Mukul SharmaandClaude Opus 5
66c30cfaf4
A new cluster directory rather than edits to k8s-admin-prd-ase1, so no homelab value is ever reused for GCP by accident. Charts are the ones already vendored here (gitea 12.7.0, argo-cd 7.7.23, cert-manager v1.20.1); only the values are new. Verified with helm template. What differs from the homelab, and why: - gitea: storageClass standard-rwo, and Recreate for a different reason than the homelab's LevelDB lock — three nodes and a ReadWriteOnce disk mean a rolling update's new pod waits forever on Multi-Attach. The admin password comes from a Secret created at bootstrap instead of the chart's published default, which would otherwise be live on a public IP. Registration is disabled and webhooks are limited to private ranges, for the same reason. - argocd: single ingress host (no Tailscale), and the homelab's Ingress health override is dropped, since Contour writes real load balancer status here. server and repoServer autoscale 1-3 on CPU; the chart omits replicas when autoscaling is on, so the HPA and ArgoCD's own self-management do not fight over the count. Memory is deliberately not a scaling metric: Go does not return memory promptly, so a memory target scales up and never back down. - cert-manager: written fresh, not copied. The homelab file was never adapted from the fleet — it pulls from a private Meesho registry and pins pods to a node pool that does not exist here. The chart's own values.yaml carries that registry too, so imageRegistry and imageNamespace are overridden back to upstream's quay.io/jetstack. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
67 lines
1.7 KiB
YAML
67 lines
1.7 KiB
YAML
# GKE values for the vendored cert-manager chart (helm-templates/cert-manager,
|
|
# v1.20.1). Written fresh rather than copied from k8s-admin-prd-ase1, whose
|
|
# file was never adapted from the fleet: it pulls images from a private
|
|
# Meesho Artifact Registry and pins pods to a "dedicated: devops" node pool
|
|
# that does not exist here.
|
|
#
|
|
# Installed once by hand with `helm install cert-manager` (namespace
|
|
# "cert-manager"), then adopted by the cert-manager Application in
|
|
# devops-infra-argo-config-gcp.
|
|
#
|
|
# Its job here is Harbor's certificate, issued from the private registry CA
|
|
# that toolshed-gke-infra's 10-infra creates and the node pool trusts. The
|
|
# CA key pair reaches the cluster as the "registry-ca" Secret in this
|
|
# namespace (kubectl, from terraform output); the ClusterIssuer that uses it
|
|
# lives with Harbor's config, not here.
|
|
# The vendored chart's own values.yaml was edited in the fleet to pull every
|
|
# image from Meesho's private Artifact Registry, which these nodes cannot
|
|
# reach. Back to upstream's registry (quay.io/jetstack/cert-manager-*).
|
|
imageRegistry: quay.io
|
|
imageNamespace: jetstack
|
|
|
|
crds:
|
|
enabled: true
|
|
# A helm uninstall must not take every Certificate in the cluster with it.
|
|
keep: true
|
|
|
|
replicaCount: 1
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 96Mi
|
|
limits:
|
|
memory: 256Mi
|
|
|
|
webhook:
|
|
replicaCount: 1
|
|
resources:
|
|
requests:
|
|
cpu: 20m
|
|
memory: 48Mi
|
|
limits:
|
|
memory: 128Mi
|
|
|
|
cainjector:
|
|
enabled: true
|
|
replicaCount: 1
|
|
resources:
|
|
requests:
|
|
cpu: 20m
|
|
memory: 96Mi
|
|
limits:
|
|
memory: 256Mi
|
|
|
|
startupapicheck:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
memory: 64Mi
|
|
|
|
prometheus:
|
|
enabled: true
|
|
servicemonitor:
|
|
enabled: false
|