diff --git a/README.md b/README.md index abb78c4..f6814b3 100644 --- a/README.md +++ b/README.md @@ -1,19 +1,4 @@ -# GitOps on Haven — Deployment Draft - -> **Draft only.** Nothing below is applied to the cluster yet. Diagrams are -> [Excalidraw JSON] (import at https://excalidraw.com) — static previews included -> as PNG. Create the repo before running any commands. - -## 1. Decisions - -| Decision | Value | Why | -|---|---|---| -| Tool | **Argo CD** | Best UI (app dependency graph, live-vs-git diff, rollback). Flux's UI (Weave GitOps) is stalled post-Weaveworks; community alternative is Capacitor. | -| Git remote | **Gitea** `git.ivanch.me/ivanch/haven` | Repo you'll create. Gitea is a first-class Argo CD source. | -| Layout | **App-of-apps** | A single root Argo `Application` watches a folder of app manifests; each app manifests as a child `Application`. One place to add/remove apps. | -| Secrets | **No change.** Keep raw env in manifests initially, migrate to ESO/Vaultwarden later. | Argo CD can't write Secret contents itself — value must live in git or come from a controller. Never commit real secrets. | -| Access | Ingress `argocd.haven`, internal-only (nginx class, **no TLS/cert-manager**) + admin password via kubectl | Matches your internal-app convention (`notepad`, `openwebui`, etc.). | -| Repo structure | **New `gitops` repo** (clean, standalone). Your current spec folder stays untouched — migrate later if desired. | Avoids mixing with the `haven` folder used by Gitea Actions CI. | +# Haven ## 2. Repo layout (`gitops/`) @@ -31,94 +16,3 @@ gitops/ │ ├── .yaml # all-in-one manifest per app │ └── .yaml ``` - -To add a new app: simply drop `.yaml` into the appropriate `apps//` folder. The ApplicationSet automatically generates an Argo CD Application for it. - -## 3. Manual bootstrap (run once, by hand) - -```bash -# Install Argo CD — declarative kustomize install (no Helm CLI, no curl pipes). -# Renders 59 resources from the official argo-cd manifests repo, pinned via ?ref= -kubectl.exe --kubeconfig=C:\Users\ivanch\.kube\config apply -k bootstrap/argocd-install -# retrieve the initial admin password -kubectl.exe --kubeconfig=C:\Users\ivanch\.kube\config -n argocd get secret argocd-initial-admin-secret \ - -o jsonpath='{.data.password}' | base64 -d -# one-time: point the root app at Gitea (requires the repo to exist first) -kubectl.exe --kubeconfig=C:\Users\ivanch\.kube\config apply -f bootstrap/root-app.yaml -``` - -Version pinning: `?ref=stable` in `bootstrap/argocd-install/kustomization.yaml` -tracks the stable branch; pin a tag (`?ref=v3.1.0`) once settled. Component -customization goes through `patches:` in that same kustomization (example -commented in the file), not by editing rendered output. - -After that, **every** change is: `git push` → Argo syncs. kubectl only for debugging. - -## 4. Key manifests - -**`bootstrap/root-app.yaml`** -```yaml -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: root - namespace: argocd - finalizers: [resources-finalizer.argocd.argoproj.io] -spec: - project: default - source: - repoURL: https://git.ivanch.me/ivanch/haven.git - targetRevision: main - path: apps/root - destination: - server: https://kubernetes.default.svc - namespace: argocd - syncPolicy: - automated: - prune: true - selfHeal: true -``` - -**`apps/root/applicationset.yaml`** — Uses the Git Files generator to discover any `apps/*/*.yaml` file and automatically generate an Argo CD `Application` pointing directly to that app file within the respective namespace. - -## 5. Ingress (internal-only, per Haven convention) - -```yaml -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: argocd-server - namespace: argocd -spec: - ingressClassName: nginx - rules: - - host: argocd.haven - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: argocd-server - port: { number: 80 } -``` - -## 6. Diagrams (Excalidraw JSON) - -Two diagrams are included as `.excalidraw` files — open https://excalidraw.com -and drop the file onto the canvas to view/edit: - -- `excalidraw/haven-gitops-flow.excalidraw` — the flow: git push → Gitea → - Argo CD → k3s, with Gitea Actions CI reduced to image build/push only. -- `excalidraw/haven-gitops-tree.excalidraw` — the app-of-apps tree: root app → - child Applications (notepad, openwebui, paperless, vaultwarden, argocd itself, - and infra deferred to a later phase). - -## 7. Migration plan - -Phase 0 (this draft) → Phase 1: install Argo CD + root app, convert 1 pilot app -(suggest `notepad` — simple, stateless-ish, single PVC) → Phase 2: onboard the -rest of `default` ns → Phase 3: infra components (ingress-nginx, cert-manager, -ESO) — do these **last**; they're the ones that can break the cluster if a sync -goes wrong → Phase 4: delete the old `haven` spec folder once Argo is the source -of truth. diff --git a/apps/cronjobs/renovatebot.yaml b/apps/cronjobs/renovatebot.yaml new file mode 100644 index 0000000..13dcaf9 --- /dev/null +++ b/apps/cronjobs/renovatebot.yaml @@ -0,0 +1,39 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: renovate + namespace: cronjobs +spec: + schedule: "0 12 * * 0" # every Sunday 12:00 + concurrencyPolicy: Forbid + jobTemplate: + spec: + template: + spec: + containers: + - name: renovate + image: renovate/renovate:44.39.3 + args: + - ivanch/haven-ops + env: + - name: LOG_LEVEL + value: debug + - name: RENOVATE_AUTODISCOVER + value: "false" + - name: RENOVATE_PLATFORM + value: "gitea" + - name: RENOVATE_ENDPOINT + value: "https://git.ivanch.me" + - name: RENOVATE_GIT_AUTHOR + value: "Renovate Bot " + - name: RENOVATE_TOKEN + valueFrom: + secretKeyRef: + name: renovate-bot + key: RENOVATE_TOKEN + - name: RENOVATE_GITHUB_COM_TOKEN + valueFrom: + secretKeyRef: + name: renovate-bot + key: RENOVATE_GITHUB_COM_TOKEN + restartPolicy: Never diff --git a/tools/validate_all.sh b/tools/validate_all.sh deleted file mode 100644 index 0af6b9d..0000000 --- a/tools/validate_all.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/bin/bash -# Dry-run validate every app manifest in apps/default/ against live cluster -export KUBECONFIG="C:\\Users\\ivanch\\.kube\\config" -cd "C:/Users/ivanch/Desktop/gitops-draft" || exit 1 -fail=0 -for f in apps/default/*.yaml; do - out=$(kubectl.exe apply --dry-run=server -f "$f" 2>&1) - if echo "$out" | grep -qi "error"; then - echo "FAIL: $f" - echo "$out" | grep -i error | head -2 - fail=1 - else - echo "OK: $f" - fi -done -[ $fail -eq 0 ] && echo "ALL apps/default dry-runs clean" -exit $fail