# GKE counterpart of incubator-infra-k8s-admin-prd-ase1-values.yaml. Starts # with only the three components installed by hand at bootstrap; every # other homelab component is added here as it is ported, each with its own # helm-overrides/gke-toolshed-prd-usc1//custom-values.yaml. clusterSpec: destination: server: "" name: "in-cluster" argocdSpec: namespace: argocd teamSpec: devops: source: # Cluster DNS, not an Ingress: ArgoCD must be able to read this before # Contour exists, because Contour is itself one of these Applications. repoURL: http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/devops-infra-helm-charts-gcp.git targetRevision: main path: helm-templates valueFiles: ../../helm-overrides/gke-toolshed-prd-usc1 labels: bu: infra team: devops env: prd cluster: gke-toolshed-prd-usc1 # nameOverride on every entry must equal the Helm release name used for the # manual bootstrap install. ArgoCD uses the Application name as the release # name, so a mismatch renders a second copy instead of adopting the first. appSpec: - name: argocd nameOverride: argocd-admin-prd namespace: argocd chartDir: argo-cd valuesDir: argocd-admin-prd - name: gitea nameOverride: gitea namespace: gitea chartDir: gitea valuesDir: gitea - name: contour # The cluster's only inbound path, pinned to the reserved IP that every # nip.io hostname is built from. Installed by ArgoCD rather than by # hand, which is only possible because nothing in the bootstrap needed # an ingress: ArgoCD reaches Gitea over cluster DNS. nameOverride: contour namespace: projectcontour chartDir: contour valuesDir: contour # Contour's HTTPProxy CRD embeds a large schema, same 256KiB # last-applied-configuration problem as cert-manager's. serverSideApply: true # Required alongside serverSideApply on this cluster. That sync option # makes Argo CD compute the diff with the Kubernetes schema compiled # into its own binary, and Argo CD v2.13 predates this cluster: live # Deployments here carry status.terminatingReplicas, beta and enabled by # default since Kubernetes 1.33, which that schema has never heard of. # The diff then aborts with "field not declared in schema" and the app # can neither be compared nor synced. ServerSideDiff hands the diff to # the API server, which necessarily knows its own fields. # # This is a workaround for an out-of-date Argo CD, not a fix. The fix is # upgrading Argo CD to a build whose schema matches the cluster. compareOptions: - ServerSideDiff=true - name: vault # Fresh install here, unlike the homelab's adoption of a running Vault. # nameOverride pinned so the release is "vault" in namespace "vault": # the Workload Identity binding Terraform created names that exact # namespace/serviceaccount pair, and a different release name renames # the service account, which leaves Vault unable to reach KMS and # therefore sealed. nameOverride: vault namespace: vault chartDir: vault valuesDir: vault - name: cert-manager nameOverride: cert-manager namespace: cert-manager chartDir: cert-manager valuesDir: cert-manager # cert-manager's CRDs embed large OpenAPI schemas; SSA avoids the # 256KiB last-applied-configuration limit, same as external-secrets. serverSideApply: true # See the contour entry above: server-side apply diffs against Argo CD's # own bundled schema, which is older than this cluster. compareOptions: - ServerSideDiff=true - name: external-secrets # Every credential in the cluster arrives through this. nameOverride is # not cosmetic here: without it the release becomes # "external-secrets--", which renames the controller's # service account — and both secretstores/vault-backend.yaml's # serviceAccountRef and Vault's own Kubernetes auth role are bound to # the plain name. nameOverride: external-secrets namespace: external-secrets chartDir: external-secrets valuesDir: external-secrets # ClusterSecretStore's CRD embeds a large provider schema and exceeds # the 256KiB annotation limit on a client-side apply. serverSideApply: true # See the contour entry above: server-side apply diffs against Argo CD's # own bundled schema, which is older than this cluster. compareOptions: - ServerSideDiff=true - name: harbor # Object names are all prefixed with the release name, and the pipeline # refers to them, so it is pinned. nameOverride: harbor namespace: harbor chartDir: harbor valuesDir: harbor - name: jenkins nameOverride: jenkins namespace: jenkins chartDir: jenkins valuesDir: jenkins - name: postgresql # Backs toolshed's control plane. Own namespace so it is addressed over # cluster DNS like any other platform component and outlives whatever # consumes it: postgresql.postgres.svc.cluster.local:5432 nameOverride: postgresql namespace: postgres chartDir: postgresql valuesDir: postgresql - name: redis # Backs toolshed's managed cache add-on, same namespace reasoning as # postgresql: redis.redis.svc.cluster.local:6379 nameOverride: redis namespace: redis chartDir: redis valuesDir: redis - name: victoria-metrics-single # Pinned name, because the chart renders its Service as # -server and both vmagent's remote write and Grafana's # datasource address it at # victoria-metrics-single-server.monitoring.svc.cluster.local:8428 nameOverride: victoria-metrics-single namespace: monitoring chartDir: victoria-metrics-single valuesDir: victoria-metrics-single - name: vmagent # The scraper. Needs the Service above to exist, so bring it up after. nameOverride: vmagent namespace: monitoring chartDir: vmagent valuesDir: vmagent - name: node-exporter nameOverride: node-exporter namespace: monitoring chartDir: node-exporter valuesDir: node-exporter - name: grafana # Requires secretstores/grafana-admin-credentials.yaml to have synced # first: without that Secret the pod generates a random admin password # nobody has. It does not crash, it just cannot be logged into until # the Secret exists and the pod restarts. nameOverride: grafana namespace: monitoring chartDir: grafana valuesDir: grafana