homelab/k8s/hooks/phase3/phase3-hooks.yaml

# ArgoCD Hook Jobs for Phase 3 releases

---
# ── Authentik — PreSync: CA ConfigMap ─────────────────────────────────────────

apiVersion: batch/v1
kind: Job
metadata:
  name: authentik-ca-setup
  namespace: iam
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: phase3-setup
      restartPolicy: Never
      containers:
      - name: ca-setup
        image: bitnami/kubectl:latest
        command:
          - /bin/sh
          - -c
          - |
            echo "Setting up CA ConfigMap for Authentik..."
            CA_PEM=$(kubectl get secret homelab-ca-secret -n cert-manager \
              -o jsonpath='{.data.tls\.crt}' | base64 -d)
            kubectl create configmap homelab-ca -n iam \
              --from-literal=homelab-ca.crt="$CA_PEM" \
              --dry-run=client -o yaml | kubectl apply -f -
            echo "✓ CA ConfigMap created"

---
# ── Authentik — PostSync: OIDC Provisioning ──────────────────────────────────

apiVersion: batch/v1
kind: Job
metadata:
  name: authentik-oidc-provision
  namespace: iam
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: phase3-setup
      restartPolicy: Never
      containers:
      - name: oidc-provision
        image: bitnami/kubectl:latest
        command:
          - /bin/sh
          - -c
          - |
            echo "Waiting for Authentik server..."
            kubectl rollout status deploy/authentik-server -n iam --timeout=180s || true

            echo "Authentik ready (OIDC provisioning requires bootstrap token from secrets)"
            echo "✓ OIDC provisioning placeholder"

---
# ── Vault — PreSync: MinIO Creds & Bucket ────────────────────────────────────

apiVersion: batch/v1
kind: Job
metadata:
  name: vault-minio-setup
  namespace: iam
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: phase3-setup
      restartPolicy: Never
      containers:
      - name: minio-setup
        image: bitnami/kubectl:latest
        command:
          - /bin/sh
          - -c
          - |
            echo "Creating Vault MinIO secrets..."
            # Note: MinIO creds from secrets.enc.yaml should be available
            echo "Vault MinIO setup (credentials from SOPS secrets)"
            echo "✓ Vault MinIO placeholder"

---
# ── Temporal — PreSync: Elasticsearch & Secrets ───────────────────────────────

apiVersion: batch/v1
kind: Job
metadata:
  name: temporal-elasticsearch-setup
  namespace: temporal
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: phase3-setup
      restartPolicy: Never
      containers:
      - name: es-setup
        image: bitnami/kubectl:latest
        command:
          - /bin/sh
          - -c
          - |
            echo "Setting up Temporal Elasticsearch..."
            kubectl create namespace temporal --dry-run=client -o yaml | kubectl apply -f -
            kubectl apply -f k8s/temporal/elasticsearch.yaml || echo "ES already exists"
            echo "✓ Elasticsearch setup"

---
# ── Ollama — PreSync: Namespace & Secrets ────────────────────────────────────

apiVersion: batch/v1
kind: Job
metadata:
  name: ollama-namespace-setup
  namespace: llm
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: phase3-setup
      restartPolicy: Never
      containers:
      - name: ns-setup
        image: bitnami/kubectl:latest
        command:
          - /bin/sh
          - -c
          - |
            echo "Setting up Ollama namespace..."
            kubectl create namespace llm --dry-run=client -o yaml | kubectl apply -f -
            kubectl label namespace llm \
              pod-security.kubernetes.io/enforce=baseline \
              pod-security.kubernetes.io/enforce-version=latest \
              --overwrite 2>/dev/null || true
            echo "✓ Ollama namespace setup"

---
# ── Story Crater Migrations — PostSync: Run Migrations ────────────────────────

apiVersion: batch/v1
kind: Job
metadata:
  name: story-crater-migrations-run
  namespace: story-crater-backend
  annotations:
    argocd.argoproj.io/hook: PostSync
    argocd.argoproj.io/hook-delete-policy: HookSucceeded
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: phase3-setup
      restartPolicy: Never
      containers:
      - name: migrations
        image: bitnami/kubectl:latest
        command:
          - /bin/sh
          - -c
          - |
            echo "Running Story Crater migrations..."
            # Note: actual migrations require CNPG cluster to be ready
            echo "Migrations placeholder (requires CNPG + Vault secrets)"
            echo "✓ Migrations setup"

---
# ── RBAC for Phase 3 Hook Jobs ───────────────────────────────────────────────

apiVersion: v1
kind: ServiceAccount
metadata:
  name: phase3-setup
  namespace: iam

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: phase3-setup
rules:
  - apiGroups: [""]
    resources: ["secrets", "configmaps"]
    verbs: ["get", "list", "create", "apply", "patch"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list", "create"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["list", "get"]
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["get", "list", "create"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: phase3-setup
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: phase3-setup
subjects:
  - kind: ServiceAccount
    name: phase3-setup
    namespace: iam