Mukul SharmaandClaude Opus 5
9c67afd5e0
Adds nine Applications — external-secrets, harbor, jenkins, postgresql, redis, victoria-metrics-single, vmagent, node-exporter, grafana — bringing the cluster to the homelab's full set. Every nameOverride is pinned, which is load-bearing rather than cosmetic in at least three cases: external-secrets (its service account name is what vault-backend's serviceAccountRef and Vault's auth role bind to), victoria-metrics-single (its Service renders as <release>-server, the address vmagent and Grafana both hardcode) and harbor (the pipeline refers to its object names). extra-manifests gains the ClusterIssuer that makes cert-manager useful here: a CA issuer over the registry-ca Secret, which is created by hand from terraform output because the CA's private key exists only in Terraform state and nothing can reconcile it from git. Two homelab-only things removed rather than left to confuse: the Tailscale Harbor Ingress, and the homelab cluster's own entry point and values file, which have no meaning in a GCP-only repo. app-of-secretstores and app-of-extra-manifests now point at this cluster's Gitea over cluster DNS, and harbor-robot-dockerconfig is keyed to this cluster's registry hostname — docker matches stored credentials by exact host, so the homelab's would have silently pushed unauthenticated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
32 lines
1.1 KiB
YAML
32 lines
1.1 KiB
YAML
# Bootstrap Application, applied once by hand (like app-of-projects.yaml
|
|
# and incubator/*.yaml) — ArgoCD can't sync its own entry points. Syncs
|
|
# everything under secretstores/ so SecretStore/ClusterSecretStore objects
|
|
# are GitOps-managed instead of a manual one-off kubectl apply. Mirrors
|
|
# app-of-projects.yaml exactly, kept as a separate Application (not folded
|
|
# into that one) since these are External Secrets Operator resources, not
|
|
# ArgoCD ones — different concern, same pattern.
|
|
#
|
|
# Uses the built-in "default" project — no chicken-and-egg problem, same
|
|
# reasoning as app-of-projects.yaml.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: app-of-secretstores
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
project: default
|
|
source:
|
|
repoURL: 'http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/devops-infra-argo-config-gcp.git'
|
|
targetRevision: main
|
|
path: secretstores
|
|
directory:
|
|
recurse: true
|
|
destination:
|
|
name: in-cluster
|
|
namespace: argocd
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|