refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)
This commit is contained in:
Story Crater Bot
@@ -0,0 +1,18 @@
|
||||
temporal:
|
||||
oidc_client_id: ENC[AES256_GCM,data:y6eSNJpCNCg=,iv:4n5fIeiVG2JZOCD4yZ4Asm/gWvRl0QNFiRGTR1bs8ws=,tag:liLSr9sadR82UPq6d3gqGA==,type:str]
|
||||
oidc_client_secret: ENC[AES256_GCM,data:ebk0FVtSfq7JbIT+84cigdLg8zfN+4HTfGxlgqLw6hs1H92SFRHQFXO1l3U=,iv:qxa8aqUVoN31PpzAhs6bNMDCM6yPvOT27urIrM1rfo0=,tag:Vo25X8Znw7eh5DNq1eIJEw==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArZ1pyMXZ0Y3RFQVZkcTg5
|
||||
aENyemRueXpIM0FaUVhMc2ZyVDRyWWlzK1JzCjA0OTZ0aGJDNVVSM29CY1RzQWJL
|
||||
eVNiSCtMSXdmbEtKeGt1L3NYMy9ibUEKLS0tIGJnU3A4MjVnZ1pCa1lPMnVoM0xo
|
||||
dWs1cVM5ZCszbXp6eFltRVhGbFc0ajQKyCc8lClnSqWUxhNOr1FDCwn5V7nvjxPN
|
||||
7kjQpldseaRbsy+TM5sFQ1w6Acmun9uYjzs8PtmTNaayc/AFfspufA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
|
||||
lastmodified: "2026-07-15T23:22:55Z"
|
||||
mac: ENC[AES256_GCM,data:0YuRxQHfdeKbjJzxHI4iBc7I2KnalNJmybB6bVQxvdRutsxKXW/bu99yqHkD4y/nI66Pi6d7LhrPhhGat3x2c6Drs7QRYVWnZ75thil6yWsOcpH7H1esxEWTP3cpoMzGdS0aF6zwU9H+WDvfm/t1wpeDpJly3eczcPvfbK1joDU=,iv:TgwfpI+ZVLyd2c/PKWsJbCI9yKkADpPPafJ5No0fLks=,tag:nqwQHtZ263CI+fY9iTUAzQ==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.2
|
||||
@@ -0,0 +1,142 @@
|
||||
# k8s/temporal/temporal-values.yaml
|
||||
# Temporal — workflow engine
|
||||
# Uses external CNPG PostgreSQL for persistence (temporal-db)
|
||||
# Visibility via same PostgreSQL instance, separate database.
|
||||
#
|
||||
# IMPORTANT — chart schema note (root-caused after Postgres never actually
|
||||
# taking effect despite looking configured):
|
||||
# We're pinned to temporalio/helm-charts @ 0.74.0 (see targetRevision in
|
||||
# k8s/argocd/apps/60-applications.yaml), which uses the OLD flat persistence
|
||||
# schema:
|
||||
# server.config.persistence.<default|visibility>.driver: "sql"|"cassandra"
|
||||
# server.config.persistence.<default|visibility>.sql: {...}
|
||||
# NOT the newer `datastores:`-wrapped schema
|
||||
# (server.config.persistence.datastores.<store>.sql) shown in the current
|
||||
# chart's values/values.postgresql.yaml example - that key was introduced in
|
||||
# a later major version and doesn't exist in 0.74.0. Helm doesn't validate
|
||||
# unknown keys, so a `datastores:` block here is silently a no-op: Temporal
|
||||
# would keep defaulting to Cassandra (with empty hosts: []) regardless of
|
||||
# anything nested inside it. Verified via `helm template` against the actual
|
||||
# 0.74.0 chart before writing this file - see chat history for the
|
||||
# side-by-side proof (rendered manifest showed CASSANDRA_HOST env vars and
|
||||
# temporal-cassandra-tool commands using the old datastores:-based values).
|
||||
#
|
||||
# Likewise `schema.setup.enabled` / `schema.update.enabled` /
|
||||
# `schema.createDatabase.enabled` are the real toggles for the schema-setup
|
||||
# Job (all default true) - there is no `jobs.autoSetup` key in this chart.
|
||||
|
||||
# ── Disable every bundled/optional sub-chart ─────────────────────────────────
|
||||
# postgresql/mysql: never enable - we never want the chart to deploy its own
|
||||
# DB, only to know how to talk to our external CNPG instance (which happens
|
||||
# via server.config.persistence.*.sql below, independent of these flags).
|
||||
postgresql:
|
||||
enabled: false
|
||||
mysql:
|
||||
enabled: false
|
||||
cassandra:
|
||||
enabled: false
|
||||
elasticsearch:
|
||||
enabled: false
|
||||
prometheus:
|
||||
enabled: false
|
||||
grafana:
|
||||
enabled: false
|
||||
|
||||
# ── Schema setup/update Jobs ──────────────────────────────────────────────────
|
||||
# The `temporal` DB is created by the dedicated temporal-db cluster's initdb and
|
||||
# `temporal_visibility` by a CNPG Database CR — both in
|
||||
# k8s/infra/databases/temporal-db.yaml — so createDatabase stays disabled.
|
||||
# setup/update run temporal-sql-tool as the `app` owner against those existing
|
||||
# DBs to install and migrate the
|
||||
# Temporal server schema — without them both DBs have zero tables and the
|
||||
# server dies on "no usable database connection found" (no schema_version row).
|
||||
schema:
|
||||
createDatabase:
|
||||
enabled: false
|
||||
setup:
|
||||
enabled: true
|
||||
update:
|
||||
enabled: true
|
||||
|
||||
# ── Temporal server config (PostgreSQL persistence) ──────────────────────────
|
||||
server:
|
||||
replicaCount: 1
|
||||
# temporalio/server:1.30.0+ dropped the `dockerize` binary and switched to
|
||||
# built-in sprig config templating. The chart still defaults to the legacy
|
||||
# configMapsToMount: "dockerize" + setConfigFilePath: false, which produces a
|
||||
# config the 1.30 server never loads — it then falls back to its embedded
|
||||
# env-only template (Cassandra default) and dies with
|
||||
# "Persistence.DataStores[default](value).Cassandra.Hosts: zero value".
|
||||
# Switch to the sprig ConfigMap and point the server at it (chart's own
|
||||
# recommendation for 1.30.0+ images; sprig mode requires setConfigFilePath).
|
||||
configMapsToMount: "sprig"
|
||||
setConfigFilePath: true
|
||||
jobService:
|
||||
enabled: false
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: temporal
|
||||
topologyKey: kubernetes.io/hostname
|
||||
config:
|
||||
logLevel: "info"
|
||||
persistence:
|
||||
defaultStore: default
|
||||
visibilityStore: visibility
|
||||
numHistoryShards: 512
|
||||
default:
|
||||
driver: "sql"
|
||||
sql:
|
||||
driver: "postgres12"
|
||||
host: "temporal-db-rw.temporal.svc.cluster.local"
|
||||
port: 5432
|
||||
database: "temporal"
|
||||
user: "app"
|
||||
# existingSecret + secretKey: point directly at the CNPG-generated
|
||||
# Secret (kubernetes.io/basic-auth, keys: username/password/...)
|
||||
# rather than duplicating the password in git as plaintext. When
|
||||
# existingSecret is set the chart's own server-secret.yaml Secret
|
||||
# template is skipped entirely (see templates/server-secret.yaml:
|
||||
# `not $driverConfig.existingSecret` guards its creation).
|
||||
# Use unified temporal-db-app secret (generated in temporal namespace)
|
||||
existingSecret: "temporal-db-app"
|
||||
secretKey: "password"
|
||||
maxConns: 20
|
||||
maxIdleConns: 10
|
||||
maxConnLifetime: "1h"
|
||||
# NOTE: no `connectAttributes: { tx_isolation: ... }` here — tx_isolation
|
||||
# is a MySQL-only connection parameter. The Postgres `pq` driver rejects
|
||||
# it ("unrecognized configuration parameter"), which killed every DB
|
||||
# connection (schema-setup job AND server) with the misleading
|
||||
# "no usable database connection found". Postgres defaults to READ
|
||||
# COMMITTED isolation anyway, so nothing is lost by omitting it.
|
||||
visibility:
|
||||
driver: "sql"
|
||||
sql:
|
||||
driver: "postgres12"
|
||||
host: "temporal-db-rw.temporal.svc.cluster.local"
|
||||
port: 5432
|
||||
database: "temporal_visibility"
|
||||
user: "app"
|
||||
# Use unified temporal-db-app secret (generated in temporal namespace)
|
||||
existingSecret: "temporal-db-app"
|
||||
secretKey: "password"
|
||||
maxConns: 20
|
||||
maxIdleConns: 10
|
||||
maxConnLifetime: "1h"
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
# ── Temporal Web UI ────────────────────────────────────────────────────────
|
||||
web:
|
||||
replicaCount: 1
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
# ── Ingress ────────────────────────────────────────────────────────
|
||||
ingress:
|
||||
enabled: false
|
||||
Reference in New Issue
Block a user