refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

2026-07-23 20:54:02 -07:00
parent 1c7395d9e1
commit e6f2ab1423
241 changed files with 467 additions and 10416 deletions
@@ -0,0 +1,50 @@
+namespace: sqs
+replicaCount: 3
+
+image:
+  repository: ghcr.io/riotpiaole/kmsvc-management-service
+  tag: latest
+  pullPolicy: Always
+
+grpcPort: 9090
+httpPort: 8080
+
+env:
+  kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
+  redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
+  authentikIssuerURL: ""
+  authentikAudience: ""
+
+resources:
+  requests:
+    cpu: 200m
+    memory: 256Mi
+  limits:
+    cpu: "1"
+    memory: 512Mi
+
+# Go's GC only reacts to GOGC by default and has no idea about the cgroup
+# memory limit above -- it'll happily grow heap until the kernel OOMKills it.
+# Setting GOMEMLIMIT to ~90% of the container limit makes the GC self-throttle
+# before that happens. Keep this in sync with resources.limits.memory.
+goMemLimit: "460MiB"
+
+hpa:
+  enabled: true
+  minReplicas: 3
+  maxReplicas: 9
+  targetCPUUtilizationPercentage: 70
+  targetMemoryUtilizationPercentage: 80
+
+ingress:
+  enabled: true
+  className: nginx
+  clusterIssuer: homelab-ca
+  host: kmsvc.riotpiao.com
+  tlsSecretName: kmsvc-tls
+  # kmsvc-cli connects via gRPC directly to --server/KMSVC_SERVER (default
+  # kmsvc.riotpiao.com:443, see kmsvc-cli's README), so raw gRPC needs an
+  # external path too — scoped to the gRPC service's own path prefix on the
+  # same host/port, rather than opening the whole host to gRPC passthrough.
+  grpcEnabled: true
+  grpcPathPrefix: /kafkamgmt.v1.QueueService/