From 06a78b24c470e58d961c4a3d6f0ed2ba943bd4b5 Mon Sep 17 00:00:00 2001 From: Junwei Zhao Date: Sat, 4 Jul 2026 11:33:58 +1000 Subject: [PATCH] Update argocd via terraform --- apply.sh | 8 +-- argocd-values.yaml | 78 -------------------------- k8s/README.md | 9 ++- terraform/argocd.tf | 131 +++++++++++++++++++++++--------------------- 4 files changed, 75 insertions(+), 151 deletions(-) delete mode 100644 argocd-values.yaml diff --git a/apply.sh b/apply.sh index 96bd8d9..9dc7d62 100755 --- a/apply.sh +++ b/apply.sh @@ -244,12 +244,8 @@ k apply -f wireguard.yaml -n wireguard # argo - -k create namespace argocd - -kubectl -n argocd create secret generic redis-credentials --from-literal=redis-password="xxx" - - helm upgrade --install argocd -n argocd -f argocd-values.yaml argo/argo-cd +# ArgoCD is now fully managed via terraform/argocd.tf (helm_release.argocd). +# Do not apply argocd-values.yaml manually anymore - it has been retired. # k8s github docker image pull diff --git a/argocd-values.yaml b/argocd-values.yaml deleted file mode 100644 index bba4b48..0000000 --- a/argocd-values.yaml +++ /dev/null @@ -1,78 +0,0 @@ -redis-ha: - enabled: false - -externalRedis: - # existingSecret: redis-credentials - host: 192.168.1.2 - -controller: - enableStatefulSet: true - metrics: - enabled: true - serviceMonitor: - enabled: true - -configs: - cm: - # -- Timeout to discover if a new manifests version got published to the repository - timeout.reconciliation: 60s - -server: - replicas: 1 - extraArgs: - - --insecure - ingress: - enabled: true - annotations: - kubernetes.io/ingress.class: "nginx" - kubernetes.io/tls-acme: "true" - cert-manager.io/cluster-issuer: "letsencrypt-prod" - nginx.ingress.kubernetes.io/proxy-body-size: 102400m - nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" - nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri" - hostname: "argo.junv.cc" - tls: - - hosts: - - argo.junv.cc - secretName: argocd-tls - metrics: - enabled: false - serviceMonitor: - enabled: true - env: - - name: ARGOCD_API_SERVER_REPLICAS - value: '2' - -repoServer: - replicas: 1 - metrics: - enabled: false - serviceMonitor: - enabled: true - -applicationSet: - metrics: - enabled: false - serviceMonitor: - enabled: true - -redis: - enabled: false - -global: - logging: - level: "warn" - -ingress: - enabled: true - path: / - hosts: - - argo.junv.cc - annotations: - kubernetes.io/ingress.class: nginx - kubernetes.io/tls-acme: "true" - labels: {} - tls: - - secretName: argocc-tls - hosts: - - argo.junv.cc diff --git a/k8s/README.md b/k8s/README.md index 26a8065..fd4912d 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -9,7 +9,7 @@ This directory contains Kubernetes configuration files and documentation that ar - **`ai-bot-serviceaccount.yaml`** - ServiceAccount, Secret, Role, and RoleBinding for ai-bot - Creates `ai-bot` service account in `ai` namespace - Grants full access to `ai` namespace only - + - **`ai-bot-clusterrole.yaml`** - ClusterRole and ClusterRoleBinding for read-only access - Grants read-only access (get, list, watch) to all namespaces - Combined with the Role above, ai-bot has: @@ -71,8 +71,7 @@ scp AI-BOT-USAGE.md 192.168.1.10:~/ ## 📋 Related - **AI Namespace Manifests**: `/ai/` directory (monitored by ArgoCD) -- **Terraform Configuration**: `/terraform/` directory -- **ArgoCD Values**: `/argocd-values.yaml` +- **Terraform Configuration**: `/terraform/` directory (includes ArgoCD's Helm values in `terraform/argocd.tf`) ## 🔄 Setup History @@ -84,6 +83,6 @@ scp AI-BOT-USAGE.md 192.168.1.10:~/ --- -**Maintainer**: junv (wahyd4) -**Cluster**: K3s on 192.168.1.2 +**Maintainer**: junv (wahyd4) +**Cluster**: K3s on 192.168.1.2 **Management Host**: 192.168.1.10 (ai-bot user) diff --git a/terraform/argocd.tf b/terraform/argocd.tf index 54ae900..80ae2ca 100644 --- a/terraform/argocd.tf +++ b/terraform/argocd.tf @@ -136,84 +136,91 @@ resource "null_resource" "wait_for_cert_manager_crds" { # We've already created it manually with the setup_argocd.sh script # Install ArgoCD +# This is the single source of truth for the ArgoCD deployment (previously +# also managed ad-hoc via `helm upgrade -f argocd-values.yaml`, which has been +# retired in favor of Terraform). resource "helm_release" "argocd" { name = "argocd" repository = "https://argoproj.github.io/argo-helm" chart = "argo-cd" - version = "9.5.14" + version = "10.1.1" namespace = kubernetes_namespace.argocd.metadata[0].name - set { - name = "server.service.type" - value = "ClusterIP" - } + # Homelab: single-node K3s, no HA needed. + values = [<<-EOT + # Dex/notifications disabled - neither SSO federation nor notification + # channels are configured, so avoid running two extra pods for nothing. + dex: + enabled: false - set { - name = "server.ingress.enabled" - value = "true" - } + notifications: + enabled: false - set { - name = "server.ingress.hosts[0]" - value = "argo.junv.cc" - } + redis-ha: + enabled: false - set { - name = "server.ingress.ingressClassName" - value = "nginx" - } + redis: + enabled: false - set { - name = "server.ingress.annotations.cert-manager\\.io/cluster-issuer" - value = "letsencrypt-prod" - } + # Use the Redis instance running on the K3s host itself instead of the + # chart's bundled redis. + # NOTE: this Redis has no auth (`requirepass` empty) and listens on + # 0.0.0.0:6379 - reachable by anything on 192.168.1.0/24. + externalRedis: + host: 192.168.1.2 + port: 6379 - set { - name = "server.ingress.tls[0].hosts[0]" - value = "argo.junv.cc" - } + controller: + metrics: + enabled: true + serviceMonitor: + enabled: true - set { - name = "server.ingress.tls[0].secretName" - value = "argocd-server-tls" - } + configs: + cm: + timeout.reconciliation: 60s - set { - name = "server.extraArgs[0]" - value = "--insecure" - } + server: + replicas: 1 + # Ingress terminates TLS, so the server can listen over plain HTTP. + extraArgs: + - --insecure + ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: "nginx" + kubernetes.io/tls-acme: "true" + cert-manager.io/cluster-issuer: "letsencrypt-prod" + nginx.ingress.kubernetes.io/proxy-body-size: 102400m + nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth" + nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri" + hostname: "argo.junv.cc" + # `tls` is a boolean for this chart (not a list) - the actual secret + # is always named `argocd-server-tls`. + tls: true + metrics: + enabled: true + serviceMonitor: + enabled: true - set { - name = "server.insecure" - value = "true" - } + repoServer: + replicas: 1 + metrics: + enabled: true + serviceMonitor: + enabled: true - # Disable components not needed for single-node homelab - set { - name = "dex.enabled" - value = "false" - } + applicationSet: + metrics: + enabled: true + serviceMonitor: + enabled: true - set { - name = "notifications.enabled" - value = "false" - } - - # Use external Redis instead of the built-in one - set { - name = "redis.enabled" - value = "false" - } - - set { - name = "externalRedis.host" - value = "192.168.1.2" - } - - set { - name = "externalRedis.port" - value = "6379" - } + global: + logging: + level: "warn" + EOT + ] depends_on = [ helm_release.cert_manager,