Story Crater BotandClaude Haiku 4.5
d282ae1aa0
Adds ConfigManagementPlugin (CMP) sidecar to argocd-repoServer. Plugin decrypts *.enc.yaml files with age key from sops-age Secret, emits plain Kubernetes Secrets. Stage 0: grafana only (2 Secrets: grafana-oidc + new grafana-admin). Updates grafana-values.yaml to wire admin.existingSecret (chart-native support). CMP Application (00-secrets.yaml) syncs at wave 0 before grafana/loki/authentik. Decryption happens on-demand during sync, no pre-built Secret commits. Stages 1-4 (loki/authentik/forgejo/temporal) extend plugin script incrementally after verification. Co-Authored-By: Claude Haiku 4.5 <[email protected]>
169 lines
4.6 KiB
YAML
169 lines
4.6 KiB
YAML
# k8s/talos-ci-cd/argocd-values.yaml
|
|
# Argo CD — single-replica homelab install (fits the 4-CPU / 32 GB RAM budget).
|
|
# Deployed via helmfile (name=argocd) so it sits alongside Authentik, MinIO, etc.
|
|
#
|
|
# UI is exposed via the cluster Ingress (k8s/ingress/ingress.yaml,
|
|
# argocd.riotpiao.com) over the WireGuard/LAN-only nginx ingress —
|
|
# never as a LoadBalancer, since argocd-server holds cluster-admin
|
|
# credentials and that Ingress isn't reachable from the WAN.
|
|
#
|
|
# OIDC + RBAC declared in configs.cm / configs.rbac below — applied by Helm directly.
|
|
# Requires: oidc-secret K8s secret (created by helmfile argocd presync hook from env vars).
|
|
# CA trust for Forgejo repo clones injected into argocd-tls-certs-cm by postsync hook.
|
|
|
|
global:
|
|
domain: argocd.riotpiao.com
|
|
|
|
configs:
|
|
params:
|
|
server.insecure: false # keep TLS on argocd-server even behind the ingress
|
|
|
|
cm:
|
|
# Must match the Ingress host above and the redirect URI registered in
|
|
# Authentik (provision_oidc.py argocd_url) exactly — ArgoCD builds its
|
|
# OIDC redirect_uri as "{url}/auth/callback", so any mismatch here is
|
|
# what Authentik's "Invalid redirect URL" error means.
|
|
url: "https://argocd.riotpiao.com"
|
|
oidc.config: |
|
|
name: Authentik
|
|
issuer: https://authentik.riotpiao.com/application/o/argocd/
|
|
clientID: $oidc-secret:client-id
|
|
clientSecret: $oidc-secret:client-secret
|
|
requestedScopes: [openid, profile, email, groups]
|
|
rootCA: |
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBbTCCARSgAwIBAgIUNa409I6cGHye4YqeiphmWDaCEXUwCgYIKoZIzj0EAwIw
|
|
FTETMBEGA1UEAxMKaG9tZWxhYi1jYTAeFw0yNjA2MTcxNjUzMjVaFw0zNjA2MTQx
|
|
NjUzMjVaMBUxEzARBgNVBAMTCmhvbWVsYWItY2EwWTATBgcqhkjOPQIBBggqhkjO
|
|
PQMBBwNCAARwkubJPPdhgKcqr+3AEO2tr5I7MhC3zzeAqpmv8glngsweiGznaDhi
|
|
Dbf8JFfilbrLEJBSuwHZQPuoNx+3fbvYo0IwQDAOBgNVHQ8BAf8EBAMCAqQwDwYD
|
|
VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUod8iYq0+QyetnxfKDprIf3XbWkEwCgYI
|
|
KoZIzj0EAwIDRwAwRAIgQ4HOLs5DOqcfAMv8NSImxoYN7TyebnlQAQXSARnIqBMC
|
|
IB9RycFvG/rpJuz/LIKi4rf6RARjLcHM/zqhXQJvBw53
|
|
-----END CERTIFICATE-----
|
|
|
|
rbac:
|
|
policy.csv: |
|
|
g, homelab-admins, role:admin
|
|
policy.default: role:readonly
|
|
|
|
cmp:
|
|
plugins:
|
|
sops-secrets:
|
|
generate:
|
|
command: sh
|
|
args:
|
|
- -c
|
|
- /var/run/argocd/plugins/sops-cmp-generate.sh
|
|
|
|
server:
|
|
replicas: 1
|
|
deploymentStrategy:
|
|
type: Recreate
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
# No Service of type LoadBalancer — port-forward only
|
|
service:
|
|
type: ClusterIP
|
|
podAnnotations:
|
|
secret.reloader.stakater.com/reload: "oidc-secret"
|
|
configmap.reloader.stakater.com/reload: "argocd-tls-certs-cm,argocd-cm"
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
repoServer:
|
|
replicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
extraContainers:
|
|
- name: sops-cmp
|
|
image: registry.gitlab.com/argoproj/argocd-helm-charts/argocd-cmp-server:v2.12.1
|
|
command: [/var/run/argocd/argocd-cmp-server]
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 999
|
|
volumeMounts:
|
|
- mountPath: /var/run/argocd
|
|
name: var-files
|
|
- mountPath: /home/argocd/cmp-server/plugins
|
|
name: plugins
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /sops-age
|
|
name: sops-age
|
|
volumes:
|
|
- name: sops-age
|
|
secret:
|
|
secretName: sops-age
|
|
|
|
applicationSet:
|
|
replicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
controller:
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1Gi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
redis:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
notifications:
|
|
enabled: false # add back later if alert routing is needed
|