feat(monitoring): enable Alertmanager (null receiver, longhorn PVC, az-a) + fix forgejo-rules ns forgejo->cicd — alerting delivery was disabled; forgejo PrometheusRule targeted a nonexistent namespace

k8s/argocd/apps/05-networking.yaml

@@ -1,26 +1,8 @@
-# Wave 0 — networking policies layered on the Cilium CNI + CoreDNS that the
-# cluster bootstrap already installed (substrate). These are raw manifests only.
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: cilium-policy
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  project: homelab
-  source:
-    repoURL: [email protected]:Riotpiaole/riotpiao.homelab.com.git
-    targetRevision: main
-    path: k8s/bootstrap/cilium
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: kube-system
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-# coredns-config Application removed: CoreDNS (incl. homelab hostname rewrites)
-# is owned by Talos via an inlineManifest (terraform/files/coredns/Corefile).
-# Managing the coredns ConfigMap from ArgoCD too would let the two reconcilers
-# fight and revert the rewrites.
+# Wave 0 — networking substrate is Talos-owned (terraform inlineManifests), not
+# ArgoCD:
+#   - CoreDNS Corefile + hostname rewrites  -> terraform/files/coredns/Corefile
+#   - Cilium LB-IPAM pool + L2 announcement -> terraform/files/cilium/*.yaml
+# Both were previously ArgoCD apps here whose empty `resources: []`
+# kustomizations never actually applied them (live objects came from manual
+# kubectl). Managing them from ArgoCD too would let two reconcilers fight. This
+# file intentionally defines no Applications now.