 Story Crater Bot
|
d2f4b3c7e4
|
Revert "feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership"
This reverts commit e7f3409d0f.
|
2026-07-15 14:59:54 -07:00 |
|
|
Story Crater BotandClaude Haiku 4.5
|
e7f3409d0f
|
feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership
Phase 0 groundwork for helmfile→ArgoCD migration:
1. Remove 3 bootstrap releases from helmfile (cert-manager, reloader, ingress-nginx)
— already managed by terraform/bootstrap-releases.tf; eliminates dual-ownership
2. Bootstrap ESO (External Secrets Operator) as TF-managed release
— required for all ExternalSecret resources in phases 1-3
— added to bootstrap-releases.tf + helm-repositories.tf
3. Create ClusterSecretStore connecting ESO to Vault (K8s auth)
— enables per-namespace/per-release secret injection
— vault config documented in docs/PHASE0-ESO-VAULT-SETUP.md (manual setup)
4. Fix argocd-bootstrap.tf CA cert copy: use jq instead of sed for cleaner metadata handling
Changes:
- helmfile.yaml.gotmpl: remove cert-manager/reloader/ingress-nginx blocks
- terraform/bootstrap-releases.tf: add external-secrets release
- terraform/helm-repositories.tf: add external-secrets Helm repo
- k8s/external-secrets/clustersecretstore.yaml: ESO→Vault ClusterSecretStore
- k8s/argocd/apps/0-wave-0.yaml: stub wave 0 applications (schema fix, rewrite pending Phase 1)
- docs/PHASE0-ESO-VAULT-SETUP.md: manual ESO-Vault auth setup procedure
Next: Phase 1 will incrementally rewrite ArgoCD Applications + migrate helmfile releases.
Co-Authored-By: Claude Haiku 4.5 <[email protected]>
|
2026-07-15 14:53:16 -07:00 |
|
|
Story Crater Bot
|
3eccf9f653
|
test(argocd): add label to vault app to verify GitOps flow
Add test-gitops=true label to vault Application to demonstrate end-to-end
GitOps sync: commit push → ArgoCD detects change → applies label to live app.
Tests that root-app watches k8s/argocd/apps/ and propagates changes.
|
2026-07-14 23:24:12 -07:00 |
|
|
Story Crater Bot
|
9e3781a069
|
fix(minio): migrate to official chart, TF-owned
Bitnami wiped Docker Hub catalog (bitnami/minio: 0 tags), chart 14.1.0
dead on ImagePullBackOff. Move to minio/minio 5.4.0 (quay.io) as one TF
helm_release. Add longhorn-xfs SC: default SC ext4 mkfs on 100Gi exceeds
kubelet mount timeout, xfs near-instant. Drop minio ArgoCD Apps (TF owns
now, kills dual-controller conflict). Fix double base64 on OIDC secret.
|
2026-07-14 16:07:03 -07:00 |
|
|
Story Crater Bot
|
418ab7bfc2
|
Fix: minio-operator uses official MinIO Operator Helm chart
|
2026-07-14 14:26:25 -07:00 |
|
|
Story Crater Bot
|
ca8525c625
|
Add minio-operator Application to deploy operator before Tenant
|
2026-07-14 14:26:01 -07:00 |
|
|
Story Crater Bot
|
47c0301a43
|
Step 2: ArgoCD app-of-apps manifests for 19 workloads
Wave 0: minio, strimzi-operator, kmsvc-redis, prometheus
Wave 1: vault, loki, cloudnative-pg, authentik (manual-sync), temporal, kafka-cluster
Wave 2: queue-crd, management-service, grafana, promtail, forgejo
Wave 3: forgejo-runner, portainer
All auto-sync except authentik (manual-sync only for IAM safety)
|
2026-07-14 13:52:18 -07:00 |
|