Story Crater Bot
4ab596196e
- Forgejo git forge + OCI registry - Argo CD pull-based GitOps - Private CA TLS (self-signed 10-year cert) - Machine credentials scoped to repositories
140 lines
3.9 KiB
YAML
140 lines
3.9 KiB
YAML
# k8s/talos-ci-cd/argocd-values.yaml
|
|
# Argo CD — single-replica homelab install (fits the 4-CPU / 32 GB RAM budget).
|
|
# Deployed via helmfile (name=argocd) so it sits alongside Authentik, MinIO, etc.
|
|
#
|
|
# UI is exposed via the cluster Ingress (k8s/ingress/ingress.yaml,
|
|
# argocd.riotpiao.homelab.com) over the WireGuard/LAN-only nginx ingress —
|
|
# never as a LoadBalancer, since argocd-server holds cluster-admin
|
|
# credentials and that Ingress isn't reachable from the WAN.
|
|
#
|
|
# OIDC + RBAC declared in configs.cm / configs.rbac below — applied by Helm directly.
|
|
# Requires: oidc-secret K8s secret (created by helmfile argocd presync hook from env vars).
|
|
# CA trust for Forgejo repo clones injected into argocd-tls-certs-cm by postsync hook.
|
|
|
|
global:
|
|
domain: argocd.riotpiao.homelab.com
|
|
|
|
configs:
|
|
params:
|
|
server.insecure: false # keep TLS on argocd-server even behind the ingress
|
|
|
|
cm:
|
|
# Must match the Ingress host above and the redirect URI registered in
|
|
# Authentik (provision_oidc.py argocd_url) exactly — ArgoCD builds its
|
|
# OIDC redirect_uri as "{url}/auth/callback", so any mismatch here is
|
|
# what Authentik's "Invalid redirect URL" error means.
|
|
url: "https://argocd.riotpiao.homelab.com"
|
|
oidc.config: |
|
|
name: Authentik
|
|
issuer: https://authentik.riotpiao.homelab.com/application/o/argocd/
|
|
clientID: $oidc-secret:client-id
|
|
clientSecret: $oidc-secret:client-secret
|
|
requestedScopes: [openid, profile, email, groups]
|
|
rootCA: |
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBbTCCARSgAwIBAgIUNa409I6cGHye4YqeiphmWDaCEXUwCgYIKoZIzj0EAwIw
|
|
FTETMBEGA1UEAxMKaG9tZWxhYi1jYTAeFw0yNjA2MTcxNjUzMjVaFw0zNjA2MTQx
|
|
NjUzMjVaMBUxEzARBgNVBAMTCmhvbWVsYWItY2EwWTATBgcqhkjOPQIBBggqhkjO
|
|
PQMBBwNCAARwkubJPPdhgKcqr+3AEO2tr5I7MhC3zzeAqpmv8glngsweiGznaDhi
|
|
Dbf8JFfilbrLEJBSuwHZQPuoNx+3fbvYo0IwQDAOBgNVHQ8BAf8EBAMCAqQwDwYD
|
|
VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUod8iYq0+QyetnxfKDprIf3XbWkEwCgYI
|
|
KoZIzj0EAwIDRwAwRAIgQ4HOLs5DOqcfAMv8NSImxoYN7TyebnlQAQXSARnIqBMC
|
|
IB9RycFvG/rpJuz/LIKi4rf6RARjLcHM/zqhXQJvBw53
|
|
-----END CERTIFICATE-----
|
|
|
|
rbac:
|
|
policy.csv: |
|
|
g, homelab-admins, role:admin
|
|
policy.default: role:readonly
|
|
|
|
server:
|
|
replicas: 1
|
|
deploymentStrategy:
|
|
type: Recreate
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
# No Service of type LoadBalancer — port-forward only
|
|
service:
|
|
type: ClusterIP
|
|
podAnnotations:
|
|
secret.reloader.stakater.com/reload: "oidc-secret"
|
|
configmap.reloader.stakater.com/reload: "argocd-tls-certs-cm,argocd-cm"
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
repoServer:
|
|
replicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
applicationSet:
|
|
replicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
controller:
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
redis:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
notifications:
|
|
enabled: false # add back later if alert routing is needed
|