adding renovatebot
This commit is contained in:
@@ -1,19 +1,4 @@
|
||||
# GitOps on Haven — Deployment Draft
|
||||
|
||||
> **Draft only.** Nothing below is applied to the cluster yet. Diagrams are
|
||||
> [Excalidraw JSON] (import at https://excalidraw.com) — static previews included
|
||||
> as PNG. Create the repo before running any commands.
|
||||
|
||||
## 1. Decisions
|
||||
|
||||
| Decision | Value | Why |
|
||||
|---|---|---|
|
||||
| Tool | **Argo CD** | Best UI (app dependency graph, live-vs-git diff, rollback). Flux's UI (Weave GitOps) is stalled post-Weaveworks; community alternative is Capacitor. |
|
||||
| Git remote | **Gitea** `git.ivanch.me/ivanch/haven` | Repo you'll create. Gitea is a first-class Argo CD source. |
|
||||
| Layout | **App-of-apps** | A single root Argo `Application` watches a folder of app manifests; each app manifests as a child `Application`. One place to add/remove apps. |
|
||||
| Secrets | **No change.** Keep raw env in manifests initially, migrate to ESO/Vaultwarden later. | Argo CD can't write Secret contents itself — value must live in git or come from a controller. Never commit real secrets. |
|
||||
| Access | Ingress `argocd.haven`, internal-only (nginx class, **no TLS/cert-manager**) + admin password via kubectl | Matches your internal-app convention (`notepad`, `openwebui`, etc.). |
|
||||
| Repo structure | **New `gitops` repo** (clean, standalone). Your current spec folder stays untouched — migrate later if desired. | Avoids mixing with the `haven` folder used by Gitea Actions CI. |
|
||||
# Haven
|
||||
|
||||
## 2. Repo layout (`gitops/`)
|
||||
|
||||
@@ -31,94 +16,3 @@ gitops/
|
||||
│ ├── <app-1>.yaml # all-in-one manifest per app
|
||||
│ └── <app-2>.yaml
|
||||
```
|
||||
|
||||
To add a new app: simply drop `<app>.yaml` into the appropriate `apps/<namespace>/` folder. The ApplicationSet automatically generates an Argo CD Application for it.
|
||||
|
||||
## 3. Manual bootstrap (run once, by hand)
|
||||
|
||||
```bash
|
||||
# Install Argo CD — declarative kustomize install (no Helm CLI, no curl pipes).
|
||||
# Renders 59 resources from the official argo-cd manifests repo, pinned via ?ref=
|
||||
kubectl.exe --kubeconfig=C:\Users\ivanch\.kube\config apply -k bootstrap/argocd-install
|
||||
# retrieve the initial admin password
|
||||
kubectl.exe --kubeconfig=C:\Users\ivanch\.kube\config -n argocd get secret argocd-initial-admin-secret \
|
||||
-o jsonpath='{.data.password}' | base64 -d
|
||||
# one-time: point the root app at Gitea (requires the repo to exist first)
|
||||
kubectl.exe --kubeconfig=C:\Users\ivanch\.kube\config apply -f bootstrap/root-app.yaml
|
||||
```
|
||||
|
||||
Version pinning: `?ref=stable` in `bootstrap/argocd-install/kustomization.yaml`
|
||||
tracks the stable branch; pin a tag (`?ref=v3.1.0`) once settled. Component
|
||||
customization goes through `patches:` in that same kustomization (example
|
||||
commented in the file), not by editing rendered output.
|
||||
|
||||
After that, **every** change is: `git push` → Argo syncs. kubectl only for debugging.
|
||||
|
||||
## 4. Key manifests
|
||||
|
||||
**`bootstrap/root-app.yaml`**
|
||||
```yaml
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: root
|
||||
namespace: argocd
|
||||
finalizers: [resources-finalizer.argocd.argoproj.io]
|
||||
spec:
|
||||
project: default
|
||||
source:
|
||||
repoURL: https://git.ivanch.me/ivanch/haven.git
|
||||
targetRevision: main
|
||||
path: apps/root
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: argocd
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: true
|
||||
selfHeal: true
|
||||
```
|
||||
|
||||
**`apps/root/applicationset.yaml`** — Uses the Git Files generator to discover any `apps/*/*.yaml` file and automatically generate an Argo CD `Application` pointing directly to that app file within the respective namespace.
|
||||
|
||||
## 5. Ingress (internal-only, per Haven convention)
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: argocd.haven
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: argocd-server
|
||||
port: { number: 80 }
|
||||
```
|
||||
|
||||
## 6. Diagrams (Excalidraw JSON)
|
||||
|
||||
Two diagrams are included as `.excalidraw` files — open https://excalidraw.com
|
||||
and drop the file onto the canvas to view/edit:
|
||||
|
||||
- `excalidraw/haven-gitops-flow.excalidraw` — the flow: git push → Gitea →
|
||||
Argo CD → k3s, with Gitea Actions CI reduced to image build/push only.
|
||||
- `excalidraw/haven-gitops-tree.excalidraw` — the app-of-apps tree: root app →
|
||||
child Applications (notepad, openwebui, paperless, vaultwarden, argocd itself,
|
||||
and infra deferred to a later phase).
|
||||
|
||||
## 7. Migration plan
|
||||
|
||||
Phase 0 (this draft) → Phase 1: install Argo CD + root app, convert 1 pilot app
|
||||
(suggest `notepad` — simple, stateless-ish, single PVC) → Phase 2: onboard the
|
||||
rest of `default` ns → Phase 3: infra components (ingress-nginx, cert-manager,
|
||||
ESO) — do these **last**; they're the ones that can break the cluster if a sync
|
||||
goes wrong → Phase 4: delete the old `haven` spec folder once Argo is the source
|
||||
of truth.
|
||||
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: renovate
|
||||
namespace: cronjobs
|
||||
spec:
|
||||
schedule: "0 12 * * 0" # every Sunday 12:00
|
||||
concurrencyPolicy: Forbid
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: renovate
|
||||
image: renovate/renovate:44.39.3
|
||||
args:
|
||||
- ivanch/haven-ops
|
||||
env:
|
||||
- name: LOG_LEVEL
|
||||
value: debug
|
||||
- name: RENOVATE_AUTODISCOVER
|
||||
value: "false"
|
||||
- name: RENOVATE_PLATFORM
|
||||
value: "gitea"
|
||||
- name: RENOVATE_ENDPOINT
|
||||
value: "https://git.ivanch.me"
|
||||
- name: RENOVATE_GIT_AUTHOR
|
||||
value: "Renovate Bot <bot@renovateapp.com>"
|
||||
- name: RENOVATE_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: renovate-bot
|
||||
key: RENOVATE_TOKEN
|
||||
- name: RENOVATE_GITHUB_COM_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: renovate-bot
|
||||
key: RENOVATE_GITHUB_COM_TOKEN
|
||||
restartPolicy: Never
|
||||
@@ -1,17 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Dry-run validate every app manifest in apps/default/ against live cluster
|
||||
export KUBECONFIG="C:\\Users\\ivanch\\.kube\\config"
|
||||
cd "C:/Users/ivanch/Desktop/gitops-draft" || exit 1
|
||||
fail=0
|
||||
for f in apps/default/*.yaml; do
|
||||
out=$(kubectl.exe apply --dry-run=server -f "$f" 2>&1)
|
||||
if echo "$out" | grep -qi "error"; then
|
||||
echo "FAIL: $f"
|
||||
echo "$out" | grep -i error | head -2
|
||||
fail=1
|
||||
else
|
||||
echo "OK: $f"
|
||||
fi
|
||||
done
|
||||
[ $fail -eq 0 ] && echo "ALL apps/default dry-runs clean"
|
||||
exit $fail
|
||||
Reference in New Issue
Block a user