homelab/APPLICATION-CONSOLIDATION-PLAN.md

ArgoCD Application Consolidation Plan

Executive Summary

Current: 39 Applications
Proposed: 32 Applications (Conservative: 35)
Benefits: Easier management, fewer Application resources, cleaner structure

Phase 1: Safe & Easy Merges (Conservative - Start Here)

These are Applications that already share the same directory and have clear parent-child relationships.

1.1 Merge: wildcard-cert + homelab-ingress → "ingress-config"

Current State:

wildcard-cert      (wave 1) → k8s/bootstrap/ingress/riotpiao-com-cert.yaml
homelab-ingress    (wave 2) → k8s/bootstrap/ingress/ingress.yaml

New State:

ingress-config     (wave 1) → k8s/bootstrap/ingress/ (kustomization)

Rationale: Both in same directory, ingress depends on cert existing

Implementation:

• Update k8s/bootstrap/ingress/kustomization.yaml to include both
• Create single Application pointing to k8s/bootstrap/ingress/
• Delete wildcard-cert and homelab-ingress Applications
• Result: 2 → 1 Applications

1.2 Merge: homarr + homarr-patches → "homarr"

Current State:

homarr             (wave 8) → Helm chart (homarr-labs.github.io)
homarr-patches     (wave 9) → k8s/applications/homarr/fix-probes-job.yaml

New State:

homarr (multi-source):
  - Source 1: Helm chart
  - Source 2: k8s/applications/homarr/ (patches as PostSync hook)

Rationale: homarr-patches is literally a patch for homarr

Implementation:

• Modify homarr Application to use multi-source
• Convert fix-probes-job.yaml to PostSync hook
• Delete homarr-patches Application
• Result: 2 → 1 Applications

1.3 Merge: temporal-db-secret-sync → temporal (as PreSync hook)

Current State:

temporal-db-secret-sync  (wave 7) → k8s/applications/temporal/db-secret-sync/
temporal                 (wave 8) → Helm chart

New State:

temporal (multi-source):
  - Source 1: k8s/applications/temporal/db-secret-sync/ (PreSync hook)
  - Source 2: Helm chart
  - Source 3: k8s/applications/temporal/ (values)

Rationale: db-secret-sync is a bootstrap job for temporal

Implementation:

• Modify temporal Application to use multi-source
• Ensure db-secret-sync Job has PreSync hook annotation
• Delete temporal-db-secret-sync Application
• Result: 2 → 1 Applications

1.4 Merge: cert-manager-issuers → cert-manager (as multi-source)

Current State:

cert-manager         (wave 0) → Helm chart
cert-manager-issuers (wave 1) → k8s/bootstrap/cert-manager/ (issuers)

New State:

cert-manager (multi-source):
  - Source 1: Helm chart
  - Source 2: k8s/bootstrap/cert-manager/ (values + issuers)

Rationale: Issuers are part of cert-manager configuration

Implementation:

• Modify cert-manager Application to use multi-source
• Keep as wave 0 (issuers can wait for CRDs to be ready)
• Delete cert-manager-issuers Application
• Result: 2 → 1 Applications

Phase 1 Result: 39 → 35 Applications (-4)

---

Phase 2: Logical Consolidations (Moderate Risk)

2.1 Merge: SQS Applications → "sqs-platform"

Current State:

strimzi-operator    (wave 5) → Helm chart (operator)
kmsvc-redis         (wave 5) → Helm chart (Redis)
kafka-cluster       (wave 6) → k8s/applications/sqs/charts/kafka-cluster/
queue-crd           (wave 6) → k8s/applications/sqs/charts/queue-crd/
management-service  (wave 7) → k8s/applications/sqs/charts/management-service/

New State:

strimzi-operator    (wave 5) → Keep separate (operator)
sqs-platform        (wave 6) → k8s/applications/sqs/ (all services + CRDs)

Rationale: These 4 apps work together as the SQS platform

Implementation:

• Create kustomization.yaml in k8s/applications/sqs/
• Create single multi-source Application
• Keep strimzi-operator separate (it's infrastructure)
• Result: 5 → 2 Applications

2.2 Merge: authentik + iam-jobs → "authentik"

Current State:

authentik   (wave 3) → Helm chart
iam-jobs    (wave 3) → k8s/security/iam/ (authentik helper jobs)

New State:

authentik (multi-source):
  - Source 1: Helm chart
  - Source 2: k8s/security/iam/ (helper jobs)

Rationale: iam-jobs appears to be authentik-specific

Implementation:

• Verify iam-jobs are authentik-specific
• Merge into single multi-source Application
• Result: 2 → 1 Applications

2.3 Remove Duplicate: ingress-nginx Application

Current State:

ingress-nginx-bootstrap (wave 0, bootstrap) → Helm chart
ingress-nginx           (wave 0, ArgoCD)    → Helm chart (DUPLICATE!)

New State:

ingress-nginx-bootstrap (wave 0, bootstrap) → Keep only this one

Rationale: These are the same thing, bootstrap one is already working

Implementation:

• Delete ingress-nginx Application (redundant)
• Result: 2 → 1 Applications

Phase 2 Result: 35 → 31 Applications (-4)

---

Phase 3: Advanced Consolidations (Consider Carefully)

3.1 Consider: Monitoring Stack

Current State:

prometheus-crds     (wave 0) → k8s/platform/monitoring/crds/
prometheus          (wave 1) → Helm chart
blackbox-exporter   (wave 1) → Helm chart

Option A: Keep separate (CRDs must be wave 0)
Option B: Create "monitoring-stack" with prometheus + blackbox-exporter only

Recommendation: Keep separate for now (CRDs are special)

3.2 Consider: Logging Stack

Current State:

loki     (wave 2) → Helm chart
promtail (wave 2) → Helm chart
grafana  (wave 2) → Helm chart

Option A: Create "logging-stack" with all three
Option B: Keep separate (grafana used by multiple systems)

Recommendation: Keep separate for now (grafana has multiple consumers)

---

Implementation Order

Sprint 1: Phase 1 (Low Risk)

1. ✅ ingress-config (wildcard-cert + homelab-ingress)
2. ✅ homarr (merge homarr-patches)
3. ✅ temporal (merge db-secret-sync)
4. ✅ cert-manager (merge issuers)

Sprint 2: Phase 2 (Moderate Risk)

5. ✅ Remove duplicate ingress-nginx
6. ✅ sqs-platform consolidation
7. ✅ authentik + iam-jobs

Sprint 3: Phase 3 (Optional)

8. ⚠️ Evaluate monitoring stack consolidation
9. ⚠️ Evaluate logging stack consolidation

---

File Changes Required

For each consolidation:

1. Update Application YAML in k8s/argocd/apps/*.yaml

   • Convert single-source to multi-source
   • Update sync waves appropriately
   • Add hook annotations where needed

2. Update kustomization.yaml in target directories

   • Ensure all resources are listed
   • Verify namespace declarations

3. Test locally:

   kubectl kustomize k8s/bootstrap/ingress/
   helm template <chart> -f values.yaml
   

4. Delete old Applications:

   kubectl delete application <old-app> -n argocd
   

---

Rollback Plan

Each consolidation is independent. If issues arise:

1. Revert git commit with the Application change
2. Restore old Applications from git history
3. Force ArgoCD refresh:

   kubectl delete application <new-merged-app> -n argocd
   kubectl apply -f k8s/argocd/apps/<old-wave-file>.yaml
   

---

Success Metrics

Before: 39 Applications
After (Conservative): 35 Applications
After (Full): 31-32 Applications

Benefits:

• ✅ Easier to understand (related apps grouped)
• ✅ Fewer Application CRs to manage
• ✅ Cleaner ArgoCD UI
• ✅ Logical grouping by function
• ✅ Reduced sync complexity

Risks:

• ⚠️ Multi-source Applications are slightly more complex
• ⚠️ Sync wave ordering must be preserved
• ⚠️ Hook timing must be correct (PreSync/PostSync)

---

Decision: Which Phase?

Recommendation: Start with Phase 1 (Conservative) → 35 Applications

This gives us:

• 4 fewer Applications to manage
• Low risk (same directories)
• Easy to understand merges
• Can evaluate Phase 2 later based on results

Do you want to proceed with Phase 1 implementation?