Mukul SharmaandClaude Opus 5
f83cedca65
Ports the rest of the homelab's stack: external-secrets, harbor, jenkins, postgresql, redis, victoria-metrics-single, vmagent, node-exporter and grafana. All nine verified with helm template. Most are the homelab's values with storage moved from local-path to standard-rwo and hostnames rebuilt on the reserved ingress IP. vmagent and node-exporter are unchanged outright — everything in them is addressed by cluster DNS, namespace or container port, none of which differs here. Harbor is the substantial one. The homelab serves it over plain HTTP and makes containerd accept that by hand-editing hosts.toml on the node; GKE nodes are managed and replaced, so that edit cannot survive. Instead the node pool was told at creation to trust a private CA for exactly this hostname, and cert-manager now signs Harbor's certificate from that same CA via an ingress-shim annotation. certSource is "secret" rather than the chart's "auto", which would self-sign a certificate nothing trusts. externalURL moves to https to match, since Harbor hands that URL to docker clients and a mismatch surfaces as registry errors. Jenkins drops secondaryingress, which exists in the homelab only to serve its Tailscale hostname. Its plugin pins are carried over deliberately: each fixes a failure whose symptom points somewhere else, above all the kubernetes/kubernetes-client-api pairing, without which agents never come online and builds hang at "Still waiting to schedule task". Postgres and Redis keep the homelab's deliberately small memory settings. Those were chosen for an 8GB node under pressure, and while this cluster has room, a bigger cache buys nothing for a handful of small tools. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
79 lines
2.9 KiB
YAML
79 lines
2.9 KiB
YAML
jenkins:
|
|
# GKE counterpart of helm-overrides/k8s-admin-prd-ase1/jenkins, same chart
|
|
# (5.8.58). Dynamic Kubernetes build agents, so idle cost is the
|
|
# controller alone.
|
|
#
|
|
# Every plugin pin below is carried over deliberately, not copied
|
|
# blindly — each one fixes a failure that is not obvious from its symptom.
|
|
# See the homelab file for the full history.
|
|
|
|
controller:
|
|
image:
|
|
# The chart's own default plugin list requires core >= 2.504.3, while
|
|
# its default image tag is 2.504.2. An upstream inconsistency in the
|
|
# chart, not our configuration: bumping core is the fix, since the
|
|
# plugins involved (kubernetes above all) are what dynamic agents
|
|
# depend on.
|
|
tag: "2.504.3-jdk21"
|
|
|
|
# Helm replaces lists wholesale rather than merging, so this is the
|
|
# chart's full default list with one version corrected, plus two
|
|
# additions — not a hand-picked subset.
|
|
installPlugins:
|
|
# Pinned as a pair. kubernetes needs kubernetes-client-api >=
|
|
# 7.3.1-256.v788a_0b_787114; left unpinned it resolves to an older
|
|
# version at image-build time and every agent launch dies with
|
|
# NoSuchMethodError while constructing the client. The pods start
|
|
# fine, so it presents as builds hanging forever at "Still waiting to
|
|
# schedule task" rather than as a plugin problem.
|
|
- kubernetes:4437.v3a_18554d3f32
|
|
- kubernetes-client-api:7.3.1-256.v788a_0b_787114
|
|
- workflow-aggregator:608.v67378e9d3db_1
|
|
- git:5.7.0
|
|
# kubernetes/git/credentials need this version, though the chart's
|
|
# own default list pins an older one. Same class of upstream
|
|
# inconsistency as the image tag.
|
|
- configuration-as-code:2006.v001a_2ca_6b_574
|
|
# Not in the chart's default list at all — provides readYaml, which
|
|
# the shared library's loadConfig stage uses to parse each repo's
|
|
# config.yaml.
|
|
- pipeline-utility-steps:3.810.va_7672d206740
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
admin:
|
|
# From Vault through External Secrets, never a plaintext password
|
|
# here. Requires secretstores/jenkins-admin-credentials.yaml to have
|
|
# synced, which in turn requires the Vault path secret/jenkins/admin.
|
|
existingSecret: jenkins-admin-credentials
|
|
userKey: jenkins-admin-user
|
|
passwordKey: jenkins-admin-password
|
|
|
|
ingress:
|
|
enabled: true
|
|
hostName: "jenkins.35.238.248.203.nip.io"
|
|
ingressClassName: contour
|
|
# The homelab also enables secondaryingress, purely to serve its
|
|
# Tailscale hostname — this chart's primary ingress supports only one
|
|
# host. There is one hostname here, so it stays off.
|
|
|
|
agent:
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: standard-rwo
|
|
size: 5Gi
|