Story Crater Bot
bea76eeba6
homelab-root and every child Application still tracked github.com/Riotpiaole/riotpiao.homelab.com, which had diverged from origin (Forgejo) for a while - pushes to Forgejo were never picked up by ArgoCD. Repointed to forgejo.riotpiao.com/rock/homelab.git, already covered by the AppProject's rock/* wildcard.
216 lines
6.4 KiB
YAML
216 lines
6.4 KiB
YAML
# Wave 3 — Vault + Authentik (identity), plus IAM raw jobs and the Forgejo
|
|
# runner. Authentik/Vault values reference SOPS-managed secrets (see *.enc.yaml
|
|
# in k8s/infra/iam) resolved by the ArgoCD SOPS plugin at sync time.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: vault
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://helm.releases.hashicorp.com
|
|
chart: vault
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/infra/iam/vault-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: iam
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: authentik
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://charts.goauthentik.io
|
|
chart: authentik
|
|
targetRevision: "*"
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/infra/iam/authentik-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: iam
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
---
|
|
# Raw IAM manifests: key-rotation cronjob + authentik migration job.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: iam-jobs
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/iam
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: iam
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
---
|
|
# Forgejo itself. Was a bootstrap Helm release (phase 3) until it was brought
|
|
# under Argo, because values changes there were inert — a proxy-body-size fix
|
|
# sat committed while the live Ingress kept nginx's 1m default and rejected
|
|
# every OCI push with 413.
|
|
#
|
|
# Wave 3: after databases (wave 2) — Forgejo needs CNPG and Redis up first.
|
|
#
|
|
# Retiring the Helm release: Argo adopts the existing objects on first sync.
|
|
# Delete the release secrets afterwards so helm stops claiming ownership:
|
|
# kubectl -n cicd delete secret -l owner=helm,name=forgejo
|
|
#
|
|
# automated sync is deliberately absent. This chart owns the Forgejo PVC and
|
|
# the git forge itself; the first sync is manual so its diff can be read before
|
|
# anything is applied. Turn on automated+selfHeal once that diff is clean.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
sources:
|
|
- repoURL: https://dl.gitea.com/charts/
|
|
chart: gitea
|
|
targetRevision: 12.7.0
|
|
helm:
|
|
valueFiles:
|
|
- $values/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
|
|
- repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
ref: values
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
# Reloader injects a STAKATER_* env var carrying a hash of the config Secret,
|
|
# so the pod rolls when that Secret changes. The chart does not render it, so
|
|
# Argo would strip it on every sync — and with selfHeal on, Argo and Reloader
|
|
# would fight over the field and Recreate the forge each round.
|
|
ignoreDifferences:
|
|
- group: apps
|
|
kind: Deployment
|
|
name: forgejo-gitea
|
|
jqPathExpressions:
|
|
- '.spec.template.spec.containers[].env[] | select(.name | startswith("STAKATER_"))'
|
|
syncPolicy:
|
|
syncOptions:
|
|
# Adopt the objects the bootstrap Helm release already created rather
|
|
# than failing on "already exists".
|
|
- ServerSideApply=true
|
|
---
|
|
# Forgejo runners (local chart, one instance per language), replacing the
|
|
# single generic "docker"-labeled runner. Each instance is a full standalone
|
|
# Deployment with its own dind sidecar, own PVCs (registration + layer
|
|
# cache) and own registered label -- there is no shared generic runner
|
|
# anymore, so each instance also builds and pushes images for the repos it
|
|
# serves (the chart's ConfigMap/NetworkPolicy fixes for that -- valid_volumes,
|
|
# network: host, egress to ingress-nginx -- apply identically to all three).
|
|
#
|
|
# `values.yaml` is the chart's default and doubles as the golang instance's
|
|
# config; node and rust layer a small values-<lang>.yaml override on top for
|
|
# just runner.name/runner.labels. All three share one runner-token Secret
|
|
# (Forgejo registration tokens are reusable across multiple runners, unlike
|
|
# GitHub's one-time tokens) -- if that assumption is ever wrong, registration
|
|
# will fail loudly in the register initContainer's logs, not silently.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo-runner-golang
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/forgejo-runner
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo-runner-node
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/forgejo-runner
|
|
helm:
|
|
valueFiles:
|
|
- values-node.yaml
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo-runner-rust
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "3"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://forgejo.riotpiao.com/rock/homelab.git
|
|
targetRevision: main
|
|
path: k8s/infra/forgejo-runner
|
|
helm:
|
|
valueFiles:
|
|
- values-rust.yaml
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|