rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(terraform): restructure control planes into a 3-node map with LAN etcd advertise and live machine CA — enables talos-cp-1/2/3 HA and drops worker configs

Browse Source
This commit is contained in:
Story Crater Bot
2026-08-18 15:08:02 -07:00
parent 9956379f5f
commit 5b34e71111
24 changed files with 75 additions and 1226 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/argocd/apps/0-minio.yaml
-76
View File
@@ -1,76 +0,0 @@
# MinIO now managed by Terraform (terraform/minio.tf) via official minio/minio
# chart — removed from ArgoCD to avoid dual-controller conflict on storage NS.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: strimzi-operator
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: kmsvc-redis
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: prometheus
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/monitoring
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: monitoring
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/00-homelab-root.yaml
-22
View File
@@ -1,22 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: homelab-root
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/argocd/root
destination:
server: https://kubernetes.default.svc
namespace: argocd
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/1-wave-1.yaml
-139
View File
@@ -1,139 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: vault
namespace: argocd
labels:
test-gitops: "true"
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/talos-iam
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: iam
syncPolicy:
automated:
prune: true
selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: loki
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/logging
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: logging
syncPolicy:
automated:
prune: true
selfHeal: true
# cloudnative-pg: managed separately via k8s/argocd/apps/cnpg-operator.yaml
# (Helm-source Application, avoids the git chicken-egg for the operator itself)
# apiVersion: argoproj.io/v1alpha1
# kind: Application
# metadata:
# name: cloudnative-pg
# namespace: argocd
# annotations:
# argocd.argoproj.io/sync-wave: "1"
# spec:
# project: homelab
# source:
# repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
# targetRevision: main
# path: k8s/ddb
# directory:
# recurse: false
# destination:
# server: https://kubernetes.default.svc
# namespace: ddb
# syncPolicy:
# automated:
# prune: true
# selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: authentik
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/talos-iam
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: iam
syncPolicy:
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: temporal
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/temporal
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: temporal
syncPolicy:
automated:
prune: true
selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: kafka-cluster
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
k8s/argocd/apps/2-wave-2.yaml
-115
View File
@@ -1,115 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: queue-crd
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: management-service
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: grafana
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/logging
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: logging
syncPolicy:
automated:
prune: true
selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: promtail
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/logging
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: logging
syncPolicy:
automated:
prune: true
selfHeal: true
# forgejo: managed separately via k8s/argocd/apps/forgejo.yaml
# (Helm-source Application with inlined values, avoids the git chicken-egg)
# apiVersion: argoproj.io/v1alpha1
# kind: Application
# metadata:
# name: forgejo
# namespace: argocd
# annotations:
# argocd.argoproj.io/sync-wave: "2"
# spec:
# project: homelab
# source:
# repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
# targetRevision: main
# path: k8s/talos-ci-cd
# directory:
# recurse: false
# destination:
# server: https://kubernetes.default.svc
# namespace: cicd
# syncPolicy:
# automated:
# prune: true
# selfHeal: true
k8s/argocd/apps/3-wave-3.yaml
-45
View File
@@ -1,45 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: forgejo-runner
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "3"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/talos-ci-cd
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: cicd
syncPolicy:
automated:
prune: true
selfHeal: true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: portainer
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "3"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/portainer
directory:
recurse: false
destination:
server: https://kubernetes.default.svc
namespace: dashboard
syncPolicy:
automated:
prune: true
selfHeal: true
k8s/argocd/apps/cnpg-operator.yaml
-22
View File
@@ -1,22 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: cnpg-operator
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
source:
repoURL: https://cloudnative-pg.github.io/charts
chart: cloudnative-pg
targetRevision: "*"
destination:
server: https://kubernetes.default.svc
namespace: ddb
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/forgejo.yaml
-146
View File
@@ -1,146 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: forgejo
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "7"
# Must sync after cnpg-operator (wave 0) and the ddb-cluster/forgejo-database
# (wave 6, k8s/data) — Forgejo's DB connection depends on both existing first.
spec:
project: homelab
source:
repoURL: https://dl.gitea.com/charts/
chart: gitea
targetRevision: "~10"
helm:
# Mirrors k8s/security/ci-cd/forgejo-values.yaml inline — avoids the
# git-repo chicken-egg (Forgejo can't source its own values from a repo
# it hosts). Keep both files in sync when editing either one.
valuesObject:
image:
repository: codeberg.org/forgejo/forgejo
tag: "13"
pullPolicy: IfNotPresent
gitea:
admin:
username: rock
email: [email protected]
config:
server:
PROTOCOL: http
DOMAIN: forgejo.riotpiao.com
ROOT_URL: https://forgejo.riotpiao.com/
HTTP_PORT: 3000
START_SSH_SERVER: true
SSH_DOMAIN: forgejo.riotpiao.com
SSH_PORT: 2222
SSH_LISTEN_PORT: 2222
database:
DB_TYPE: postgres
HOST: ddb-cluster-rw.ddb.svc:5432
NAME: forgejo
USER: app
repository:
ROOT: /data/git
actions:
ENABLED: true
packages:
ENABLED: true
metrics:
ENABLED: true
service:
DISABLE_REGISTRATION: true
oauth2:
ENABLED: true
PROVIDER: openidconnect
OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
CLIENT_ID: forgejo
AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
cache:
ADAPTER: redis
HOST: "redis://forgejo-redis.cicd.svc:6379/0"
session:
PROVIDER: redis
PROVIDER_CONFIG: "redis://forgejo-redis.cicd.svc:6379/1"
queue:
TYPE: redis
CONN_STR: "redis://forgejo-redis.cicd.svc:6379/2"
metrics:
enabled: true
serviceMonitor:
enabled: false
persistence:
enabled: true
storageClass: longhorn
size: 20Gi
accessModes:
- ReadWriteMany
replicaCount: 2
deployment:
strategy:
type: RollingUpdate
env:
- name: SSL_CERT_DIR
value: /homelab-ca
- name: GITEA__database__PASSWD
valueFrom:
secretKeyRef:
name: ddb-cluster-app
key: password
podAnnotations:
configmap.reloader.stakater.com/reload: "homelab-ca"
service:
http:
type: LoadBalancer
port: 3000
targetPort: 3000
annotations:
io.cilium/lb-ipam-ips: "192.168.1.165"
io.cilium/lb-ipam-sharing-key: "forgejo"
ssh:
type: LoadBalancer
port: 2222
targetPort: 2222
annotations:
io.cilium/lb-ipam-ips: "192.168.1.165"
io.cilium/lb-ipam-sharing-key: "forgejo"
resources:
requests:
cpu: 250m
memory: 512Mi
limits:
cpu: "1"
memory: 1Gi
tolerations:
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
extraVolumes:
- name: homelab-ca
configMap:
name: homelab-ca
extraVolumeMounts:
- name: homelab-ca
mountPath: /homelab-ca
readOnly: true
ingress:
enabled: false
postgresql:
enabled: false
postgresql-ha:
enabled: false
mysql:
enabled: false
redis-cluster:
enabled: false
act_runner:
enabled: false
destination:
server: https://kubernetes.default.svc
namespace: cicd
syncPolicy:
syncOptions:
- CreateNamespace=true
# NO automated sync — Forgejo is what CI uses to push commits; auto-sync
# would let a bad CI commit break the system CI depends on. Manual only.
k8s/argocd/apps/layer-1-infrastructure.yaml
-21
View File
@@ -1,21 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: layer-1-infrastructure
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/infrastructure
destination:
server: https://kubernetes.default.svc
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/layer-2-bootstrap.yaml
-21
View File
@@ -1,21 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: layer-2-bootstrap
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/bootstrap
destination:
server: https://kubernetes.default.svc
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/layer-3-platform.yaml
-21
View File
@@ -1,21 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: layer-3-platform
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "3"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/platform
destination:
server: https://kubernetes.default.svc
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/layer-4-security.yaml
-21
View File
@@ -1,21 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: layer-4-security
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "4"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/security
destination:
server: https://kubernetes.default.svc
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/layer-5-applications.yaml
-21
View File
@@ -1,21 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: layer-5-applications
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "5"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/applications
destination:
server: https://kubernetes.default.svc
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/layer-6-data.yaml
-21
View File
@@ -1,21 +0,0 @@
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: layer-6-data
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "6"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/data
destination:
server: https://kubernetes.default.svc
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/phase0-minio.yaml
-86
View File
@@ -1,86 +0,0 @@
# Phase 0 — MinIO (S3 backend for Terraform state)
# Deployed first, before all other applications
# Note: MinIO PVC managed separately (prevent_destroy in terraform/minio.tf)
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: minio
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
sources:
- repoURL: https://charts.min.io/
chart: minio
targetRevision: 5.4.0
helm:
values: |
mode: standalone
replicas: 1
drivesPerNode: 1
pools: 1
rootUser: minioadmin
rootPassword: nhKRAxwIjDBCzwFDvsAa7dNLouCXXh13LvMoxMVkUtY=
persistence:
enabled: true
size: 100Gi
storageClass: longhorn-xfs
accessMode: ReadWriteOnce
resources:
requests:
memory: 512Mi
service:
type: ClusterIP
port: 9000
consoleService:
type: ClusterIP
port: 9001
buckets:
- name: terraform-state
policy: none
purge: false
- name: vault
policy: none
purge: false
- name: riotpiao-models
policy: none
purge: false
- name: loki-chunks
policy: none
purge: false
- name: loki-ruler
policy: none
purge: false
- name: loki-admin
policy: none
purge: false
- name: loki-index
policy: none
purge: false
environment:
MINIO_IDENTITY_OPENID_CONFIG_URL: https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration
MINIO_IDENTITY_OPENID_CLIENT_ID: minio
MINIO_IDENTITY_OPENID_CLIENT_SECRET: 9d2867fe08c3bf7fedd7e32bbaf4456fce3b0aaf788966d7559e1955947b0219
MINIO_IDENTITY_OPENID_CLAIM_NAME: policy
MINIO_IDENTITY_OPENID_SCOPES: openid,profile,email,minio
MINIO_IDENTITY_OPENID_REDIRECT_URI: https://minio.riotpiao.com/oauth_callback
MINIO_IDENTITY_OPENID_DISPLAY_NAME: Authentik
destination:
server: https://kubernetes.default.svc
namespace: storage
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/phase1-hookless-0.yaml
-172
View File
@@ -1,172 +0,0 @@
# Phase 1 — Hookless releases: strimzi-operator, kafka-cluster, kmsvc-redis, queue-crd, management-service
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: strimzi-operator
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
source:
repoURL: https://strimzi.io/charts/
chart: strimzi-kafka-operator
targetRevision: 0.46.0
helm:
values: |
watchNamespaces: ["sqs"]
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: kmsvc-redis
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
source:
repoURL: https://charts.bitnami.com/bitnami
chart: redis
targetRevision: 20.6.0
helm:
values: |
architecture: standalone
global:
security:
allowInsecureImages: true
image:
repository: bitnamilegacy/redis
auth:
enabled: false
master:
persistence:
enabled: true
storageClass: longhorn
size: 2Gi
resources:
limits:
memory: 1Gi
requests:
memory: 1Gi
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: kafka-cluster
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs/charts/kafka-cluster
helm:
values: |
namespace: sqs
nodePool:
replicas: 3
storage:
class: longhorn-kafka
sizeGi: 10
resources:
memory: 5Gi
cpu: "2"
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: queue-crd
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs/charts/queue-crd
helm:
values: |
namespace: sqs
kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: management-service
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/sqs/charts/management-service
helm:
values: |
namespace: sqs
env:
kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
authentikIssuerURL: "https://authentik.riotpiao.com/application/o/kafaka/"
authentikAudience: "QI0gPtR99ar8VvhK8Tqox4SDkTKzbNU7lbgwBNSc"
ingress:
enabled: true
host: kmsvc.riotpiao.com
clusterIssuer: homelab-ca
destination:
server: https://kubernetes.default.svc
namespace: sqs
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/phase1-hookless-1.yaml
-55
View File
@@ -1,55 +0,0 @@
# Phase 1 — Hookless releases continued: promtail, portainer
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: promtail
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://grafana.github.io/helm-charts
chart: promtail
targetRevision: latest
helm:
valueFiles:
- k8s/logging/promtail-values.yaml
destination:
server: https://kubernetes.default.svc
namespace: logging
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: portainer
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "3"
spec:
project: homelab
source:
repoURL: https://portainer.github.io/k8s/
chart: portainer
targetRevision: latest
helm:
valueFiles:
- k8s/portainer/portainer-values.yaml
destination:
server: https://kubernetes.default.svc
namespace: dashboard
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/phase2-storage-observability-0.yaml
-61
View File
@@ -1,61 +0,0 @@
# Phase 2 — Storage/observability chain: prometheus, cloudnative-pg
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: prometheus
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
sources:
- repoURL: https://prometheus-community.github.io/helm-charts
chart: kube-prometheus-stack
targetRevision: latest
helm:
valueFiles:
- k8s/monitoring/prometheus-values.yaml
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/hooks/phase2
destination:
server: https://kubernetes.default.svc
namespace: monitoring
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: cloudnative-pg
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
project: homelab
sources:
- repoURL: https://cloudnative-pg.github.io/charts
chart: cloudnative-pg
targetRevision: "~0.20"
helm:
valueFiles:
- k8s/ddb/cnpg-values.yaml
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/hooks/phase2
destination:
server: https://kubernetes.default.svc
namespace: ddb
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/phase2-storage-observability-1.yaml
-115
View File
@@ -1,115 +0,0 @@
# Phase 2 — Storage/observability chain continued: loki, grafana, forgejo, forgejo-runner
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: loki
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
source:
repoURL: https://grafana.github.io/helm-charts
chart: loki
targetRevision: latest
helm:
valueFiles:
- k8s/logging/loki-values.yaml
- k8s/logging/loki-secrets.enc.yaml
destination:
server: https://kubernetes.default.svc
namespace: logging
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: grafana
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
project: homelab
source:
repoURL: https://grafana.github.io/helm-charts
chart: grafana
targetRevision: latest
helm:
valueFiles:
- k8s/logging/grafana-values.yaml
- k8s/logging/grafana-secrets.enc.yaml
destination:
server: https://kubernetes.default.svc
namespace: logging
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: forgejo
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
project: homelab
source:
repoURL: https://dl.gitea.com/charts/
chart: gitea
targetRevision: "~10"
helm:
valueFiles:
- k8s/talos-ci-cd/forgejo-values.yaml
- k8s/talos-ci-cd/forgejo-secrets.enc.yaml
destination:
server: https://kubernetes.default.svc
namespace: cicd
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: forgejo-runner
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "3"
spec:
project: homelab
sources:
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/talos-ci-cd/charts/forgejo-runner
helm:
valueFiles:
- values.yaml
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/hooks/phase2
destination:
server: https://kubernetes.default.svc
namespace: cicd
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true
k8s/argocd/apps/phase3-iam-0.yaml
-32
View File
@@ -1,32 +0,0 @@
# Phase 3 — IAM (Authentik) — identity-critical release
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: authentik
namespace: argocd
annotations:
argocd.argoproj.io/sync-wave: "1"
spec:
project: homelab
sources:
- repoURL: https://charts.goauthentik.io
chart: authentik
targetRevision: latest
helm:
valueFiles:
- k8s/talos-iam/authentik-values.yaml
- k8s/talos-iam/authentik-secrets.enc.yaml
- repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
targetRevision: main
path: k8s/hooks/phase3
destination:
server: https://kubernetes.default.svc
namespace: iam
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- CreateNamespace=true