Mukul SharmaandClaude Opus 5
9c67afd5e0
Adds nine Applications — external-secrets, harbor, jenkins, postgresql, redis, victoria-metrics-single, vmagent, node-exporter, grafana — bringing the cluster to the homelab's full set. Every nameOverride is pinned, which is load-bearing rather than cosmetic in at least three cases: external-secrets (its service account name is what vault-backend's serviceAccountRef and Vault's auth role bind to), victoria-metrics-single (its Service renders as <release>-server, the address vmagent and Grafana both hardcode) and harbor (the pipeline refers to its object names). extra-manifests gains the ClusterIssuer that makes cert-manager useful here: a CA issuer over the registry-ca Secret, which is created by hand from terraform output because the CA's private key exists only in Terraform state and nothing can reconcile it from git. Two homelab-only things removed rather than left to confuse: the Tailscale Harbor Ingress, and the homelab cluster's own entry point and values file, which have no meaning in a GCP-only repo. app-of-secretstores and app-of-extra-manifests now point at this cluster's Gitea over cluster DNS, and harbor-robot-dockerconfig is keyed to this cluster's registry hostname — docker matches stored credentials by exact host, so the homelab's would have silently pushed unauthenticated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
32 lines
1.4 KiB
YAML
32 lines
1.4 KiB
YAML
# The issuer that signs Harbor's certificate, from the private CA the GKE
|
|
# node pool was told to trust.
|
|
#
|
|
# Terraform generates that CA and puts its PUBLIC key in Secret Manager,
|
|
# which is what every node fetches to verify image pulls. cert-manager needs
|
|
# both halves in order to sign, so the key pair is created as the
|
|
# `registry-ca` Secret in the cert-manager namespace by hand, from
|
|
# `terraform output` — the private key exists nowhere else, so nothing can
|
|
# reconcile it from git:
|
|
#
|
|
# TF=~/Documents/localgit/toolshed-gke-infra/envs/prod/10-infra
|
|
# kubectl -n cert-manager create secret tls registry-ca \
|
|
# --cert=<(terraform -chdir=$TF output -raw registry_ca_cert_pem) \
|
|
# --key=<(terraform -chdir=$TF output -raw registry_ca_key_pem)
|
|
#
|
|
# A ClusterIssuer, not an Issuer, so Harbor's namespace can request a
|
|
# certificate without the CA's private key being copied there. Note that a
|
|
# ClusterIssuer always reads its secret from cert-manager's own namespace,
|
|
# which is what makes that possible.
|
|
#
|
|
# This is the whole reason cert-manager is installed at all: nothing else in
|
|
# this cluster uses TLS. Let's Encrypt cannot help here, because nip.io is
|
|
# not on the public suffix list and every *.nip.io certificate shares one
|
|
# rate limit.
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: registry-ca-issuer
|
|
spec:
|
|
ca:
|
|
secretName: registry-ca
|