values.yaml b/k8s/applications/sqs/charts/queue-crd/values.yaml similarity index 100% rename from k8s/sqs/charts/queue-crd/values.yaml rename to k8s/applications/sqs/charts/queue-crd/values.yaml diff --git a/k8s/sqs/environments/homelab.yaml b/k8s/applications/sqs/environments/homelab.yaml similarity index 100% rename from k8s/sqs/environments/homelab.yaml rename to k8s/applications/sqs/environments/homelab.yaml diff --git a/k8s/applications/sqs/environments/kustomization.yaml b/k8s/applications/sqs/environments/kustomization.yaml new file mode 100644 index 0000000..f8c3667 --- /dev/null +++ b/k8s/applications/sqs/environments/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: sqs +resources: [] +# homelab.yaml is configuration, not a K8s manifest diff --git a/k8s/sqs/helmfile.yaml.gotmpl b/k8s/applications/sqs/helmfile.yaml.gotmpl similarity index 100% rename from k8s/sqs/helmfile.yaml.gotmpl rename to k8s/applications/sqs/helmfile.yaml.gotmpl diff --git a/k8s/applications/sqs/kustomization.yaml b/k8s/applications/sqs/kustomization.yaml new file mode 100644 index 0000000..c0a5fd9 --- /dev/null +++ b/k8s/applications/sqs/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: sqs +resources: + - argocd/ + - environments/ + - queues/ +# Helm charts deployed via ArgoCD Helm source diff --git a/k8s/applications/sqs/queues/kustomization.yaml b/k8s/applications/sqs/queues/kustomization.yaml new file mode 100644 index 0000000..587b59f --- /dev/null +++ b/k8s/applications/sqs/queues/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - orders-fifo.yaml diff --git a/k8s/sqs/queues/orders-fifo.yaml b/k8s/applications/sqs/queues/orders-fifo.yaml similarity index 100% rename from k8s/sqs/queues/orders-fifo.yaml rename to k8s/applications/sqs/queues/orders-fifo.yaml diff --git a/k8s/temporal/PHASE_2_TESTING.md b/k8s/applications/temporal/PHASE_2_TESTING.md similarity index 100% rename from k8s/temporal/PHASE_2_TESTING.md rename to k8s/applications/temporal/PHASE_2_TESTING.md diff --git a/k8s/temporal/TEMPORAL_OAUTH2_SETUP.md b/k8s/applications/temporal/TEMPORAL_OAUTH2_SETUP.md similarity index 100% rename from k8s/temporal/TEMPORAL_OAUTH2_SETUP.md rename to k8s/applications/temporal/TEMPORAL_OAUTH2_SETUP.md diff --git a/k8s/temporal/elasticsearch.yaml b/k8s/applications/temporal/elasticsearch.yaml similarity index 100% rename from k8s/temporal/elasticsearch.yaml rename to k8s/applications/temporal/elasticsearch.yaml diff --git a/k8s/applications/temporal/kustomization.yaml b/k8s/applications/temporal/kustomization.yaml new file mode 100644 index 0000000..5dadecf --- /dev/null +++ b/k8s/applications/temporal/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: temporal +resources: + - elasticsearch.yaml + - queues/ +# SOPS secrets (*.enc.yaml) handled by ArgoCD SOPS plugin at sync time +# temporal deployed via ArgoCD Helm source diff --git a/k8s/temporal/queues/example-queue.yaml b/k8s/applications/temporal/queues/example-queue.yaml similarity index 100% rename from k8s/temporal/queues/example-queue.yaml rename to k8s/applications/temporal/queues/example-queue.yaml diff --git a/k8s/applications/temporal/queues/kustomization.yaml b/k8s/applications/temporal/queues/kustomization.yaml new file mode 100644 index 0000000..c5741b6 --- /dev/null +++ b/k8s/applications/temporal/queues/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - example-queue.yaml diff --git a/k8s/temporal/temporal-secrets.enc.yaml b/k8s/applications/temporal/temporal-secrets.enc.yaml similarity index 100% rename from k8s/temporal/temporal-secrets.enc.yaml rename to k8s/applications/temporal/temporal-secrets.enc.yaml diff --git a/k8s/temporal/temporal-values.yaml b/k8s/applications/temporal/temporal-values.yaml similarity index 100% rename from k8s/temporal/temporal-values.yaml rename to k8s/applications/temporal/temporal-values.yaml diff --git a/k8s/argocd/apps/00-homelab-root.yaml b/k8s/argocd/apps/00-homelab-root.yaml new file mode 100644 index 0000000..5690153 --- /dev/null +++ b/k8s/argocd/apps/00-homelab-root.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: homelab-root + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + project: homelab + source: + repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git + targetRevision: main + path: k8s/argocd/root + destination: + server: https://kubernetes.default.svc + namespace: argocd + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/argocd/apps/layer-1-infrastructure.yaml b/k8s/argocd/apps/layer-1-infrastructure.yaml new file mode 100644 index 0000000..61be883 --- /dev/null +++ b/k8s/argocd/apps/layer-1-infrastructure.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: layer-1-infrastructure + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + project: homelab + source: + repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git + targetRevision: main + path: k8s/infrastructure + destination: + server: https://kubernetes.default.svc + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/argocd/apps/layer-2-bootstrap.yaml b/k8s/argocd/apps/layer-2-bootstrap.yaml new file mode 100644 index 0000000..a960332 --- /dev/null +++ b/k8s/argocd/apps/layer-2-bootstrap.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: layer-2-bootstrap + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + project: homelab + source: + repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git + targetRevision: main + path: k8s/bootstrap + destination: + server: https://kubernetes.default.svc + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/argocd/apps/layer-3-platform.yaml b/k8s/argocd/apps/layer-3-platform.yaml new file mode 100644 index 0000000..28b02ee --- /dev/null +++ b/k8s/argocd/apps/layer-3-platform.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: layer-3-platform + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "3" +spec: + project: homelab + source: + repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git + targetRevision: main + path: k8s/platform + destination: + server: https://kubernetes.default.svc + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/argocd/apps/layer-4-security.yaml b/k8s/argocd/apps/layer-4-security.yaml new file mode 100644 index 0000000..ffe4fb8 --- /dev/null +++ b/k8s/argocd/apps/layer-4-security.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: layer-4-security + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "4" +spec: + project: homelab + source: + repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git + targetRevision: main + path: k8s/security + destination: + server: https://kubernetes.default.svc + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/argocd/apps/layer-5-applications.yaml b/k8s/argocd/apps/layer-5-applications.yaml new file mode 100644 index 0000000..746a1d3 --- /dev/null +++ b/k8s/argocd/apps/layer-5-applications.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: layer-5-applications + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "5" +spec: + project: homelab + source: + repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git + targetRevision: main + path: k8s/applications + destination: + server: https://kubernetes.default.svc + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/argocd/apps/layer-6-data.yaml b/k8s/argocd/apps/layer-6-data.yaml new file mode 100644 index 0000000..aa02ddd --- /dev/null +++ b/k8s/argocd/apps/layer-6-data.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: layer-6-data + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "6" +spec: + project: homelab + source: + repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git + targetRevision: main + path: k8s/data + destination: + server: https://kubernetes.default.svc + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/k8s/argocd/root/kustomization.yaml b/k8s/argocd/root/kustomization.yaml new file mode 100644 index 0000000..ac0078d --- /dev/null +++ b/k8s/argocd/root/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +metadata: + name: homelab-root + +# Root Application orchestration +# Includes all layer Applications in order (sync-wave) + +resources: + - ../apps/layer-1-infrastructure.yaml + - ../apps/layer-2-bootstrap.yaml + - ../apps/layer-3-platform.yaml + - ../apps/layer-4-security.yaml + - ../apps/layer-5-applications.yaml + - ../apps/layer-6-data.yaml diff --git a/k8s/base/namespace-setup.sh b/k8s/base/namespace-setup.sh deleted file mode 100755 index 6b18587..0000000 --- a/k8s/base/namespace-setup.sh +++ /dev/null @@ -1,19 +0,0 @@ -#!/bin/bash -# Reusable namespace setup script -# Creates namespace and applies pod-security policy labels -# Usage: bash k8s/base/namespace-setup.sh [ ...] -set -euo pipefail - -if [ $# -eq 0 ]; then - echo "Usage: $0 [ ...]" >&2 - exit 1 -fi - -for namespace in "$@"; do - kubectl create namespace "$namespace" --dry-run=client -o yaml | kubectl apply -f - - kubectl label namespace "$namespace" \ - pod-security.kubernetes.io/enforce=privileged \ - pod-security.kubernetes.io/enforce-version=latest \ - --overwrite - echo "✓ Namespace '$namespace' ready" -done diff --git a/k8s/base/poddisruptionbudgets.yaml b/k8s/base/poddisruptionbudgets.yaml deleted file mode 100644 index 40a5e60..0000000 --- a/k8s/base/poddisruptionbudgets.yaml +++ /dev/null @@ -1,322 +0,0 @@ -# k8s/base/poddisruptionbudgets.yaml -# PodDisruptionBudgets ensure zero-downtime cluster maintenance. -# Allows Kubernetes to gracefully drain nodes during updates/maintenance -# without violating availability guarantees. - ---- -# Observability stack -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: grafana - namespace: logging -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: grafana - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: loki - namespace: logging -spec: - minAvailable: 1 - selector: - matchLabels: - app: loki - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: prometheus - namespace: monitoring -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: prometheus - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: prometheus-operator - namespace: monitoring -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: kube-prometheus-stack-operator - ---- -# IAM stack -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: authentik - namespace: iam -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: authentik - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: vault - namespace: iam -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: vault - ---- -# CI/CD stack -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: argocd-server - namespace: cicd -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: argocd-server - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: argocd-repo-server - namespace: cicd -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: argocd-repo-server - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: forgejo - namespace: forge -spec: - minAvailable: 1 - selector: - matchLabels: - app: forgejo - ---- -# Ingress & network -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: ingress-nginx - namespace: ingress-nginx -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: ingress-nginx - ---- -# Certificate management -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: cert-manager - namespace: cert-manager -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: cert-manager - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: cert-manager-webhook - namespace: cert-manager -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: cert-manager-webhook - ---- -# Storage & replication -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: minio-az-a - namespace: storage -spec: - minAvailable: 2 - selector: - matchLabels: - app: minio - instance: az-a - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: minio-az-b - namespace: storage -spec: - minAvailable: 2 - selector: - matchLabels: - app: minio - instance: az-b - ---- -# Database -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: cnpg-cluster - namespace: ddb -spec: - minAvailable: 2 - selector: - matchLabels: - cnpg.io/cluster: ddb-cluster - ---- -# Messaging -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: kafka-broker - namespace: sqs -spec: - minAvailable: 2 - selector: - matchLabels: - app.kubernetes.io/name: kafka - app.kubernetes.io/component: kafka-broker - ---- -# Workflow orchestration -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: temporal-cassandra - namespace: temporal -spec: - minAvailable: 2 - selector: - matchLabels: - app: cassandra - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: temporal-server - namespace: temporal -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: temporal - app.kubernetes.io/component: server - ---- -# LLM inference -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: ollama - namespace: llm -spec: - minAvailable: 1 - selector: - matchLabels: - app: ollama - ---- -# Cluster DNS -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: coredns - namespace: kube-system -spec: - minAvailable: 1 - selector: - matchLabels: - k8s-app: kube-dns - ---- -# Cilium networking -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: cilium-agent - namespace: kube-system -spec: - minAvailable: 1 - selector: - matchLabels: - k8s-app: cilium - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: cilium-operator - namespace: kube-system -spec: - minAvailable: 1 - selector: - matchLabels: - io.cilium/app: operator - ---- -# Longhorn storage -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: longhorn-manager - namespace: longhorn-system -spec: - minAvailable: 2 - selector: - matchLabels: - app: longhorn-manager - ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: longhorn-csi-plugin - namespace: longhorn-system -spec: - minAvailable: 1 - selector: - matchLabels: - app: csi-provisioner - ---- -# System components -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: kube-state-metrics - namespace: monitoring -spec: - minAvailable: 1 - selector: - matchLabels: - app.kubernetes.io/name: kube-state-metrics diff --git a/k8s/base/secrets.enc.yaml b/k8s/base/secrets.enc.yaml deleted file mode 100644 index 98cea03..0000000 --- a/k8s/base/secrets.enc.yaml +++ /dev/null @@ -1,38 +0,0 @@ -authentik: - secret_key: ENC[AES256_GCM,data:4u/VJKGJL6J+ILh2+HY=,iv:mZus6YQX7TK6BK8JbHvS113ph4jZpUqKiKLK69nLc8k=,tag:xj/FhXl/GpA7zfYBkyEpGA==,type:str] - bootstrap_password: ENC[AES256_GCM,data:z5qyj124j90pimo07QQ=,iv:oJj54T0WEoy4zq8gTPsCBEZ5BqJubbyuLBdb9in98oU=,tag:SaVmxgIqxhzBjOnMi1PT6g==,type:str] - bootstrap_token: ENC[AES256_GCM,data:zbs67SwmNqXUj1inerg=,iv:TL3hu2NR9eCvZQHM9L2WJHlhi1lqNJDU+tKHJHy8OZM=,tag:2fzVZDXazzNrExBq/12dfQ==,type:str] - postgresql_password: ENC[AES256_GCM,data:lnisFWkVkv9LmRiB+cA=,iv:nFcecdugM8GB+ty4Ac5HhN84ekWk+VpDRh2QuW7cZhk=,tag:8Nu9aodwPqQ+1OP4xRVr2g==,type:str] -minio: - root_user: ENC[AES256_GCM,data:MQQHIaoc1tuG8A==,iv:92bGTYwyqc7tasjO0F8j2cBH28/ZOBHMkawsix6Z0UE=,tag:gkug3OeiZ5tpPrtXApFfsg==,type:str] - root_password: ENC[AES256_GCM,data:Neb1t95cJqxnnXKCIAYqLl6N0zdtD843RrnHyXhnEulZhvqPeMC2Y1DIZr8=,iv:NSveFwxhONWq8MfcVCvjLisbHJgZfkLBBp9Z0tmxQ+Y=,tag:zM0hpg97GcMJ9YFtDj7vjQ==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:I+JJuokOMYX/52sSxos=,iv:wxZQ1NaeYCF3EMkZKyrzTXP35fbiA8VnMZV3cX+NYuA=,tag:O/7kuLTws7cz45GbACHsYQ==,type:str] -forgejo: - admin_password: ENC[AES256_GCM,data:WbjwEpB6vkRjZEwXg1QVPVl0pj5/QOfuo0SJndBr5OE=,iv:jvZ7+IH++qaUJL9Ts2+6X5ip1QvLOeGfzoBsKsFjbwo=,tag:zQXfRuXUdqwTcA7EDzRwJA==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:2ikhULuCiUx98G9FubTKolZrDLuctA6F7m7xSTK/K+qHAmN4Zuqi+BzU56dfC0W2g7ZUqQ8flPQ8Jw2HlR/mww==,iv:zVZeAdxraSEQNMSX1r08L8j5g7pCKP86OTOBAHg3AIU=,tag:vke5Pj7QnEPIbI6LswLXnQ==,type:str] -grafana: - admin_password: ENC[AES256_GCM,data:cFfbO8f/A2yQVnXUa2Trpnp9g6M=,iv:LEnAOBFwr4YtmlXdE+GnorFPR1zJ406sxch0pgnnTCs=,tag:LDkt62m8zIw6sBTIiJBLTA==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:YQV8mM6ogq57bXb1oFCocO+JPhFztAhqosex54s4ZcvJDSnQbAy/ILfcTVqQ26qoD4M7Bf2p+P/lSAO9RXPKtA==,iv:X2X/k2MqdEXN0SO53RadvS3JKzkXlTfgSf5bZCaWFRI=,tag:UK+BvSBa2ZXLmZHoh/V18A==,type:str] -argocd: - oidc_client_secret: ENC[AES256_GCM,data:BxTd8J/hnMDRBwND1ho=,iv:hP8OwLWTiaB3tT5kQarDWpfPYe/wWP/7DP+TyM7OJZY=,tag:K05rRDyk6dJYAtjJmgtbNQ==,type:str] -temporal: - oidc_client_id: ENC[AES256_GCM,data:zKj5POhCGcfoXy+d+zg=,iv:1NmLIy0xQ9V9AZipU/r6HQOPkvsTFV29cESVFsRZaZw=,tag:U+SkYLAXj5OSNJImINO5sw==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:hWgK6dhh7onHmTwq3UU=,iv:iahP7vl3RPQaOJDvlTVqjn1+w8H8y0AZ/CToiIpZtB4=,tag:qqRhHShIc36aEmtUHHUnig==,type:str] -ollama: - oidc_client_id: ENC[AES256_GCM,data:b9+dTdLSL4mbodLBcI8=,iv:gnborzVMME6Baw4LuvucjdqjNnyygXhRZ1K4yQyr26c=,tag:2DfC9uRbVKzf5zcPspa+vA==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:Ow8JrhgCJlHfYfQ1GBc=,iv:QBXdVyowDKPsN4Fjbe9Eh0O4cTgrPAx6EfN5kpRRsek=,tag:zw4mN/SJQMh25vm/yoCNBQ==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxVWZkRDRBc09BakYvaUZD - em1CcFhwOVpjRnJsYjhxM3J3WldnMjE3MkJvClJrT1BXaGFkOU80V3krbVRNYXVo - RE5Jb0dISEJiU1lVc1U4blI0b2d6SVUKLS0tIDM2dk95M08rQkNuYStYbks1ZVBG - L2pIS3ZMYUVxTndwcW1zNCtPbWJ0Y2sKW6SkSLf+y37WR0hVy5bVegnsjBRCsmqq - VYNVFf/xzrCU6Bjv0KV/1laHHmQoea1xQPC2l6KrptUEZoVjDYkKpQ== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-15T22:03:57Z" - mac: ENC[AES256_GCM,data:wds9Tc4t3V5uTxdsXtJuuOXLfRNt+uPso6Ge3TTgv8BDDxN/jPQmBPljvdKp8U7kXhtq7ifgtEbJUwunZvBAhJN8T2gQs6+SaNgNS+H7RqWXWsTnMy0u1PAz6WX8FEYNeZMqePrkAtV6kLjx3B/b6bL+mRxVXut8+kBmfpKgoEI=,iv:Su6uHqqn5qdoIdxxOGRmapyv8OsYNbPwRVD/QHgJZa0=,tag:hh9KcYDXPaq+aGUDzJDPKQ==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/cert-manager/cert-manager-values.yaml b/k8s/bootstrap/cert-manager/cert-manager-values.yaml similarity index 100% rename from k8s/cert-manager/cert-manager-values.yaml rename to k8s/bootstrap/cert-manager/cert-manager-values.yaml diff --git a/k8s/bootstrap/cert-manager/kustomization.yaml b/k8s/bootstrap/cert-manager/kustomization.yaml new file mode 100644 index 0000000..e3b2849 --- /dev/null +++ b/k8s/bootstrap/cert-manager/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: cert-manager +resources: [] +# cert-manager deployed via ArgoCD Helm source (see layer-2-bootstrap app) diff --git a/k8s/bootstrap/cilium/kustomization.yaml b/k8s/bootstrap/cilium/kustomization.yaml new file mode 100644 index 0000000..6fee30a --- /dev/null +++ b/k8s/bootstrap/cilium/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kube-system +resources: [] +# Cilium deployed via Helm chart diff --git a/k8s/cilium/l2-announcement-policy.yaml b/k8s/bootstrap/cilium/l2-announcement-policy.yaml similarity index 100% rename from k8s/cilium/l2-announcement-policy.yaml rename to k8s/bootstrap/cilium/l2-announcement-policy.yaml diff --git a/k8s/cilium/lb-ipam-pool.yaml b/k8s/bootstrap/cilium/lb-ipam-pool.yaml similarity index 100% rename from k8s/cilium/lb-ipam-pool.yaml rename to k8s/bootstrap/cilium/lb-ipam-pool.yaml diff --git a/k8s/coredns/coredns-configmap.yaml b/k8s/bootstrap/coredns/coredns-configmap.yaml similarity index 100% rename from k8s/coredns/coredns-configmap.yaml rename to k8s/bootstrap/coredns/coredns-configmap.yaml diff --git a/k8s/coredns/coredns-deployment.yaml b/k8s/bootstrap/coredns/coredns-deployment.yaml similarity index 100% rename from k8s/coredns/coredns-deployment.yaml rename to k8s/bootstrap/coredns/coredns-deployment.yaml diff --git a/k8s/bootstrap/coredns/kustomization.yaml b/k8s/bootstrap/coredns/kustomization.yaml new file mode 100644 index 0000000..be84455 --- /dev/null +++ b/k8s/bootstrap/coredns/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: kube-system +resources: [] +# CoreDNS deployed via Helm chart diff --git a/k8s/ingress/ingress.yaml b/k8s/bootstrap/ingress/ingress.yaml similarity index 100% rename from k8s/ingress/ingress.yaml rename to k8s/bootstrap/ingress/ingress.yaml diff --git a/k8s/bootstrap/ingress/kustomization.yaml b/k8s/bootstrap/ingress/kustomization.yaml new file mode 100644 index 0000000..cfe69e2 --- /dev/null +++ b/k8s/bootstrap/ingress/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: ingress-nginx +resources: [] +# Ingress controller deployed via Helm chart diff --git a/k8s/ingress/nginx-values.yaml b/k8s/bootstrap/ingress/nginx-values.yaml similarity index 100% rename from k8s/ingress/nginx-values.yaml rename to k8s/bootstrap/ingress/nginx-values.yaml diff --git a/k8s/ingress/wildcard-cert.yaml b/k8s/bootstrap/ingress/wildcard-cert.yaml similarity index 100% rename from k8s/ingress/wildcard-cert.yaml rename to k8s/bootstrap/ingress/wildcard-cert.yaml diff --git a/k8s/bootstrap/kustomization.yaml b/k8s/bootstrap/kustomization.yaml new file mode 100644 index 0000000..e19596b --- /dev/null +++ b/k8s/bootstrap/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +metadata: + name: bootstrap + +# Layer 2: Bootstrap — networking, certificates, DNS +# Dependencies: infrastructure (namespaces, storage from layer 1) +# Order: Applied second + +resources: + - cert-manager/ + - cilium/ + - coredns/ + - ingress/ diff --git a/k8s/data/kustomization.yaml b/k8s/data/kustomization.yaml new file mode 100644 index 0000000..71b6460 --- /dev/null +++ b/k8s/data/kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +metadata: + name: data + +# Layer 6: Data — stateful services (databases, message brokers) +# Dependencies: all previous layers +# Order: Applied last + +# Placeholder for future database deployments +# Currently empty; databases deployed via Layer 5 applications +resources: [] diff --git a/k8s/ddb/cnpg-values.yaml b/k8s/ddb/cnpg-values.yaml deleted file mode 100644 index d05017f..0000000 --- a/k8s/ddb/cnpg-values.yaml +++ /dev/null @@ -1,51 +0,0 @@ -# CloudNativePG Operator Configuration -# Handles PostgreSQL cluster management with HA replication -# -# Timeout settings tuned for clusters with 5+ second network latency spikes - -# Operator deployment -replicaCount: 1 - -# Operator Pod configuration -podAnnotations: - prometheus.io/scrape: "true" - prometheus.io/port: "8080" - -# Resource limits -resources: - limits: - memory: 512Mi - requests: - memory: 256Mi - -# Monitoring -monitoring: - enabled: true - serviceMonitor: - enabled: false # disable until we have prometheus-operator CRDs - -# ── Configuration for operator behavior ──────────────────────────────────────── -# Applied to the cnpg-controller-manager-config ConfigMap -config: - # HTTP client timeout for communicating with Postgres instances - # Default: 30s. Increased to 120s to tolerate 5+ second network latency spikes - instanceManagerHTTPClientTimeout: 120s - - # TLS verification for instance manager - instanceManagerTLSInsecureSkipVerify: false - - # Allow debug logging to diagnose HTTP communication issues - enableDebugLogging: true - - # Pod debugging (disabled; security risk in production) - enablePodDebugging: false - - # In-place updates for instance manager (disabled; safer for HA) - enableInstanceManagerInplaceUpdates: false - - # Azure PVC updates (not applicable for Longhorn) - enableAzurePVCUpdates: false - - # Certificate lifetime (90 days) and renewal threshold (7 days before expiry) - certificateDuration: 90 - expiringCheckThreshold: 7 diff --git a/k8s/ddb/init-users.sh b/k8s/ddb/init-users.sh deleted file mode 100755 index 7079759..0000000 --- a/k8s/ddb/init-users.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/bash -# Safe database initialization script -# Applies init-users.sql with environment variable substitution -# Exit on any error -set -euo pipefail - -# Get superuser password from CNPG secret -PG_PASSWORD=$(kubectl get secret -n ddb ddb-cluster-app -o jsonpath='{.data.password}' | base64 -d) -export PGPASSWORD="$PG_PASSWORD" - -# Apply SQL with safe variable substitution (psql -v prevents injection) -psql \ - -h ddb-cluster-rw.ddb.svc.cluster.local \ - -U postgres \ - -d postgres \ - -v authentik_password="$AUTHENTIK_PG_PASSWORD" \ - -v story_crater_password="$STORY_CRATER_PG_PASSWORD" \ - -f k8s/ddb/init-users.sql - -unset PGPASSWORD -echo "✓ Database initialization complete" diff --git a/k8s/ddb/init-users.sql b/k8s/ddb/init-users.sql deleted file mode 100644 index 1d792bb..0000000 --- a/k8s/ddb/init-users.sql +++ /dev/null @@ -1,11 +0,0 @@ --- Database initialization for homelab applications --- Idempotent: safe to re-run --- Required environment variables: --- AUTHENTIK_PG_PASSWORD --- STORY_CRATER_PG_PASSWORD - -CREATE ROLE IF NOT EXISTS authentik WITH LOGIN PASSWORD :'authentik_password'; -CREATE DATABASE IF NOT EXISTS authentik OWNER authentik; - -CREATE ROLE IF NOT EXISTS story_crater WITH LOGIN PASSWORD :'story_crater_password'; -CREATE DATABASE IF NOT EXISTS story_crater OWNER story_crater; diff --git a/k8s/hooks/phase2/phase2-hooks.yaml b/k8s/hooks/phase2/phase2-hooks.yaml deleted file mode 100644 index 09db118..0000000 --- a/k8s/hooks/phase2/phase2-hooks.yaml +++ /dev/null @@ -1,323 +0,0 @@ -# ArgoCD Hook Jobs for Phase 2 releases -# Replaces helmfile presync/postsync hooks with K8s Job manifests - ---- -# ── CloudNativePG — PreSync: Create CNPG Cluster CR ────────────────────────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: cnpg-cluster-setup - namespace: ddb - annotations: - argocd.argoproj.io/hook: PreSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: cnpg-setup - restartPolicy: Never - containers: - - name: setup - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - set -e - echo "Creating CNPG Cluster CR..." - - # Wait for operator to be ready - kubectl rollout status deploy/cloudnative-pg -n ddb --timeout=120s 2>/dev/null || true - - # Apply CNPG Cluster CR (from existing helmfile hook) - kubectl apply -f - <<'EOF' - apiVersion: postgresql.cnpg.io/v1 - kind: Cluster - metadata: - name: ddb-cluster - namespace: ddb - spec: - instances: 3 - imageName: ghcr.io/cloudnative-pg/postgresql:16.2 - bootstrap: - initdb: - database: postgres - owner: postgres - postInitApplicationSQL: - - "CREATE EXTENSION IF NOT EXISTS vector;" - storage: - size: 10Gi - storageClass: longhorn - postgresql: - parameters: - max_parallel_workers_per_gather: "4" - max_parallel_workers: "4" - shared_buffers: "256MB" - wal_sender_timeout: "900" - wal_receiver_timeout: "900" - podTemplateSpec: - spec: - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - matchExpressions: - - key: cnpg.io/cluster - operator: In - values: - - ddb-cluster - topologyKey: kubernetes.io/hostname - containers: - - name: postgres - livenessProbe: - httpGet: - port: 8000 - path: /healthz - initialDelaySeconds: 0 - timeoutSeconds: 60 - periodSeconds: 10 - failureThreshold: 3 - readinessProbe: - httpGet: - port: 8000 - path: /readyz - initialDelaySeconds: 0 - timeoutSeconds: 60 - periodSeconds: 10 - failureThreshold: 3 - startupProbe: - httpGet: - port: 8000 - path: /healthz - initialDelaySeconds: 0 - timeoutSeconds: 60 - periodSeconds: 10 - failureThreshold: 360 - EOF - - echo "✓ CNPG Cluster CR applied" - ---- -# ── CloudNativePG — PostSync: Wait for cluster, init-users, migrations ────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: cnpg-init-complete - namespace: ddb - annotations: - argocd.argoproj.io/hook: PostSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: cnpg-setup - restartPolicy: Never - containers: - - name: init - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - set -e - echo "Waiting for CNPG cluster to be Ready..." - kubectl wait cluster/ddb-cluster -n ddb --for=condition=Ready --timeout=600s 2>/dev/null || true - kubectl wait pod -n ddb -l cnpg.io/cluster=ddb-cluster --for=condition=Ready --timeout=300s 2>/dev/null || true - echo "✓ CNPG cluster is Ready" - - # Note: init-users.sh and migrations require access to .env secrets - # TODO: migrate to SOPS-based secret injection - echo "Database initialization requires Vault/Secret integration (placeholder)" - ---- -# ── Prometheus — PostSync: Apply alerts and CRDs ────────────────────────────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: prometheus-alerts-apply - namespace: monitoring - annotations: - argocd.argoproj.io/hook: PostSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: prometheus-setup - restartPolicy: Never - containers: - - name: apply-alerts - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - set -e - echo "Waiting for Prometheus operator..." - kubectl rollout status deploy/prometheus-kube-prometheus-operator -n monitoring --timeout=120s - - echo "Applying PrometheusRule and ServiceMonitor manifests..." - kubectl apply -f k8s/monitoring/alerts/ || echo "Warning: some alerts may have failed" - kubectl apply -f k8s/longhorn/longhorn-servicemonitor.yaml || echo "Warning: Longhorn ServiceMonitor failed" - - echo "✓ Alerts applied" - ---- -# ── Forgejo-Runner — PreSync: Generate runner token ────────────────────────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: forgejo-runner-token-gen - namespace: cicd - annotations: - argocd.argoproj.io/hook: PreSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: forgejo-setup - restartPolicy: Never - containers: - - name: token-gen - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - set -e - echo "Waiting for Forgejo to be ready..." - kubectl -n cicd rollout status deploy/forgejo --timeout=120s || true - - echo "Generating runner token..." - TOKEN=$(kubectl -n cicd exec deploy/forgejo -c gitea -- \ - forgejo actions generate-runner-token 2>/dev/null | tr -d '\r\n') || TOKEN="placeholder" - - if [ -z "$TOKEN" ] || [ "$TOKEN" = "placeholder" ]; then - echo "Warning: Could not generate token, using placeholder" - TOKEN="placeholder-token-$(date +%s)" - fi - - kubectl -n cicd create secret generic runner-token \ - --from-literal=token="$TOKEN" \ - --dry-run=client -o yaml | kubectl apply -f - - - echo "✓ Runner token stored" - ---- -# ── RBAC for Hook Jobs ────────────────────────────────────────────────────── - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: cnpg-setup - namespace: ddb - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cnpg-setup -rules: - - apiGroups: ["postgresql.cnpg.io"] - resources: ["clusters"] - verbs: ["get", "list", "create", "apply", "patch"] - - apiGroups: [""] - resources: ["pods"] - verbs: ["list", "get", "wait"] - - apiGroups: ["apps"] - resources: ["deployments"] - verbs: ["list", "get"] - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cnpg-setup -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cnpg-setup -subjects: - - kind: ServiceAccount - name: cnpg-setup - namespace: ddb - ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: prometheus-setup - namespace: monitoring - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: prometheus-setup -rules: - - apiGroups: ["monitoring.coreos.com"] - resources: ["prometheusrules", "servicemonitors"] - verbs: ["get", "list", "create", "apply", "patch"] - - apiGroups: ["apps"] - resources: ["deployments"] - verbs: ["list", "get"] - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: prometheus-setup -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: prometheus-setup -subjects: - - kind: ServiceAccount - name: prometheus-setup - namespace: monitoring - ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: forgejo-setup - namespace: cicd - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: forgejo-setup -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "create", "apply", "patch"] - - apiGroups: ["apps"] - resources: ["deployments"] - verbs: ["list", "get"] - - apiGroups: [""] - resources: ["pods", "pods/exec"] - verbs: ["list", "get", "create"] - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: forgejo-setup -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: forgejo-setup -subjects: - - kind: ServiceAccount - name: forgejo-setup - namespace: cicd diff --git a/k8s/hooks/phase3/phase3-hooks.yaml b/k8s/hooks/phase3/phase3-hooks.yaml deleted file mode 100644 index cd62902..0000000 --- a/k8s/hooks/phase3/phase3-hooks.yaml +++ /dev/null @@ -1,100 +0,0 @@ -# ArgoCD Hook Jobs for Phase 3 (IAM only) - ---- -# ── Authentik — PreSync: CA ConfigMap ───────────────────────────────────────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: authentik-ca-setup - namespace: iam - annotations: - argocd.argoproj.io/hook: PreSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: phase3-setup - restartPolicy: Never - containers: - - name: ca-setup - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - echo "Setting up CA ConfigMap for Authentik..." - CA_PEM=$(kubectl get secret homelab-ca-secret -n cert-manager \ - -o jsonpath='{.data.tls\.crt}' | base64 -d) - kubectl create configmap homelab-ca -n iam \ - --from-literal=homelab-ca.crt="$CA_PEM" \ - --dry-run=client -o yaml | kubectl apply -f - - echo "✓ CA ConfigMap created" - ---- -# ── Authentik — PostSync: OIDC Provisioning ────────────────────────────────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: authentik-oidc-provision - namespace: iam - annotations: - argocd.argoproj.io/hook: PostSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: phase3-setup - restartPolicy: Never - containers: - - name: oidc-provision - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - echo "Waiting for Authentik server..." - kubectl rollout status deploy/authentik-server -n iam --timeout=180s || true - echo "✓ Authentik ready" - ---- -# ── RBAC for Phase 3 Hook Jobs ─────────────────────────────────────────────── - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: phase3-setup - namespace: iam - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: phase3-setup -rules: - - apiGroups: [""] - resources: ["secrets", "configmaps"] - verbs: ["get", "list", "create", "apply", "patch"] - - apiGroups: [""] - resources: ["namespaces"] - verbs: ["get", "list", "create"] - - apiGroups: ["apps"] - resources: ["deployments"] - verbs: ["list", "get"] - ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: phase3-setup -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: phase3-setup -subjects: - - kind: ServiceAccount - name: phase3-setup - namespace: iam diff --git a/k8s/infrastructure/kustomization.yaml b/k8s/infrastructure/kustomization.yaml new file mode 100644 index 0000000..51d5656 --- /dev/null +++ b/k8s/infrastructure/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +metadata: + name: infrastructure + +namespace: infrastructure + +# Layer 1: Infrastructure — storage, persistent volumes +# Dependencies: None (base layer) +# Order: Applied first + +resources: + - minio/ + - longhorn/ diff --git a/k8s/infrastructure/longhorn/kustomization.yaml b/k8s/infrastructure/longhorn/kustomization.yaml new file mode 100644 index 0000000..bc9c51b --- /dev/null +++ b/k8s/infrastructure/longhorn/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: longhorn-system +resources: [] +# Longhorn deployed via Helm chart (values in parent layer) diff --git a/k8s/longhorn/longhorn-servicemonitor.yaml b/k8s/infrastructure/longhorn/longhorn-servicemonitor.yaml similarity index 100% rename from k8s/longhorn/longhorn-servicemonitor.yaml rename to k8s/infrastructure/longhorn/longhorn-servicemonitor.yaml diff --git a/k8s/storage/.env.example b/k8s/infrastructure/minio/.env.example similarity index 100% rename from k8s/storage/.env.example rename to k8s/infrastructure/minio/.env.example diff --git a/k8s/storage/bootstrap.sh b/k8s/infrastructure/minio/bootstrap.sh similarity index 100% rename from k8s/storage/bootstrap.sh rename to k8s/infrastructure/minio/bootstrap.sh diff --git a/k8s/infrastructure/minio/kustomization.yaml b/k8s/infrastructure/minio/kustomization.yaml new file mode 100644 index 0000000..237b4c3 --- /dev/null +++ b/k8s/infrastructure/minio/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: minio +resources: + - minio-tenant.yaml + - minio-service.yaml + - minio-replication-job.yaml +# Legacy: minio-legacy-alias.yaml skipped (migration artifact, conflicts with namespace transform) diff --git a/k8s/storage/minio-bucket-init.sh b/k8s/infrastructure/minio/minio-bucket-init.sh similarity index 100% rename from k8s/storage/minio-bucket-init.sh rename to k8s/infrastructure/minio/minio-bucket-init.sh diff --git a/k8s/storage/minio-legacy-alias.yaml b/k8s/infrastructure/minio/minio-legacy-alias.yaml similarity index 100% rename from k8s/storage/minio-legacy-alias.yaml rename to k8s/infrastructure/minio/minio-legacy-alias.yaml diff --git a/k8s/storage/minio-operator-values.yaml b/k8s/infrastructure/minio/minio-operator-values.yaml similarity index 100% rename from k8s/storage/minio-operator-values.yaml rename to k8s/infrastructure/minio/minio-operator-values.yaml diff --git a/k8s/storage/minio-replication-job.yaml b/k8s/infrastructure/minio/minio-replication-job.yaml similarity index 100% rename from k8s/storage/minio-replication-job.yaml rename to k8s/infrastructure/minio/minio-replication-job.yaml diff --git a/k8s/storage/minio-service.yaml b/k8s/infrastructure/minio/minio-service.yaml similarity index 100% rename from k8s/storage/minio-service.yaml rename to k8s/infrastructure/minio/minio-service.yaml diff --git a/k8s/storage/minio-tenant.yaml b/k8s/infrastructure/minio/minio-tenant.yaml similarity index 100% rename from k8s/storage/minio-tenant.yaml rename to k8s/infrastructure/minio/minio-tenant.yaml diff --git a/k8s/storage/minio-values.yaml b/k8s/infrastructure/minio/minio-values.yaml similarity index 100% rename from k8s/storage/minio-values.yaml rename to k8s/infrastructure/minio/minio-values.yaml diff --git a/k8s/storage/test/README.md b/k8s/infrastructure/minio/test/README.md similarity index 100% rename from k8s/storage/test/README.md rename to k8s/infrastructure/minio/test/README.md diff --git a/k8s/storage/test/go.mod b/k8s/infrastructure/minio/test/go.mod similarity index 100% rename from k8s/storage/test/go.mod rename to k8s/infrastructure/minio/test/go.mod diff --git a/k8s/storage/test/go.sum b/k8s/infrastructure/minio/test/go.sum similarity index 100% rename from k8s/storage/test/go.sum rename to k8s/infrastructure/minio/test/go.sum diff --git a/k8s/storage/test/main.go b/k8s/infrastructure/minio/test/main.go similarity index 100% rename from k8s/storage/test/main.go rename to k8s/infrastructure/minio/test/main.go diff --git a/k8s/infrastructure/minio/test/test b/k8s/infrastructure/minio/test/test new file mode 100755 index 0000000..d107195 Binary files /dev/null and b/k8s/infrastructure/minio/test/test differ diff --git a/k8s/platform/kustomization.yaml b/k8s/platform/kustomization.yaml new file mode 100644 index 0000000..d38c599 --- /dev/null +++ b/k8s/platform/kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +metadata: + name: platform + +# Layer 3: Platform — observability, monitoring, logging +# Dependencies: bootstrap (networking), infrastructure (storage) +# Order: Applied third + +resources: + - monitoring/ + - logging/ diff --git a/k8s/logging/.env.example b/k8s/platform/logging/.env.example similarity index 100% rename from k8s/logging/.env.example rename to k8s/platform/logging/.env.example diff --git a/k8s/logging/bootstrap.sh b/k8s/platform/logging/bootstrap.sh similarity index 100% rename from k8s/logging/bootstrap.sh rename to k8s/platform/logging/bootstrap.sh diff --git a/k8s/logging/grafana-secrets.enc.yaml b/k8s/platform/logging/grafana-secrets.enc.yaml similarity index 100% rename from k8s/logging/grafana-secrets.enc.yaml rename to k8s/platform/logging/grafana-secrets.enc.yaml diff --git a/k8s/logging/grafana-values.yaml b/k8s/platform/logging/grafana-values.yaml similarity index 100% rename from k8s/logging/grafana-values.yaml rename to k8s/platform/logging/grafana-values.yaml diff --git a/k8s/platform/logging/kustomization.yaml b/k8s/platform/logging/kustomization.yaml new file mode 100644 index 0000000..3c6d481 --- /dev/null +++ b/k8s/platform/logging/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: logging +resources: [] +# Loki/Promtail deployed via Helm chart diff --git a/k8s/logging/loki-secrets.enc.yaml b/k8s/platform/logging/loki-secrets.enc.yaml similarity index 100% rename from k8s/logging/loki-secrets.enc.yaml rename to k8s/platform/logging/loki-secrets.enc.yaml diff --git a/k8s/logging/loki-values-secrets.enc.yaml b/k8s/platform/logging/loki-values-secrets.enc.yaml similarity index 100% rename from k8s/logging/loki-values-secrets.enc.yaml rename to k8s/platform/logging/loki-values-secrets.enc.yaml diff --git a/k8s/logging/loki-values.yaml b/k8s/platform/logging/loki-values.yaml similarity index 100% rename from k8s/logging/loki-values.yaml rename to k8s/platform/logging/loki-values.yaml diff --git a/k8s/logging/minio-values.yaml b/k8s/platform/logging/minio-values.yaml similarity index 100% rename from k8s/logging/minio-values.yaml rename to k8s/platform/logging/minio-values.yaml diff --git a/k8s/logging/promtail-values.yaml b/k8s/platform/logging/promtail-values.yaml similarity index 100% rename from k8s/logging/promtail-values.yaml rename to k8s/platform/logging/promtail-values.yaml diff --git a/k8s/monitoring/alerts/ingress-alerts.yaml b/k8s/platform/monitoring/alerts/ingress-alerts.yaml similarity index 100% rename from k8s/monitoring/alerts/ingress-alerts.yaml rename to k8s/platform/monitoring/alerts/ingress-alerts.yaml diff --git a/k8s/platform/monitoring/alerts/kustomization.yaml b/k8s/platform/monitoring/alerts/kustomization.yaml new file mode 100644 index 0000000..eb85ebd --- /dev/null +++ b/k8s/platform/monitoring/alerts/kustomization.yaml @@ -0,0 +1,13 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ingress-alerts.yaml + - svc-argocd-rules.yaml + - svc-authentik-rules.yaml + - svc-forgejo-rules.yaml + - svc-grafana-rules.yaml + - svc-minio-rules.yaml + - svc-story-crater-backend-rules.yaml + - svc-story-crater-frontend-rules.yaml + - svc-vault-rules.yaml diff --git a/k8s/monitoring/alerts/svc-argocd-rules.yaml b/k8s/platform/monitoring/alerts/svc-argocd-rules.yaml similarity index 100% rename from k8s/monitoring/alerts/svc-argocd-rules.yaml rename to k8s/platform/monitoring/alerts/svc-argocd-rules.yaml diff --git a/k8s/monitoring/alerts/svc-authentik-rules.yaml b/k8s/platform/monitoring/alerts/svc-authentik-rules.yaml similarity index 100% rename from k8s/monitoring/alerts/svc-authentik-rules.yaml rename to k8s/platform/monitoring/alerts/svc-authentik-rules.yaml diff --git a/k8s/monitoring/alerts/svc-forgejo-rules.yaml b/k8s/platform/monitoring/alerts/svc-forgejo-rules.yaml similarity index 100% rename from k8s/monitoring/alerts/svc-forgejo-rules.yaml rename to k8s/platform/monitoring/alerts/svc-forgejo-rules.yaml diff --git a/k8s/monitoring/alerts/svc-grafana-rules.yaml b/k8s/platform/monitoring/alerts/svc-grafana-rules.yaml similarity index 100% rename from k8s/monitoring/alerts/svc-grafana-rules.yaml rename to k8s/platform/monitoring/alerts/svc-grafana-rules.yaml diff --git a/k8s/monitoring/alerts/svc-minio-rules.yaml b/k8s/platform/monitoring/alerts/svc-minio-rules.yaml similarity index 100% rename from k8s/monitoring/alerts/svc-minio-rules.yaml rename to k8s/platform/monitoring/alerts/svc-minio-rules.yaml diff --git a/k8s/monitoring/alerts/svc-story-crater-backend-rules.yaml b/k8s/platform/monitoring/alerts/svc-story-crater-backend-rules.yaml similarity index 100% rename from k8s/monitoring/alerts/svc-story-crater-backend-rules.yaml rename to k8s/platform/monitoring/alerts/svc-story-crater-backend-rules.yaml diff --git a/k8s/monitoring/alerts/svc-story-crater-frontend-rules.yaml b/k8s/platform/monitoring/alerts/svc-story-crater-frontend-rules.yaml similarity index 100% rename from k8s/monitoring/alerts/svc-story-crater-frontend-rules.yaml rename to k8s/platform/monitoring/alerts/svc-story-crater-frontend-rules.yaml diff --git a/k8s/monitoring/alerts/svc-vault-rules.yaml b/k8s/platform/monitoring/alerts/svc-vault-rules.yaml similarity index 100% rename from k8s/monitoring/alerts/svc-vault-rules.yaml rename to k8s/platform/monitoring/alerts/svc-vault-rules.yaml diff --git a/k8s/monitoring/blackbox-exporter-values.yaml b/k8s/platform/monitoring/blackbox-exporter-values.yaml similarity index 100% rename from k8s/monitoring/blackbox-exporter-values.yaml rename to k8s/platform/monitoring/blackbox-exporter-values.yaml diff --git a/k8s/monitoring/bootstrap.sh b/k8s/platform/monitoring/bootstrap.sh similarity index 100% rename from k8s/monitoring/bootstrap.sh rename to k8s/platform/monitoring/bootstrap.sh diff --git a/k8s/monitoring/dashboards/control-plane-logs.yaml b/k8s/platform/monitoring/dashboards/control-plane-logs.yaml similarity index 100% rename from k8s/monitoring/dashboards/control-plane-logs.yaml rename to k8s/platform/monitoring/dashboards/control-plane-logs.yaml diff --git a/k8s/monitoring/dashboards/hardware-overview.yaml b/k8s/platform/monitoring/dashboards/hardware-overview.yaml similarity index 100% rename from k8s/monitoring/dashboards/hardware-overview.yaml rename to k8s/platform/monitoring/dashboards/hardware-overview.yaml diff --git a/k8s/monitoring/dashboards/kube-controller-health.yaml b/k8s/platform/monitoring/dashboards/kube-controller-health.yaml similarity index 100% rename from k8s/monitoring/dashboards/kube-controller-health.yaml rename to k8s/platform/monitoring/dashboards/kube-controller-health.yaml diff --git a/k8s/monitoring/dashboards/service-availability.yaml b/k8s/platform/monitoring/dashboards/service-availability.yaml similarity index 100% rename from k8s/monitoring/dashboards/service-availability.yaml rename to k8s/platform/monitoring/dashboards/service-availability.yaml diff --git a/k8s/monitoring/dashboards/service-golden-signals.yaml b/k8s/platform/monitoring/dashboards/service-golden-signals.yaml similarity index 100% rename from k8s/monitoring/dashboards/service-golden-signals.yaml rename to k8s/platform/monitoring/dashboards/service-golden-signals.yaml diff --git a/k8s/monitoring/dashboards/service-internals.yaml b/k8s/platform/monitoring/dashboards/service-internals.yaml similarity index 100% rename from k8s/monitoring/dashboards/service-internals.yaml rename to k8s/platform/monitoring/dashboards/service-internals.yaml diff --git a/k8s/monitoring/dashboards/services/argocd.descriptor.yaml b/k8s/platform/monitoring/dashboards/services/argocd.descriptor.yaml similarity index 100% rename from k8s/monitoring/dashboards/services/argocd.descriptor.yaml rename to k8s/platform/monitoring/dashboards/services/argocd.descriptor.yaml diff --git a/k8s/monitoring/dashboards/services/authentik.descriptor.yaml b/k8s/platform/monitoring/dashboards/services/authentik.descriptor.yaml similarity index 100% rename from k8s/monitoring/dashboards/services/authentik.descriptor.yaml rename to k8s/platform/monitoring/dashboards/services/authentik.descriptor.yaml diff --git a/k8s/monitoring/dashboards/services/forgejo.descriptor.yaml b/k8s/platform/monitoring/dashboards/services/forgejo.descriptor.yaml similarity index 100% rename from k8s/monitoring/dashboards/services/forgejo.descriptor.yaml rename to k8s/platform/monitoring/dashboards/services/forgejo.descriptor.yaml diff --git a/k8s/monitoring/dashboards/services/grafana.descriptor.yaml b/k8s/platform/monitoring/dashboards/services/grafana.descriptor.yaml similarity index 100% rename from k8s/monitoring/dashboards/services/grafana.descriptor.yaml rename to k8s/platform/monitoring/dashboards/services/grafana.descriptor.yaml diff --git a/k8s/monitoring/dashboards/services/minio.descriptor.yaml b/k8s/platform/monitoring/dashboards/services/minio.descriptor.yaml similarity index 100% rename from k8s/monitoring/dashboards/services/minio.descriptor.yaml rename to k8s/platform/monitoring/dashboards/services/minio.descriptor.yaml diff --git a/k8s/monitoring/dashboards/services/story-crater-backend.descriptor.yaml b/k8s/platform/monitoring/dashboards/services/story-crater-backend.descriptor.yaml similarity index 100% rename from k8s/monitoring/dashboards/services/story-crater-backend.descriptor.yaml rename to k8s/platform/monitoring/dashboards/services/story-crater-backend.descriptor.yaml diff --git a/k8s/monitoring/dashboards/services/story-crater-frontend.descriptor.yaml b/k8s/platform/monitoring/dashboards/services/story-crater-frontend.descriptor.yaml similarity index 100% rename from k8s/monitoring/dashboards/services/story-crater-frontend.descriptor.yaml rename to k8s/platform/monitoring/dashboards/services/story-crater-frontend.descriptor.yaml diff --git a/k8s/monitoring/dashboards/services/vault.descriptor.yaml b/k8s/platform/monitoring/dashboards/services/vault.descriptor.yaml similarity index 100% rename from k8s/monitoring/dashboards/services/vault.descriptor.yaml rename to k8s/platform/monitoring/dashboards/services/vault.descriptor.yaml diff --git a/k8s/monitoring/dashboards/svc-argocd.yaml b/k8s/platform/monitoring/dashboards/svc-argocd.yaml similarity index 100% rename from k8s/monitoring/dashboards/svc-argocd.yaml rename to k8s/platform/monitoring/dashboards/svc-argocd.yaml diff --git a/k8s/monitoring/dashboards/svc-authentik.yaml b/k8s/platform/monitoring/dashboards/svc-authentik.yaml similarity index 100% rename from k8s/monitoring/dashboards/svc-authentik.yaml rename to k8s/platform/monitoring/dashboards/svc-authentik.yaml diff --git a/k8s/monitoring/dashboards/svc-forgejo.yaml b/k8s/platform/monitoring/dashboards/svc-forgejo.yaml similarity index 100% rename from k8s/monitoring/dashboards/svc-forgejo.yaml rename to k8s/platform/monitoring/dashboards/svc-forgejo.yaml diff --git a/k8s/monitoring/dashboards/svc-grafana.yaml b/k8s/platform/monitoring/dashboards/svc-grafana.yaml similarity index 100% rename from k8s/monitoring/dashboards/svc-grafana.yaml rename to k8s/platform/monitoring/dashboards/svc-grafana.yaml diff --git a/k8s/monitoring/dashboards/svc-minio.yaml b/k8s/platform/monitoring/dashboards/svc-minio.yaml similarity index 100% rename from k8s/monitoring/dashboards/svc-minio.yaml rename to k8s/platform/monitoring/dashboards/svc-minio.yaml diff --git a/k8s/monitoring/dashboards/svc-story-crater-backend.yaml b/k8s/platform/monitoring/dashboards/svc-story-crater-backend.yaml similarity index 100% rename from k8s/monitoring/dashboards/svc-story-crater-backend.yaml rename to k8s/platform/monitoring/dashboards/svc-story-crater-backend.yaml diff --git a/k8s/monitoring/dashboards/svc-story-crater-frontend.yaml b/k8s/platform/monitoring/dashboards/svc-story-crater-frontend.yaml similarity index 100% rename from k8s/monitoring/dashboards/svc-story-crater-frontend.yaml rename to k8s/platform/monitoring/dashboards/svc-story-crater-frontend.yaml diff --git a/k8s/monitoring/dashboards/svc-vault.yaml b/k8s/platform/monitoring/dashboards/svc-vault.yaml similarity index 100% rename from k8s/monitoring/dashboards/svc-vault.yaml rename to k8s/platform/monitoring/dashboards/svc-vault.yaml diff --git a/k8s/platform/monitoring/kustomization.yaml b/k8s/platform/monitoring/kustomization.yaml new file mode 100644 index 0000000..a711a13 --- /dev/null +++ b/k8s/platform/monitoring/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: monitoring +resources: + - alerts/ +# prometheus/blackbox deployed via ArgoCD Helm source diff --git a/k8s/monitoring/prometheus-values.yaml b/k8s/platform/monitoring/prometheus-values.yaml similarity index 100% rename from k8s/monitoring/prometheus-values.yaml rename to k8s/platform/monitoring/prometheus-values.yaml diff --git a/k8s/monitoring/servicemonitors/argocd.yaml b/k8s/platform/monitoring/servicemonitors/argocd.yaml similarity index 100% rename from k8s/monitoring/servicemonitors/argocd.yaml rename to k8s/platform/monitoring/servicemonitors/argocd.yaml diff --git a/k8s/monitoring/servicemonitors/authentik.yaml b/k8s/platform/monitoring/servicemonitors/authentik.yaml similarity index 100% rename from k8s/monitoring/servicemonitors/authentik.yaml rename to k8s/platform/monitoring/servicemonitors/authentik.yaml diff --git a/k8s/monitoring/servicemonitors/forgejo.yaml b/k8s/platform/monitoring/servicemonitors/forgejo.yaml similarity index 100% rename from k8s/monitoring/servicemonitors/forgejo.yaml rename to k8s/platform/monitoring/servicemonitors/forgejo.yaml diff --git a/k8s/monitoring/servicemonitors/minio.yaml b/k8s/platform/monitoring/servicemonitors/minio.yaml similarity index 100% rename from k8s/monitoring/servicemonitors/minio.yaml rename to k8s/platform/monitoring/servicemonitors/minio.yaml diff --git a/k8s/talos-ci-cd/argocd-values.yaml b/k8s/security/ci-cd/argocd-values.yaml similarity index 100% rename from k8s/talos-ci-cd/argocd-values.yaml rename to k8s/security/ci-cd/argocd-values.yaml diff --git a/k8s/talos-ci-cd/charts/forgejo-runner/Chart.yaml b/k8s/security/ci-cd/charts/forgejo-runner/Chart.yaml similarity index 100% rename from k8s/talos-ci-cd/charts/forgejo-runner/Chart.yaml rename to k8s/security/ci-cd/charts/forgejo-runner/Chart.yaml diff --git a/k8s/talos-ci-cd/charts/forgejo-runner/templates/deployment.yaml b/k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml similarity index 100% rename from k8s/talos-ci-cd/charts/forgejo-runner/templates/deployment.yaml rename to k8s/security/ci-cd/charts/forgejo-runner/templates/deployment.yaml diff --git a/k8s/talos-ci-cd/charts/forgejo-runner/templates/networkpolicy.yaml b/k8s/security/ci-cd/charts/forgejo-runner/templates/networkpolicy.yaml similarity index 100% rename from k8s/talos-ci-cd/charts/forgejo-runner/templates/networkpolicy.yaml rename to k8s/security/ci-cd/charts/forgejo-runner/templates/networkpolicy.yaml diff --git a/k8s/talos-ci-cd/charts/forgejo-runner/templates/pvc.yaml b/k8s/security/ci-cd/charts/forgejo-runner/templates/pvc.yaml similarity index 100% rename from k8s/talos-ci-cd/charts/forgejo-runner/templates/pvc.yaml rename to k8s/security/ci-cd/charts/forgejo-runner/templates/pvc.yaml diff --git a/k8s/talos-ci-cd/charts/forgejo-runner/values.yaml b/k8s/security/ci-cd/charts/forgejo-runner/values.yaml similarity index 100% rename from k8s/talos-ci-cd/charts/forgejo-runner/values.yaml rename to k8s/security/ci-cd/charts/forgejo-runner/values.yaml diff --git a/k8s/security/ci-cd/charts/kustomization.yaml b/k8s/security/ci-cd/charts/kustomization.yaml new file mode 100644 index 0000000..393243b --- /dev/null +++ b/k8s/security/ci-cd/charts/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - forgejo-runner/ diff --git a/k8s/talos-ci-cd/deploy-scaffold/api/deployment.yaml b/k8s/security/ci-cd/deploy-scaffold/api/deployment.yaml similarity index 100% rename from k8s/talos-ci-cd/deploy-scaffold/api/deployment.yaml rename to k8s/security/ci-cd/deploy-scaffold/api/deployment.yaml diff --git a/k8s/talos-ci-cd/deploy-scaffold/api/service.yaml b/k8s/security/ci-cd/deploy-scaffold/api/service.yaml similarity index 100% rename from k8s/talos-ci-cd/deploy-scaffold/api/service.yaml rename to k8s/security/ci-cd/deploy-scaffold/api/service.yaml diff --git a/k8s/talos-ci-cd/deploy-scaffold/apps/api.yaml b/k8s/security/ci-cd/deploy-scaffold/apps/api.yaml similarity index 100% rename from k8s/talos-ci-cd/deploy-scaffold/apps/api.yaml rename to k8s/security/ci-cd/deploy-scaffold/apps/api.yaml diff --git a/k8s/talos-ci-cd/deploy-scaffold/apps/argocd.yaml b/k8s/security/ci-cd/deploy-scaffold/apps/argocd.yaml similarity index 100% rename from k8s/talos-ci-cd/deploy-scaffold/apps/argocd.yaml rename to k8s/security/ci-cd/deploy-scaffold/apps/argocd.yaml diff --git a/k8s/talos-ci-cd/deploy-scaffold/apps/forge.yaml b/k8s/security/ci-cd/deploy-scaffold/apps/forge.yaml similarity index 100% rename from k8s/talos-ci-cd/deploy-scaffold/apps/forge.yaml rename to k8s/security/ci-cd/deploy-scaffold/apps/forge.yaml diff --git a/k8s/talos-ci-cd/example-workflows/ci.yml b/k8s/security/ci-cd/example-workflows/ci.yml similarity index 100% rename from k8s/talos-ci-cd/example-workflows/ci.yml rename to k8s/security/ci-cd/example-workflows/ci.yml diff --git a/k8s/talos-ci-cd/forgejo-secrets.enc.yaml b/k8s/security/ci-cd/forgejo-secrets.enc.yaml similarity index 100% rename from k8s/talos-ci-cd/forgejo-secrets.enc.yaml rename to k8s/security/ci-cd/forgejo-secrets.enc.yaml diff --git a/k8s/talos-ci-cd/forgejo-values.yaml b/k8s/security/ci-cd/forgejo-values.yaml similarity index 100% rename from k8s/talos-ci-cd/forgejo-values.yaml rename to k8s/security/ci-cd/forgejo-values.yaml diff --git a/k8s/security/ci-cd/kustomization.yaml b/k8s/security/ci-cd/kustomization.yaml new file mode 100644 index 0000000..f853f3d --- /dev/null +++ b/k8s/security/ci-cd/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: ci-cd +resources: [] +# Helm charts (forgejo-runner) deployed via ArgoCD Helm source diff --git a/k8s/talos-ci-cd/talos-cli.sh b/k8s/security/ci-cd/talos-cli.sh similarity index 100% rename from k8s/talos-ci-cd/talos-cli.sh rename to k8s/security/ci-cd/talos-cli.sh diff --git a/k8s/talos-iam/.env.example b/k8s/security/iam/.env.example similarity index 100% rename from k8s/talos-iam/.env.example rename to k8s/security/iam/.env.example diff --git a/k8s/talos-iam/OAUTH_APP_SETUP.md b/k8s/security/iam/OAUTH_APP_SETUP.md similarity index 100% rename from k8s/talos-iam/OAUTH_APP_SETUP.md rename to k8s/security/iam/OAUTH_APP_SETUP.md diff --git a/k8s/talos-iam/README.md b/k8s/security/iam/README.md similarity index 100% rename from k8s/talos-iam/README.md rename to k8s/security/iam/README.md diff --git a/k8s/talos-iam/authentik-migrations-job.yaml b/k8s/security/iam/authentik-migrations-job.yaml similarity index 100% rename from k8s/talos-iam/authentik-migrations-job.yaml rename to k8s/security/iam/authentik-migrations-job.yaml diff --git a/k8s/talos-iam/authentik-secrets.enc.yaml b/k8s/security/iam/authentik-secrets.enc.yaml similarity index 100% rename from k8s/talos-iam/authentik-secrets.enc.yaml rename to k8s/security/iam/authentik-secrets.enc.yaml diff --git a/k8s/talos-iam/authentik-values.yaml b/k8s/security/iam/authentik-values.yaml similarity index 100% rename from k8s/talos-iam/authentik-values.yaml rename to k8s/security/iam/authentik-values.yaml diff --git a/k8s/talos-iam/example_register_dashboard.py b/k8s/security/iam/example_register_dashboard.py similarity index 100% rename from k8s/talos-iam/example_register_dashboard.py rename to k8s/security/iam/example_register_dashboard.py diff --git a/k8s/talos-iam/go-example-oidc/.env.example b/k8s/security/iam/go-example-oidc/.env.example similarity index 100% rename from k8s/talos-iam/go-example-oidc/.env.example rename to k8s/security/iam/go-example-oidc/.env.example diff --git a/k8s/talos-iam/go-example-oidc/go.mod b/k8s/security/iam/go-example-oidc/go.mod similarity index 100% rename from k8s/talos-iam/go-example-oidc/go.mod rename to k8s/security/iam/go-example-oidc/go.mod diff --git a/k8s/talos-iam/go-example-oidc/go.sum b/k8s/security/iam/go-example-oidc/go.sum similarity index 100% rename from k8s/talos-iam/go-example-oidc/go.sum rename to k8s/security/iam/go-example-oidc/go.sum diff --git a/k8s/talos-iam/go-example-oidc/main.go b/k8s/security/iam/go-example-oidc/main.go similarity index 100% rename from k8s/talos-iam/go-example-oidc/main.go rename to k8s/security/iam/go-example-oidc/main.go diff --git a/k8s/talos-iam/key-rotation-cronjob.yaml b/k8s/security/iam/key-rotation-cronjob.yaml similarity index 100% rename from k8s/talos-iam/key-rotation-cronjob.yaml rename to k8s/security/iam/key-rotation-cronjob.yaml diff --git a/k8s/talos-iam/key_rotate.rs b/k8s/security/iam/key_rotate.rs similarity index 100% rename from k8s/talos-iam/key_rotate.rs rename to k8s/security/iam/key_rotate.rs diff --git a/k8s/security/iam/kustomization.yaml b/k8s/security/iam/kustomization.yaml new file mode 100644 index 0000000..e986def --- /dev/null +++ b/k8s/security/iam/kustomization.yaml @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: iam +resources: + - key-rotation-cronjob.yaml + - authentik-migrations-job.yaml +# SOPS secrets (*.enc.yaml) handled by ArgoCD SOPS plugin at sync time +# authentik/vault deployed via ArgoCD Helm source diff --git a/k8s/talos-iam/register_oauth_app.py b/k8s/security/iam/register_oauth_app.py similarity index 100% rename from k8s/talos-iam/register_oauth_app.py rename to k8s/security/iam/register_oauth_app.py diff --git a/k8s/talos-iam/setup_talos_iam.sh b/k8s/security/iam/setup_talos_iam.sh similarity index 100% rename from k8s/talos-iam/setup_talos_iam.sh rename to k8s/security/iam/setup_talos_iam.sh diff --git a/k8s/talos-iam/setup_vault.sh b/k8s/security/iam/setup_vault.sh similarity index 100% rename from k8s/talos-iam/setup_vault.sh rename to k8s/security/iam/setup_vault.sh diff --git a/k8s/talos-iam/vault-values.yaml b/k8s/security/iam/vault-values.yaml similarity index 100% rename from k8s/talos-iam/vault-values.yaml rename to k8s/security/iam/vault-values.yaml diff --git a/k8s/talos-iam/verify_existing_oauth_integrations.sh b/k8s/security/iam/verify_existing_oauth_integrations.sh similarity index 100% rename from k8s/talos-iam/verify_existing_oauth_integrations.sh rename to k8s/security/iam/verify_existing_oauth_integrations.sh diff --git a/k8s/security/kustomization.yaml b/k8s/security/kustomization.yaml new file mode 100644 index 0000000..8b71d08 --- /dev/null +++ b/k8s/security/kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +metadata: + name: security + +# Layer 4: Security — identity, access control, secrets +# Dependencies: bootstrap (networking), platform (logging) +# Order: Applied fourth + +resources: + - iam/ + - ci-cd/ diff --git a/kustomize b/kustomize new file mode 100755 index 0000000..ae9fb32 Binary files /dev/null and b/kustomize differ