Story Crater Bot
8d63db9f3b
- Fix ArgoCD Application schema: move syncOptions under syncPolicy (00-secrets.yaml) - Remove helm install --wait flag (talos-cp-2 slow node timeout issue) - Add comprehensive progress logging with timestamps to bootstrap.sh - Fix SOPS key path (/Users/rockliang/.sops/key.txt, not homelab-age.key) - Add local SOPS decryption for bootstrap secrets - Add CNPG NetworkPolicy allowing app→database connectivity - Disable Forgejo bundled dependencies (saves 66Gi storage) - Inject database credentials via deployment.env (GITEA__DATABASE__*) - Remove invalid ext4 mount options from StorageClass - Add namespace manifests with PodSecurity labels - Add encrypted forgejo-admin secret (SOPS) - Reduce forgejo-db size 50Gi→25Gi per instance - Prepare ArgoCD SOPS CMP plugin (for post-bootstrap)
11 lines
371 B
YAML
11 lines
371 B
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: cicd
|
|
labels:
|
|
# Baseline allows most workloads while blocking clearly dangerous configurations
|
|
# Redis needs some relaxed settings but doesn't need full privileged access
|
|
pod-security.kubernetes.io/enforce: baseline
|
|
pod-security.kubernetes.io/audit: baseline
|
|
pod-security.kubernetes.io/warn: baseline
|