refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

2026-08-18 15:08:03 -07:00
parent 54fa540b33
commit 41f5b05395
241 changed files with 467 additions and 10416 deletions
@@ -0,0 +1,84 @@
+# PostSync hook to patch longhorn-csi-plugin DaemonSet with control-plane tolerations
+# This runs after longhorn-config Application syncs, ensuring CSI plugin can run on all nodes
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: longhorn-patch-csi-tolerations
+  namespace: longhorn-system
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      name: patch-csi-tolerations
+    spec:
+      restartPolicy: Never
+      serviceAccountName: longhorn-patch-csi-tolerations
+      containers:
+      - name: patch
+        image: bitnami/kubectl:latest
+        command:
+        - /bin/bash
+        - -c
+        - |
+          set -euo pipefail
+          
+          echo "Patching longhorn-csi-plugin DaemonSet with control-plane tolerations..."
+          
+          kubectl patch daemonset longhorn-csi-plugin -n longhorn-system --type=json -p='[
+            {
+              "op": "add",
+              "path": "/spec/template/spec/tolerations/-",
+              "value": {
+                "key": "node-role.kubernetes.io/control-plane",
+                "operator": "Exists",
+                "effect": "NoSchedule"
+              }
+            }
+          ]'
+          
+          echo "✓ Patch applied successfully"
+          
+          echo ""
+          echo "Waiting for CSI plugin pods to roll out to all nodes..."
+          kubectl rollout status daemonset/longhorn-csi-plugin -n longhorn-system --timeout=120s
+          
+          echo ""
+          echo "Final status:"
+          kubectl get daemonset longhorn-csi-plugin -n longhorn-system
+          kubectl get pods -n longhorn-system -l app=longhorn-csi-plugin -o wide
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: longhorn-patch-csi-tolerations
+  namespace: longhorn-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: longhorn-patch-csi-tolerations
+  namespace: longhorn-system
+rules:
+- apiGroups: ["apps"]
+  resources: ["daemonsets"]
+  verbs: ["get", "patch"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["list", "get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: longhorn-patch-csi-tolerations
+  namespace: longhorn-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: longhorn-patch-csi-tolerations
+subjects:
+- kind: ServiceAccount
+  name: longhorn-patch-csi-tolerations
+  namespace: longhorn-system