From ff22027c7a896c24901d03c8d858e3dcd61c3097 Mon Sep 17 00:00:00 2001 From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com> Date: Wed, 15 Jul 2026 16:24:45 -0700 Subject: [PATCH] refactor(argocd): phase3 reduced to authentik only (remove vault, temporal, ollama, story-crater) --- k8s/argocd/apps/phase3-iam-0.yaml | 33 +----- k8s/argocd/apps/phase3-llm.yaml | 32 ------ k8s/argocd/apps/phase3-workflows.yaml | 59 ----------- k8s/hooks/phase3/phase3-hooks.yaml | 128 +---------------------- k8s/llm/ollama-secrets.enc.yaml | 20 ---- k8s/logging/loki-values-secrets.enc.yaml | 0 k8s/talos-iam/vault-secrets.enc.yaml | 18 ---- 7 files changed, 3 insertions(+), 287 deletions(-) delete mode 100644 k8s/argocd/apps/phase3-llm.yaml delete mode 100644 k8s/argocd/apps/phase3-workflows.yaml delete mode 100644 k8s/llm/ollama-secrets.enc.yaml create mode 100644 k8s/logging/loki-values-secrets.enc.yaml delete mode 100644 k8s/talos-iam/vault-secrets.enc.yaml diff --git a/k8s/argocd/apps/phase3-iam-0.yaml b/k8s/argocd/apps/phase3-iam-0.yaml index 9bd837a..59ac356 100644 --- a/k8s/argocd/apps/phase3-iam-0.yaml +++ b/k8s/argocd/apps/phase3-iam-0.yaml @@ -1,4 +1,4 @@ -# Phase 3 — IAM (Authentik + Vault) — identity/secret-critical releases +# Phase 3 — IAM (Authentik) — identity-critical release --- apiVersion: argoproj.io/v1alpha1 @@ -30,34 +30,3 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - ---- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: vault - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - project: homelab - sources: - - repoURL: https://helm.releases.hashicorp.com - chart: vault - targetRevision: latest - helm: - valueFiles: - - k8s/talos-iam/vault-values.yaml - - k8s/talos-iam/vault-secrets.enc.yaml - - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git - targetRevision: main - path: k8s/hooks/phase3 - destination: - server: https://kubernetes.default.svc - namespace: iam - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/k8s/argocd/apps/phase3-llm.yaml b/k8s/argocd/apps/phase3-llm.yaml deleted file mode 100644 index a4421a9..0000000 --- a/k8s/argocd/apps/phase3-llm.yaml +++ /dev/null @@ -1,32 +0,0 @@ -# Phase 3 — LLM (Ollama with OIDC) - ---- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: ollama - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "2" -spec: - project: homelab - sources: - - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git - targetRevision: main - path: k8s/llm/charts/ollama - helm: - valueFiles: - - values.yaml - - k8s/llm/ollama-secrets.enc.yaml - - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git - targetRevision: main - path: k8s/hooks/phase3 - destination: - server: https://kubernetes.default.svc - namespace: llm - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/k8s/argocd/apps/phase3-workflows.yaml b/k8s/argocd/apps/phase3-workflows.yaml deleted file mode 100644 index 42bc9eb..0000000 --- a/k8s/argocd/apps/phase3-workflows.yaml +++ /dev/null @@ -1,59 +0,0 @@ -# Phase 3 — Workflows (Temporal + Story Crater Migrations) - ---- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: temporal - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - project: homelab - sources: - - repoURL: https://go.temporal.io/helm-charts - chart: temporal - targetRevision: "~0.55" - helm: - valueFiles: - - k8s/temporal/temporal-values.yaml - - k8s/temporal/temporal-secrets.enc.yaml - - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git - targetRevision: main - path: k8s/hooks/phase3 - destination: - server: https://kubernetes.default.svc - namespace: temporal - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ---- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: story-crater-migrations - namespace: argocd - annotations: - argocd.argoproj.io/sync-wave: "2" -spec: - project: homelab - source: - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git - targetRevision: main - path: k8s/story-crater-backend/charts/migrations-noop - helm: - valueFiles: - - values.yaml - destination: - server: https://kubernetes.default.svc - namespace: story-crater-backend - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/k8s/hooks/phase3/phase3-hooks.yaml b/k8s/hooks/phase3/phase3-hooks.yaml index 606f1f5..cd62902 100644 --- a/k8s/hooks/phase3/phase3-hooks.yaml +++ b/k8s/hooks/phase3/phase3-hooks.yaml @@ -1,4 +1,4 @@ -# ArgoCD Hook Jobs for Phase 3 releases +# ArgoCD Hook Jobs for Phase 3 (IAM only) --- # ── Authentik — PreSync: CA ConfigMap ───────────────────────────────────────── @@ -58,128 +58,7 @@ spec: - | echo "Waiting for Authentik server..." kubectl rollout status deploy/authentik-server -n iam --timeout=180s || true - - echo "Authentik ready (OIDC provisioning requires bootstrap token from secrets)" - echo "✓ OIDC provisioning placeholder" - ---- -# ── Vault — PreSync: MinIO Creds & Bucket ──────────────────────────────────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: vault-minio-setup - namespace: iam - annotations: - argocd.argoproj.io/hook: PreSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: phase3-setup - restartPolicy: Never - containers: - - name: minio-setup - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - echo "Creating Vault MinIO secrets..." - # Note: MinIO creds from secrets.enc.yaml should be available - echo "Vault MinIO setup (credentials from SOPS secrets)" - echo "✓ Vault MinIO placeholder" - ---- -# ── Temporal — PreSync: Elasticsearch & Secrets ─────────────────────────────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: temporal-elasticsearch-setup - namespace: temporal - annotations: - argocd.argoproj.io/hook: PreSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: phase3-setup - restartPolicy: Never - containers: - - name: es-setup - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - echo "Setting up Temporal Elasticsearch..." - kubectl create namespace temporal --dry-run=client -o yaml | kubectl apply -f - - kubectl apply -f k8s/temporal/elasticsearch.yaml || echo "ES already exists" - echo "✓ Elasticsearch setup" - ---- -# ── Ollama — PreSync: Namespace & Secrets ──────────────────────────────────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: ollama-namespace-setup - namespace: llm - annotations: - argocd.argoproj.io/hook: PreSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: phase3-setup - restartPolicy: Never - containers: - - name: ns-setup - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - echo "Setting up Ollama namespace..." - kubectl create namespace llm --dry-run=client -o yaml | kubectl apply -f - - kubectl label namespace llm \ - pod-security.kubernetes.io/enforce=baseline \ - pod-security.kubernetes.io/enforce-version=latest \ - --overwrite 2>/dev/null || true - echo "✓ Ollama namespace setup" - ---- -# ── Story Crater Migrations — PostSync: Run Migrations ──────────────────────── - -apiVersion: batch/v1 -kind: Job -metadata: - name: story-crater-migrations-run - namespace: story-crater-backend - annotations: - argocd.argoproj.io/hook: PostSync - argocd.argoproj.io/hook-delete-policy: HookSucceeded -spec: - backoffLimit: 1 - template: - spec: - serviceAccountName: phase3-setup - restartPolicy: Never - containers: - - name: migrations - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - echo "Running Story Crater migrations..." - # Note: actual migrations require CNPG cluster to be ready - echo "Migrations placeholder (requires CNPG + Vault secrets)" - echo "✓ Migrations setup" + echo "✓ Authentik ready" --- # ── RBAC for Phase 3 Hook Jobs ─────────────────────────────────────────────── @@ -205,9 +84,6 @@ rules: - apiGroups: ["apps"] resources: ["deployments"] verbs: ["list", "get"] - - apiGroups: ["batch"] - resources: ["jobs"] - verbs: ["get", "list", "create"] --- apiVersion: rbac.authorization.k8s.io/v1 diff --git a/k8s/llm/ollama-secrets.enc.yaml b/k8s/llm/ollama-secrets.enc.yaml deleted file mode 100644 index 4b432fa..0000000 --- a/k8s/llm/ollama-secrets.enc.yaml +++ /dev/null @@ -1,20 +0,0 @@ -ollama: - minio_access_key: ENC[AES256_GCM,data:8GM6GyPNs1SfTQ==,iv:D03MJ5BbmgkQZXreDb8ZdwG7Jc+FBPOPVUezHrdahQU=,tag:7BAugt9R+d5QdMtJsUFYnQ==,type:str] - minio_secret_key: ENC[AES256_GCM,data:IEJ2WoG6mOXNWtdPFrkd2DPNilLE0mL+pHDhD24sLjhV+b+I5vhclArrqX4=,iv:z9LeIP/CWv9MACvve22ioNZIc7oD12y0jMwYO4Zv+o8=,tag:PrK7BKTHeo9c4+QSdSO9Ww==,type:str] - oidc_client_id: ENC[AES256_GCM,data:r0UT39bX,iv:bOlH3El5VrFyyGFnV3m9XEGhKoxpqWbwX0Aoh9jEq0E=,tag:9yZnVGhMn5MsKvlRrYS02Q==,type:str] - oidc_client_secret: ENC[AES256_GCM,data:6DcQW8t9SvRgc95jQa04sfv9vTE=,iv:RmYLyXG+SbQUmir5j40r3KK2enA9YzJPnlW5Z1Vtkzo=,tag:MVka9N+FU0OLp9dkcYehZA==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5OHMzZmtNOXp0L3h4Y3Zl - LzBxaHkrSDl6eVJ6b1JqTXdNZzdGSHI3M0VJCmwwYStjSXhOR2orRFJQYy94aXBn - clpxV1ZSdko4UFl1OUM2QW5uTmZKcGMKLS0tIG9lMnFTanpicDJRTDY4K1pjOEpm - NnV3TS9rZzdGd0tmZXNuOUVPbXBVbU0KRoWu536ZUSDg+a5XiLbP8TpVlEcpolo1 - Gtj3sjaRTdWwguiNlhmxIzpdb+88mYbDJIerotDIknnc1oWvcOgq6Q== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-15T23:22:55Z" - mac: ENC[AES256_GCM,data:4bGmma4shLOaZZ7VJB9JIQ8x3qZrrGR3b6FBE5/J7GBwxVdu/mg9xi/VlgFwDd1axrQ/DuFczJdnK4YtYe9tVLpJzoWXJt93T4BXEmthhIDzn+G2bWqogqAwqVncMwz6PXrrP8TI0pgZz2KvGBU03FESN8ymU54X9uPc63YZPjI=,iv:ZBPy2GzEKMq66Lh/4vhhGf0PVpdyR4EhpkOtWRQRcPg=,tag:a37rAAM+lglbexcwM5lrKQ==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2 diff --git a/k8s/logging/loki-values-secrets.enc.yaml b/k8s/logging/loki-values-secrets.enc.yaml new file mode 100644 index 0000000..e69de29 diff --git a/k8s/talos-iam/vault-secrets.enc.yaml b/k8s/talos-iam/vault-secrets.enc.yaml deleted file mode 100644 index 8f2fd7a..0000000 --- a/k8s/talos-iam/vault-secrets.enc.yaml +++ /dev/null @@ -1,18 +0,0 @@ -vault: - minio_access_key: ENC[AES256_GCM,data:9xlDx4SYgo/ziA==,iv:M2ZTUgTwpF6XIIAYV6fl/uJDkWDx3BNq1AAB8cwHlTc=,tag:L6SeSdzkYsZeNiZSLyIABQ==,type:str] - minio_secret_key: ENC[AES256_GCM,data:SqR1gnc2w0ojHBQWKlHbtl/8CxvVRZYuo/4/Y1Ywo3L1YqjBJJ3kaBgImN4=,iv:+OPeOUeofyotnTOX3VbN69KX7sudxulzDW6hcyy3aX0=,tag:AyODMQmENoMxoaTANeBlCA==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnVFdBNkVNdWxiRVloRVFh - WmJsYWxyQkxWTDQrd094QkR1c0VjbHZkYVdNCmtwNitJeTFFR0FzVTBCOFppdnM5 - bjJMQzNvWnVzU0hINkdGenBJcUI3SWcKLS0tIFRESlBrY0JiQ3JIOEhxNUZ5bFpD - M2JFcVJmYUdjVEo4SzNDSHZLRnJKSjAKA6IgXmTVf1D0sWl3TaM+8Aa/zOFrJmOv - u3jxLXNczAUxO1YeDcmfaztyV0GW0cNwlk2yZoGlcqU/vqCL0Thxvw== - -----END AGE ENCRYPTED FILE----- - recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh - lastmodified: "2026-07-15T23:22:55Z" - mac: ENC[AES256_GCM,data:Jk9xbLYxXyAeOky2yqDfmYcvIxUGQ45aiWAnUXu9mOZAprjtVxm2meqxqietn8q4fL1t4WLY+Rp19K+zmdX4qDgiMb0qpz0bdm3JurP8L3UYVld9nGxoqk5hZPmnvG3Iv8mwCL9L/GZFUYSGxUHEZMZXqfKw0K+MoU6CEx8mC14=,iv:BGxZ/pB5kz3js00lYfYU9Cuby1IHZX6FiINkLS1EJ+w=,tag:HHa7qCUBYxCUlglUEZBBUg==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.2