fix: consolidate helmfile into one file; expose gRPC externally for kmsvc-cli

Cross-file `needs:` across separate nested helmfiles didn't resolve in
Helmfile v1 (releases defined in sibling files weren't visible to each
other's dependency graph) -- confirmed live against the homelab cluster:
kafka-cluster failed with "depend(s) on an undefined release" even though
strimzi-operator had just been installed successfully by a sibling file.
Collapsed releases.d/*.gotmpl into a single helmfile.yaml.gotmpl so the
whole release graph is resolved together.

Also add a second Ingress (management-service-grpc, backend-protocol: GRPC)
scoped to the QueueService gRPC path prefix on the same host/port as the
REST ingress. kmsvc-cli dials --server directly via gRPC (default
kmsvc.homelab.internal:443 per its README), so raw gRPC needs an external
path too, not just REST -- the original "gRPC stays internal" default
didn't account for the CLI's own connection model.

Add Dockerfile.queue-operator (existed for cmd/server only before).

Dockerfile.queue-operator

@@ -0,0 +1,12 @@
+FROM golang:1.26 AS build
+WORKDIR /src
+ENV GOPRIVATE=forgejo.riotpiao.homelab.com
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -trimpath -o /out/queue-operator ./cmd/queue-operator
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/queue-operator /queue-operator
+USER nonroot:nonroot
+ENTRYPOINT ["/queue-operator"]

k8s/charts/management-service/templates/ingress-grpc.yaml

@@ -0,0 +1,27 @@
+{{- if and .Values.ingress.enabled .Values.ingress.grpcEnabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: management-service-grpc
+  namespace: {{ .Values.namespace }}
+  annotations:
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }}
+    nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host }}
+      secretName: {{ .Values.ingress.tlsSecretName }}
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: {{ .Values.ingress.grpcPathPrefix }}
+            pathType: Prefix
+            backend:
+              service:
+                name: management-service
+                port:
+                  number: {{ .Values.grpcPort }}
+{{- end }}

k8s/charts/management-service/values.yaml

@@ -36,3 +36,9 @@ ingress:
   clusterIssuer: homelab-ca
   host: kmsvc.homelab.internal
   tlsSecretName: kmsvc-tls
+  # kmsvc-cli connects via gRPC directly to --server/KMSVC_SERVER (default
+  # kmsvc.homelab.internal:443, see kmsvc-cli's README), so raw gRPC needs an
+  # external path too — scoped to the gRPC service's own path prefix on the
+  # same host/port, rather than opening the whole host to gRPC passthrough.
+  grpcEnabled: true
+  grpcPathPrefix: /kafkamgmt.v1.QueueService/

k8s/helmfile.yaml.gotmpl

@@ -1,15 +1,99 @@
 environments:
+  default:
+    values:
+      - environments/homelab.yaml
   homelab:
     values:
       - environments/homelab.yaml
-
+---
 helmDefaults:
   wait: true
   timeout: 600
 
-helmfiles:
-  - path: releases.d/00-strimzi-operator.yaml.gotmpl
-  - path: releases.d/01-kafka-cluster.yaml.gotmpl
-  - path: releases.d/02-redis.yaml.gotmpl
-  - path: releases.d/03-queue-crd.yaml.gotmpl
-  - path: releases.d/04-management-service.yaml.gotmpl
+repositories:
+  - name: strimzi
+    url: https://strimzi.io/charts/
+  - name: bitnami
+    url: https://charts.bitnami.com/bitnami
+
+releases:
+  - name: strimzi-operator
+    namespace: {{ .Values.namespace }}
+    chart: strimzi/strimzi-kafka-operator
+    version: 0.46.0
+    values:
+      - watchNamespaces: ["{{ .Values.namespace }}"]
+
+  - name: kafka-cluster
+    namespace: {{ .Values.namespace }}
+    chart: charts/kafka-cluster
+    needs:
+      - {{ .Values.namespace }}/strimzi-operator
+    values:
+      - namespace: {{ .Values.namespace }}
+        nodePool:
+          replicas: {{ .Values.kafkaCluster.nodePool.replicas }}
+          storage:
+            class: {{ .Values.kafkaCluster.nodePool.storage.class }}
+            sizeGi: {{ .Values.kafkaCluster.nodePool.storage.sizeGi }}
+          resources:
+            memory: {{ .Values.kafkaCluster.nodePool.resources.memory }}
+            cpu: {{ .Values.kafkaCluster.nodePool.resources.cpu | quote }}
+
+  - name: kmsvc-redis
+    namespace: {{ .Values.namespace }}
+    chart: bitnami/redis
+    version: 20.6.0
+    values:
+      - architecture: standalone
+        # Bitnami stopped publishing version-pinned tags under docker.io/bitnami
+        # (only `latest` remains there); bitnamilegacy/* mirrors the old
+        # versioned tags for free, so pin there instead of floating on `latest`.
+        # The chart's container-image allowlist check doesn't know about the
+        # legacy mirror, hence allowInsecureImages.
+        global:
+          security:
+            allowInsecureImages: true
+        image:
+          repository: bitnamilegacy/redis
+        auth:
+          enabled: false
+        master:
+          persistence:
+            enabled: true
+            storageClass: {{ .Values.redis.storageClass }}
+            size: 2Gi
+          resources:
+            limits:
+              memory: {{ .Values.redis.memoryLimit }}
+            requests:
+              memory: {{ .Values.redis.memoryLimit }}
+
+  - name: queue-crd
+    namespace: {{ .Values.namespace }}
+    chart: charts/queue-crd
+    needs:
+      - {{ .Values.namespace }}/kafka-cluster
+      - {{ .Values.namespace }}/kmsvc-redis
+    values:
+      - namespace: {{ .Values.namespace }}
+        kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092"
+        redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379"
+
+  - name: management-service
+    namespace: {{ .Values.namespace }}
+    chart: charts/management-service
+    needs:
+      - {{ .Values.namespace }}/kafka-cluster
+      - {{ .Values.namespace }}/kmsvc-redis
+    values:
+      - namespace: {{ .Values.namespace }}
+        env:
+          kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092"
+          redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379"
+          authentikIssuerURL: {{ .Values.managementService.authentikIssuerURL | quote }}
+          authentikAudience: {{ .Values.managementService.authentikAudience | quote }}
+        ingress:
+          enabled: true
+          host: {{ .Values.managementService.ingress.host | quote }}
+          clusterIssuer: {{ .Values.managementService.ingress.clusterIssuer | quote }}

k8s/releases.d/00-strimzi-operator.yaml.gotmpl

@@ -1,16 +0,0 @@
-environments:
-  homelab:
-    values:
-      - ../environments/homelab.yaml
----
-repositories:
-  - name: strimzi
-    url: https://strimzi.io/charts/
-
-releases:
-  - name: strimzi-operator
-    namespace: {{ .Values.namespace }}
-    chart: strimzi/strimzi-kafka-operator
-    version: 0.46.0
-    values:
-      - watchNamespaces: ["{{ .Values.namespace }}"]

k8s/releases.d/01-kafka-cluster.yaml.gotmpl

@@ -1,21 +0,0 @@
-environments:
-  homelab:
-    values:
-      - ../environments/homelab.yaml
----
-releases:
-  - name: kafka-cluster
-    namespace: {{ .Values.namespace }}
-    chart: ../charts/kafka-cluster
-    needs:
-      - {{ .Values.namespace }}/strimzi-operator
-    values:
-      - namespace: {{ .Values.namespace }}
-        nodePool:
-          replicas: {{ .Values.kafkaCluster.nodePool.replicas }}
-          storage:
-            class: {{ .Values.kafkaCluster.nodePool.storage.class }}
-            sizeGi: {{ .Values.kafkaCluster.nodePool.storage.sizeGi }}
-          resources:
-            memory: {{ .Values.kafkaCluster.nodePool.resources.memory }}
-            cpu: {{ .Values.kafkaCluster.nodePool.resources.cpu | quote }}

k8s/releases.d/02-redis.yaml.gotmpl

@@ -1,28 +0,0 @@
-environments:
-  homelab:
-    values:
-      - ../environments/homelab.yaml
----
-repositories:
-  - name: bitnami
-    url: https://charts.bitnami.com/bitnami
-
-releases:
-  - name: kmsvc-redis
-    namespace: {{ .Values.namespace }}
-    chart: bitnami/redis
-    version: 20.6.0
-    values:
-      - architecture: standalone
-        auth:
-          enabled: false
-        master:
-          persistence:
-            enabled: true
-            storageClass: {{ .Values.redis.storageClass }}
-            size: 2Gi
-          resources:
-            limits:
-              memory: {{ .Values.redis.memoryLimit }}
-            requests:
-              memory: {{ .Values.redis.memoryLimit }}

k8s/releases.d/03-queue-crd.yaml.gotmpl

@@ -1,16 +0,0 @@
-environments:
-  homelab:
-    values:
-      - ../environments/homelab.yaml
----
-releases:
-  - name: queue-crd
-    namespace: {{ .Values.namespace }}
-    chart: ../charts/queue-crd
-    needs:
-      - {{ .Values.namespace }}/kafka-cluster
-      - {{ .Values.namespace }}/kmsvc-redis
-    values:
-      - namespace: {{ .Values.namespace }}
-        kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092"
-        redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379"

k8s/releases.d/04-management-service.yaml.gotmpl

@@ -1,23 +0,0 @@
-environments:
-  homelab:
-    values:
-      - ../environments/homelab.yaml
----
-releases:
-  - name: management-service
-    namespace: {{ .Values.namespace }}
-    chart: ../charts/management-service
-    needs:
-      - {{ .Values.namespace }}/kafka-cluster
-      - {{ .Values.namespace }}/kmsvc-redis
-    values:
-      - namespace: {{ .Values.namespace }}
-        env:
-          kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092"
-          redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379"
-          authentikIssuerURL: {{ .Values.managementService.authentikIssuerURL | quote }}
-          authentikAudience: {{ .Values.managementService.authentikAudience | quote }}
-        ingress:
-          enabled: true
-          host: {{ .Values.managementService.ingress.host | quote }}
-          clusterIssuer: {{ .Values.managementService.ingress.clusterIssuer | quote }}