refactor: one self-contained folder per platform service

Each platform/apps/<service>/ now holds its own application.yaml
(multi-source: chart + values + raw-manifest extras), values.yaml, and
any extra manifests (HTTPRoute, RBAC, ClusterSecretStore) together,
replacing the split apps/*.yaml + manifests/*/ + separate *-config
Application pattern.

Root platform-app.yaml now recurses platform/apps/*/application.yaml
only. Extras get a resource-level sync-wave (1) so they still land
after their service's Helm chart within the same Application sync.

Also adds an HTTPRoute for vault (vault.fireflylab.local) - exposed
same as every other service here, accepted as LAN-only exposure.

platform/apps/external-secrets-config.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: external-secrets-config
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
-    targetRevision: main
-    path: manifests/external-secrets-config
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: external-secrets
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - SkipDryRunOnMissingResource=true

platform/apps/external-secrets/application.yaml

@@ -13,10 +13,15 @@ spec:
       targetRevision: "0.10.0"  # TODO: verify latest via `helm search repo external-secrets/external-secrets --versions`
       helm:
         valueFiles:
-          - $values/manifests/external-secrets/values.yaml
+          - $values/platform/apps/external-secrets/values.yaml
     - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
       targetRevision: main
       ref: values
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
+      targetRevision: main
+      path: platform/apps/external-secrets
+      directory:
+        exclude: "{application.yaml,values.yaml}"
   destination:
     server: https://kubernetes.default.svc
     namespace: external-secrets
@@ -27,3 +32,4 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
+      - SkipDryRunOnMissingResource=true

platform/apps/external-secrets/clustersecretstore.yaml

@@ -0,0 +1,19 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: vault-backend
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  provider:
+    vault:
+      server: "http://vault.vault.svc.cluster.local:8200"
+      path: kv
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets
+          serviceAccountRef:
+            name: external-secrets-vault-auth
+            namespace: external-secrets

platform/apps/external-secrets/serviceaccount.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-secrets-vault-auth
+  namespace: external-secrets
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"

platform/apps/external-secrets/values.yaml

@@ -0,0 +1 @@
+installCRDs: true

platform/apps/harbor-config.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: harbor-config
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
-    targetRevision: main
-    path: manifests/harbor-config
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: harbor
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - SkipDryRunOnMissingResource=true

platform/apps/harbor/application.yaml

@@ -13,10 +13,15 @@ spec:
       targetRevision: "1.16.0"  # TODO: verify latest via `helm search repo harbor/harbor --versions`
       helm:
         valueFiles:
-          - $values/manifests/harbor/values.yaml
+          - $values/platform/apps/harbor/values.yaml
     - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
       targetRevision: main
       ref: values
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
+      targetRevision: main
+      path: platform/apps/harbor
+      directory:
+        exclude: "{application.yaml,values.yaml}"
   destination:
     server: https://kubernetes.default.svc
     namespace: harbor
@@ -26,3 +31,4 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+      - SkipDryRunOnMissingResource=true

platform/apps/harbor/httproute.yaml

@@ -0,0 +1,22 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: harbor
+  namespace: harbor
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "harbor.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        # verify with: kubectl get svc -n harbor  (nginx frontend, combines portal+core+registry)
+        - name: harbor-nginx
+          port: 80

platform/apps/harbor/values.yaml

@@ -0,0 +1,30 @@
+expose:
+  type: clusterIP
+  tls:
+    enabled: false
+
+externalURL: http://harbor.fireflylab.local
+
+persistence:
+  imageChartStorage:
+    disableRedirect: true
+    type: filesystem
+    filesystem:
+      rootdirectory: /storage
+  persistentVolumeClaim:
+    registry:
+      storageClass: nfs-delete
+      size: 50Gi
+    jobservice:
+      jobLog:
+        storageClass: nfs-delete
+        size: 5Gi
+    database:
+      storageClass: nfs-delete
+      size: 5Gi
+    redis:
+      storageClass: nfs-delete
+      size: 2Gi
+    trivy:
+      storageClass: nfs-delete
+      size: 5Gi

platform/apps/headlamp-config.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: headlamp-config
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
-    targetRevision: main
-    path: manifests/headlamp-config
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: headlamp
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - SkipDryRunOnMissingResource=true

platform/apps/headlamp/application.yaml

@@ -13,10 +13,15 @@ spec:
       targetRevision: "0.31.0"  # TODO: verify latest via `helm search repo headlamp/headlamp --versions`
       helm:
         valueFiles:
-          - $values/manifests/headlamp/values.yaml
+          - $values/platform/apps/headlamp/values.yaml
     - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
       targetRevision: main
       ref: values
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
+      targetRevision: main
+      path: platform/apps/headlamp
+      directory:
+        exclude: "{application.yaml,values.yaml}"
   destination:
     server: https://kubernetes.default.svc
     namespace: headlamp
@@ -26,3 +31,4 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+      - SkipDryRunOnMissingResource=true

platform/apps/headlamp/rbac.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: headlamp-admin
+  namespace: headlamp
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: headlamp-admin
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: headlamp-admin
+    namespace: headlamp

platform/apps/headlamp/values.yaml

@@ -0,0 +1,2 @@
+service:
+  type: ClusterIP

platform/apps/jenkins-config.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: jenkins-config
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
-    targetRevision: main
-    path: manifests/jenkins-config
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: jenkins
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - SkipDryRunOnMissingResource=true

platform/apps/jenkins/application.yaml

@@ -13,10 +13,15 @@ spec:
       targetRevision: "5.8.0"  # TODO: verify latest via `helm search repo jenkins/jenkins --versions`
       helm:
         valueFiles:
-          - $values/manifests/jenkins/values.yaml
+          - $values/platform/apps/jenkins/values.yaml
     - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
       targetRevision: main
       ref: values
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
+      targetRevision: main
+      path: platform/apps/jenkins
+      directory:
+        exclude: "{application.yaml,values.yaml}"
   destination:
     server: https://kubernetes.default.svc
     namespace: jenkins
@@ -26,3 +31,4 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+      - SkipDryRunOnMissingResource=true

platform/apps/jenkins/httproute.yaml

@@ -0,0 +1,22 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jenkins
+  namespace: jenkins
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "jenkins.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        # verify with: kubectl get svc -n jenkins
+        - name: jenkins
+          port: 8080

platform/apps/jenkins/values.yaml

@@ -0,0 +1,14 @@
+controller:
+  serviceType: ClusterIP
+  persistence:
+    storageClass: nfs-delete
+    size: 20Gi
+  resources:
+    requests:
+      cpu: 250m
+      memory: 1Gi
+    limits:
+      memory: 2Gi
+
+agent:
+  enabled: true

platform/apps/kube-prometheus-stack-config.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kube-prometheus-stack-config
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
-    targetRevision: main
-    path: manifests/kube-prometheus-stack-config
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: monitoring
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - SkipDryRunOnMissingResource=true

platform/apps/kube-prometheus-stack/application.yaml

@@ -13,10 +13,15 @@ spec:
       targetRevision: "65.0.0"  # TODO: verify latest via `helm search repo prometheus-community/kube-prometheus-stack --versions`
       helm:
         valueFiles:
-          - $values/manifests/kube-prometheus-stack/values.yaml
+          - $values/platform/apps/kube-prometheus-stack/values.yaml
     - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
       targetRevision: main
       ref: values
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
+      targetRevision: main
+      path: platform/apps/kube-prometheus-stack
+      directory:
+        exclude: "{application.yaml,values.yaml}"
   destination:
     server: https://kubernetes.default.svc
     namespace: monitoring
@@ -27,3 +32,4 @@ spec:
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
+      - SkipDryRunOnMissingResource=true

platform/apps/kube-prometheus-stack/httproute.yaml

@@ -0,0 +1,22 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana
+  namespace: monitoring
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "grafana.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        # verify with: kubectl get svc -n monitoring
+        - name: kube-prometheus-stack-grafana
+          port: 80

platform/apps/kube-prometheus-stack/values.yaml

@@ -0,0 +1,26 @@
+grafana:
+  persistence:
+    enabled: true
+    storageClassName: nfs-delete
+    size: 5Gi
+
+prometheus:
+  prometheusSpec:
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: nfs-delete
+          resources:
+            requests:
+              storage: 20Gi
+    retention: 15d
+
+alertmanager:
+  alertmanagerSpec:
+    storage:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: nfs-delete
+          resources:
+            requests:
+              storage: 2Gi

platform/apps/sonarqube-config.yaml

@@ -1,22 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: sonarqube-config
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-spec:
-  project: default
-  source:
-    repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
-    targetRevision: main
-    path: manifests/sonarqube-config
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: sonarqube
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - SkipDryRunOnMissingResource=true

platform/apps/sonarqube/application.yaml

@@ -13,10 +13,15 @@ spec:
       targetRevision: "10.6.0"  # TODO: verify latest via `helm search repo sonarqube/sonarqube --versions`
       helm:
         valueFiles:
-          - $values/manifests/sonarqube/values.yaml
+          - $values/platform/apps/sonarqube/values.yaml
     - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
       targetRevision: main
       ref: values
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
+      targetRevision: main
+      path: platform/apps/sonarqube
+      directory:
+        exclude: "{application.yaml,values.yaml}"
   destination:
     server: https://kubernetes.default.svc
     namespace: sonarqube
@@ -26,3 +31,4 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+      - SkipDryRunOnMissingResource=true

platform/apps/sonarqube/httproute.yaml

@@ -0,0 +1,22 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: sonarqube
+  namespace: sonarqube
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "sonarqube.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        # verify with: kubectl get svc -n sonarqube
+        - name: sonarqube-sonarqube
+          port: 9000

platform/apps/sonarqube/values.yaml

@@ -0,0 +1,17 @@
+postgresql:
+  enabled: false
+
+persistence:
+  enabled: true
+  storageClass: nfs-delete
+  size: 20Gi
+
+service:
+  type: ClusterIP
+
+resources:
+  requests:
+    cpu: 500m
+    memory: 2Gi
+  limits:
+    memory: 4Gi

platform/apps/vault/application.yaml

@@ -13,10 +13,15 @@ spec:
       targetRevision: "0.30.0"  # TODO: verify latest via `helm search repo hashicorp/vault --versions`
       helm:
         valueFiles:
-          - $values/manifests/vault/values.yaml
+          - $values/platform/apps/vault/values.yaml
     - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
       targetRevision: main
       ref: values
+    - repoURL: https://gitea.fireflylab.cc/duynguyen/cluster-platform.git
+      targetRevision: main
+      path: platform/apps/vault
+      directory:
+        exclude: "{application.yaml,values.yaml}"
   destination:
     server: https://kubernetes.default.svc
     namespace: vault
@@ -26,3 +31,4 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
+      - SkipDryRunOnMissingResource=true

platform/apps/vault/httproute.yaml

@@ -0,0 +1,22 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vault
+  namespace: vault
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "vault.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        # verify with: kubectl get svc -n vault  (UI served on same port as API when ui.enabled)
+        - name: vault
+          port: 8200

platform/apps/vault/values.yaml

@@ -0,0 +1,15 @@
+server:
+  dataStorage:
+    enabled: true
+    storageClass: nfs-delete
+    size: 10Gi
+  standalone:
+    enabled: true
+  ha:
+    enabled: false
+
+ui:
+  enabled: true
+
+injector:
+  enabled: true