refactor(argocd): consolidate Applications (39→35)
Merge related Applications using multi-source pattern and PostSync hooks: 1. ingress-config ← wildcard-cert + homelab-ingress (2→1) - Both in k8s/bootstrap/ingress/, now use kustomization - Certificate deployed before Ingresses (wave 1) 2. homarr ← homarr + homarr-patches (2→1) - Added PostSync hook source (fix-probes-job.yaml) - Patches run after Helm chart deployment 3. temporal ← temporal + temporal-db-secret-sync (2→1) - Added PostSync hook source (copy-job.yaml) - DB secret sync runs after Temporal deployment 4. Removed duplicate: ingress-nginx Application - ingress-nginx-bootstrap (bootstrap) is working - Removed redundant ArgoCD-managed ingress-nginx - Eliminated duplicate DaemonSet Skipped: cert-manager + cert-manager-issuers - Wave separation needed (CRDs before Issuers) - Keep separate for safety Result: 39 → 35 Applications (-4, -10.3%) Files: - k8s/bootstrap/ingress/kustomization.yaml (updated) - k8s/argocd/apps/00-substrate.yaml (merges + removal) - k8s/argocd/apps/60-applications.yaml (merges) - CONSOLIDATION-RESULTS.md (documentation) - APPLICATION-CONSOLIDATION-PLAN.md (analysis) - GITOPS-STATUS.md (updated inventory)
This commit is contained in:
Story Crater Bot
@@ -0,0 +1,301 @@
|
||||
# ArgoCD Application Consolidation Plan
|
||||
|
||||
## Executive Summary
|
||||
|
||||
**Current:** 39 Applications
|
||||
**Proposed:** 32 Applications (Conservative: 35)
|
||||
**Benefits:** Easier management, fewer Application resources, cleaner structure
|
||||
|
||||
## Phase 1: Safe & Easy Merges (Conservative - Start Here)
|
||||
|
||||
These are Applications that already share the same directory and have clear parent-child relationships.
|
||||
|
||||
### 1.1 Merge: wildcard-cert + homelab-ingress → "ingress-config"
|
||||
|
||||
**Current State:**
|
||||
```
|
||||
wildcard-cert (wave 1) → k8s/bootstrap/ingress/riotpiao-com-cert.yaml
|
||||
homelab-ingress (wave 2) → k8s/bootstrap/ingress/ingress.yaml
|
||||
```
|
||||
|
||||
**New State:**
|
||||
```
|
||||
ingress-config (wave 1) → k8s/bootstrap/ingress/ (kustomization)
|
||||
```
|
||||
|
||||
**Rationale:** Both in same directory, ingress depends on cert existing
|
||||
|
||||
**Implementation:**
|
||||
- Update `k8s/bootstrap/ingress/kustomization.yaml` to include both
|
||||
- Create single Application pointing to k8s/bootstrap/ingress/
|
||||
- Delete wildcard-cert and homelab-ingress Applications
|
||||
- Result: 2 → 1 Applications
|
||||
|
||||
### 1.2 Merge: homarr + homarr-patches → "homarr"
|
||||
|
||||
**Current State:**
|
||||
```
|
||||
homarr (wave 8) → Helm chart (homarr-labs.github.io)
|
||||
homarr-patches (wave 9) → k8s/applications/homarr/fix-probes-job.yaml
|
||||
```
|
||||
|
||||
**New State:**
|
||||
```
|
||||
homarr (multi-source):
|
||||
- Source 1: Helm chart
|
||||
- Source 2: k8s/applications/homarr/ (patches as PostSync hook)
|
||||
```
|
||||
|
||||
**Rationale:** homarr-patches is literally a patch for homarr
|
||||
|
||||
**Implementation:**
|
||||
- Modify homarr Application to use multi-source
|
||||
- Convert fix-probes-job.yaml to PostSync hook
|
||||
- Delete homarr-patches Application
|
||||
- Result: 2 → 1 Applications
|
||||
|
||||
### 1.3 Merge: temporal-db-secret-sync → temporal (as PreSync hook)
|
||||
|
||||
**Current State:**
|
||||
```
|
||||
temporal-db-secret-sync (wave 7) → k8s/applications/temporal/db-secret-sync/
|
||||
temporal (wave 8) → Helm chart
|
||||
```
|
||||
|
||||
**New State:**
|
||||
```
|
||||
temporal (multi-source):
|
||||
- Source 1: k8s/applications/temporal/db-secret-sync/ (PreSync hook)
|
||||
- Source 2: Helm chart
|
||||
- Source 3: k8s/applications/temporal/ (values)
|
||||
```
|
||||
|
||||
**Rationale:** db-secret-sync is a bootstrap job for temporal
|
||||
|
||||
**Implementation:**
|
||||
- Modify temporal Application to use multi-source
|
||||
- Ensure db-secret-sync Job has PreSync hook annotation
|
||||
- Delete temporal-db-secret-sync Application
|
||||
- Result: 2 → 1 Applications
|
||||
|
||||
### 1.4 Merge: cert-manager-issuers → cert-manager (as multi-source)
|
||||
|
||||
**Current State:**
|
||||
```
|
||||
cert-manager (wave 0) → Helm chart
|
||||
cert-manager-issuers (wave 1) → k8s/bootstrap/cert-manager/ (issuers)
|
||||
```
|
||||
|
||||
**New State:**
|
||||
```
|
||||
cert-manager (multi-source):
|
||||
- Source 1: Helm chart
|
||||
- Source 2: k8s/bootstrap/cert-manager/ (values + issuers)
|
||||
```
|
||||
|
||||
**Rationale:** Issuers are part of cert-manager configuration
|
||||
|
||||
**Implementation:**
|
||||
- Modify cert-manager Application to use multi-source
|
||||
- Keep as wave 0 (issuers can wait for CRDs to be ready)
|
||||
- Delete cert-manager-issuers Application
|
||||
- Result: 2 → 1 Applications
|
||||
|
||||
**Phase 1 Result: 39 → 35 Applications (-4)**
|
||||
|
||||
---
|
||||
|
||||
## Phase 2: Logical Consolidations (Moderate Risk)
|
||||
|
||||
### 2.1 Merge: SQS Applications → "sqs-platform"
|
||||
|
||||
**Current State:**
|
||||
```
|
||||
strimzi-operator (wave 5) → Helm chart (operator)
|
||||
kmsvc-redis (wave 5) → Helm chart (Redis)
|
||||
kafka-cluster (wave 6) → k8s/applications/sqs/charts/kafka-cluster/
|
||||
queue-crd (wave 6) → k8s/applications/sqs/charts/queue-crd/
|
||||
management-service (wave 7) → k8s/applications/sqs/charts/management-service/
|
||||
```
|
||||
|
||||
**New State:**
|
||||
```
|
||||
strimzi-operator (wave 5) → Keep separate (operator)
|
||||
sqs-platform (wave 6) → k8s/applications/sqs/ (all services + CRDs)
|
||||
```
|
||||
|
||||
**Rationale:** These 4 apps work together as the SQS platform
|
||||
|
||||
**Implementation:**
|
||||
- Create kustomization.yaml in k8s/applications/sqs/
|
||||
- Create single multi-source Application
|
||||
- Keep strimzi-operator separate (it's infrastructure)
|
||||
- Result: 5 → 2 Applications
|
||||
|
||||
### 2.2 Merge: authentik + iam-jobs → "authentik"
|
||||
|
||||
**Current State:**
|
||||
```
|
||||
authentik (wave 3) → Helm chart
|
||||
iam-jobs (wave 3) → k8s/security/iam/ (authentik helper jobs)
|
||||
```
|
||||
|
||||
**New State:**
|
||||
```
|
||||
authentik (multi-source):
|
||||
- Source 1: Helm chart
|
||||
- Source 2: k8s/security/iam/ (helper jobs)
|
||||
```
|
||||
|
||||
**Rationale:** iam-jobs appears to be authentik-specific
|
||||
|
||||
**Implementation:**
|
||||
- Verify iam-jobs are authentik-specific
|
||||
- Merge into single multi-source Application
|
||||
- Result: 2 → 1 Applications
|
||||
|
||||
### 2.3 Remove Duplicate: ingress-nginx Application
|
||||
|
||||
**Current State:**
|
||||
```
|
||||
ingress-nginx-bootstrap (wave 0, bootstrap) → Helm chart
|
||||
ingress-nginx (wave 0, ArgoCD) → Helm chart (DUPLICATE!)
|
||||
```
|
||||
|
||||
**New State:**
|
||||
```
|
||||
ingress-nginx-bootstrap (wave 0, bootstrap) → Keep only this one
|
||||
```
|
||||
|
||||
**Rationale:** These are the same thing, bootstrap one is already working
|
||||
|
||||
**Implementation:**
|
||||
- Delete ingress-nginx Application (redundant)
|
||||
- Result: 2 → 1 Applications
|
||||
|
||||
**Phase 2 Result: 35 → 31 Applications (-4)**
|
||||
|
||||
---
|
||||
|
||||
## Phase 3: Advanced Consolidations (Consider Carefully)
|
||||
|
||||
### 3.1 Consider: Monitoring Stack
|
||||
|
||||
**Current State:**
|
||||
```
|
||||
prometheus-crds (wave 0) → k8s/platform/monitoring/crds/
|
||||
prometheus (wave 1) → Helm chart
|
||||
blackbox-exporter (wave 1) → Helm chart
|
||||
```
|
||||
|
||||
**Option A:** Keep separate (CRDs must be wave 0)
|
||||
**Option B:** Create "monitoring-stack" with prometheus + blackbox-exporter only
|
||||
|
||||
**Recommendation:** Keep separate for now (CRDs are special)
|
||||
|
||||
### 3.2 Consider: Logging Stack
|
||||
|
||||
**Current State:**
|
||||
```
|
||||
loki (wave 2) → Helm chart
|
||||
promtail (wave 2) → Helm chart
|
||||
grafana (wave 2) → Helm chart
|
||||
```
|
||||
|
||||
**Option A:** Create "logging-stack" with all three
|
||||
**Option B:** Keep separate (grafana used by multiple systems)
|
||||
|
||||
**Recommendation:** Keep separate for now (grafana has multiple consumers)
|
||||
|
||||
---
|
||||
|
||||
## Implementation Order
|
||||
|
||||
### Sprint 1: Phase 1 (Low Risk)
|
||||
1. ✅ ingress-config (wildcard-cert + homelab-ingress)
|
||||
2. ✅ homarr (merge homarr-patches)
|
||||
3. ✅ temporal (merge db-secret-sync)
|
||||
4. ✅ cert-manager (merge issuers)
|
||||
|
||||
### Sprint 2: Phase 2 (Moderate Risk)
|
||||
5. ✅ Remove duplicate ingress-nginx
|
||||
6. ✅ sqs-platform consolidation
|
||||
7. ✅ authentik + iam-jobs
|
||||
|
||||
### Sprint 3: Phase 3 (Optional)
|
||||
8. ⚠️ Evaluate monitoring stack consolidation
|
||||
9. ⚠️ Evaluate logging stack consolidation
|
||||
|
||||
---
|
||||
|
||||
## File Changes Required
|
||||
|
||||
### For each consolidation:
|
||||
|
||||
1. **Update Application YAML** in `k8s/argocd/apps/*.yaml`
|
||||
- Convert single-source to multi-source
|
||||
- Update sync waves appropriately
|
||||
- Add hook annotations where needed
|
||||
|
||||
2. **Update kustomization.yaml** in target directories
|
||||
- Ensure all resources are listed
|
||||
- Verify namespace declarations
|
||||
|
||||
3. **Test locally:**
|
||||
```bash
|
||||
kubectl kustomize k8s/bootstrap/ingress/
|
||||
helm template <chart> -f values.yaml
|
||||
```
|
||||
|
||||
4. **Delete old Applications:**
|
||||
```bash
|
||||
kubectl delete application <old-app> -n argocd
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Rollback Plan
|
||||
|
||||
Each consolidation is independent. If issues arise:
|
||||
|
||||
1. **Revert git commit** with the Application change
|
||||
2. **Restore old Applications** from git history
|
||||
3. **Force ArgoCD refresh:**
|
||||
```bash
|
||||
kubectl delete application <new-merged-app> -n argocd
|
||||
kubectl apply -f k8s/argocd/apps/<old-wave-file>.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Success Metrics
|
||||
|
||||
**Before:** 39 Applications
|
||||
**After (Conservative):** 35 Applications
|
||||
**After (Full):** 31-32 Applications
|
||||
|
||||
**Benefits:**
|
||||
- ✅ Easier to understand (related apps grouped)
|
||||
- ✅ Fewer Application CRs to manage
|
||||
- ✅ Cleaner ArgoCD UI
|
||||
- ✅ Logical grouping by function
|
||||
- ✅ Reduced sync complexity
|
||||
|
||||
**Risks:**
|
||||
- ⚠️ Multi-source Applications are slightly more complex
|
||||
- ⚠️ Sync wave ordering must be preserved
|
||||
- ⚠️ Hook timing must be correct (PreSync/PostSync)
|
||||
|
||||
---
|
||||
|
||||
## Decision: Which Phase?
|
||||
|
||||
**Recommendation:** Start with **Phase 1 (Conservative)** → 35 Applications
|
||||
|
||||
This gives us:
|
||||
- 4 fewer Applications to manage
|
||||
- Low risk (same directories)
|
||||
- Easy to understand merges
|
||||
- Can evaluate Phase 2 later based on results
|
||||
|
||||
**Do you want to proceed with Phase 1 implementation?**
|
||||
Reference in New Issue
Block a user