feat(substrate): deploy cert-manager/ingress-nginx/reloader + privileged PodSecurity for ingress-nginx

2026-08-18 15:08:02 -07:00
parent a6465f7158
commit d9ae0a6c44
4 changed files with 215 additions and 0 deletions
@@ -0,0 +1,162 @@
+# Wave 0/1 — cluster substrate: cert-manager, ingress-nginx, reloader, and the
+# Let's Encrypt issuers + wildcard cert. Previously installed by Terraform; now
+# owned by app-of-apps (Pure GitOps). Controllers at wave 0; the ClusterIssuers
+# and wildcard Certificate at wave 1 so cert-manager CRDs exist first.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  sources:
+    - repoURL: https://charts.jetstack.io
+      chart: cert-manager
+      targetRevision: "v1.21.0"
+      helm:
+        valueFiles:
+          - $values/k8s/bootstrap/cert-manager/cert-manager-values.yaml
+    - repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ingress-nginx
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  sources:
+    - repoURL: https://kubernetes.github.io/ingress-nginx
+      chart: ingress-nginx
+      targetRevision: "4.15.1"
+      helm:
+        valueFiles:
+          - $values/k8s/bootstrap/ingress/nginx-values.yaml
+    - repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ingress-nginx
+  syncPolicy:
+    managedNamespaceMetadata:
+      # hostPort 80/443 requires the privileged PodSecurity level; the default
+      # baseline/restricted enforce blocks the controller DaemonSet.
+      labels:
+        pod-security.kubernetes.io/enforce: privileged
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: reloader
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  source:
+    repoURL: https://stakater.github.io/stakater-charts
+    chart: reloader
+    targetRevision: "2.2.14"
+    helm:
+      values: |
+        reloader:
+          deployment:
+            tolerations:
+              - key: node-role.kubernetes.io/control-plane
+                operator: Exists
+                effect: NoSchedule
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: reloader
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+# Wave 1 — LE ClusterIssuers + wildcard cert (needs cert-manager CRDs from wave 0).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager-issuers
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  source:
+    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/bootstrap/cert-manager
+    directory:
+      include: "letsencrypt-issuer.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cert-manager
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: wildcard-cert
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  source:
+    repoURL: http://forgejo.riotpiao.com:3000/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/bootstrap/ingress
+    directory:
+      include: "riotpiao-com-cert.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ingress-nginx
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true