refactor: one self-contained folder per platform service
Each platform/apps/<service>/ now holds its own application.yaml (multi-source: chart + values + raw-manifest extras), values.yaml, and any extra manifests (HTTPRoute, RBAC, ClusterSecretStore) together, replacing the split apps/*.yaml + manifests/*/ + separate *-config Application pattern. Root platform-app.yaml now recurses platform/apps/*/application.yaml only. Extras get a resource-level sync-wave (1) so they still land after their service's Helm chart within the same Application sync. Also adds an HTTPRoute for vault (vault.fireflylab.local) - exposed same as every other service here, accepted as LAN-only exposure.
This commit is contained in:
@@ -10,33 +10,40 @@ storage must already be up).
|
||||
|
||||
```
|
||||
Git repo (cluster-platform)
|
||||
└── ArgoCD watches platform/apps/ → syncs all Applications
|
||||
└── ArgoCD watches platform/apps/*/application.yaml (recursive) → syncs all Applications
|
||||
|
||||
platform-app.yaml ← root Application, applied once by hand (kubectl apply)
|
||||
platform/apps/ ← ArgoCD watches this path; one Application CRD per service
|
||||
manifests/ ← Helm values + raw manifests referenced by those Applications
|
||||
platform-app.yaml ← root "main" Application, applied once by hand (kubectl apply)
|
||||
platform/apps/<service>/ ← one self-contained folder per service:
|
||||
application.yaml ArgoCD Application CRD (multi-source: chart + values + extras)
|
||||
values.yaml Helm values for the upstream chart
|
||||
*.yaml any extra raw manifests (HTTPRoute, RBAC, ClusterSecretStore)
|
||||
```
|
||||
|
||||
Sync waves (no hard interdependencies between services yet — grouped for
|
||||
readability / staggered rollout):
|
||||
Each service's `application.yaml` is a single multi-source Application:
|
||||
upstream Helm chart + this repo's `values.yaml` (via `ref: values`) + a third
|
||||
source pointing at the same folder (excluding `application.yaml`/`values.yaml`)
|
||||
for any extra raw manifests. The root `platform-app.yaml` only watches
|
||||
`platform/apps/*/application.yaml` (`directory.recurse: true` + `include`
|
||||
filter) — it never touches `values.yaml` or the extras directly.
|
||||
|
||||
Ordering uses two independent layers:
|
||||
- **Application-level** `sync-wave` (on `application.yaml`'s `metadata`) —
|
||||
orders services relative to each other.
|
||||
- **Resource-level** `sync-wave` (on the extra manifests themselves, e.g.
|
||||
`httproute.yaml`) — orders a service's own extras (wave `"1"`) after its
|
||||
Helm chart's resources (implicit wave `"0"`), within the same Application.
|
||||
|
||||
| Wave | Service | Purpose |
|
||||
|------|---------|---------|
|
||||
| 0 | vault | Secrets engine (standalone, manual init/unseal) |
|
||||
| 0 | headlamp | K8s dashboard |
|
||||
| 1 | headlamp-config | ClusterRoleBinding for login token |
|
||||
| 1 | external-secrets | Vault → K8s Secret operator |
|
||||
| 1 | kube-prometheus-stack | Prometheus + Grafana + Alertmanager |
|
||||
| 1 | harbor | Image registry |
|
||||
| 2 | external-secrets-config | ClusterSecretStore wired to Vault (k8s auth) |
|
||||
| 2 | kube-prometheus-stack-config | Grafana HTTPRoute |
|
||||
| 2 | harbor-config | Harbor HTTPRoute |
|
||||
| 2 | jenkins | CI |
|
||||
| 2 | sonarqube | Code quality (embedded H2, no external Postgres) |
|
||||
| 3 | jenkins-config | Jenkins HTTPRoute |
|
||||
| 3 | sonarqube-config | SonarQube HTTPRoute |
|
||||
| 0 | vault | Secrets engine (standalone, manual init/unseal) (+ HTTPRoute, wave 1 internally) |
|
||||
| 0 | headlamp | K8s dashboard (+ RBAC for login token, wave 1 internally) |
|
||||
| 1 | external-secrets | Vault → K8s Secret operator (+ ClusterSecretStore, wave 1 internally) |
|
||||
| 1 | kube-prometheus-stack | Prometheus + Grafana + Alertmanager (+ HTTPRoute, wave 1 internally) |
|
||||
| 1 | harbor | Image registry (+ HTTPRoute, wave 1 internally) |
|
||||
| 2 | jenkins | CI (+ HTTPRoute, wave 1 internally) |
|
||||
| 2 | sonarqube | Code quality, embedded H2 (+ HTTPRoute, wave 1 internally) |
|
||||
|
||||
⚠️ Chart `targetRevision` pins in `platform/apps/*.yaml` are best-effort and
|
||||
⚠️ Chart `targetRevision` pins in each `application.yaml` are best-effort and
|
||||
marked `TODO: verify latest` — this session had no live access to the Helm
|
||||
repos to confirm current versions. Run `helm repo add <name> <url> && helm
|
||||
search repo <name>/<chart> --versions` before or after first sync and bump
|
||||
@@ -88,8 +95,9 @@ vault write auth/kubernetes/role/external-secrets \
|
||||
ttl=1h
|
||||
```
|
||||
|
||||
Once this is done, `external-secrets-config`'s `ClusterSecretStore` (`vault-backend`)
|
||||
should show `Valid` — check with `kubectl get clustersecretstore vault-backend -o yaml`.
|
||||
Once this is done, the `ClusterSecretStore` (`vault-backend`, part of the
|
||||
`external-secrets` Application) should show `Valid` — check with
|
||||
`kubectl get clustersecretstore vault-backend -o yaml`.
|
||||
|
||||
Per-service `ExternalSecret` resources (harbor-credentials, gitea-credentials,
|
||||
sonarqube-token, Jenkins creds) aren't created yet — that's a follow-up once
|
||||
@@ -112,7 +120,7 @@ kubectl exec -n jenkins deploy/jenkins -c jenkins -- cat /run/secrets/additional
|
||||
is set inside its own database on first boot, so it cannot be swapped via a
|
||||
`kubectl patch` the way ArgoCD's can.
|
||||
|
||||
**Headlamp login token** (ServiceAccount created by `headlamp-config`):
|
||||
**Headlamp login token** (ServiceAccount created by `headlamp/rbac.yaml`):
|
||||
|
||||
```bash
|
||||
kubectl create token headlamp-admin -n headlamp
|
||||
@@ -121,10 +129,10 @@ Paste the token into the Headlamp UI login screen.
|
||||
|
||||
### Apply HTTPRoutes note
|
||||
|
||||
Each `*-config` Application creates its own HTTPRoute (unlike
|
||||
`cluster-bootstrap`'s ArgoCD route, which had to be applied by hand to avoid
|
||||
a chicken-and-egg problem before Envoy existed) — Envoy Gateway is already up
|
||||
by the time this repo syncs, so these are fully GitOps/auto-synced.
|
||||
Each service creates its own HTTPRoute as part of the same Application
|
||||
(unlike `cluster-bootstrap`'s ArgoCD route, which had to be applied by hand to
|
||||
avoid a chicken-and-egg problem before Envoy existed) — Envoy Gateway is
|
||||
already up by the time this repo syncs, so these are fully GitOps/auto-synced.
|
||||
|
||||
Backend service names in each `httproute.yaml` are best-effort based on each
|
||||
chart's naming convention and marked with a `verify with: kubectl get svc`
|
||||
@@ -134,11 +142,16 @@ comment — confirm and adjust if a route doesn't resolve.
|
||||
|
||||
| Service | Hostname |
|
||||
|---------|----------|
|
||||
| Vault | vault.fireflylab.local |
|
||||
| Grafana | grafana.fireflylab.local |
|
||||
| Harbor | harbor.fireflylab.local |
|
||||
| Jenkins | jenkins.fireflylab.local |
|
||||
| SonarQube | sonarqube.fireflylab.local |
|
||||
|
||||
Vault and Headlamp have no HTTPRoute — Vault stays internal-only
|
||||
(`vault.vault.svc.cluster.local:8200`); Headlamp is accessed via
|
||||
`kubectl port-forward` until/unless you add a route for it.
|
||||
Headlamp has no HTTPRoute — accessed via `kubectl port-forward` until/unless
|
||||
you add a route for it.
|
||||
|
||||
⚠️ Vault's UI/API is now reachable externally via Envoy Gateway (HTTP, no TLS,
|
||||
same as every other service here). Since Vault holds secrets, consider whether
|
||||
that's acceptable for your threat model versus keeping it `kubectl
|
||||
port-forward`/internal-only.
|
||||
|
||||
Reference in New Issue
Block a user