Story Crater Bot
8d63db9f3b
- Fix ArgoCD Application schema: move syncOptions under syncPolicy (00-secrets.yaml) - Remove helm install --wait flag (talos-cp-2 slow node timeout issue) - Add comprehensive progress logging with timestamps to bootstrap.sh - Fix SOPS key path (/Users/rockliang/.sops/key.txt, not homelab-age.key) - Add local SOPS decryption for bootstrap secrets - Add CNPG NetworkPolicy allowing app→database connectivity - Disable Forgejo bundled dependencies (saves 66Gi storage) - Inject database credentials via deployment.env (GITEA__DATABASE__*) - Remove invalid ext4 mount options from StorageClass - Add namespace manifests with PodSecurity labels - Add encrypted forgejo-admin secret (SOPS) - Reduce forgejo-db size 50Gi→25Gi per instance - Prepare ArgoCD SOPS CMP plugin (for post-bootstrap)
107 lines
2.1 KiB
YAML
107 lines
2.1 KiB
YAML
# ArgoCD Helm Values — Bootstrap Mode (SOPS plugin added post-bootstrap)
|
|
# Chart: https://github.com/argoproj/argo-helm
|
|
|
|
global:
|
|
domain: argocd.riotpiao.com
|
|
|
|
# Server configuration
|
|
server:
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
|
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
|
hosts:
|
|
- argocd.riotpiao.com
|
|
tls:
|
|
- secretName: argocd-server-tls
|
|
hosts:
|
|
- argocd.riotpiao.com
|
|
|
|
# Allow insecure mode (terminate TLS at ingress)
|
|
extraArgs:
|
|
- --insecure
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
# Tolerations for control-plane
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# Repo server configuration
|
|
repoServer:
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
# Tolerations for control-plane
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# Controller configuration
|
|
controller:
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2Gi
|
|
|
|
# Tolerations for control-plane
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# Application controller configuration
|
|
applicationSet:
|
|
enabled: true
|
|
|
|
# Notifications (optional, for Slack/Discord alerts)
|
|
notifications:
|
|
enabled: false
|
|
|
|
# Redis for caching
|
|
redis:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
|
|
# ArgoCD configuration
|
|
configs:
|
|
# Default project allows all repos
|
|
cm:
|
|
admin.enabled: "true"
|
|
application.instanceLabelKey: argocd.argoproj.io/instance
|
|
|
|
params:
|
|
server.insecure: true
|
|
|
|
# RBAC (allow admin full access)
|
|
rbac:
|
|
policy.default: role:readonly
|
|
policy.csv: |
|
|
g, admin, role:admin
|