devops-infra-argo-config-gcp/values/incubator-infra-gke-toolshed-prd-usc1-values.yaml

# GKE counterpart of incubator-infra-k8s-admin-prd-ase1-values.yaml. Starts
# with only the three components installed by hand at bootstrap; every
# other homelab component is added here as it is ported, each with its own
# helm-overrides/gke-toolshed-prd-usc1/<name>/custom-values.yaml.
clusterSpec:
  destination:
    server: ""
    name: "in-cluster"

argocdSpec:
  namespace: argocd

teamSpec:
  devops:
    source:
      # Cluster DNS, not an Ingress: ArgoCD must be able to read this before
      # Contour exists, because Contour is itself one of these Applications.
      repoURL: http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/devops-infra-helm-charts-gcp.git
      targetRevision: main
      path: helm-templates
      valueFiles: ../../helm-overrides/gke-toolshed-prd-usc1
    labels:
      bu: infra
      team: devops
      env: prd
      cluster: gke-toolshed-prd-usc1

# nameOverride on every entry must equal the Helm release name used for the
# manual bootstrap install. ArgoCD uses the Application name as the release
# name, so a mismatch renders a second copy instead of adopting the first.
appSpec:
  - name: argocd
    nameOverride: argocd-admin-prd
    namespace: argocd
    chartDir: argo-cd
    valuesDir: argocd-admin-prd
    # Argo CD v3's own CRDs (applications, applicationsets, appprojects)
    # embed large schemas, past the 256KiB last-applied-configuration limit
    # a client-side apply writes — the same reason cert-manager and
    # external-secrets use this.
    serverSideApply: true
    # And therefore the same stale-schema diff problem: see the contour
    # entry. Once the upgrade lands, Argo CD's schema matches this cluster
    # and this becomes belt-and-braces rather than load-bearing.
    compareOptions:
      - ServerSideDiff=true
  - name: gitea
    nameOverride: gitea
    namespace: gitea
    chartDir: gitea
    valuesDir: gitea
  - name: contour
    # The cluster's only inbound path, pinned to the reserved IP that every
    # nip.io hostname is built from. Installed by ArgoCD rather than by
    # hand, which is only possible because nothing in the bootstrap needed
    # an ingress: ArgoCD reaches Gitea over cluster DNS.
    nameOverride: contour
    namespace: projectcontour
    chartDir: contour
    valuesDir: contour
    # Contour's HTTPProxy CRD embeds a large schema, same 256KiB
    # last-applied-configuration problem as cert-manager's.
    serverSideApply: true
    # Required alongside serverSideApply on this cluster. That sync option
    # makes Argo CD compute the diff with the Kubernetes schema compiled
    # into its own binary, and Argo CD v2.13 predates this cluster: live
    # Deployments here carry status.terminatingReplicas, beta and enabled by
    # default since Kubernetes 1.33, which that schema has never heard of.
    # The diff then aborts with "field not declared in schema" and the app
    # can neither be compared nor synced. ServerSideDiff hands the diff to
    # the API server, which necessarily knows its own fields.
    #
    # This is a workaround for an out-of-date Argo CD, not a fix. The fix is
    # upgrading Argo CD to a build whose schema matches the cluster.
    compareOptions:
      - ServerSideDiff=true
  - name: vault
    # Fresh install here, unlike the homelab's adoption of a running Vault.
    # nameOverride pinned so the release is "vault" in namespace "vault":
    # the Workload Identity binding Terraform created names that exact
    # namespace/serviceaccount pair, and a different release name renames
    # the service account, which leaves Vault unable to reach KMS and
    # therefore sealed.
    nameOverride: vault
    namespace: vault
    chartDir: vault
    valuesDir: vault
  - name: cert-manager
    nameOverride: cert-manager
    namespace: cert-manager
    chartDir: cert-manager
    valuesDir: cert-manager
    # cert-manager's CRDs embed large OpenAPI schemas; SSA avoids the
    # 256KiB last-applied-configuration limit, same as external-secrets.
    serverSideApply: true
    # See the contour entry above: server-side apply diffs against Argo CD's
    # own bundled schema, which is older than this cluster.
    compareOptions:
      - ServerSideDiff=true
  - name: external-secrets
    # Every credential in the cluster arrives through this. nameOverride is
    # not cosmetic here: without it the release becomes
    # "external-secrets-<cluster>-<env>", which renames the controller's
    # service account — and both secretstores/vault-backend.yaml's
    # serviceAccountRef and Vault's own Kubernetes auth role are bound to
    # the plain name.
    nameOverride: external-secrets
    namespace: external-secrets
    chartDir: external-secrets
    valuesDir: external-secrets
    # ClusterSecretStore's CRD embeds a large provider schema and exceeds
    # the 256KiB annotation limit on a client-side apply.
    serverSideApply: true
    # See the contour entry above: server-side apply diffs against Argo CD's
    # own bundled schema, which is older than this cluster.
    compareOptions:
      - ServerSideDiff=true
  - name: harbor
    # Object names are all prefixed with the release name, and the pipeline
    # refers to them, so it is pinned.
    nameOverride: harbor
    namespace: harbor
    chartDir: harbor
    valuesDir: harbor
  - name: jenkins
    nameOverride: jenkins
    namespace: jenkins
    chartDir: jenkins
    valuesDir: jenkins
  - name: postgresql
    # Backs toolshed's control plane. Own namespace so it is addressed over
    # cluster DNS like any other platform component and outlives whatever
    # consumes it: postgresql.postgres.svc.cluster.local:5432
    nameOverride: postgresql
    namespace: postgres
    chartDir: postgresql
    valuesDir: postgresql
  - name: redis
    # Backs toolshed's managed cache add-on, same namespace reasoning as
    # postgresql: redis.redis.svc.cluster.local:6379
    nameOverride: redis
    namespace: redis
    chartDir: redis
    valuesDir: redis
  - name: victoria-metrics-single
    # Pinned name, because the chart renders its Service as
    # <release>-server and both vmagent's remote write and Grafana's
    # datasource address it at
    # victoria-metrics-single-server.monitoring.svc.cluster.local:8428
    nameOverride: victoria-metrics-single
    namespace: monitoring
    chartDir: victoria-metrics-single
    valuesDir: victoria-metrics-single
  - name: vmagent
    # The scraper. Needs the Service above to exist, so bring it up after.
    nameOverride: vmagent
    namespace: monitoring
    chartDir: vmagent
    valuesDir: vmagent
  - name: node-exporter
    nameOverride: node-exporter
    namespace: monitoring
    chartDir: node-exporter
    valuesDir: node-exporter
  - name: grafana
    # Requires secretstores/grafana-admin-credentials.yaml to have synced
    # first: without that Secret the pod generates a random admin password
    # nobody has. It does not crash, it just cannot be logged into until
    # the Secret exists and the pod restarts.
    nameOverride: grafana
    namespace: monitoring
    chartDir: grafana
    valuesDir: grafana