Mukul SharmaandClaude Opus 5
9c67afd5e0
Adds nine Applications — external-secrets, harbor, jenkins, postgresql, redis, victoria-metrics-single, vmagent, node-exporter, grafana — bringing the cluster to the homelab's full set. Every nameOverride is pinned, which is load-bearing rather than cosmetic in at least three cases: external-secrets (its service account name is what vault-backend's serviceAccountRef and Vault's auth role bind to), victoria-metrics-single (its Service renders as <release>-server, the address vmagent and Grafana both hardcode) and harbor (the pipeline refers to its object names). extra-manifests gains the ClusterIssuer that makes cert-manager useful here: a CA issuer over the registry-ca Secret, which is created by hand from terraform output because the CA's private key exists only in Terraform state and nothing can reconcile it from git. Two homelab-only things removed rather than left to confuse: the Tailscale Harbor Ingress, and the homelab cluster's own entry point and values file, which have no meaning in a GCP-only repo. app-of-secretstores and app-of-extra-manifests now point at this cluster's Gitea over cluster DNS, and harbor-robot-dockerconfig is keyed to this cluster's registry hostname — docker matches stored credentials by exact host, so the homelab's would have silently pushed unauthenticated. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
143 lines
5.3 KiB
YAML
143 lines
5.3 KiB
YAML
# GKE counterpart of incubator-infra-k8s-admin-prd-ase1-values.yaml. Starts
|
|
# with only the three components installed by hand at bootstrap; every
|
|
# other homelab component is added here as it is ported, each with its own
|
|
# helm-overrides/gke-toolshed-prd-usc1/<name>/custom-values.yaml.
|
|
clusterSpec:
|
|
destination:
|
|
server: ""
|
|
name: "in-cluster"
|
|
|
|
argocdSpec:
|
|
namespace: argocd
|
|
|
|
teamSpec:
|
|
devops:
|
|
source:
|
|
# Cluster DNS, not an Ingress: ArgoCD must be able to read this before
|
|
# Contour exists, because Contour is itself one of these Applications.
|
|
repoURL: http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/devops-infra-helm-charts-gcp.git
|
|
targetRevision: main
|
|
path: helm-templates
|
|
valueFiles: ../../helm-overrides/gke-toolshed-prd-usc1
|
|
labels:
|
|
bu: infra
|
|
team: devops
|
|
env: prd
|
|
cluster: gke-toolshed-prd-usc1
|
|
|
|
# nameOverride on every entry must equal the Helm release name used for the
|
|
# manual bootstrap install. ArgoCD uses the Application name as the release
|
|
# name, so a mismatch renders a second copy instead of adopting the first.
|
|
appSpec:
|
|
- name: argocd
|
|
nameOverride: argocd-admin-prd
|
|
namespace: argocd
|
|
chartDir: argo-cd
|
|
valuesDir: argocd-admin-prd
|
|
- name: gitea
|
|
nameOverride: gitea
|
|
namespace: gitea
|
|
chartDir: gitea
|
|
valuesDir: gitea
|
|
- name: contour
|
|
# The cluster's only inbound path, pinned to the reserved IP that every
|
|
# nip.io hostname is built from. Installed by ArgoCD rather than by
|
|
# hand, which is only possible because nothing in the bootstrap needed
|
|
# an ingress: ArgoCD reaches Gitea over cluster DNS.
|
|
nameOverride: contour
|
|
namespace: projectcontour
|
|
chartDir: contour
|
|
valuesDir: contour
|
|
# Contour's HTTPProxy CRD embeds a large schema, same 256KiB
|
|
# last-applied-configuration problem as cert-manager's.
|
|
serverSideApply: true
|
|
- name: vault
|
|
# Fresh install here, unlike the homelab's adoption of a running Vault.
|
|
# nameOverride pinned so the release is "vault" in namespace "vault":
|
|
# the Workload Identity binding Terraform created names that exact
|
|
# namespace/serviceaccount pair, and a different release name renames
|
|
# the service account, which leaves Vault unable to reach KMS and
|
|
# therefore sealed.
|
|
nameOverride: vault
|
|
namespace: vault
|
|
chartDir: vault
|
|
valuesDir: vault
|
|
- name: cert-manager
|
|
nameOverride: cert-manager
|
|
namespace: cert-manager
|
|
chartDir: cert-manager
|
|
valuesDir: cert-manager
|
|
# cert-manager's CRDs embed large OpenAPI schemas; SSA avoids the
|
|
# 256KiB last-applied-configuration limit, same as external-secrets.
|
|
serverSideApply: true
|
|
- name: external-secrets
|
|
# Every credential in the cluster arrives through this. nameOverride is
|
|
# not cosmetic here: without it the release becomes
|
|
# "external-secrets-<cluster>-<env>", which renames the controller's
|
|
# service account — and both secretstores/vault-backend.yaml's
|
|
# serviceAccountRef and Vault's own Kubernetes auth role are bound to
|
|
# the plain name.
|
|
nameOverride: external-secrets
|
|
namespace: external-secrets
|
|
chartDir: external-secrets
|
|
valuesDir: external-secrets
|
|
# ClusterSecretStore's CRD embeds a large provider schema and exceeds
|
|
# the 256KiB annotation limit on a client-side apply.
|
|
serverSideApply: true
|
|
- name: harbor
|
|
# Object names are all prefixed with the release name, and the pipeline
|
|
# refers to them, so it is pinned.
|
|
nameOverride: harbor
|
|
namespace: harbor
|
|
chartDir: harbor
|
|
valuesDir: harbor
|
|
- name: jenkins
|
|
nameOverride: jenkins
|
|
namespace: jenkins
|
|
chartDir: jenkins
|
|
valuesDir: jenkins
|
|
- name: postgresql
|
|
# Backs toolshed's control plane. Own namespace so it is addressed over
|
|
# cluster DNS like any other platform component and outlives whatever
|
|
# consumes it: postgresql.postgres.svc.cluster.local:5432
|
|
nameOverride: postgresql
|
|
namespace: postgres
|
|
chartDir: postgresql
|
|
valuesDir: postgresql
|
|
- name: redis
|
|
# Backs toolshed's managed cache add-on, same namespace reasoning as
|
|
# postgresql: redis.redis.svc.cluster.local:6379
|
|
nameOverride: redis
|
|
namespace: redis
|
|
chartDir: redis
|
|
valuesDir: redis
|
|
- name: victoria-metrics-single
|
|
# Pinned name, because the chart renders its Service as
|
|
# <release>-server and both vmagent's remote write and Grafana's
|
|
# datasource address it at
|
|
# victoria-metrics-single-server.monitoring.svc.cluster.local:8428
|
|
nameOverride: victoria-metrics-single
|
|
namespace: monitoring
|
|
chartDir: victoria-metrics-single
|
|
valuesDir: victoria-metrics-single
|
|
- name: vmagent
|
|
# The scraper. Needs the Service above to exist, so bring it up after.
|
|
nameOverride: vmagent
|
|
namespace: monitoring
|
|
chartDir: vmagent
|
|
valuesDir: vmagent
|
|
- name: node-exporter
|
|
nameOverride: node-exporter
|
|
namespace: monitoring
|
|
chartDir: node-exporter
|
|
valuesDir: node-exporter
|
|
- name: grafana
|
|
# Requires secretstores/grafana-admin-credentials.yaml to have synced
|
|
# first: without that Secret the pod generates a random admin password
|
|
# nobody has. It does not crash, it just cannot be logged into until
|
|
# the Secret exists and the pod restarts.
|
|
nameOverride: grafana
|
|
namespace: monitoring
|
|
chartDir: grafana
|
|
valuesDir: grafana
|