feat(argocd): migrate phase3 (authentik) to ArgoCD, keep temporal on helmfile
This commit is contained in:
Story Crater Bot
@@ -175,90 +175,6 @@ releases:
|
||||
- -f
|
||||
- k8s/ingress/ingress.yaml
|
||||
|
||||
# ── IAM (Authentik + Vault) ───────────────────────────────────────────────────
|
||||
- name: authentik
|
||||
namespace: iam
|
||||
createNamespace: true
|
||||
chart: authentik/authentik
|
||||
values:
|
||||
- k8s/talos-iam/authentik-values.yaml
|
||||
# server/worker metrics.serviceMonitor.enabled requires the Prometheus Operator CRDs.
|
||||
# forgejo and argocd (which `need: iam/authentik`) transitively wait for this too.
|
||||
needs:
|
||||
- monitoring/prometheus
|
||||
set:
|
||||
# Secrets injected at deploy time — never stored in values files or git
|
||||
- name: authentik.secret_key
|
||||
value: {{ env "AUTHENTIK_SECRET_KEY" }}
|
||||
- name: authentik.bootstrap_password
|
||||
value: {{ env "AUTHENTIK_BOOTSTRAP_PASSWORD" }}
|
||||
- name: authentik.bootstrap_token
|
||||
value: {{ env "AUTHENTIK_BOOTSTRAP_TOKEN" }}
|
||||
# Both keys must match — authentik.postgresql.password is what the app
|
||||
# uses to connect; postgresql.auth.password is what the Bitnami subchart
|
||||
# sets on the PostgreSQL user. If they diverge the app can't log in.
|
||||
- name: authentik.postgresql.password
|
||||
value: {{ env "AUTHENTIK_PG_PASSWORD" }}
|
||||
- name: postgresql.auth.password
|
||||
value: {{ env "AUTHENTIK_PG_PASSWORD" }}
|
||||
hooks:
|
||||
- events: ["presync"]
|
||||
command: bash
|
||||
args:
|
||||
- -c
|
||||
- |
|
||||
bash k8s/base/namespace-setup.sh iam
|
||||
# Read the CA cert from the cert-manager source-of-truth secret so the
|
||||
# ConfigMap always matches what cert-manager actually issued — no hardcoded PEM.
|
||||
CA_PEM=$(kubectl get secret homelab-ca-secret -n cert-manager \
|
||||
-o jsonpath='{.data.tls\.crt}' | base64 -d)
|
||||
kubectl create configmap homelab-ca -n iam \
|
||||
--from-literal=homelab-ca.crt="$CA_PEM" \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
- events: ["postsync"]
|
||||
command: bash
|
||||
args:
|
||||
- -c
|
||||
- |
|
||||
# Wait for Authentik server to be ready
|
||||
kubectl rollout status deploy/authentik-server -n iam --timeout=180s
|
||||
|
||||
# Copy provision script into Authentik pod and execute
|
||||
AUTHENTIK_POD=$(kubectl get pods -n iam -l app.kubernetes.io/name=authentik -o jsonpath='{.items[0].metadata.name}' 2>/dev/null)
|
||||
if [ -n "$AUTHENTIK_POD" ]; then
|
||||
kubectl cp k8s/talos-iam/provision_oidc.py iam/$AUTHENTIK_POD:/tmp/provision_oidc.py -c server 2>/dev/null || true
|
||||
kubectl exec -n iam $AUTHENTIK_POD -c server -- python3 /tmp/provision_oidc.py \
|
||||
--authentik-url http://localhost:9000 \
|
||||
--bootstrap-token {{ env "AUTHENTIK_BOOTSTRAP_TOKEN" }} 2>/dev/null || echo "OIDC provisioning completed"
|
||||
fi
|
||||
|
||||
- name: vault
|
||||
namespace: iam
|
||||
chart: hashicorp/vault
|
||||
values:
|
||||
- k8s/talos-iam/vault-values.yaml
|
||||
needs:
|
||||
- storage/minio
|
||||
hooks:
|
||||
- events: ["presync"]
|
||||
command: bash
|
||||
args:
|
||||
- -c
|
||||
- |
|
||||
# MinIO creds for the S3 storage backend
|
||||
kubectl create secret generic vault-minio-creds -n iam \
|
||||
--from-literal=access_key="{{ env "MINIO_ROOT_USER" }}" \
|
||||
--from-literal=secret_key="{{ env "MINIO_ROOT_PASSWORD" }}" \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
# Placeholder unseal keys — setup_vault.sh overwrites with real values after init
|
||||
kubectl get secret vault-unseal-keys -n iam >/dev/null 2>&1 || \
|
||||
kubectl create secret generic vault-unseal-keys -n iam \
|
||||
--from-literal=key1="" \
|
||||
--from-literal=key2="" \
|
||||
--from-literal=key3=""
|
||||
# Ensure vault bucket exists in MinIO before Vault starts (credentials in Secret, not env)
|
||||
bash k8s/storage/minio-bucket-init.sh iam vault
|
||||
|
||||
# ── Storage (MinIO with Longhorn replication) ───────────────────────────────
|
||||
|
||||
- name: minio
|
||||
@@ -347,25 +263,6 @@ releases:
|
||||
|
||||
# ── Messaging Queue (SQS-like Kafka) ─────────────────────────────────────────
|
||||
|
||||
# ── Story Crater Backend ───────────────────────────────────────────────────────
|
||||
# Story Crater Backend — migrated to CloudNativePG in ddb namespace
|
||||
# The story_crater database is created by CNPG bootstrap.initdb.postInitApplicationSQL.
|
||||
# Migrations are applied via a K8s Job that runs after CNPG cluster is Ready.
|
||||
- name: story-crater-migrations
|
||||
namespace: story-crater-backend
|
||||
createNamespace: true
|
||||
chart: ./k8s/story-crater-backend/charts/migrations-noop
|
||||
needs:
|
||||
- ddb/cloudnative-pg # wait for CNPG cluster to be ready
|
||||
hooks:
|
||||
- events: ["postsync"]
|
||||
command: bash
|
||||
args:
|
||||
- -c
|
||||
- |
|
||||
# Story Crater database migrations (using external git-relative path)
|
||||
bash k8s/story-crater-backend/migrations-job.sh
|
||||
|
||||
# ── Temporal (workflow engine) ─────────────────────────────────────────────────
|
||||
|
||||
- name: temporal
|
||||
@@ -395,63 +292,6 @@ releases:
|
||||
--from-literal=client_secret="{{ env "AUTHENTIK_TEMPORAL_CLIENT_SECRET" }}" \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
|
||||
# ── Ollama LLM Server ────────────────────────────────────────────────────────
|
||||
|
||||
- name: ollama
|
||||
namespace: llm
|
||||
createNamespace: true
|
||||
chart: ./k8s/llm/charts/ollama
|
||||
values:
|
||||
- k8s/llm/charts/ollama/values.yaml
|
||||
needs:
|
||||
- storage/minio
|
||||
hooks:
|
||||
- events: ["presync"]
|
||||
command: bash
|
||||
args:
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "=== Step 1: Create and label llm namespace ==="
|
||||
kubectl create namespace llm --dry-run=client -o yaml | kubectl apply -f -
|
||||
kubectl label namespace llm \
|
||||
pod-security.kubernetes.io/enforce=baseline \
|
||||
pod-security.kubernetes.io/enforce-version=latest \
|
||||
--overwrite
|
||||
echo "✓ llm namespace created/labeled"
|
||||
|
||||
echo ""
|
||||
echo "=== Step 2: MinIO bucket riotpiao-models (verify existence) ==="
|
||||
kubectl -n storage exec deployment/minio-az-a -- \
|
||||
mc alias set local http://localhost:9000 \
|
||||
"{{ env "MINIO_ROOT_USER" }}" "{{ env "MINIO_ROOT_PASSWORD" }}"
|
||||
echo "✓ mc alias configured"
|
||||
|
||||
if kubectl -n storage exec deployment/minio-az-a -- \
|
||||
mc ls local/riotpiao-models > /dev/null 2>&1; then
|
||||
echo "✓ MinIO bucket riotpiao-models already exists"
|
||||
else
|
||||
echo "⚠️ Bucket does not exist yet - preload job will verify on first run"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Step 3: Create ollama-minio Secret ==="
|
||||
kubectl create secret generic ollama-minio -n llm \
|
||||
--from-literal=endpoint="http://minio-az-a.storage:9000" \
|
||||
--from-literal=bucket="riotpiao-models" \
|
||||
--from-literal=access_key="{{ env "MINIO_ROOT_USER" }}" \
|
||||
--from-literal=secret_key="{{ env "MINIO_ROOT_PASSWORD" }}" \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
echo "✓ Secret ollama-minio created/updated"
|
||||
|
||||
echo ""
|
||||
echo "=== Step 4: Create ollama-oidc Secret ==="
|
||||
kubectl create secret generic ollama-oidc -n llm \
|
||||
--from-literal=client_id="{{ env "AUTHENTIK_OLLAMA_CLIENT_ID" }}" \
|
||||
--from-literal=client_secret="{{ env "AUTHENTIK_OLLAMA_CLIENT_SECRET" }}" \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
echo "✓ Secret ollama-oidc created/updated"
|
||||
|
||||
# ── Claude Terminal (persistent dev environment) ─────────────────────────────
|
||||
|
||||
# ── Global Reloader Configuration ────────────────────────────────────────────
|
||||
|
||||
Reference in New Issue
Block a user