Story Crater Bot
ca8525c625
Add minio-operator Application to deploy operator before Tenant
2026-07-14 14:26:01 -07:00
Story Crater Bot
8a3a892cbd
Fix: Inject homelab-ca cert into ArgoCD repo-server
...
- Mount homelab-ca-secret for TLS verification
- Allows repo-server to reach forgejo.riotpiao.homelab.com
- Fixes x509 certificate verification error
2026-07-14 14:01:14 -07:00
Story Crater Bot
cdacdd8d11
Re-enable cert-manager manifests for TF import
...
- ClusterIssuers + Certificates now back in TF
- Will import existing live resources
2026-07-14 13:55:08 -07:00
Story Crater Bot
263a48a22d
Fix: ArgoCD AppProject sourceRepos for correct forgejo URL
...
- Changed from forgejo.forge.riotpiao.homelab.com/rock/* to forgejo.riotpiao.homelab.com/riotpiao.com/*
- Allows homelab root app to access workload app manifests
2026-07-14 13:52:53 -07:00
Story Crater Bot
edd4ea7fe4
Fix: set ingress-nginx to privileged PodSecurity level
...
- privileged level allows hostPort (80/443) required for nginx
- Other namespaces remain at baseline for security
- Cleaner than exempting namespace entirely
2026-07-14 13:43:56 -07:00
Story Crater Bot
086ad9f9a9
Fix: exempt ingress-nginx from PodSecurity policy
...
- restricted policy forbids hostPort (80/443) — broke nginx
- Remove pod-security labels from ingress-nginx namespace entirely
- Other namespaces remain at baseline level
2026-07-14 13:41:36 -07:00
Story Crater Bot
3eabb847fd
Re-add ingress-nginx to TF bootstrap (PodSecurity policy fixed)
...
- ingress-nginx now has restricted policy level (allows hostPort)
- Previous timeout was due to policy blocking pod deployment
- Re-importing helm release to TF management
2026-07-14 13:37:22 -07:00
Story Crater Bot
6109477bf9
Skip TF management of ingress-nginx (helm timeout issues)
...
- ingress-nginx already deployed and working in cluster
- Helm updates timeout repeatedly (5+ min with context deadline exceeded)
- Remove from bootstrap releases; manage separately via helm/kubectl
- cert-manager + reloader continue via TF
2026-07-14 13:32:40 -07:00
Story Crater Bot
20c634fd03
Fix: ingress-nginx PodSecurity policy enforcement level
...
- ingress-nginx requires hostPort (80/443) which is forbidden at baseline level
- Change to restricted enforcement level to allow hostPort
- Other namespaces remain at baseline for security
2026-07-14 13:31:16 -07:00
Story Crater Bot
074b43e1f2
Temp: disable kubernetes_manifest cert-manager resources (already live)
...
- Will import separately after helm issues resolved
- Avoids re-create conflicts during bootstrap apply
2026-07-14 13:26:26 -07:00
Story Crater Bot
c2e084c7c2
Fix: downgrade ArgoCD to 7.3.3, ignore helm metadata drift
...
- ArgoCD 7.9.1 -> 7.3.3 (match live cluster)
- Ignore helm release metadata in lifecycle rules
- Prevents unnecessary upgrade attempts
2026-07-14 13:16:55 -07:00
Story Crater Bot
dd608d3231
Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF
...
- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply
2026-07-14 13:14:46 -07:00
Story Crater Bot
9a4d486b86
feat: Terraform foundation for cluster & app bootstrap
...
Phase 1 infrastructure-as-code setup:
- Core providers (kubernetes, helm, null)
- 15 Helm repositories (grafana, minio, prometheus, etc.)
- Namespace scaffolding (15 namespaces with pod-security labels)
- Storage classes (longhorn, longhorn-kafka with prevent_destroy)
- TLS certificate bootstrap (selfsigned, CA, wildcard cert)
- Remote state backend config (local for now, S3/GCS TODO)
- Variable definitions for all secrets/OIDC clients
Tested: terraform plan passes with no changes (bootstrap infrastructure ready)
Next: Create 25 helm_release resources (Phase 2-4)
Kept helmfile intact; network/Cilium managed via helmfile (no config risk)
Co-Authored-By: Claude Haiku 4.5 <[email protected]
2026-07-14 09:27:24 -07:00
Story Crater Bot