Story Crater Bot
d2f4b3c7e4
Revert "feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership"
...
This reverts commit e7f3409d0f
2026-07-15 14:59:54 -07:00
Story Crater Bot and Claude Haiku 4.5
e7f3409d0f
feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership
...
Phase 0 groundwork for helmfile→ArgoCD migration:
1. Remove 3 bootstrap releases from helmfile (cert-manager, reloader, ingress-nginx)
— already managed by terraform/bootstrap-releases.tf; eliminates dual-ownership
2. Bootstrap ESO (External Secrets Operator) as TF-managed release
— required for all ExternalSecret resources in phases 1-3
— added to bootstrap-releases.tf + helm-repositories.tf
3. Create ClusterSecretStore connecting ESO to Vault (K8s auth)
— enables per-namespace/per-release secret injection
— vault config documented in docs/PHASE0-ESO-VAULT-SETUP.md (manual setup)
4. Fix argocd-bootstrap.tf CA cert copy: use jq instead of sed for cleaner metadata handling
Changes:
- helmfile.yaml.gotmpl: remove cert-manager/reloader/ingress-nginx blocks
- terraform/bootstrap-releases.tf: add external-secrets release
- terraform/helm-repositories.tf: add external-secrets Helm repo
- k8s/external-secrets/clustersecretstore.yaml: ESO→Vault ClusterSecretStore
- k8s/argocd/apps/0-wave-0.yaml: stub wave 0 applications (schema fix, rewrite pending Phase 1)
- docs/PHASE0-ESO-VAULT-SETUP.md: manual ESO-Vault auth setup procedure
Next: Phase 1 will incrementally rewrite ArgoCD Applications + migrate helmfile releases.
Co-Authored-By: Claude Haiku 4.5 <[email protected]
2026-07-15 14:53:16 -07:00
Story Crater Bot
0d4e98d88b
feat: track full CoreDNS Deployment manifest, add topologySpreadConstraints
...
CoreDNS is Talos-bootstrapped and previously untracked except for its
ConfigMap. Pull the full live spec into one file as the single source of
truth, add topologySpreadConstraints so the 2 replicas don't land on the
same node. ScheduleAnyway (not DoNotSchedule) to avoid blocking scheduling
if a node is briefly unavailable.
2026-07-13 16:51:49 -07:00
Story Crater Bot
e6d7626fb6
remove: strip all oauth2-proxy deployments
...
- Delete oauth2-proxy helm releases from helmfile (temporal, kmsvc, longhorn, portainer)
- Remove oauth2-proxy manifests and ingress redirects
- Add direct ingress for kmsvc management service
- Update temporal/portainer/longhorn ingress comments to reflect direct service exposure
Services now accessible without oauth2-proxy layer.
2026-07-11 19:36:31 -07:00
Story Crater Bot
11898733e8
infra: add helmfile and talos cluster configuration
...
- helmfile: 18 releases across 22 namespaces
- Pod disruption budgets for zero-downtime drain
- Nginx ingress with LoadBalancer + Cilium LB-IPAM
- Cluster bootstrap hooks
2026-07-11 19:16:41 -07:00
Story Crater Bot