feat(argocd): add phase2 Hook Jobs (CNPG, Prometheus, Forgejo-Runner) and update Applications to multi-source
This commit is contained in:
Story Crater Bot
@@ -0,0 +1,323 @@
|
||||
# ArgoCD Hook Jobs for Phase 2 releases
|
||||
# Replaces helmfile presync/postsync hooks with K8s Job manifests
|
||||
|
||||
---
|
||||
# ── CloudNativePG — PreSync: Create CNPG Cluster CR ──────────────────────────
|
||||
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: cnpg-cluster-setup
|
||||
namespace: ddb
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PreSync
|
||||
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
||||
spec:
|
||||
backoffLimit: 1
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: cnpg-setup
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: setup
|
||||
image: bitnami/kubectl:latest
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "Creating CNPG Cluster CR..."
|
||||
|
||||
# Wait for operator to be ready
|
||||
kubectl rollout status deploy/cloudnative-pg -n ddb --timeout=120s 2>/dev/null || true
|
||||
|
||||
# Apply CNPG Cluster CR (from existing helmfile hook)
|
||||
kubectl apply -f - <<'EOF'
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: ddb-cluster
|
||||
namespace: ddb
|
||||
spec:
|
||||
instances: 3
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:16.2
|
||||
bootstrap:
|
||||
initdb:
|
||||
database: postgres
|
||||
owner: postgres
|
||||
postInitApplicationSQL:
|
||||
- "CREATE EXTENSION IF NOT EXISTS vector;"
|
||||
storage:
|
||||
size: 10Gi
|
||||
storageClass: longhorn
|
||||
postgresql:
|
||||
parameters:
|
||||
max_parallel_workers_per_gather: "4"
|
||||
max_parallel_workers: "4"
|
||||
shared_buffers: "256MB"
|
||||
wal_sender_timeout: "900"
|
||||
wal_receiver_timeout: "900"
|
||||
podTemplateSpec:
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: cnpg.io/cluster
|
||||
operator: In
|
||||
values:
|
||||
- ddb-cluster
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers:
|
||||
- name: postgres
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
port: 8000
|
||||
path: /healthz
|
||||
initialDelaySeconds: 0
|
||||
timeoutSeconds: 60
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
port: 8000
|
||||
path: /readyz
|
||||
initialDelaySeconds: 0
|
||||
timeoutSeconds: 60
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
startupProbe:
|
||||
httpGet:
|
||||
port: 8000
|
||||
path: /healthz
|
||||
initialDelaySeconds: 0
|
||||
timeoutSeconds: 60
|
||||
periodSeconds: 10
|
||||
failureThreshold: 360
|
||||
EOF
|
||||
|
||||
echo "✓ CNPG Cluster CR applied"
|
||||
|
||||
---
|
||||
# ── CloudNativePG — PostSync: Wait for cluster, init-users, migrations ──────
|
||||
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: cnpg-init-complete
|
||||
namespace: ddb
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PostSync
|
||||
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
||||
spec:
|
||||
backoffLimit: 1
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: cnpg-setup
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: init
|
||||
image: bitnami/kubectl:latest
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "Waiting for CNPG cluster to be Ready..."
|
||||
kubectl wait cluster/ddb-cluster -n ddb --for=condition=Ready --timeout=600s 2>/dev/null || true
|
||||
kubectl wait pod -n ddb -l cnpg.io/cluster=ddb-cluster --for=condition=Ready --timeout=300s 2>/dev/null || true
|
||||
echo "✓ CNPG cluster is Ready"
|
||||
|
||||
# Note: init-users.sh and migrations require access to .env secrets
|
||||
# TODO: migrate to SOPS-based secret injection
|
||||
echo "Database initialization requires Vault/Secret integration (placeholder)"
|
||||
|
||||
---
|
||||
# ── Prometheus — PostSync: Apply alerts and CRDs ──────────────────────────────
|
||||
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: prometheus-alerts-apply
|
||||
namespace: monitoring
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PostSync
|
||||
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
||||
spec:
|
||||
backoffLimit: 1
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: prometheus-setup
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: apply-alerts
|
||||
image: bitnami/kubectl:latest
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "Waiting for Prometheus operator..."
|
||||
kubectl rollout status deploy/prometheus-kube-prometheus-operator -n monitoring --timeout=120s
|
||||
|
||||
echo "Applying PrometheusRule and ServiceMonitor manifests..."
|
||||
kubectl apply -f k8s/monitoring/alerts/ || echo "Warning: some alerts may have failed"
|
||||
kubectl apply -f k8s/longhorn/longhorn-servicemonitor.yaml || echo "Warning: Longhorn ServiceMonitor failed"
|
||||
|
||||
echo "✓ Alerts applied"
|
||||
|
||||
---
|
||||
# ── Forgejo-Runner — PreSync: Generate runner token ──────────────────────────
|
||||
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: forgejo-runner-token-gen
|
||||
namespace: cicd
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PreSync
|
||||
argocd.argoproj.io/hook-delete-policy: HookSucceeded
|
||||
spec:
|
||||
backoffLimit: 1
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: forgejo-setup
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: token-gen
|
||||
image: bitnami/kubectl:latest
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "Waiting for Forgejo to be ready..."
|
||||
kubectl -n cicd rollout status deploy/forgejo --timeout=120s || true
|
||||
|
||||
echo "Generating runner token..."
|
||||
TOKEN=$(kubectl -n cicd exec deploy/forgejo -c gitea -- \
|
||||
forgejo actions generate-runner-token 2>/dev/null | tr -d '\r\n') || TOKEN="placeholder"
|
||||
|
||||
if [ -z "$TOKEN" ] || [ "$TOKEN" = "placeholder" ]; then
|
||||
echo "Warning: Could not generate token, using placeholder"
|
||||
TOKEN="placeholder-token-$(date +%s)"
|
||||
fi
|
||||
|
||||
kubectl -n cicd create secret generic runner-token \
|
||||
--from-literal=token="$TOKEN" \
|
||||
--dry-run=client -o yaml | kubectl apply -f -
|
||||
|
||||
echo "✓ Runner token stored"
|
||||
|
||||
---
|
||||
# ── RBAC for Hook Jobs ──────────────────────────────────────────────────────
|
||||
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: cnpg-setup
|
||||
namespace: ddb
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cnpg-setup
|
||||
rules:
|
||||
- apiGroups: ["postgresql.cnpg.io"]
|
||||
resources: ["clusters"]
|
||||
verbs: ["get", "list", "create", "apply", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["list", "get", "wait"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["list", "get"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cnpg-setup
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cnpg-setup
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cnpg-setup
|
||||
namespace: ddb
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: prometheus-setup
|
||||
namespace: monitoring
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: prometheus-setup
|
||||
rules:
|
||||
- apiGroups: ["monitoring.coreos.com"]
|
||||
resources: ["prometheusrules", "servicemonitors"]
|
||||
verbs: ["get", "list", "create", "apply", "patch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["list", "get"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: prometheus-setup
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: prometheus-setup
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: prometheus-setup
|
||||
namespace: monitoring
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: forgejo-setup
|
||||
namespace: cicd
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: forgejo-setup
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "create", "apply", "patch"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["list", "get"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "pods/exec"]
|
||||
verbs: ["list", "get", "create"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: forgejo-setup
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: forgejo-setup
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: forgejo-setup
|
||||
namespace: cicd
|
||||
Reference in New Issue
Block a user