refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

2026-07-23 20:54:02 -07:00
parent 1c7395d9e1
commit e6f2ab1423
241 changed files with 467 additions and 10416 deletions
@@ -16,7 +16,7 @@ spec:
      targetRevision: "5.0.18"
      helm:
        valueFiles:
-          - $values/k8s/infrastructure/minio/minio-operator-values.yaml
+          - $values/k8s/infra/minio/minio-operator-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -43,7 +43,7 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/infrastructure/minio
+    path: k8s/infra/minio
  destination:
    server: https://kubernetes.default.svc
    namespace: storage
@@ -68,7 +68,7 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/infrastructure/longhorn
+    path: k8s/infra/longhorn
  destination:
    server: https://kubernetes.default.svc
    namespace: longhorn-system
@@ -93,7 +93,7 @@ spec:
      helm:
        skipCrds: true
        valueFiles:
-          - $values/k8s/platform/monitoring/prometheus-values.yaml
+          - $values/k8s/infra/monitoring/prometheus-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -122,7 +122,7 @@ spec:
      # metadata conflict since CRDs are cluster-scoped).
 ---
 # CRDs only, extracted to plain YAML (`helm show crds kube-prometheus-stack`)
-# and committed to git under k8s/platform/monitoring/crds/, applied via Server-
+# and committed to git under k8s/infra/monitoring/crds/, applied via Server-
 # Side Apply to avoid the etcd 262144-byte last-applied-configuration
 # annotation limit that client-side apply hits on these very large CRDs
 # (prometheuses, alertmanagers, scrapeconfigs, etc). A plain git path source
@@ -131,7 +131,7 @@ spec:
 # means from a Helm chart. Split out from the main `prometheus` Application
 # (helm.skipCrds: true there) because ServerSideApply conflicts with that
 # app's managedNamespaceMetadata.
-# NOTE: bump k8s/platform/monitoring/crds/kube-prometheus-stack-crds.yaml
+# NOTE: bump k8s/infra/monitoring/crds/kube-prometheus-stack-crds.yaml
 # whenever the kube-prometheus-stack chart version changes materially
 # (`helm show crds prometheus-community/kube-prometheus-stack > ...`).
 apiVersion: argoproj.io/v1alpha1
@@ -146,7 +146,38 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/platform/monitoring/crds
+    path: k8s/infra/monitoring/crds
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+---
+# Cluster monitoring config: custom PrometheusRules (per-app namespaces),
+# ServiceMonitors (monitoring ns), and Grafana dashboard ConfigMaps (logging ns,
+# grafana sidecar-discovered). Single source = k8s/infra/monitoring (one
+# kustomization, no namespace transformer so per-app rule namespaces are kept).
+# Wave 2: after prometheus-operator CRDs (wave 0) + stack (wave 1) and grafana
+# (wave 2, logging). ServerSideApply avoids the etcd last-applied annotation
+# limit on the large dashboard ConfigMap JSON.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: monitoring-config
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/infra/monitoring
  destination:
    server: https://kubernetes.default.svc
    namespace: monitoring
@@ -173,7 +204,7 @@ spec:
      targetRevision: "~11"
      helm:
        valueFiles:
-          - $values/k8s/platform/monitoring/blackbox-exporter-values.yaml
+          - $values/k8s/infra/monitoring/blackbox-exporter-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -18,7 +18,7 @@ spec:
      targetRevision: "*"
      helm:
        valueFiles:
-          - $values/k8s/platform/logging/loki-values.yaml
+          - $values/k8s/infra/logging/loki-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -52,7 +52,7 @@ spec:
      targetRevision: "*"
      helm:
        valueFiles:
-          - $values/k8s/platform/logging/grafana-values.yaml
+          - $values/k8s/infra/logging/grafana-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -86,7 +86,7 @@ spec:
      targetRevision: "*"
      helm:
        valueFiles:
-          - $values/k8s/platform/logging/promtail-values.yaml
+          - $values/k8s/infra/logging/promtail-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -1,6 +1,6 @@
 # Wave 3 — Vault + Authentik (identity), plus IAM raw jobs and the Forgejo
 # runner. Authentik/Vault values reference SOPS-managed secrets (see *.enc.yaml
-# in k8s/security/iam) resolved by the ArgoCD SOPS plugin at sync time.
+# in k8s/infra/iam) resolved by the ArgoCD SOPS plugin at sync time.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
@@ -16,7 +16,7 @@ spec:
      targetRevision: "*"
      helm:
        valueFiles:
-          - $values/k8s/security/iam/vault-values.yaml
+          - $values/k8s/infra/iam/vault-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -45,7 +45,7 @@ spec:
      targetRevision: "*"
      helm:
        valueFiles:
-          - $values/k8s/security/iam/authentik-values.yaml
+          - $values/k8s/infra/iam/authentik-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -70,7 +70,7 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/security/iam
+    path: k8s/infra/iam
  destination:
    server: https://kubernetes.default.svc
    namespace: iam
@@ -92,7 +92,7 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/security/ci-cd/charts/forgejo-runner
+    path: k8s/infra/forgejo-runner
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
@@ -1,24 +1,28 @@
-# Wave 6 — Database schemas + init jobs.
-# CNPG operator and ddb-cluster are bootstrap-only (k8s/bootstrap-local/).
-# This app manages ONLY the per-app databases and schema initialization.
-# Dependencies: ddb-cluster (bootstrap wave 0), SOPS secrets (wave 4)
+# Wave 2 — dedicated per-app CNPG Postgres clusters (authentik-db → ns iam,
+# temporal-db + visibility → ns temporal). ONE App, ONE folder (k8s/infra/databases).
+# CNPG operator is Phase-0 bootstrap; these Cluster CRs are GitOps — no circular
+# dep (they run after ArgoCD is up, before their apps at w3/w8). CNPG generates
+# each cluster's `<name>-app` secret + `<name>-rw` service in-namespace; the apps
+# read them locally. Forgejo's DB stays separate (bootstrap/circular).
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: data-schemas
+  name: databases
  namespace: argocd
  annotations:
-    argocd.argoproj.io/sync-wave: "6"
+    argocd.argoproj.io/sync-wave: "2"
 spec:
  project: homelab
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/data/schemas  # CHANGED from k8s/data to avoid ddb-cluster duplication
+    path: k8s/infra/databases
  destination:
    server: https://kubernetes.default.svc
-    namespace: ddb
+    namespace: default
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true
@@ -70,7 +70,7 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/applications/sqs/charts/kafka-cluster
+    path: k8s/apps/messaging/kafka-cluster
  destination:
    server: https://kubernetes.default.svc
    namespace: sqs
@@ -91,7 +91,7 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/applications/sqs/charts/queue-crd
+    path: k8s/apps/messaging/queue-crd
  destination:
    server: https://kubernetes.default.svc
    namespace: sqs
@@ -112,7 +112,7 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/applications/sqs/charts/management-service
+    path: k8s/apps/messaging/management-service
  destination:
    server: https://kubernetes.default.svc
    namespace: sqs
@@ -2,7 +2,7 @@
 # helpers (cloudflared tunnel, duckdns updater) that are already running.
 # Experimental dirs (llm, forge, dev-tools, shadowsocks) are intentionally
 # NOT included yet — add them here once they're production-ready.
-# temporal using unified CNPG pattern (app user, ddb-cluster-app secret)
+# temporal using unified CNPG pattern (app user, temporal-db-app secret)
 # Secret copied by bootstrap.sh (like cicd/iam namespaces)
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -19,7 +19,7 @@ spec:
      targetRevision: "0.74.0"
      helm:
        valueFiles:
-          - $values/k8s/applications/temporal/temporal-values.yaml
+          - $values/k8s/apps/temporal/temporal-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -48,7 +48,7 @@ spec:
      targetRevision: "*"
      helm:
        valueFiles:
-          - $values/k8s/applications/portainer/portainer-values.yaml
+          - $values/k8s/apps/portainer/portainer-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
@@ -74,7 +74,7 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/applications/cloudflared
+    path: k8s/apps/cloudflared
  destination:
    server: https://kubernetes.default.svc
    namespace: cloudflared
@@ -97,7 +97,7 @@ spec:
  source:
    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
    targetRevision: main
-    path: k8s/applications/duckdns
+    path: k8s/apps/duckdns
  destination:
    server: https://kubernetes.default.svc
    namespace: duckdns
@@ -125,13 +125,13 @@ spec:
      targetRevision: "*"
      helm:
        valueFiles:
-          - $values/k8s/applications/homarr/homarr-values.yaml
+          - $values/k8s/apps/homarr/homarr-values.yaml
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
      ref: values
    - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
      targetRevision: main
-      path: k8s/applications/homarr  # PostSync hook: fix-probes-job.yaml
+      path: k8s/apps/homarr  # PostSync hook: fix-probes-job.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: dashboard