refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

k8s/argocd/apps/10-storage-observability.yaml

@@ -16,7 +16,7 @@ spec:
       targetRevision: "5.0.18"
       helm:
         valueFiles:
-          - $values/k8s/infrastructure/minio/minio-operator-values.yaml
+          - $values/k8s/infra/minio/minio-operator-values.yaml
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
@@ -43,7 +43,7 @@ spec:
   source:
     repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
-    path: k8s/infrastructure/minio
+    path: k8s/infra/minio
   destination:
     server: https://kubernetes.default.svc
     namespace: storage
@@ -68,7 +68,7 @@ spec:
   source:
     repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
-    path: k8s/infrastructure/longhorn
+    path: k8s/infra/longhorn
   destination:
     server: https://kubernetes.default.svc
     namespace: longhorn-system
@@ -93,7 +93,7 @@ spec:
       helm:
         skipCrds: true
         valueFiles:
-          - $values/k8s/platform/monitoring/prometheus-values.yaml
+          - $values/k8s/infra/monitoring/prometheus-values.yaml
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values
@@ -122,7 +122,7 @@ spec:
       # metadata conflict since CRDs are cluster-scoped).
 ---
 # CRDs only, extracted to plain YAML (`helm show crds kube-prometheus-stack`)
-# and committed to git under k8s/platform/monitoring/crds/, applied via Server-
+# and committed to git under k8s/infra/monitoring/crds/, applied via Server-
 # Side Apply to avoid the etcd 262144-byte last-applied-configuration
 # annotation limit that client-side apply hits on these very large CRDs
 # (prometheuses, alertmanagers, scrapeconfigs, etc). A plain git path source
@@ -131,7 +131,7 @@ spec:
 # means from a Helm chart. Split out from the main `prometheus` Application
 # (helm.skipCrds: true there) because ServerSideApply conflicts with that
 # app's managedNamespaceMetadata.
-# NOTE: bump k8s/platform/monitoring/crds/kube-prometheus-stack-crds.yaml
+# NOTE: bump k8s/infra/monitoring/crds/kube-prometheus-stack-crds.yaml
 # whenever the kube-prometheus-stack chart version changes materially
 # (`helm show crds prometheus-community/kube-prometheus-stack > ...`).
 apiVersion: argoproj.io/v1alpha1
@@ -146,7 +146,38 @@ spec:
   source:
     repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
     targetRevision: main
-    path: k8s/platform/monitoring/crds
+    path: k8s/infra/monitoring/crds
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+---
+# Cluster monitoring config: custom PrometheusRules (per-app namespaces),
+# ServiceMonitors (monitoring ns), and Grafana dashboard ConfigMaps (logging ns,
+# grafana sidecar-discovered). Single source = k8s/infra/monitoring (one
+# kustomization, no namespace transformer so per-app rule namespaces are kept).
+# Wave 2: after prometheus-operator CRDs (wave 0) + stack (wave 1) and grafana
+# (wave 2, logging). ServerSideApply avoids the etcd last-applied annotation
+# limit on the large dashboard ConfigMap JSON.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: monitoring-config
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
+    targetRevision: main
+    path: k8s/infra/monitoring
   destination:
     server: https://kubernetes.default.svc
     namespace: monitoring
@@ -173,7 +204,7 @@ spec:
       targetRevision: "~11"
       helm:
         valueFiles:
-          - $values/k8s/platform/monitoring/blackbox-exporter-values.yaml
+          - $values/k8s/infra/monitoring/blackbox-exporter-values.yaml
     - repoURL: https://forgejo.riotpiao.com/riotpiao.com/homelab.git
       targetRevision: main
       ref: values