refactor(argocd): phase3 reduced to authentik only (remove vault, temporal, ollama, story-crater)

k8s/argocd/apps/phase3-iam-0.yaml

@@ -1,4 +1,4 @@
-# Phase 3 — IAM (Authentik + Vault) — identity/secret-critical releases
+# Phase 3 — IAM (Authentik) — identity-critical release
 
 ---
 apiVersion: argoproj.io/v1alpha1
@@ -30,34 +30,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: vault
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "0"
-spec:
-  project: homelab
-  sources:
-    - repoURL: https://helm.releases.hashicorp.com
-      chart: vault
-      targetRevision: latest
-      helm:
-        valueFiles:
-          - k8s/talos-iam/vault-values.yaml
-          - k8s/talos-iam/vault-secrets.enc.yaml
-    - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
-      targetRevision: main
-      path: k8s/hooks/phase3
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: iam
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

k8s/argocd/apps/phase3-llm.yaml

@@ -1,32 +0,0 @@
-# Phase 3 — LLM (Ollama with OIDC)
-
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ollama
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: homelab
-  sources:
-    - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
-      targetRevision: main
-      path: k8s/llm/charts/ollama
-      helm:
-        valueFiles:
-          - values.yaml
-          - k8s/llm/ollama-secrets.enc.yaml
-    - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
-      targetRevision: main
-      path: k8s/hooks/phase3
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: llm
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

k8s/argocd/apps/phase3-workflows.yaml

@@ -1,59 +0,0 @@
-# Phase 3 — Workflows (Temporal + Story Crater Migrations)
-
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: temporal
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  project: homelab
-  sources:
-    - repoURL: https://go.temporal.io/helm-charts
-      chart: temporal
-      targetRevision: "~0.55"
-      helm:
-        valueFiles:
-          - k8s/temporal/temporal-values.yaml
-          - k8s/temporal/temporal-secrets.enc.yaml
-    - repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
-      targetRevision: main
-      path: k8s/hooks/phase3
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: temporal
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: story-crater-migrations
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git
-    targetRevision: main
-    path: k8s/story-crater-backend/charts/migrations-noop
-    helm:
-      valueFiles:
-        - values.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: story-crater-backend
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true

k8s/hooks/phase3/phase3-hooks.yaml

@@ -1,4 +1,4 @@
-# ArgoCD Hook Jobs for Phase 3 releases
+# ArgoCD Hook Jobs for Phase 3 (IAM only)
 
 ---
 # ── Authentik — PreSync: CA ConfigMap ─────────────────────────────────────────
@@ -58,128 +58,7 @@ spec:
           - |
             echo "Waiting for Authentik server..."
             kubectl rollout status deploy/authentik-server -n iam --timeout=180s || true
-
+            echo "✓ Authentik ready"
-            echo "Authentik ready (OIDC provisioning requires bootstrap token from secrets)"
-            echo "✓ OIDC provisioning placeholder"
-
----
-# ── Vault — PreSync: MinIO Creds & Bucket ────────────────────────────────────
-
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: vault-minio-setup
-  namespace: iam
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
-spec:
-  backoffLimit: 1
-  template:
-    spec:
-      serviceAccountName: phase3-setup
-      restartPolicy: Never
-      containers:
-      - name: minio-setup
-        image: bitnami/kubectl:latest
-        command:
-          - /bin/sh
-          - -c
-          - |
-            echo "Creating Vault MinIO secrets..."
-            # Note: MinIO creds from secrets.enc.yaml should be available
-            echo "Vault MinIO setup (credentials from SOPS secrets)"
-            echo "✓ Vault MinIO placeholder"
-
----
-# ── Temporal — PreSync: Elasticsearch & Secrets ───────────────────────────────
-
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: temporal-elasticsearch-setup
-  namespace: temporal
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
-spec:
-  backoffLimit: 1
-  template:
-    spec:
-      serviceAccountName: phase3-setup
-      restartPolicy: Never
-      containers:
-      - name: es-setup
-        image: bitnami/kubectl:latest
-        command:
-          - /bin/sh
-          - -c
-          - |
-            echo "Setting up Temporal Elasticsearch..."
-            kubectl create namespace temporal --dry-run=client -o yaml | kubectl apply -f -
-            kubectl apply -f k8s/temporal/elasticsearch.yaml || echo "ES already exists"
-            echo "✓ Elasticsearch setup"
-
----
-# ── Ollama — PreSync: Namespace & Secrets ────────────────────────────────────
-
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ollama-namespace-setup
-  namespace: llm
-  annotations:
-    argocd.argoproj.io/hook: PreSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
-spec:
-  backoffLimit: 1
-  template:
-    spec:
-      serviceAccountName: phase3-setup
-      restartPolicy: Never
-      containers:
-      - name: ns-setup
-        image: bitnami/kubectl:latest
-        command:
-          - /bin/sh
-          - -c
-          - |
-            echo "Setting up Ollama namespace..."
-            kubectl create namespace llm --dry-run=client -o yaml | kubectl apply -f -
-            kubectl label namespace llm \
-              pod-security.kubernetes.io/enforce=baseline \
-              pod-security.kubernetes.io/enforce-version=latest \
-              --overwrite 2>/dev/null || true
-            echo "✓ Ollama namespace setup"
-
----
-# ── Story Crater Migrations — PostSync: Run Migrations ────────────────────────
-
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: story-crater-migrations-run
-  namespace: story-crater-backend
-  annotations:
-    argocd.argoproj.io/hook: PostSync
-    argocd.argoproj.io/hook-delete-policy: HookSucceeded
-spec:
-  backoffLimit: 1
-  template:
-    spec:
-      serviceAccountName: phase3-setup
-      restartPolicy: Never
-      containers:
-      - name: migrations
-        image: bitnami/kubectl:latest
-        command:
-          - /bin/sh
-          - -c
-          - |
-            echo "Running Story Crater migrations..."
-            # Note: actual migrations require CNPG cluster to be ready
-            echo "Migrations placeholder (requires CNPG + Vault secrets)"
-            echo "✓ Migrations setup"
 
 ---
 # ── RBAC for Phase 3 Hook Jobs ───────────────────────────────────────────────
@@ -205,9 +84,6 @@ rules:
   - apiGroups: ["apps"]
     resources: ["deployments"]
     verbs: ["list", "get"]
-  - apiGroups: ["batch"]
-    resources: ["jobs"]
-    verbs: ["get", "list", "create"]
 
 ---
 apiVersion: rbac.authorization.k8s.io/v1

k8s/llm/ollama-secrets.enc.yaml

@@ -1,20 +0,0 @@
-ollama:
-    minio_access_key: ENC[AES256_GCM,data:8GM6GyPNs1SfTQ==,iv:D03MJ5BbmgkQZXreDb8ZdwG7Jc+FBPOPVUezHrdahQU=,tag:7BAugt9R+d5QdMtJsUFYnQ==,type:str]
-    minio_secret_key: ENC[AES256_GCM,data:IEJ2WoG6mOXNWtdPFrkd2DPNilLE0mL+pHDhD24sLjhV+b+I5vhclArrqX4=,iv:z9LeIP/CWv9MACvve22ioNZIc7oD12y0jMwYO4Zv+o8=,tag:PrK7BKTHeo9c4+QSdSO9Ww==,type:str]
-    oidc_client_id: ENC[AES256_GCM,data:r0UT39bX,iv:bOlH3El5VrFyyGFnV3m9XEGhKoxpqWbwX0Aoh9jEq0E=,tag:9yZnVGhMn5MsKvlRrYS02Q==,type:str]
-    oidc_client_secret: ENC[AES256_GCM,data:6DcQW8t9SvRgc95jQa04sfv9vTE=,iv:RmYLyXG+SbQUmir5j40r3KK2enA9YzJPnlW5Z1Vtkzo=,tag:MVka9N+FU0OLp9dkcYehZA==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5OHMzZmtNOXp0L3h4Y3Zl
-            LzBxaHkrSDl6eVJ6b1JqTXdNZzdGSHI3M0VJCmwwYStjSXhOR2orRFJQYy94aXBn
-            clpxV1ZSdko4UFl1OUM2QW5uTmZKcGMKLS0tIG9lMnFTanpicDJRTDY4K1pjOEpm
-            NnV3TS9rZzdGd0tmZXNuOUVPbXBVbU0KRoWu536ZUSDg+a5XiLbP8TpVlEcpolo1
-            Gtj3sjaRTdWwguiNlhmxIzpdb+88mYbDJIerotDIknnc1oWvcOgq6Q==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-15T23:22:55Z"
-    mac: ENC[AES256_GCM,data:4bGmma4shLOaZZ7VJB9JIQ8x3qZrrGR3b6FBE5/J7GBwxVdu/mg9xi/VlgFwDd1axrQ/DuFczJdnK4YtYe9tVLpJzoWXJt93T4BXEmthhIDzn+G2bWqogqAwqVncMwz6PXrrP8TI0pgZz2KvGBU03FESN8ymU54X9uPc63YZPjI=,iv:ZBPy2GzEKMq66Lh/4vhhGf0PVpdyR4EhpkOtWRQRcPg=,tag:a37rAAM+lglbexcwM5lrKQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/talos-iam/vault-secrets.enc.yaml

@@ -1,18 +0,0 @@
-vault:
-    minio_access_key: ENC[AES256_GCM,data:9xlDx4SYgo/ziA==,iv:M2ZTUgTwpF6XIIAYV6fl/uJDkWDx3BNq1AAB8cwHlTc=,tag:L6SeSdzkYsZeNiZSLyIABQ==,type:str]
-    minio_secret_key: ENC[AES256_GCM,data:SqR1gnc2w0ojHBQWKlHbtl/8CxvVRZYuo/4/Y1Ywo3L1YqjBJJ3kaBgImN4=,iv:+OPeOUeofyotnTOX3VbN69KX7sudxulzDW6hcyy3aX0=,tag:AyODMQmENoMxoaTANeBlCA==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnVFdBNkVNdWxiRVloRVFh
-            WmJsYWxyQkxWTDQrd094QkR1c0VjbHZkYVdNCmtwNitJeTFFR0FzVTBCOFppdnM5
-            bjJMQzNvWnVzU0hINkdGenBJcUI3SWcKLS0tIFRESlBrY0JiQ3JIOEhxNUZ5bFpD
-            M2JFcVJmYUdjVEo4SzNDSHZLRnJKSjAKA6IgXmTVf1D0sWl3TaM+8Aa/zOFrJmOv
-            u3jxLXNczAUxO1YeDcmfaztyV0GW0cNwlk2yZoGlcqU/vqCL0Thxvw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
-    lastmodified: "2026-07-15T23:22:55Z"
-    mac: ENC[AES256_GCM,data:Jk9xbLYxXyAeOky2yqDfmYcvIxUGQ45aiWAnUXu9mOZAprjtVxm2meqxqietn8q4fL1t4WLY+Rp19K+zmdX4qDgiMb0qpz0bdm3JurP8L3UYVld9nGxoqk5hZPmnvG3Iv8mwCL9L/GZFUYSGxUHEZMZXqfKw0K+MoU6CEx8mC14=,iv:BGxZ/pB5kz3js00lYfYU9Cuby1IHZX6FiINkLS1EJ+w=,tag:HHa7qCUBYxCUlglUEZBBUg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2