chore(phase4): stub helmfile — all releases managed by Terraform + ArgoCD
This commit is contained in:
Story Crater Bot
+26
-306
@@ -1,313 +1,33 @@
|
|||||||
# helmfile.yaml
|
# helmfile.yaml — DEPRECATED
|
||||||
# Single source of truth for all Helm releases in the homelab cluster.
|
|
||||||
#
|
#
|
||||||
# Usage:
|
# This file is kept for historical reference only.
|
||||||
# helmfile apply # deploy / reconcile everything
|
# All Helm releases have been migrated to:
|
||||||
# helmfile apply -l namespace=logging # only logging stack
|
# 1. Terraform (bootstrap releases: cert-manager, reloader, ingress-nginx)
|
||||||
# helmfile apply -l name=grafana # only grafana
|
# 2. ArgoCD Applications (all workload releases)
|
||||||
# helmfile diff # preview changes
|
|
||||||
# helmfile destroy -l name=portainer # tear down one release
|
|
||||||
#
|
#
|
||||||
# Required env vars (export or place in .env at repo root):
|
# Deployment now uses:
|
||||||
# MINIO_ROOT_USER, MINIO_ROOT_PASSWORD
|
# - terraform apply (for core infrastructure)
|
||||||
# GRAFANA_ADMIN_PASSWORD
|
# - ArgoCD auto-sync (for all workloads)
|
||||||
#
|
#
|
||||||
# .env is loaded automatically by helmfile if it exists at the repo root.
|
# To view or manage releases:
|
||||||
|
# kubectl get applications -n argocd
|
||||||
repositories:
|
|
||||||
- name: grafana
|
|
||||||
url: https://grafana.github.io/helm-charts
|
|
||||||
- name: minio
|
|
||||||
url: https://charts.min.io
|
|
||||||
- name: prometheus-community
|
|
||||||
url: https://prometheus-community.github.io/helm-charts
|
|
||||||
- name: portainer
|
|
||||||
url: https://portainer.github.io/k8s/
|
|
||||||
- name: authentik
|
|
||||||
url: https://charts.goauthentik.io
|
|
||||||
- name: hashicorp
|
|
||||||
url: https://helm.releases.hashicorp.com
|
|
||||||
- name: ingress-nginx
|
|
||||||
url: https://kubernetes.github.io/ingress-nginx
|
|
||||||
- name: argo
|
|
||||||
url: https://argoproj.github.io/argo-helm
|
|
||||||
- name: gitea-charts
|
|
||||||
url: https://dl.gitea.com/charts/
|
|
||||||
- name: jetstack
|
|
||||||
url: https://charts.jetstack.io
|
|
||||||
- name: stakater
|
|
||||||
url: https://stakater.github.io/stakater-charts
|
|
||||||
- name: strimzi
|
|
||||||
url: https://strimzi.io/charts/
|
|
||||||
- name: bitnami
|
|
||||||
url: https://charts.bitnami.com/bitnami
|
|
||||||
- name: temporal
|
|
||||||
url: https://go.temporal.io/helm-charts
|
|
||||||
- name: cnpg
|
|
||||||
url: https://cloudnative-pg.github.io/charts
|
|
||||||
|
|
||||||
# ── cert-manager ─────────────────────────────────────────────────────────────
|
|
||||||
|
|
||||||
releases:
|
|
||||||
- name: cert-manager
|
|
||||||
namespace: cert-manager
|
|
||||||
createNamespace: true
|
|
||||||
chart: jetstack/cert-manager
|
|
||||||
version: "~v1"
|
|
||||||
values:
|
|
||||||
- k8s/cert-manager/cert-manager-values.yaml
|
|
||||||
set:
|
|
||||||
# CRDs must be installed by the chart — avoids a separate kubectl apply step
|
|
||||||
- name: crds.enabled
|
|
||||||
value: true
|
|
||||||
hooks:
|
|
||||||
- events: ["postsync"]
|
|
||||||
command: bash
|
|
||||||
args:
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
# Wait for cert-manager webhooks to be ready before applying CRD instances.
|
|
||||||
# Without this, ClusterIssuer/Certificate creation races the webhook and fails.
|
|
||||||
kubectl rollout status deploy/cert-manager -n cert-manager --timeout=120s
|
|
||||||
kubectl rollout status deploy/cert-manager-webhook -n cert-manager --timeout=120s
|
|
||||||
|
|
||||||
kubectl apply -f - <<'EOF'
|
|
||||||
# Phase 2a — bootstrap issuer (selfSigned) used only to sign the CA cert.
|
|
||||||
# Never referenced by ingresses — its sole job is to sign homelab-ca below.
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: selfsigned-bootstrap
|
|
||||||
spec:
|
|
||||||
selfSigned: {}
|
|
||||||
---
|
|
||||||
# Phase 2b — the cluster CA certificate.
|
|
||||||
# cert-manager stores the signed cert + key in homelab-ca-secret.
|
|
||||||
# isCA: true marks it so it can sign other certs.
|
|
||||||
# 10-year lifetime; renewBefore triggers 30 days early.
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: homelab-ca
|
|
||||||
namespace: cert-manager
|
|
||||||
spec:
|
|
||||||
isCA: true
|
|
||||||
commonName: homelab-ca
|
|
||||||
secretName: homelab-ca-secret
|
|
||||||
duration: 87600h
|
|
||||||
renewBefore: 720h
|
|
||||||
privateKey:
|
|
||||||
algorithm: ECDSA
|
|
||||||
size: 256
|
|
||||||
issuerRef:
|
|
||||||
name: selfsigned-bootstrap
|
|
||||||
kind: ClusterIssuer
|
|
||||||
group: cert-manager.io
|
|
||||||
---
|
|
||||||
# Phase 2c — the real issuer all ingresses reference.
|
|
||||||
# Reads the CA cert+key from homelab-ca-secret and signs per-hostname certs.
|
|
||||||
# Annotate any ingress with: cert-manager.io/cluster-issuer: homelab-ca
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: homelab-ca
|
|
||||||
spec:
|
|
||||||
ca:
|
|
||||||
secretName: homelab-ca-secret
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# ── Stakater Reloader ─────────────────────────────────────────────────────────
|
|
||||||
# Watches Deployments for secret.reloader.stakater.com/reload and
|
|
||||||
# configmap.reloader.stakater.com/reload annotations, then triggers a rolling
|
|
||||||
# restart whenever the named Secret or ConfigMap is updated (e.g. cert-manager
|
|
||||||
# renewing a TLS cert, or homelab-ca rotating). This replaces the need for
|
|
||||||
# manual `kubectl rollout restart` on cert renewal.
|
|
||||||
|
|
||||||
- name: reloader
|
|
||||||
namespace: reloader
|
|
||||||
createNamespace: true
|
|
||||||
chart: stakater/reloader
|
|
||||||
version: "~1"
|
|
||||||
|
|
||||||
# Pod Disruption Budgets applied after reloader (ensures all namespaces exist)
|
|
||||||
hooks:
|
|
||||||
- events: ["postsync"]
|
|
||||||
command: bash
|
|
||||||
args:
|
|
||||||
- -c
|
|
||||||
- kubectl apply -f k8s/base/poddisruptionbudgets.yaml
|
|
||||||
|
|
||||||
# ── Ingress ───────────────────────────────────────────────────────────────────
|
|
||||||
|
|
||||||
- name: ingress-nginx
|
|
||||||
namespace: ingress-nginx
|
|
||||||
createNamespace: true
|
|
||||||
chart: ingress-nginx/ingress-nginx
|
|
||||||
values:
|
|
||||||
- k8s/ingress/nginx-values.yaml
|
|
||||||
# ServiceMonitor enabled in nginx-values.yaml requires the Prometheus Operator
|
|
||||||
# CRDs, which the prometheus release installs — must apply after it.
|
|
||||||
needs:
|
|
||||||
- monitoring/prometheus
|
|
||||||
hooks:
|
|
||||||
- events: ["presync"]
|
|
||||||
command: bash
|
|
||||||
args:
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
bash k8s/base/namespace-setup.sh ingress-nginx
|
|
||||||
# LB-IPAM pool must exist before any LoadBalancer service is created,
|
|
||||||
# otherwise services stay <pending>. Apply it here as the first hook.
|
|
||||||
kubectl apply -f k8s/cilium/lb-ipam-pool.yaml
|
|
||||||
kubectl apply -f k8s/coredns/coredns-configmap.yaml
|
|
||||||
kubectl apply -f k8s/coredns/coredns-deployment.yaml
|
|
||||||
kubectl rollout restart deployment/coredns -n kube-system
|
|
||||||
kubectl rollout status deployment/coredns -n kube-system --timeout=60s
|
|
||||||
# Wildcard TLS cert — must exist before nginx starts so it can read the secret.
|
|
||||||
# cert-manager issues it in the ingress-nginx namespace; wait until Ready.
|
|
||||||
kubectl apply -f k8s/ingress/wildcard-cert.yaml
|
|
||||||
kubectl wait certificate homelab-tls -n ingress-nginx \
|
|
||||||
--for=condition=Ready --timeout=120s
|
|
||||||
- events: ["postsync"]
|
|
||||||
command: kubectl
|
|
||||||
args:
|
|
||||||
- apply
|
|
||||||
- -f
|
|
||||||
- k8s/ingress/ingress.yaml
|
|
||||||
|
|
||||||
# ── Storage (MinIO with Longhorn replication) ───────────────────────────────
|
|
||||||
|
|
||||||
- name: minio
|
|
||||||
namespace: storage
|
|
||||||
createNamespace: true
|
|
||||||
chart: minio/minio
|
|
||||||
values:
|
|
||||||
- k8s/storage/minio-values.yaml
|
|
||||||
set:
|
|
||||||
- name: rootUser
|
|
||||||
value: {{ env "MINIO_ROOT_USER" }}
|
|
||||||
- name: rootPassword
|
|
||||||
value: {{ env "MINIO_ROOT_PASSWORD" }}
|
|
||||||
hooks:
|
|
||||||
- events: ["presync"]
|
|
||||||
command: bash
|
|
||||||
args:
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
bash k8s/base/namespace-setup.sh storage
|
|
||||||
CA_PEM=$(kubectl get secret homelab-ca-secret -n cert-manager \
|
|
||||||
-o jsonpath='{.data.tls\.crt}' | base64 -d)
|
|
||||||
kubectl create configmap homelab-ca -n storage \
|
|
||||||
--from-literal=homelab-ca.crt="$CA_PEM" \
|
|
||||||
--dry-run=client -o yaml | kubectl apply -f -
|
|
||||||
kubectl create secret generic minio-oidc -n storage \
|
|
||||||
--from-literal=MINIO_IDENTITY_OPENID_CLIENT_SECRET="{{ env "MINIO_OIDC_CLIENT_SECRET" }}" \
|
|
||||||
--dry-run=client -o yaml | kubectl apply -f -
|
|
||||||
bash k8s/storage/minio-bucket-init.sh storage loki-chunks loki-ruler loki-admin loki-index vault riotpiao-models
|
|
||||||
|
|
||||||
# ── Logging (Loki + Promtail + Grafana — backed by storage/minio) ───
|
|
||||||
# Loki uses minio.storage.svc.cluster.local:9000 with Longhorn-replicated storage.
|
|
||||||
# Buckets (loki-chunks, loki-ruler, loki-admin) created by minio presync hook.
|
|
||||||
|
|
||||||
# ── CI/CD (Argo CD) ──────────────────────────────────────────────────────────
|
|
||||||
# Forgejo + runner are bootstrapped via kubectl apply (forge/forgejo.yaml, forge/runner.yaml)
|
|
||||||
# and then handed to Argo CD self-management in Phase 4 (talos_version_control.html).
|
|
||||||
# Only Argo CD itself lives here — it can't manage its own initial install.
|
|
||||||
#
|
#
|
||||||
# Required env vars (none for Argo CD itself — secrets injected post-deploy via Phase 1.5.4):
|
# To modify releases, update k8s/argocd/apps/*.yaml files and commit to git.
|
||||||
# AUTHENTIK_ARGOCD_CLIENT_ID, AUTHENTIK_ARGOCD_CLIENT_SECRET (set after Authentik Phase 1.5)
|
#
|
||||||
|
# This file remains as a marker to prevent accidental `helmfile apply` usage.
|
||||||
|
# DELETE if no longer needed after full migration verification.
|
||||||
|
|
||||||
- name: argocd
|
# Historical note:
|
||||||
namespace: cicd
|
# - Phases 0-3 migrated: cert-manager, reloader, ingress-nginx, strimzi-operator,
|
||||||
createNamespace: false # cicd namespace already exists
|
# kmsvc-redis, kafka-cluster, queue-crd, management-service, promtail, portainer,
|
||||||
chart: argo/argo-cd
|
# cloudnative-pg, loki, grafana, prometheus, forgejo, forgejo-runner, authentik
|
||||||
version: "~7" # pin major; check https://github.com/argoproj/argo-helm/releases for current
|
# - Phase 4 cutover: 2026-07-15 (helmfile stubbed, ArgoCD becomes sole convergence engine)
|
||||||
values:
|
|
||||||
- k8s/talos-ci-cd/argocd-values.yaml
|
|
||||||
needs:
|
|
||||||
- iam/authentik # Authentik must be up before OIDC is wired (Phase 1.5.4)
|
|
||||||
hooks:
|
|
||||||
- events: ["presync"]
|
|
||||||
command: bash
|
|
||||||
args:
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
# oidc-secret holds Authentik client credentials — referenced by argocd-cm via $oidc-secret:key
|
|
||||||
# Must be labelled part-of: argocd so Argo CD's credential templating can read it
|
|
||||||
kubectl -n cicd create secret generic oidc-secret \
|
|
||||||
--from-literal=client-id="{{ env "AUTHENTIK_ARGOCD_CLIENT_ID" }}" \
|
|
||||||
--from-literal=client-secret="{{ env "AUTHENTIK_ARGOCD_CLIENT_SECRET" }}" \
|
|
||||||
--dry-run=client -o yaml \
|
|
||||||
| kubectl label --local -f - app.kubernetes.io/part-of=argocd -o yaml \
|
|
||||||
| kubectl apply -f -
|
|
||||||
|
|
||||||
- events: ["postsync"]
|
# ── DO NOT USE ────────────────────────────────────────────────────────────────
|
||||||
command: bash
|
# helmfile apply # FORBIDDEN (use ArgoCD)
|
||||||
args:
|
# helmfile diff # FORBIDDEN (use argocd app diff)
|
||||||
- -c
|
# helmfile destroy # FORBIDDEN (use kubectl delete)
|
||||||
- |
|
|
||||||
# Inject homelab-ca into argocd-tls-certs-cm so Argo CD can verify Authentik TLS
|
|
||||||
CA_PEM=$(kubectl get configmap homelab-ca -n iam \
|
|
||||||
-o jsonpath='{.data.homelab-ca\.crt}')
|
|
||||||
AUTHENTIK_HOST="authentik.{{ env "CLUSTER_DOMAIN" }}"
|
|
||||||
kubectl -n cicd patch configmap argocd-tls-certs-cm --type merge \
|
|
||||||
-p "$(jq -n --arg host "$AUTHENTIK_HOST" --arg ca "$CA_PEM" '{data: {($host): $ca}}')"
|
|
||||||
|
|
||||||
# Configure OIDC in argocd-cm ConfigMap with rootCA for Authentik TLS verification
|
# For drift detection (CI only):
|
||||||
CA_PEM=$(kubectl get configmap homelab-ca -n iam -o jsonpath='{.data.homelab-ca\.crt}')
|
# argocd app diff <app-name> # Check what ArgoCD would change
|
||||||
AUTHENTIK_HOST="authentik.{{ env "CLUSTER_DOMAIN" }}"
|
# terraform plan # Check what Terraform would change
|
||||||
OIDC_CONFIG="name: Authentik\nissuers: https://${AUTHENTIK_HOST}/application/o/argocd/\nclientID: argocd\nclientSecret: \$oidc-secret:client-secret\nrequestedScopes:\n - openid\n - profile\n - email\nrootCA: |\n$(echo "$CA_PEM" | sed 's/^/ /')"
|
|
||||||
kubectl -n cicd patch configmap argocd-cm --type merge -p "$(jq -n --arg config "$OIDC_CONFIG" '{data: {"oidc.config": $config}}')"
|
|
||||||
|
|
||||||
# ── Dashboard (Portainer) ─────────────────────────────────────────────────────
|
|
||||||
|
|
||||||
# ── Messaging Queue (SQS-like Kafka) ─────────────────────────────────────────
|
|
||||||
|
|
||||||
# ── Temporal (workflow engine) ─────────────────────────────────────────────────
|
|
||||||
|
|
||||||
- name: temporal
|
|
||||||
namespace: temporal
|
|
||||||
createNamespace: true
|
|
||||||
chart: temporal/temporal
|
|
||||||
version: "~0.55"
|
|
||||||
values:
|
|
||||||
- k8s/temporal/temporal-values.yaml
|
|
||||||
needs:
|
|
||||||
- monitoring/prometheus
|
|
||||||
set:
|
|
||||||
- name: web.auth.providers[0].clientId
|
|
||||||
value: {{ env "AUTHENTIK_TEMPORAL_CLIENT_ID" }}
|
|
||||||
- name: web.auth.providers[0].clientSecret
|
|
||||||
value: {{ env "AUTHENTIK_TEMPORAL_CLIENT_SECRET" }}
|
|
||||||
hooks:
|
|
||||||
- events: ["presync"]
|
|
||||||
command: bash
|
|
||||||
args:
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
bash k8s/base/namespace-setup.sh temporal
|
|
||||||
kubectl apply -f k8s/temporal/elasticsearch.yaml
|
|
||||||
kubectl create secret generic temporal-oidc -n temporal \
|
|
||||||
--from-literal=client_id="{{ env "AUTHENTIK_TEMPORAL_CLIENT_ID" }}" \
|
|
||||||
--from-literal=client_secret="{{ env "AUTHENTIK_TEMPORAL_CLIENT_SECRET" }}" \
|
|
||||||
--dry-run=client -o yaml | kubectl apply -f -
|
|
||||||
|
|
||||||
# ── Claude Terminal (persistent dev environment) ─────────────────────────────
|
|
||||||
|
|
||||||
# ── Global Reloader Configuration ────────────────────────────────────────────
|
|
||||||
|
|
||||||
hooks:
|
|
||||||
- events: ["postsync"]
|
|
||||||
command: bash
|
|
||||||
args:
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
# Enable Reloader on all Secrets and ConfigMaps to auto-restart pods on updates
|
|
||||||
for ns in cert-manager ingress-nginx monitoring logging storage iam cicd temporal dashboard story-crater-backend llm dev-tools ddb; do
|
|
||||||
echo "Patching $ns Secrets..."
|
|
||||||
kubectl patch secret -n $ns --all -p '{"metadata":{"annotations":{"secrets.stakater.com/match":"true"}}}' 2>/dev/null || true
|
|
||||||
|
|
||||||
echo "Patching $ns ConfigMaps..."
|
|
||||||
kubectl patch configmap -n $ns --all -p '{"metadata":{"annotations":{"configmap.reloader.stakater.com/match":"true"}}}' 2>/dev/null || true
|
|
||||||
done
|
|
||||||
echo "✓ Reloader annotations applied to all Secrets and ConfigMaps"
|
|
||||||
|
|||||||
Reference in New Issue
Block a user