catalin/fukuops
1
0
Fork 1
Code Issues 10 Pull requests Projects 2 Releases Packages 10 Activity

feat: migrate argocd from k8s manifests to argo-helm

Browse source
This commit is contained in:
cătălin 2026-08-06 09:54:40 +02:00
commit 56a78aa73a
No known key found for this signature in database
38 changed files with 438 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.gitignore vendored
View file

@ -15,4 +15,5 @@ terraform.rc
secrets.yaml
.env
*~
*.tgz
STABILITY.md

2
k8s/argo-apps/adguard.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: adguard
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

4
k8s/argo-apps/argo.yaml
View file

@ -3,11 +3,11 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: argo
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''
namespace: argocd
namespace: argo-cd
server: https://kubernetes.default.svc
sources:
- repoURL: https://git.roboces.dev/catalin/fukuops.git

2
k8s/argo-apps/authentik.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: authentik
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/dcsi.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: democratic-csi
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/forgejo.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: forgejo
namespace: argocd
namespace: argo-cd
annotations:
argocd.argoproj.io/sync-options: Force=true,Replace=true
spec:

2
k8s/argo-apps/huesporro.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: huesoporro
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/immich.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: immich
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/kured.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: kured
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/meili.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: meili
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/miniflux.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: miniflux
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/oxicloud.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: oxicloud
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/portainer.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: portainer
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/renovate.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: renovate
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

78
k8s/argo-apps/rustical.yaml Normal file
View file

@ -0,0 +1,78 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: rustical
namespace: argo-cd
spec:
destination:
name: ''
namespace: apps-roboces
server: https://kubernetes.default.svc
sources:
- repoURL: git.roboces.dev/catalin/fukuops
chart: rustical
targetRevision: 0.1.2
helm:
valuesObject:
replicaCount: 1
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsUser: 10000
runAsGroup: 10000
capabilities:
drop:
- all
service:
type: LoadBalancer
port: 8001
ingress:
enabled: true
className: "traefik"
hosts:
- host: cal.roboces.dev
paths:
- path: /
pathType: Prefix
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 256Mi
livenessProbe:
tcpSocket:
port: 4000
initialDelaySeconds: 10
timeoutSeconds: 15
successThreshold: 1
failureThreshold: 3
periodSeconds: 10
readinessProbe:
tcpSocket:
port: 4000
initialDelaySeconds: 5
timeoutSeconds: 2
successThreshold: 1
failureThreshold: 3
periodSeconds: 10
persistence:
enabled: true
rustical:
oidc:
name: "Authentik"
issuer: "https://auth.fukurokuju.dev/application/o/rustical/"
claim_userid: "preffered_username"
scopes: '["openid", "profile", "groups"]'
allow_sign_up: "true"
frontend:
allow_password_login: "false"
secret:
existingSecretName: rustical
project: roboces
syncPolicy:
automated:
prune: true
selfHeal: true

2
k8s/argo-apps/sealed-secrets.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: sealed-secrets
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/tailscale.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: tailscale
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/vault-sm.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: vault-sm
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

2
k8s/argo-apps/vaultwarden.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: vaultwarden
namespace: argocd
namespace: argo-cd
spec:
destination:
name: ''

8
k8s/charts/rustical/Chart.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: v2
name: rustical
description: A Helm chart for Rustical
type: application
version: 0.1.2
appVersion: 0.14.1
annotations:
artifacthub.io/images: "- name: rustical\n image: ghcr.io/lennart-k/rustical:0.14.1\n"

3
k8s/charts/rustical/README.md Normal file
View file

@ -0,0 +1,3 @@
# Rustical
A Helm chart for [Rustical](https://github.com/lennart-k/rustical), an LDAP address book application.

49
k8s/charts/rustical/templates/_helpers.tpl Normal file
View file

@ -0,0 +1,49 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "rustical.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
*/}}
{{- define "rustical.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "rustical.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "rustical.labels" -}}
helm.sh/chart: {{ include "rustical.chart" . }}
{{ include "rustical.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "rustical.selectorLabels" -}}
app.kubernetes.io/name: {{ include "rustical.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}

97
k8s/charts/rustical/templates/deployment.yaml Normal file
View file

@ -0,0 +1,97 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "rustical.fullname" . }}
labels:
{{- include "rustical.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
selector:
matchLabels:
{{- include "rustical.selectorLabels" . | nindent 6 }}
strategy:
rollingUpdate:
maxSurge: 50%
maxUnavailable: 50%
type: RollingUpdate
template:
metadata:
{{- with .Values.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "rustical.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullpolicy }}
{{- if or .Values.secret.existingSecretName .Values.secret.enabled }}
envFrom:
- secretRef:
name: {{ .Values.secret.existingSecretName | default (include "rustical.fullname" .) }}
{{- end }}
env:
{{- range $key, $value := .Values.env }}
- name: {{ $key }}
value: {{ $value | quote }}
{{- end }}
{{- range $section, $items := .Values.rustical }}
{{- range $key, $value := $items }}
{{- if not (eq $value nil) }}
- name: {{ printf "RUSTICAL_%s__%s" (upper $section) (upper $key) }}
value: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
ports:
- name: http
containerPort: 4000
protocol: TCP
{{- if .Values.persistence.enabled }}
volumeMounts:
- name: data
mountPath: {{ .Values.persistence.mountPath }}
{{- end }}
livenessProbe:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.readinessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- if .Values.persistence.enabled }}
volumes:
- name: data
{{- if .Values.persistence.existingClaim }}
persistentVolumeClaim:
claimName: {{ .Values.persistence.existingClaim }}
{{- else }}
persistentVolumeClaim:
claimName: {{ include "rustical.fullname" . }}-pvc
{{- end }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
restartPolicy: Always
automountServiceAccountToken: false

39
k8s/charts/rustical/templates/ingress.yaml Normal file
View file

@ -0,0 +1,39 @@
{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ include "rustical.fullname" . }}
labels:
{{- include "rustical.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
ingressClassName: {{ .Values.ingress.className }}
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
pathType: {{ .pathType }}
backend:
service:
name: {{ include "rustical.fullname" $ }}
port:
number: {{ $.Values.service.port }}
{{- end }}
{{- end }}
{{- end }}

14
k8s/charts/rustical/templates/pvc.yaml Normal file
View file

@ -0,0 +1,14 @@
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ include "rustical.fullname" . }}-pvc
labels:
{{- include "rustical.labels" . | nindent 4 }}
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: {{ .Values.persistence.size }}
{{- end }}

13
k8s/charts/rustical/templates/secret.yaml Normal file
View file

@ -0,0 +1,13 @@
{{- if and .Values.secret.enabled (not .Values.secret.existingSecretName) -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "rustical.fullname" . }}
labels:
{{- include "rustical.labels" . | nindent 4 }}
type: Opaque
stringData:
{{- range $key, $value := .Values.secret.data }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}

15
k8s/charts/rustical/templates/service.yaml Normal file
View file

@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "rustical.fullname" . }}
labels:
{{- include "rustical.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: {{ .Values.service.targetPort }}
protocol: TCP
name: http
selector:
{{- include "rustical.selectorLabels" . | nindent 4 }}

44
k8s/charts/rustical/values.yaml Normal file
View file

@ -0,0 +1,44 @@
replicaCount: 1
image:
repository: ghcr.io/lennart-k/rustical
pullpolicy: IfNotPresent
tag: ""
imagePullSecrets: []
podAnnotations: {}
podSecurityContext: {}
securityContext: {}
service:
type: ClusterIP
port: 4000
targetPort: 4000
ingress:
enabled: false
resources: {}
livenessProbe: {}
readinessProbe: {}
autoscaling:
enabled: false
nodeSelector: {}
tolerations: []
affinity: {}
rustical: {}
secret:
enabled: false
existingSecretName: ""
data: {}
persistence:
enabled: true
existingClaim: ""
size: "1Gi"
mountPath: /var/lib/rustical/

30
k8s/helm/argo-cd/values.yaml Normal file
View file

@ -0,0 +1,30 @@
---
global:
domain: argo.fuku
configs:
params:
server.insecure: true
server:
service:
type: LoadBalancer
servicePortHttp: 8002
servicePortHttps: 8003
redis:
image:
repository: docker.io/library/redis
tag: 8.2.3-alpine
repoServer:
livenessProbe:
initialDelaySeconds: 60
periodSeconds: 30
timeoutSeconds: 10
failureThreshold: 10
readinessProbe:
initialDelaySeconds: 30
periodSeconds: 30
timeoutSeconds: 10
failureThreshold: 10

2
k8s/services/argo/appgen.yaml
View file

@ -3,7 +3,7 @@ apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: fukuops-appgen
namespace: argocd
namespace: argo-cd
finalizers:
- resources-finalizer.argocd.argoproj.io
spec:

11
k8s/services/argo/argocd-cmd-params-cm.yaml
View file

@ -1,11 +0,0 @@
---
apiVersion: v1
kind: ConfigMap
metadata:
name: argocd-cmd-params-cm
namespace: argocd
labels:
app.kubernetes.io/name: argocd-cmd-params-cm
app.kubernetes.io/part-of: argocd
data:
server.insecure: 'true'

16
k8s/services/argo/ingress-route.yaml
View file

@ -3,24 +3,16 @@ apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
name: argocd-server
namespace: argocd
namespace: argo-cd
spec:
entryPoints:
- websecure
- web
routes:
- kind: Rule
match: Host(`argo.fuku`)
priority: 10
services:
- name: argocd-server
port: 80
- kind: Rule
match: Host(`argo.fuku`) && Headers(`Content-Type`, `application/grpc`)
priority: 11
services:
- name: argocd-server
port: 80
scheme: h2c
- name: argo-cd-argocd-server
port: 8002
tls:
certResolver: default
secretName: argocd-server-tls

2
k8s/services/argo/project-fuku.yaml
View file

@ -2,7 +2,7 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
namespace: argocd
namespace: argo-cd
name: fuku
spec:
destinations:

4
k8s/services/argo/project-management.yaml
View file

@ -2,11 +2,11 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
namespace: argocd
namespace: argo-cd
name: management
spec:
destinations:
- namespace: argocd
- namespace: argo-cd
server: https://kubernetes.default.svc
- namespace: democratic-csi
server: https://kubernetes.default.svc

2
k8s/services/argo/project-roboces.yaml
View file

@ -2,7 +2,7 @@
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
namespace: argocd
namespace: argo-cd
name: roboces
spec:
destinations:

14
k8s/services/argo/repos.yaml
View file

@ -1,20 +1,10 @@
---
apiVersion: v1
kind: Secret
metadata:
name: fuku-services
namespace: argocd
labels:
argocd.argoproj.io/secret-type: repository
stringData:
url: https://gitlab.com/fukurokuju/k3s/services.git
---
apiVersion: v1
kind: Secret
metadata:
name: fukuops-repo
namespace: argocd
namespace: argo-cd
labels:
argocd.argoproj.io/secret-type: repository
stringData:
url: https://git.roboces.dev/catalin/fukuops.git
url: "https://git.roboces.dev/catalin/fukuops.git"

9
k8s/services/argo/tls-store.yaml Normal file
View file

@ -0,0 +1,9 @@
---
apiVersion: traefik.io/v1alpha1
kind: TLSStore
metadata:
name: default
namespace: argo-cd
spec:
certificates:
- secretName: argocd-server-tls

20
tofu/adguard/main.tf
View file

@ -42,20 +42,11 @@ resource "adguard_rewrite" "ireul" {
answer = "192.168.1.6"
}
resource "adguard_rewrite" "argo_1" {
resource "adguard_rewrite" "argo" {
domain = "argo.fuku"
answer = "192.168.1.31"
answer = "192.168.1.12"
}
resource "adguard_rewrite" "argo_2" {
domain = "argo.fuku"
answer = "192.168.1.32"
}
resource "adguard_rewrite" "argo_3" {
domain = "argo.fuku"
answer = "192.168.1.33"
}
resource "adguard_rewrite" "feeds" {
domain = "feeds.roboces.dev"
answer = "192.168.1.12"
@ -105,11 +96,18 @@ resource "adguard_rewrite" "pgadmin" {
domain = "pgadmin.fuku"
answer = "192.168.1.12"
}
resource "adguard_rewrite" "d1" {
domain = "d1.fuku"
answer = "192.168.1.10"
}
resource "adguard_rewrite" "d2" {
domain = "d1.fuku"
answer = "192.168.1.13"
}
resource "adguard_rewrite" "vault" {
domain = "vault.roboces.dev"
answer = "192.168.1.12"
}