refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

2026-08-18 15:08:03 -07:00
parent 54fa540b33
commit 41f5b05395
241 changed files with 467 additions and 10416 deletions
@@ -0,0 +1,49 @@
+runner:
+  image:
+    repository: code.forgejo.org/forgejo/runner
+    tag: "6"          # pin exact release before apply
+  name: talos-runner
+  labels: "docker:docker://node:22-bookworm"
+  # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
+  # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
+  forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
+  # tokenSecret: name of the K8s Secret that holds the runner registration token
+  # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
+  tokenSecret: runner-token
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "2"
+      memory: 4Gi
+
+dind:
+  image:
+    repository: docker
+    tag: "27-dind"    # pin exact release before apply
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "2"
+      memory: 4Gi
+
+persistence:
+  reg:
+    storageClass: longhorn  # Unified StorageClass (3 replicas)
+    size: 1Gi               # .runner registration file + config — survives pod restarts
+  dind:
+    storageClass: longhorn  # Unified StorageClass (3 replicas)
+    size: 30Gi              # docker layer cache — keeps rebuilds fast across restarts
+
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+# Pin to az-a (talos-cp-1) — sole Longhorn node; RWO PVCs (reg/dind cache) only
+# attach there.
+nodeSelector:
+  topology.kubernetes.io/zone: az-a