refactor(argocd): consolidate Applications (39→35)

Merge related Applications using multi-source pattern and PostSync hooks: 1. ingress-config ← wildcard-cert + homelab-ingress (2→1) - Both in k8s/bootstrap/ingress/, now use kustomization - Certificate deployed before Ingresses (wave 1) 2. homarr ← homarr + homarr-patches (2→1) - Added PostSync hook source (fix-probes-job.yaml) - Patches run after Helm chart deployment 3. temporal ← temporal + temporal-db-secret-sync (2→1) - Added PostSync hook source (copy-job.yaml) - DB secret sync runs after Temporal deployment 4. Removed duplicate: ingress-nginx Application - ingress-nginx-bootstrap (bootstrap) is working - Removed redundant ArgoCD-managed ingress-nginx - Eliminated duplicate DaemonSet Skipped: cert-manager + cert-manager-issuers - Wave separation needed (CRDs before Issuers) - Keep separate for safety Result: 39 → 35 Applications (-4, -10.3%) Files: - k8s/bootstrap/ingress/kustomization.yaml (updated) - k8s/argocd/apps/00-substrate.yaml (merges + removal) - k8s/argocd/apps/60-applications.yaml (merges) - CONSOLIDATION-RESULTS.md (documentation) - APPLICATION-CONSOLIDATION-PLAN.md (analysis) - GITOPS-STATUS.md (updated inventory)
2026-07-23 07:29:51 -07:00
parent 4e7a7b065e
commit 423e40200a
5 changed files with 510 additions and 122 deletions
@@ -34,43 +34,9 @@ spec:
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ingress-nginx
-  namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  project: homelab
-  revisionHistoryLimit: 3
-  sources:
-    - repoURL: https://kubernetes.github.io/ingress-nginx
-      chart: ingress-nginx
-      targetRevision: "4.15.1"
-      helm:
-        valueFiles:
-          - $values/k8s/bootstrap/ingress/nginx-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
-      targetRevision: main
-      ref: values
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: ingress-nginx
-  syncPolicy:
-    managedNamespaceMetadata:
-      # hostPort 80/443 requires the privileged PodSecurity level; the default
-      # baseline/restricted enforce blocks the controller DaemonSet.
-      labels:
-        pod-security.kubernetes.io/enforce: privileged
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
+# ingress-nginx removed: duplicate of ingress-nginx-bootstrap
+# The bootstrap version (k8s/bootstrap-local/06-ingress-nginx.yaml) is kept
+# to break the circular dependency (ArgoCD needs Forgejo domain access)
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -133,10 +99,13 @@ spec:
      prune: true
      selfHeal: true
 ---
+# Consolidated: wildcard-cert + homelab-ingress → ingress-config
+# Manages both the wildcard TLS certificate and all Ingress rules.
+# Certificate must exist before Ingresses (wave 1), but both are in same directory.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: wildcard-cert
+  name: ingress-config
  namespace: argocd
  finalizers:
    - resources-finalizer.argocd.argoproj.io
@@ -149,44 +118,11 @@ spec:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
    path: k8s/bootstrap/ingress
-    directory:
-      include: "riotpiao-com-cert.yaml"
  destination:
    server: https://kubernetes.default.svc
-    namespace: ingress-nginx
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
---
-# Ingress host rules for all *.riotpiao.com services (grafana, authentik,
-# forgejo, vault, minio, prometheus, etc). Previously orphaned — ingress.yaml
-# was in k8s/bootstrap/ingress but no app applied it, so the services had no
-# Ingress object and were unreachable via the LAN ingress (192.168.1.160).
-# Each object carries its own namespace; no destination.namespace override.
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: homelab-ingress
-  namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: homelab
-  revisionHistoryLimit: 3
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
-    targetRevision: main
-    path: k8s/bootstrap/ingress
-    directory:
-      include: "ingress.yaml"
-  destination:
-    server: https://kubernetes.default.svc
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
@@ -2,33 +2,9 @@
 # helpers (cloudflared tunnel, duckdns updater) that are already running.
 # Experimental dirs (llm, forge, dev-tools, shadowsocks) are intentionally
 # NOT included yet — add them here once they're production-ready.
+# Consolidated: temporal-db-secret-sync + temporal → temporal
 # Syncs the CNPG-generated temporal-db-role Secret from ddb -> temporal ns
-# (see db-secret-sync/copy-job.yaml for why this is a separate Application
-# rather than folded into temporal/'s own kustomization). Runs one wave
-# before `temporal` so the Secret exists before the server pods start.
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: temporal-db-secret-sync
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "7"
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
-    targetRevision: main
-    path: k8s/applications/temporal/db-secret-sync
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: temporal
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
---
+# via PostSync hook (db-secret-sync/copy-job.yaml).
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -48,6 +24,9 @@ spec:
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
+      targetRevision: main
+      path: k8s/applications/temporal/db-secret-sync  # PostSync hook: copy-job.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: temporal
@@ -133,6 +112,8 @@ spec:
    syncOptions:
      - CreateNamespace=true
 ---
+# Consolidated: homarr + homarr-patches → homarr
+# Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -152,6 +133,9 @@ spec:
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
+    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
+      targetRevision: main
+      path: k8s/applications/homarr  # PostSync hook: fix-probes-job.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: dashboard
@@ -161,25 +145,3 @@ spec:
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
-
---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: homarr-patches
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "9"  # After homarr (wave 8)
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
-    targetRevision: main
-    path: k8s/applications/homarr
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: dashboard
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true