Mukul Sharma
1d206444f6
demo-go-app moved from ArgoCD's default project to the new webapp project (devops-argo-config#7de2f8b). ArgoCD RBAC is keyed <project>/<app-name>, so the jenkins-ci sync/get policy has to move with it or syncArgoApp's scoped token starts getting silent 403s on its next sync.
119 lines
4.2 KiB
YAML
119 lines
4.2 KiB
YAML
argo-cd:
|
|
global:
|
|
image:
|
|
tag: "v2.13.8"
|
|
|
|
# Single-node homelab VM (8GB RAM / 6 cores, see claude.md) — no dedicated
|
|
# devops node pool here, so the GKE nodeSelector/toleration pair from the
|
|
# fleet's admin cluster doesn't apply. Every component below is trimmed to
|
|
# a single replica with small resource requests to fit the ~700MB total
|
|
# budget claude.md tracks for ArgoCD.
|
|
|
|
# SSO deferred per claude.md ("not yet implemented") — Dex stays off until
|
|
# that's picked back up. Revisit this file when it is.
|
|
dex:
|
|
enabled: false
|
|
|
|
controller:
|
|
replicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 400Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 768Mi
|
|
|
|
redis-ha:
|
|
enabled: false
|
|
redis:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
|
|
repoServer:
|
|
replicas: 1
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 300m
|
|
memory: 512Mi
|
|
|
|
server:
|
|
replicas: 1
|
|
extraArgs:
|
|
- --insecure
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: contour
|
|
hostname: "argocd.192.168.1.7.nip.io"
|
|
# Tailscale nip.io variant, same dual-host pattern as Gitea — chart
|
|
# supports this natively via extraHosts (confirmed against the real
|
|
# values.yaml, not assumed).
|
|
extraHosts:
|
|
- name: "argocd.100.90.248.118.nip.io"
|
|
path: /
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
|
|
# Not used by this repo's Applications (plain Application manifests
|
|
# rendered by generic-argo-apps-chart, not the ApplicationSet CRD) and
|
|
# notifications has no configured trigger/service — both off to save RAM.
|
|
applicationSet:
|
|
enabled: false
|
|
notifications:
|
|
enabled: false
|
|
|
|
configs:
|
|
cm:
|
|
url: "https://argocd.192.168.1.7.nip.io"
|
|
timeout.reconciliation: 3m
|
|
timeout.reconciliation.jitter: 60s
|
|
# ArgoCD's built-in Ingress health check waits for
|
|
# status.loadBalancer.ingress to be populated — that only happens
|
|
# behind a Service type=LoadBalancer. Contour here is exposed via
|
|
# hostPort (MetalLB is installed but not load-bearing, see
|
|
# claude.md), so nothing ever writes that status field and every
|
|
# Ingress sits "Progressing" forever even though it's actually
|
|
# serving traffic fine. Override: an Ingress existing is enough.
|
|
resource.customizations.health.networking.k8s.io_Ingress: |
|
|
hs = {}
|
|
hs.status = "Healthy"
|
|
hs.message = "Ingress considered healthy on sight — this cluster's Contour has no LoadBalancer status to wait on (hostPort, not MetalLB)."
|
|
return hs
|
|
# Scoped account for Jenkins to trigger a sync as the last step of the
|
|
# CI/CD pipeline — devops-lib's real deployArgoCD.groovy always closes
|
|
# its 4-step ceremony with `argocd app sync --hard-refresh`; without
|
|
# this, our pipeline stops at the tag-bump commit and a human has to
|
|
# remember to click Sync. Uses apiKey auth (token-based), not the
|
|
# admin account — same least-privilege pattern as Harbor's robot
|
|
# account. Token itself is generated via CLI (not declarative — see
|
|
# bootstrap note in devops-lib's syncArgoApp.groovy) and stored in
|
|
# Vault like every other credential here.
|
|
accounts.jenkins-ci: apiKey
|
|
accounts.jenkins-ci.enabled: "true"
|
|
# No custom RBAC policy beyond the jenkins-ci account below: single-user
|
|
# homelab, the initial admin secret (kubectl -n argocd get secret
|
|
# argocd-initial-admin-secret) is enough for you. The fleet's
|
|
# role:admins / role:backend / GitHub-team policy.csv and real teammate
|
|
# emails from the source cluster are dropped here.
|
|
rbac:
|
|
policy.csv: |
|
|
p, jenkins-ci, applications, sync, webapp/demo-go-app, allow
|
|
p, jenkins-ci, applications, get, webapp/demo-go-app, allow
|
|
repositories:
|
|
devops-infra-helm-charts:
|
|
url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-helm-charts.git
|
|
devops-infra-argo-config:
|
|
url: http://gitea.192.168.1.7.nip.io/mukul/devops-infra-argo-config.git
|