refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

2026-08-18 15:08:03 -07:00
parent 54fa540b33
commit 41f5b05395
241 changed files with 467 additions and 10416 deletions
@@ -0,0 +1,95 @@
+# PostSync hook to patch Homarr deployment probes
+# Chart v8.23.0 doesn't support probe customization via values
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: homarr-fix-probes
+  namespace: dashboard
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      restartPolicy: Never
+      serviceAccountName: homarr-probe-patcher
+      containers:
+      - name: patch
+        image: python:3.12-alpine
+        command:
+        - /bin/sh
+        - -c
+        - |
+          set -e
+          echo "Installing kubectl..."
+          wget -q -O /tmp/kubectl https://dl.k8s.io/release/v1.28.0/bin/linux/amd64/kubectl
+          chmod +x /tmp/kubectl
+          
+          echo "Patching Homarr deployment probes..."
+          /tmp/kubectl -n dashboard patch deployment homarr --type=json -p='[
+            {
+              "op": "replace",
+              "path": "/spec/template/spec/containers/0/livenessProbe/initialDelaySeconds",
+              "value": 60
+            },
+            {
+              "op": "replace",
+              "path": "/spec/template/spec/containers/0/livenessProbe/periodSeconds",
+              "value": 30
+            },
+            {
+              "op": "replace",
+              "path": "/spec/template/spec/containers/0/livenessProbe/timeoutSeconds",
+              "value": 5
+            },
+            {
+              "op": "replace",
+              "path": "/spec/template/spec/containers/0/readinessProbe/initialDelaySeconds",
+              "value": 45
+            },
+            {
+              "op": "replace",
+              "path": "/spec/template/spec/containers/0/readinessProbe/periodSeconds",
+              "value": 15
+            },
+            {
+              "op": "replace",
+              "path": "/spec/template/spec/containers/0/readinessProbe/timeoutSeconds",
+              "value": 5
+            }
+          ]'
+          
+          echo "✅ Probes patched successfully"
+          echo "  Liveness: 60s initial, 30s period, 5s timeout"
+          echo "  Readiness: 45s initial, 15s period, 5s timeout"
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: homarr-probe-patcher
+  namespace: dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: homarr-probe-patcher
+  namespace: dashboard
+rules:
+- apiGroups: ["apps"]
+  resources: ["deployments"]
+  verbs: ["get", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: homarr-probe-patcher
+  namespace: dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: homarr-probe-patcher
+subjects:
+- kind: ServiceAccount
+  name: homarr-probe-patcher
+  namespace: dashboard
@@ -0,0 +1,23 @@
+apiVersion: ENC[AES256_GCM,data:XZc=,iv:0Lgui0+X2oTlgCX5HEIIihEsGJD0C2+pDIOTCNi4r+g=,tag:U2DPsVJ1gCoZw1YcgmT7UA==,type:str]
+kind: ENC[AES256_GCM,data:SRkjGwsv,iv:KRBfS7COsTs/l3Fhyk5FvH7IVc+r/6M6FVOo+kPDe1Q=,tag:113xdFELRoJiU4Kn8BmvPA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:stIxzQqOUvpbEANL4aQ=,iv:Q+DCLGtw3wihhdAgEbzYHyQhFTPWFyE2iJKl9mYaA2E=,tag:2XRGRbPQLNUGbA1dZI9xEQ==,type:str]
+    namespace: ENC[AES256_GCM,data:wIhhcrQi3cDF,iv:gnCCkV7GKXA2HWOOeNUGnpAycf8U7pl6F8Vfo6DhLR4=,tag:xnqvCtUdFPB5D9meJb36GA==,type:str]
+type: ENC[AES256_GCM,data:1qUDnlHH,iv:gBaC+6MXvZY/bIpy/cEG/zWwLBaUFMVfxAHa1OnwfnQ=,tag:u9PcCfvA2BydFNQQKws1Og==,type:str]
+stringData:
+    SECRET_ENCRYPTION_KEY: ENC[AES256_GCM,data:b0h8ekf7RIbQ9YTpaXPmR3aeNonk60lgltPmnRe7lVk9wlAdaXkNChINcAsarw9YhfYvfCZfS8U33/QxLGjaYA==,iv:uOmx8w3XPKnoxfasf7gqi/bljxigpLwaAC30c2TroKg=,tag:JphkeY49bQLm6cPjT6g8LA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiUW1BVmEvTnJqa3RuQ3NG
+            UFg3SE1SclpWd01TZnFOK0trQ1c2YThUQmpRCkdGc3FJSmRCcFIycWcvZXJCbDdj
+            T1M2cFFUakpOa2FST1k2UHc0a1hCRWMKLS0tIDk0UVdYRUkvTEM4TEVWRElrY3dN
+            SFU2bkZxUGlDL0JNSnY3UU54Z3BhbFUKnJYwwQkUveNjTF9CveVUBF8RO7QjDnYA
+            1+COKzvXuCIupvPcS87AtkrOfbfTu3IK78pfxZn04FmMOuAyj0ynzA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
+    lastmodified: "2026-07-22T15:59:29Z"
+    mac: ENC[AES256_GCM,data:uMmKD4fvu39KZc2lDoDD25g/p/eIGW/CYFIwYXcRFPdbLLLi+iW9ks/2l5tHqzlwHEtlL1RH4HLOQr25k3GAJA2FhVnyVmyZ4N2EnJfic/9XTfef9E8tKVo2cXEgYMCPbpH8sVu2OoaQ9BFw8dTM9ZxuTdGKksGOtGp56I4R8hA=,iv:QFhVAZ1jykTNLPDzqjYf9jkg5PuqYA8+s0Hn57ND3KA=,tag:Zz2qYANQP33izwg+3Ap16A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
@@ -0,0 +1,48 @@
+# Homarr landing page with Authentik SSO
+# Probes patched via PostSync hook (chart doesn't support customization)
+
+image:
+  repository: ghcr.io/homarr-labs/homarr
+  tag: "latest"
+  pullPolicy: Always
+
+replicaCount: 1
+
+# Configure SSO via environment variables
+# Chart supports these via top-level env dict (not array)
+env:
+  AUTH_PROVIDERS: "oidc,credentials"
+  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
+  AUTH_OIDC_CLIENT_NAME: "Authentik"
+  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
+  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
+  AUTH_OIDC_AUTO_LOGIN: "false"
+  BASE_URL: "https://homarr.riotpiao.com"
+  NEXTAUTH_URL: "https://homarr.riotpiao.com"
+
+# Client credentials from homarr-oidc secret
+# Chart doesn't support envFrom, so we add via extraEnv
+extraEnv:
+  - name: AUTH_OIDC_CLIENT_ID
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-id
+  - name: AUTH_OIDC_CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-secret
+
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 256Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: dashboard
+resources:
+  - fix-probes-job.yaml
+# PostSync hook to patch Homarr deployment probes
+# (homarr-secrets.enc.yaml managed by sops-secrets Application)