homelab/CONSOLIDATION-RESULTS.md

ArgoCD Application Consolidation - Implementation Results

Summary

Before: 39 Applications
After: 35 Applications
Removed: 4 Applications (-10.3%)

Implemented Merges

✅ 1. ingress-config ← wildcard-cert + homelab-ingress

Before:

• wildcard-cert (wave 1): k8s/bootstrap/ingress/riotpiao-com-cert.yaml
• homelab-ingress (wave 2): k8s/bootstrap/ingress/ingress.yaml

After:

• ingress-config (wave 1): k8s/bootstrap/ingress/ (kustomization)

Changes:

• Updated k8s/bootstrap/ingress/kustomization.yaml to include both files
• Merged both Applications into single ingress-config in 00-substrate.yaml
• Certificate created before Ingresses (wave 1)

---

✅ 2. homarr ← homarr + homarr-patches

Before:

• homarr (wave 8): Helm chart + values
• homarr-patches (wave 9): k8s/applications/homarr/ (PostSync hook)

After:

• homarr (wave 8): Multi-source (Helm + values + PostSync patches)

Changes:

• Added third source to homarr Application
• fix-probes-job.yaml already has PostSync hook annotation
• Removed homarr-patches Application from 60-applications.yaml

---

✅ 3. temporal ← temporal + temporal-db-secret-sync

Before:

• temporal-db-secret-sync (wave 7): k8s/applications/temporal/db-secret-sync/
• temporal (wave 8): Helm chart + values

After:

• temporal (wave 8): Multi-source (Helm + values + PostSync db-secret-sync)

Changes:

• Added third source to temporal Application
• copy-job.yaml already has PostSync hook annotation
• Removed temporal-db-secret-sync Application from 60-applications.yaml

---

✅ 4. Removed Duplicate: ingress-nginx

Before:

• ingress-nginx-bootstrap (bootstrap): Working, has LoadBalancer IP
• ingress-nginx (ArgoCD): Duplicate, LoadBalancer pending

After:

• ingress-nginx-bootstrap (bootstrap): Kept

Changes:

• Removed ingress-nginx Application from 00-substrate.yaml
• Bootstrap version breaks circular dependency (ArgoCD → Forgejo → Ingress)
• Eliminated duplicate DaemonSet

---

Skipped Consolidations

⏭️ cert-manager + cert-manager-issuers

Decision: KEEP SEPARATE

Reasoning:

• cert-manager (wave 0) installs CRDs
• cert-manager-issuers (wave 1) creates Issuers using those CRDs
• Wave separation ensures CRDs exist before Issuers
• Merging risks race condition (Issuer created before CRD ready)
• This is intentional separation for safety

---

Files Modified

1. k8s/bootstrap/ingress/kustomization.yaml - Added resources list
2. k8s/argocd/apps/00-substrate.yaml - Merged wildcard-cert + homelab-ingress, removed ingress-nginx
3. k8s/argocd/apps/60-applications.yaml - Merged homarr + temporal Applications

---

Benefits Achieved

✅ Easier Management

• 4 fewer Application CRs to track
• Related resources grouped together
• Clearer ownership model

✅ Better Sync Behavior

• PostSync hooks ensure proper ordering
• No separate Applications for patches/hooks
• Single Application manages entire stack

✅ Cleaner Structure

• Multi-source Applications are standard pattern
• Each logical service = one Application
• Hooks embedded where they belong

---

Next Steps (Optional Phase 2)

Potential Future Consolidations:

1. SQS Platform (5 → 2 Applications)

   • Keep strimzi-operator separate
   • Merge: kmsvc-redis + kafka-cluster + queue-crd + management-service

2. IAM (3 → 2 Applications)

   • Keep vault separate
   • Merge: authentik + iam-jobs

3. Monitoring (3 → 2 Applications)

   • Keep prometheus-crds separate (wave 0)
   • Merge: prometheus + blackbox-exporter

Recommendation: Evaluate after Forgejo push and observe current consolidations in action.

---

Validation Plan

After pushing to Forgejo:

# Check Applications synced successfully
kubectl get applications -n argocd

# Verify consolidated Applications are healthy
kubectl get application ingress-config -n argocd
kubectl get application homarr -n argocd
kubectl get application temporal -n argocd

# Check ingress-nginx duplicate removed
kubectl get application ingress-nginx -n argocd  # Should be gone

# Verify resources deployed correctly
kubectl get certificate -n ingress-nginx riotpiao-com-tls
kubectl get ingress -A
kubectl get job -n dashboard homarr-fix-probes
kubectl get job -n temporal temporal-db-secret-sync

---

Rollback Procedure

If issues arise, revert specific commits:

# Identify commit
git log --oneline | grep consolidation

# Revert specific merge
git revert <commit-hash>

# Or restore old Applications from git history
git show <commit>:k8s/argocd/apps/00-substrate.yaml > temp.yaml
kubectl apply -f temp.yaml

---

Conclusion

Successfully consolidated 4 Applications while maintaining:

• ✅ Proper sync wave ordering
• ✅ Hook execution timing
• ✅ Resource namespace separation
• ✅ GitOps best practices

Status: Ready to commit and push to Forgejo for validation.