feat: add vault, external-secrets, monitoring, harbor, jenkins, sonarqube, headlamp

Two-source ArgoCD Applications (upstream chart + values from this repo),
same pattern as cluster-bootstrap. Each service paired with a *-config
Application for HTTPRoute/RBAC/ClusterSecretStore that must exist
after the main install (separate sync wave).

Chart targetRevision pins and HTTPRoute backendRef service names are
best-effort - marked TODO/verify in-file since no live helm repo access
this session to confirm current versions or actual rendered svc names.

manifests/external-secrets-config/clustersecretstore.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: vault-backend
+spec:
+  provider:
+    vault:
+      server: "http://vault.vault.svc.cluster.local:8200"
+      path: kv
+      version: v2
+      auth:
+        kubernetes:
+          mountPath: kubernetes
+          role: external-secrets
+          serviceAccountRef:
+            name: external-secrets-vault-auth
+            namespace: external-secrets

manifests/external-secrets-config/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: external-secrets-vault-auth
+  namespace: external-secrets

manifests/external-secrets/values.yaml

@@ -0,0 +1 @@
+installCRDs: true

manifests/harbor-config/httproute.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: harbor
+  namespace: harbor
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "harbor.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        # verify with: kubectl get svc -n harbor  (nginx frontend, combines portal+core+registry)
+        - name: harbor-nginx
+          port: 80

manifests/harbor/values.yaml

@@ -0,0 +1,30 @@
+expose:
+  type: clusterIP
+  tls:
+    enabled: false
+
+externalURL: http://harbor.fireflylab.local
+
+persistence:
+  imageChartStorage:
+    disableRedirect: true
+    type: filesystem
+    filesystem:
+      rootdirectory: /storage
+  persistentVolumeClaim:
+    registry:
+      storageClass: nfs-delete
+      size: 50Gi
+    jobservice:
+      jobLog:
+        storageClass: nfs-delete
+        size: 5Gi
+    database:
+      storageClass: nfs-delete
+      size: 5Gi
+    redis:
+      storageClass: nfs-delete
+      size: 2Gi
+    trivy:
+      storageClass: nfs-delete
+      size: 5Gi

manifests/headlamp-config/rbac.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: headlamp-admin
+  namespace: headlamp
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: headlamp-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: headlamp-admin
+    namespace: headlamp

manifests/headlamp/values.yaml

@@ -0,0 +1,2 @@
+service:
+  type: ClusterIP

manifests/jenkins-config/httproute.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jenkins
+  namespace: jenkins
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "jenkins.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        # verify with: kubectl get svc -n jenkins
+        - name: jenkins
+          port: 8080

manifests/jenkins/values.yaml

@@ -0,0 +1,14 @@
+controller:
+  serviceType: ClusterIP
+  persistence:
+    storageClass: nfs-delete
+    size: 20Gi
+  resources:
+    requests:
+      cpu: 250m
+      memory: 1Gi
+    limits:
+      memory: 2Gi
+
+agent:
+  enabled: true

manifests/kube-prometheus-stack-config/httproute.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana
+  namespace: monitoring
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "grafana.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        # verify with: kubectl get svc -n monitoring
+        - name: kube-prometheus-stack-grafana
+          port: 80

manifests/kube-prometheus-stack/values.yaml

@@ -0,0 +1,26 @@
+grafana:
+  persistence:
+    enabled: true
+    storageClassName: nfs-delete
+    size: 5Gi
+
+prometheus:
+  prometheusSpec:
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: nfs-delete
+          resources:
+            requests:
+              storage: 20Gi
+    retention: 15d
+
+alertmanager:
+  alertmanagerSpec:
+    storage:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: nfs-delete
+          resources:
+            requests:
+              storage: 2Gi

manifests/sonarqube-config/httproute.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: sonarqube
+  namespace: sonarqube
+spec:
+  parentRefs:
+    - name: envoy-gateway
+      namespace: envoy-gateway-system
+  hostnames:
+    - "sonarqube.fireflylab.local"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        # verify with: kubectl get svc -n sonarqube
+        - name: sonarqube-sonarqube
+          port: 9000

manifests/sonarqube/values.yaml

@@ -0,0 +1,17 @@
+postgresql:
+  enabled: false
+
+persistence:
+  enabled: true
+  storageClass: nfs-delete
+  size: 20Gi
+
+service:
+  type: ClusterIP
+
+resources:
+  requests:
+    cpu: 500m
+    memory: 2Gi
+  limits:
+    memory: 4Gi

manifests/vault/values.yaml

@@ -0,0 +1,15 @@
+server:
+  dataStorage:
+    enabled: true
+    storageClass: nfs-delete
+    size: 10Gi
+  standalone:
+    enabled: true
+  ha:
+    enabled: false
+
+ui:
+  enabled: true
+
+injector:
+  enabled: true