Mukul SharmaandClaude Opus 5
a3429adf2c
Fresh install, unlike the homelab's adoption of a running Vault, so there is no live state to diff against. nameOverride pins the release to "vault" in namespace "vault" because Terraform's Workload Identity binding names that exact pair; a different release name renames the service account and leaves Vault sealed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
73 lines
2.6 KiB
YAML
73 lines
2.6 KiB
YAML
# GKE counterpart of incubator-infra-k8s-admin-prd-ase1-values.yaml. Starts
|
|
# with only the three components installed by hand at bootstrap; every
|
|
# other homelab component is added here as it is ported, each with its own
|
|
# helm-overrides/gke-toolshed-prd-usc1/<name>/custom-values.yaml.
|
|
clusterSpec:
|
|
destination:
|
|
server: ""
|
|
name: "in-cluster"
|
|
|
|
argocdSpec:
|
|
namespace: argocd
|
|
|
|
teamSpec:
|
|
devops:
|
|
source:
|
|
# Cluster DNS, not an Ingress: ArgoCD must be able to read this before
|
|
# Contour exists, because Contour is itself one of these Applications.
|
|
repoURL: http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/devops-infra-helm-charts-gcp.git
|
|
targetRevision: main
|
|
path: helm-templates
|
|
valueFiles: ../../helm-overrides/gke-toolshed-prd-usc1
|
|
labels:
|
|
bu: infra
|
|
team: devops
|
|
env: prd
|
|
cluster: gke-toolshed-prd-usc1
|
|
|
|
# nameOverride on every entry must equal the Helm release name used for the
|
|
# manual bootstrap install. ArgoCD uses the Application name as the release
|
|
# name, so a mismatch renders a second copy instead of adopting the first.
|
|
appSpec:
|
|
- name: argocd
|
|
nameOverride: argocd-admin-prd
|
|
namespace: argocd
|
|
chartDir: argo-cd
|
|
valuesDir: argocd-admin-prd
|
|
- name: gitea
|
|
nameOverride: gitea
|
|
namespace: gitea
|
|
chartDir: gitea
|
|
valuesDir: gitea
|
|
- name: contour
|
|
# The cluster's only inbound path, pinned to the reserved IP that every
|
|
# nip.io hostname is built from. Installed by ArgoCD rather than by
|
|
# hand, which is only possible because nothing in the bootstrap needed
|
|
# an ingress: ArgoCD reaches Gitea over cluster DNS.
|
|
nameOverride: contour
|
|
namespace: projectcontour
|
|
chartDir: contour
|
|
valuesDir: contour
|
|
# Contour's HTTPProxy CRD embeds a large schema, same 256KiB
|
|
# last-applied-configuration problem as cert-manager's.
|
|
serverSideApply: true
|
|
- name: vault
|
|
# Fresh install here, unlike the homelab's adoption of a running Vault.
|
|
# nameOverride pinned so the release is "vault" in namespace "vault":
|
|
# the Workload Identity binding Terraform created names that exact
|
|
# namespace/serviceaccount pair, and a different release name renames
|
|
# the service account, which leaves Vault unable to reach KMS and
|
|
# therefore sealed.
|
|
nameOverride: vault
|
|
namespace: vault
|
|
chartDir: vault
|
|
valuesDir: vault
|
|
- name: cert-manager
|
|
nameOverride: cert-manager
|
|
namespace: cert-manager
|
|
chartDir: cert-manager
|
|
valuesDir: cert-manager
|
|
# cert-manager's CRDs embed large OpenAPI schemas; SSA avoids the
|
|
# 256KiB last-applied-configuration limit, same as external-secrets.
|
|
serverSideApply: true
|