Story Crater Bot
f656338a15
Major accomplishments from comprehensive cluster review: ## Storage HA (answering "are volumes replicated?") - Verified 3-node Longhorn HA: ALL 17 volumes have 3 replicas - Fixed CLAUDE.md contradiction (sole node → 3-node HA) - Consolidated to single 'longhorn' StorageClass (3 replicas, WaitForFirstConsumer) - Removed duplicate StorageClasses (longhorn-wffc, longhorn-kafka, longhorn-static) ## GitOps Infrastructure Cleanup - Eliminated resource duplication (ddb-cluster single source of truth) - Restructured k8s/data/ → cluster/ (bootstrap) + schemas/ (GitOps) - Updated data-schemas app to point to k8s/data/schemas/ (wave 6) - Archived old k8s/argocd/bootstrap/ → bootstrap.archived/ ## Bootstrap Dependencies Fixed - Added 05-wait-for-databases.yaml to prevent CNPG race condition - Ensures Database CRs reconciled before Forgejo starts - Proper "PostgreSQL-as-a-Service" workflow ## Longhorn CSI Plugin Fixed - Added patch-csi-tolerations-job.yaml (GitOps PostSync hook) - CSI plugin now runs on all 3 nodes (cp-1, cp-2, cp-3) - Fixes volume attachment on tainted control-plane nodes ## Live Migration (Zero Downtime) - Migrated 37 applications to ArgoCD app-of-apps management - Fixed Forgejo startup issues: * Service selector mismatch (app: forgejo → app: gitea) * Missing homelab-ca ConfigMap * Missing forgejo-oidc secret (temporary) * CNPG database creation timing ## Documentation (10 comprehensive files) - WHATS-NEXT.md - Daily GitOps workflow - MIGRATION-STATUS.md - Cluster health report - REVIEW-SUMMARY.md - Session overview - GITOPS-REBUILD-PLAN.md - Architecture reference - DDB-REVIEW.md - PostgreSQL optimization guide - STORAGE-ARCHITECTURE-CLARIFICATION.md - Storage HA investigation - BOOTSTRAP-DEPENDENCY-FIX.md - CNPG race condition fix - STORAGECLASS-CONSOLIDATION.md - Single StorageClass rationale - IMPLEMENTATION-CHECKLIST.md - Migration checklist - bootstrap.sh - Automated bootstrap script ## Cluster Status - ArgoCD: 4/4 pods running - DDB cluster: 3/3 instances healthy - Longhorn: 3/3 nodes, all CSI plugins running - Forgejo: Running, accessible at http://192.168.1.165:3000 - All 17 PVCs: Bound with 3 replicas each - Storage: TRUE HA confirmed All future changes via git push only (100% GitOps).
152 lines
4.7 KiB
YAML
152 lines
4.7 KiB
YAML
# Forgejo - Git server hosting the GitOps repo (bootstrap only, manual sync).
|
|
# ArgoCD cannot auto-sync Forgejo because Forgejo hosts the repo ArgoCD syncs
|
|
# from → circular dependency. Apply once via bootstrap, manual sync only afterward.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "0" # Bootstrap wave
|
|
bootstrap-phase: "0"
|
|
description: "Bootstrap-only: Forgejo hosts the GitOps repo"
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://dl.gitea.com/charts/
|
|
chart: gitea
|
|
targetRevision: "~10"
|
|
helm:
|
|
# Inline values (git-independent) - keep in sync with k8s/security/ci-cd/forgejo-values.yaml
|
|
valuesObject:
|
|
image:
|
|
repository: codeberg.org/forgejo/forgejo
|
|
tag: "13"
|
|
pullPolicy: IfNotPresent
|
|
gitea:
|
|
admin:
|
|
username: rock
|
|
email: [email protected]
|
|
config:
|
|
server:
|
|
PROTOCOL: http
|
|
DOMAIN: forgejo.riotpiao.com
|
|
ROOT_URL: https://forgejo.riotpiao.com/
|
|
HTTP_PORT: 3000
|
|
START_SSH_SERVER: true
|
|
SSH_DOMAIN: forgejo.riotpiao.com
|
|
SSH_PORT: 2222
|
|
SSH_LISTEN_PORT: 2222
|
|
database:
|
|
DB_TYPE: postgres
|
|
HOST: ddb-cluster-rw.ddb.svc:5432
|
|
NAME: forgejo
|
|
USER: app
|
|
repository:
|
|
ROOT: /data/git
|
|
actions:
|
|
ENABLED: true
|
|
packages:
|
|
ENABLED: true
|
|
metrics:
|
|
ENABLED: true
|
|
service:
|
|
DISABLE_REGISTRATION: true
|
|
oauth2:
|
|
ENABLED: true
|
|
PROVIDER: openidconnect
|
|
OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
|
|
CLIENT_ID: forgejo
|
|
AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
|
|
cache:
|
|
ADAPTER: redis
|
|
HOST: "redis://forgejo-redis.cicd.svc:6379/0"
|
|
session:
|
|
PROVIDER: redis
|
|
PROVIDER_CONFIG: "redis://forgejo-redis.cicd.svc:6379/1"
|
|
queue:
|
|
TYPE: redis
|
|
CONN_STR: "redis://forgejo-redis.cicd.svc:6379/2"
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: false
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn
|
|
size: 20Gi
|
|
accessModes:
|
|
- ReadWriteMany
|
|
replicaCount: 2
|
|
deployment:
|
|
strategy:
|
|
type: RollingUpdate
|
|
env:
|
|
- name: SSL_CERT_DIR
|
|
value: /homelab-ca
|
|
- name: GITEA__database__PASSWD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ddb-cluster-app
|
|
key: password
|
|
- name: GITEA__oauth2__CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: forgejo-oidc
|
|
key: CLIENT_SECRET
|
|
podAnnotations:
|
|
configmap.reloader.stakater.com/reload: "homelab-ca"
|
|
service:
|
|
http:
|
|
type: LoadBalancer
|
|
port: 3000
|
|
targetPort: 3000
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.165"
|
|
io.cilium/lb-ipam-sharing-key: "forgejo"
|
|
ssh:
|
|
type: LoadBalancer
|
|
port: 2222
|
|
targetPort: 2222
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.165"
|
|
io.cilium/lb-ipam-sharing-key: "forgejo"
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
extraVolumes:
|
|
- name: homelab-ca
|
|
configMap:
|
|
name: homelab-ca
|
|
extraVolumeMounts:
|
|
- name: homelab-ca
|
|
mountPath: /homelab-ca
|
|
readOnly: true
|
|
ingress:
|
|
enabled: false
|
|
postgresql:
|
|
enabled: false
|
|
postgresql-ha:
|
|
enabled: false
|
|
mysql:
|
|
enabled: false
|
|
redis-cluster:
|
|
enabled: false
|
|
act_runner:
|
|
enabled: false
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
syncPolicy:
|
|
# NO automated sync - Forgejo hosts the repo; auto-sync would let a bad
|
|
# CI commit break the system CI depends on. Manual sync only.
|
|
syncOptions: []
|