refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

2026-07-23 20:54:02 -07:00
parent 1c7395d9e1
commit e6f2ab1423
241 changed files with 467 additions and 10416 deletions
@@ -0,0 +1,26 @@
+clusterName: kmsvc
+namespace: sqs
+
+nodePool:
+  replicas: 3
+  storage:
+    class: longhorn
+    # Longhorn's per-node scheduling budget on the current 2-node cluster has
+    # only ~36Gi of headroom left (other PVCs already reserve the rest), and
+    # each node hosts one replica of all 3 broker volumes -- so 3 * sizeGi
+    # must fit in that headroom. Revisit once the 3rd node joins.
+    sizeGi: 10
+  resources:
+    memory: 5Gi
+    cpu: "2"
+  heapOpts: "-Xms2g -Xmx2g"
+  # design.md §7: 3 real zones now exist (talos-cp-1=az-a, talos-worker-1=az-b,
+  # talos-worker-2=az-c), so anti-affinity keys off zone instead of hostname —
+  # spreads the 3 broker pods one-per-zone/one-per-node (equivalent today,
+  # but zone is the correct long-term key if a node ever gets replaced within
+  # the same zone).
+  antiAffinityTopologyKey: topology.kubernetes.io/zone
+
+kafka:
+  replicationFactor: 3
+  minInsyncReplicas: 2