diff --git a/helmfile.yaml.gotmpl b/helmfile.yaml.gotmpl index 7d747e3..708a8d8 100644 --- a/helmfile.yaml.gotmpl +++ b/helmfile.yaml.gotmpl @@ -175,90 +175,6 @@ releases: - -f - k8s/ingress/ingress.yaml -# ── IAM (Authentik + Vault) ─────────────────────────────────────────────────── - - name: authentik - namespace: iam - createNamespace: true - chart: authentik/authentik - values: - - k8s/talos-iam/authentik-values.yaml - # server/worker metrics.serviceMonitor.enabled requires the Prometheus Operator CRDs. - # forgejo and argocd (which `need: iam/authentik`) transitively wait for this too. - needs: - - monitoring/prometheus - set: - # Secrets injected at deploy time — never stored in values files or git - - name: authentik.secret_key - value: {{ env "AUTHENTIK_SECRET_KEY" }} - - name: authentik.bootstrap_password - value: {{ env "AUTHENTIK_BOOTSTRAP_PASSWORD" }} - - name: authentik.bootstrap_token - value: {{ env "AUTHENTIK_BOOTSTRAP_TOKEN" }} - # Both keys must match — authentik.postgresql.password is what the app - # uses to connect; postgresql.auth.password is what the Bitnami subchart - # sets on the PostgreSQL user. If they diverge the app can't log in. - - name: authentik.postgresql.password - value: {{ env "AUTHENTIK_PG_PASSWORD" }} - - name: postgresql.auth.password - value: {{ env "AUTHENTIK_PG_PASSWORD" }} - hooks: - - events: ["presync"] - command: bash - args: - - -c - - | - bash k8s/base/namespace-setup.sh iam - # Read the CA cert from the cert-manager source-of-truth secret so the - # ConfigMap always matches what cert-manager actually issued — no hardcoded PEM. - CA_PEM=$(kubectl get secret homelab-ca-secret -n cert-manager \ - -o jsonpath='{.data.tls\.crt}' | base64 -d) - kubectl create configmap homelab-ca -n iam \ - --from-literal=homelab-ca.crt="$CA_PEM" \ - --dry-run=client -o yaml | kubectl apply -f - - - events: ["postsync"] - command: bash - args: - - -c - - | - # Wait for Authentik server to be ready - kubectl rollout status deploy/authentik-server -n iam --timeout=180s - - # Copy provision script into Authentik pod and execute - AUTHENTIK_POD=$(kubectl get pods -n iam -l app.kubernetes.io/name=authentik -o jsonpath='{.items[0].metadata.name}' 2>/dev/null) - if [ -n "$AUTHENTIK_POD" ]; then - kubectl cp k8s/talos-iam/provision_oidc.py iam/$AUTHENTIK_POD:/tmp/provision_oidc.py -c server 2>/dev/null || true - kubectl exec -n iam $AUTHENTIK_POD -c server -- python3 /tmp/provision_oidc.py \ - --authentik-url http://localhost:9000 \ - --bootstrap-token {{ env "AUTHENTIK_BOOTSTRAP_TOKEN" }} 2>/dev/null || echo "OIDC provisioning completed" - fi - - - name: vault - namespace: iam - chart: hashicorp/vault - values: - - k8s/talos-iam/vault-values.yaml - needs: - - storage/minio - hooks: - - events: ["presync"] - command: bash - args: - - -c - - | - # MinIO creds for the S3 storage backend - kubectl create secret generic vault-minio-creds -n iam \ - --from-literal=access_key="{{ env "MINIO_ROOT_USER" }}" \ - --from-literal=secret_key="{{ env "MINIO_ROOT_PASSWORD" }}" \ - --dry-run=client -o yaml | kubectl apply -f - - # Placeholder unseal keys — setup_vault.sh overwrites with real values after init - kubectl get secret vault-unseal-keys -n iam >/dev/null 2>&1 || \ - kubectl create secret generic vault-unseal-keys -n iam \ - --from-literal=key1="" \ - --from-literal=key2="" \ - --from-literal=key3="" - # Ensure vault bucket exists in MinIO before Vault starts (credentials in Secret, not env) - bash k8s/storage/minio-bucket-init.sh iam vault - # ── Storage (MinIO with Longhorn replication) ─────────────────────────────── - name: minio @@ -347,25 +263,6 @@ releases: # ── Messaging Queue (SQS-like Kafka) ───────────────────────────────────────── -# ── Story Crater Backend ─────────────────────────────────────────────────────── -# Story Crater Backend — migrated to CloudNativePG in ddb namespace -# The story_crater database is created by CNPG bootstrap.initdb.postInitApplicationSQL. -# Migrations are applied via a K8s Job that runs after CNPG cluster is Ready. - - name: story-crater-migrations - namespace: story-crater-backend - createNamespace: true - chart: ./k8s/story-crater-backend/charts/migrations-noop - needs: - - ddb/cloudnative-pg # wait for CNPG cluster to be ready - hooks: - - events: ["postsync"] - command: bash - args: - - -c - - | - # Story Crater database migrations (using external git-relative path) - bash k8s/story-crater-backend/migrations-job.sh - # ── Temporal (workflow engine) ───────────────────────────────────────────────── - name: temporal @@ -395,63 +292,6 @@ releases: --from-literal=client_secret="{{ env "AUTHENTIK_TEMPORAL_CLIENT_SECRET" }}" \ --dry-run=client -o yaml | kubectl apply -f - -# ── Ollama LLM Server ──────────────────────────────────────────────────────── - - - name: ollama - namespace: llm - createNamespace: true - chart: ./k8s/llm/charts/ollama - values: - - k8s/llm/charts/ollama/values.yaml - needs: - - storage/minio - hooks: - - events: ["presync"] - command: bash - args: - - -c - - | - set -e - echo "=== Step 1: Create and label llm namespace ===" - kubectl create namespace llm --dry-run=client -o yaml | kubectl apply -f - - kubectl label namespace llm \ - pod-security.kubernetes.io/enforce=baseline \ - pod-security.kubernetes.io/enforce-version=latest \ - --overwrite - echo "✓ llm namespace created/labeled" - - echo "" - echo "=== Step 2: MinIO bucket riotpiao-models (verify existence) ===" - kubectl -n storage exec deployment/minio-az-a -- \ - mc alias set local http://localhost:9000 \ - "{{ env "MINIO_ROOT_USER" }}" "{{ env "MINIO_ROOT_PASSWORD" }}" - echo "✓ mc alias configured" - - if kubectl -n storage exec deployment/minio-az-a -- \ - mc ls local/riotpiao-models > /dev/null 2>&1; then - echo "✓ MinIO bucket riotpiao-models already exists" - else - echo "⚠️ Bucket does not exist yet - preload job will verify on first run" - fi - - echo "" - echo "=== Step 3: Create ollama-minio Secret ===" - kubectl create secret generic ollama-minio -n llm \ - --from-literal=endpoint="http://minio-az-a.storage:9000" \ - --from-literal=bucket="riotpiao-models" \ - --from-literal=access_key="{{ env "MINIO_ROOT_USER" }}" \ - --from-literal=secret_key="{{ env "MINIO_ROOT_PASSWORD" }}" \ - --dry-run=client -o yaml | kubectl apply -f - - echo "✓ Secret ollama-minio created/updated" - - echo "" - echo "=== Step 4: Create ollama-oidc Secret ===" - kubectl create secret generic ollama-oidc -n llm \ - --from-literal=client_id="{{ env "AUTHENTIK_OLLAMA_CLIENT_ID" }}" \ - --from-literal=client_secret="{{ env "AUTHENTIK_OLLAMA_CLIENT_SECRET" }}" \ - --dry-run=client -o yaml | kubectl apply -f - - echo "✓ Secret ollama-oidc created/updated" - # ── Claude Terminal (persistent dev environment) ───────────────────────────── # ── Global Reloader Configuration ────────────────────────────────────────────