Story Crater Bot
e6f2ab1423
refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)
2026-07-23 20:54:02 -07:00
Story Crater Bot
c6493f14ae
feat(ci,iac): Consolidate Forgejo CI workflows and add Talos Terraform IaC
...
Consolidate three separate Forgejo Actions (argocd-sync, security-scan, validate-k8s) into single cluster-ci workflow for cleaner CI/CD pipeline with proper job sequencing and reduced auth overhead.
Add Terraform configuration for Talos cluster machine configs:
- Provider setup for Talos
- Centralized variables for CP and worker configs
- Template-based config generation for controlplane.yaml and worker-*.yaml
- Sensitive data separated in terraform.tfvars (gitignored)
- Local state tracking for infrastructure
2026-07-17 23:44:08 -07:00
Story Crater Bot
842360288d
docs(terraform): add state management script and best practices guide
2026-07-15 16:31:55 -07:00
Story Crater Bot
09980aa41d
docs(phase1): create migration guide for 9 hookless releases
...
Detailed Phase 1 workflow:
- Template Application spec (Helm source, values, sync policy)
- Per-release migration pattern (create → test → remove → commit)
- Helmfile ↔ ArgoCD mapping table
- Local chart handling (source.path vs source.chart)
- Verification checklist
- Rollback instructions
Reference: execute one release at a time, verify before next.
2026-07-15 15:05:12 -07:00
Story Crater Bot
d2f4b3c7e4
Revert "feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership"
...
This reverts commit e7f3409d0f
2026-07-15 14:59:54 -07:00
Story Crater Bot and Claude Haiku 4.5
e7f3409d0f
feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership
...
Phase 0 groundwork for helmfile→ArgoCD migration:
1. Remove 3 bootstrap releases from helmfile (cert-manager, reloader, ingress-nginx)
— already managed by terraform/bootstrap-releases.tf; eliminates dual-ownership
2. Bootstrap ESO (External Secrets Operator) as TF-managed release
— required for all ExternalSecret resources in phases 1-3
— added to bootstrap-releases.tf + helm-repositories.tf
3. Create ClusterSecretStore connecting ESO to Vault (K8s auth)
— enables per-namespace/per-release secret injection
— vault config documented in docs/PHASE0-ESO-VAULT-SETUP.md (manual setup)
4. Fix argocd-bootstrap.tf CA cert copy: use jq instead of sed for cleaner metadata handling
Changes:
- helmfile.yaml.gotmpl: remove cert-manager/reloader/ingress-nginx blocks
- terraform/bootstrap-releases.tf: add external-secrets release
- terraform/helm-repositories.tf: add external-secrets Helm repo
- k8s/external-secrets/clustersecretstore.yaml: ESO→Vault ClusterSecretStore
- k8s/argocd/apps/0-wave-0.yaml: stub wave 0 applications (schema fix, rewrite pending Phase 1)
- docs/PHASE0-ESO-VAULT-SETUP.md: manual ESO-Vault auth setup procedure
Next: Phase 1 will incrementally rewrite ArgoCD Applications + migrate helmfile releases.
Co-Authored-By: Claude Haiku 4.5 <[email protected]
2026-07-15 14:53:16 -07:00
Story Crater Bot