Mukul SharmaandClaude Opus 5
3b11f3e0ea
References to helm-overrides/k8s-admin-prd-ase1 now either name the homelab repo that still has that folder, or point at the GKE equivalent under gke-toolshed-prd-usc1. Comments only; no rendered values change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Fn2kUxyYNY4ApytbLiGWeY
175 lines
7.0 KiB
YAML
175 lines
7.0 KiB
YAML
# GKE counterpart of the homelab devops-infra-argo-config repo's
|
|
# incubator-infra-k8s-admin-prd-ase1-values.yaml. Starts
|
|
# with only the three components installed by hand at bootstrap; every
|
|
# other homelab component is added here as it is ported, each with its own
|
|
# helm-overrides/gke-toolshed-prd-usc1/<name>/custom-values.yaml.
|
|
clusterSpec:
|
|
destination:
|
|
server: ""
|
|
name: "in-cluster"
|
|
|
|
argocdSpec:
|
|
namespace: argocd
|
|
|
|
teamSpec:
|
|
devops:
|
|
source:
|
|
# Cluster DNS, not an Ingress: ArgoCD must be able to read this before
|
|
# Contour exists, because Contour is itself one of these Applications.
|
|
repoURL: http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/devops-infra-helm-charts-gcp.git
|
|
targetRevision: main
|
|
path: helm-templates
|
|
valueFiles: ../../helm-overrides/gke-toolshed-prd-usc1
|
|
labels:
|
|
bu: infra
|
|
team: devops
|
|
env: prd
|
|
cluster: gke-toolshed-prd-usc1
|
|
|
|
# nameOverride on every entry must equal the Helm release name used for the
|
|
# manual bootstrap install. ArgoCD uses the Application name as the release
|
|
# name, so a mismatch renders a second copy instead of adopting the first.
|
|
appSpec:
|
|
- name: argocd
|
|
nameOverride: argocd-admin-prd
|
|
namespace: argocd
|
|
chartDir: argo-cd
|
|
valuesDir: argocd-admin-prd
|
|
# Argo CD v3's own CRDs (applications, applicationsets, appprojects)
|
|
# embed large schemas, past the 256KiB last-applied-configuration limit
|
|
# a client-side apply writes — the same reason cert-manager and
|
|
# external-secrets use this.
|
|
serverSideApply: true
|
|
# And therefore the same stale-schema diff problem: see the contour
|
|
# entry. Once the upgrade lands, Argo CD's schema matches this cluster
|
|
# and this becomes belt-and-braces rather than load-bearing.
|
|
compareOptions:
|
|
- ServerSideDiff=true
|
|
- name: gitea
|
|
nameOverride: gitea
|
|
namespace: gitea
|
|
chartDir: gitea
|
|
valuesDir: gitea
|
|
- name: contour
|
|
# The cluster's only inbound path, pinned to the reserved IP that every
|
|
# deployshed.com record resolves to. Installed by ArgoCD rather than by
|
|
# hand, which is only possible because nothing in the bootstrap needed
|
|
# an ingress: ArgoCD reaches Gitea over cluster DNS.
|
|
nameOverride: contour
|
|
namespace: projectcontour
|
|
chartDir: contour
|
|
valuesDir: contour
|
|
# Contour's HTTPProxy CRD embeds a large schema, same 256KiB
|
|
# last-applied-configuration problem as cert-manager's.
|
|
serverSideApply: true
|
|
# Required alongside serverSideApply on this cluster. That sync option
|
|
# makes Argo CD compute the diff with the Kubernetes schema compiled
|
|
# into its own binary, and Argo CD v2.13 predates this cluster: live
|
|
# Deployments here carry status.terminatingReplicas, beta and enabled by
|
|
# default since Kubernetes 1.33, which that schema has never heard of.
|
|
# The diff then aborts with "field not declared in schema" and the app
|
|
# can neither be compared nor synced. ServerSideDiff hands the diff to
|
|
# the API server, which necessarily knows its own fields.
|
|
#
|
|
# This is a workaround for an out-of-date Argo CD, not a fix. The fix is
|
|
# upgrading Argo CD to a build whose schema matches the cluster.
|
|
compareOptions:
|
|
- ServerSideDiff=true
|
|
- name: vault
|
|
# Fresh install here, unlike the homelab's adoption of a running Vault.
|
|
# nameOverride pinned so the release is "vault" in namespace "vault":
|
|
# the Workload Identity binding Terraform created names that exact
|
|
# namespace/serviceaccount pair, and a different release name renames
|
|
# the service account, which leaves Vault unable to reach KMS and
|
|
# therefore sealed.
|
|
nameOverride: vault
|
|
namespace: vault
|
|
chartDir: vault
|
|
valuesDir: vault
|
|
- name: cert-manager
|
|
nameOverride: cert-manager
|
|
namespace: cert-manager
|
|
chartDir: cert-manager
|
|
valuesDir: cert-manager
|
|
# cert-manager's CRDs embed large OpenAPI schemas; SSA avoids the
|
|
# 256KiB last-applied-configuration limit, same as external-secrets.
|
|
serverSideApply: true
|
|
# See the contour entry above: server-side apply diffs against Argo CD's
|
|
# own bundled schema, which is older than this cluster.
|
|
compareOptions:
|
|
- ServerSideDiff=true
|
|
- name: external-secrets
|
|
# Every credential in the cluster arrives through this. nameOverride is
|
|
# not cosmetic here: without it the release becomes
|
|
# "external-secrets-<cluster>-<env>", which renames the controller's
|
|
# service account — and both secretstores/vault-backend.yaml's
|
|
# serviceAccountRef and Vault's own Kubernetes auth role are bound to
|
|
# the plain name.
|
|
nameOverride: external-secrets
|
|
namespace: external-secrets
|
|
chartDir: external-secrets
|
|
valuesDir: external-secrets
|
|
# ClusterSecretStore's CRD embeds a large provider schema and exceeds
|
|
# the 256KiB annotation limit on a client-side apply.
|
|
serverSideApply: true
|
|
# See the contour entry above: server-side apply diffs against Argo CD's
|
|
# own bundled schema, which is older than this cluster.
|
|
compareOptions:
|
|
- ServerSideDiff=true
|
|
- name: harbor
|
|
# Object names are all prefixed with the release name, and the pipeline
|
|
# refers to them, so it is pinned.
|
|
nameOverride: harbor
|
|
namespace: harbor
|
|
chartDir: harbor
|
|
valuesDir: harbor
|
|
- name: jenkins
|
|
nameOverride: jenkins
|
|
namespace: jenkins
|
|
chartDir: jenkins
|
|
valuesDir: jenkins
|
|
- name: postgresql
|
|
# Backs toolshed's control plane. Own namespace so it is addressed over
|
|
# cluster DNS like any other platform component and outlives whatever
|
|
# consumes it: postgresql.postgres.svc.cluster.local:5432
|
|
nameOverride: postgresql
|
|
namespace: postgres
|
|
chartDir: postgresql
|
|
valuesDir: postgresql
|
|
- name: redis
|
|
# Backs toolshed's managed cache add-on, same namespace reasoning as
|
|
# postgresql: redis.redis.svc.cluster.local:6379
|
|
nameOverride: redis
|
|
namespace: redis
|
|
chartDir: redis
|
|
valuesDir: redis
|
|
- name: victoria-metrics-single
|
|
# Pinned name, because the chart renders its Service as
|
|
# <release>-server and both vmagent's remote write and Grafana's
|
|
# datasource address it at
|
|
# victoria-metrics-single-server.monitoring.svc.cluster.local:8428
|
|
nameOverride: victoria-metrics-single
|
|
namespace: monitoring
|
|
chartDir: victoria-metrics-single
|
|
valuesDir: victoria-metrics-single
|
|
- name: vmagent
|
|
# The scraper. Needs the Service above to exist, so bring it up after.
|
|
nameOverride: vmagent
|
|
namespace: monitoring
|
|
chartDir: vmagent
|
|
valuesDir: vmagent
|
|
- name: node-exporter
|
|
nameOverride: node-exporter
|
|
namespace: monitoring
|
|
chartDir: node-exporter
|
|
valuesDir: node-exporter
|
|
- name: grafana
|
|
# Requires secretstores/grafana-admin-credentials.yaml to have synced
|
|
# first: without that Secret the pod generates a random admin password
|
|
# nobody has. It does not crash, it just cannot be logged into until
|
|
# the Secret exists and the pod restarts.
|
|
nameOverride: grafana
|
|
namespace: monitoring
|
|
chartDir: grafana
|
|
valuesDir: grafana
|