mirror of
https://github.com/wahyd4/home-docker.git
synced 2026-08-08 20:15:03 +10:00
Update argocd via terraform
This commit is contained in:
@@ -244,12 +244,8 @@ k apply -f wireguard.yaml -n wireguard
|
||||
|
||||
|
||||
# argo
|
||||
|
||||
k create namespace argocd
|
||||
|
||||
kubectl -n argocd create secret generic redis-credentials --from-literal=redis-password="xxx"
|
||||
|
||||
helm upgrade --install argocd -n argocd -f argocd-values.yaml argo/argo-cd
|
||||
# ArgoCD is now fully managed via terraform/argocd.tf (helm_release.argocd).
|
||||
# Do not apply argocd-values.yaml manually anymore - it has been retired.
|
||||
|
||||
|
||||
# k8s github docker image pull
|
||||
|
||||
@@ -1,78 +0,0 @@
|
||||
redis-ha:
|
||||
enabled: false
|
||||
|
||||
externalRedis:
|
||||
# existingSecret: redis-credentials
|
||||
host: 192.168.1.2
|
||||
|
||||
controller:
|
||||
enableStatefulSet: true
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
configs:
|
||||
cm:
|
||||
# -- Timeout to discover if a new manifests version got published to the repository
|
||||
timeout.reconciliation: 60s
|
||||
|
||||
server:
|
||||
replicas: 1
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
kubernetes.io/tls-acme: "true"
|
||||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 102400m
|
||||
nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
|
||||
nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
|
||||
hostname: "argo.junv.cc"
|
||||
tls:
|
||||
- hosts:
|
||||
- argo.junv.cc
|
||||
secretName: argocd-tls
|
||||
metrics:
|
||||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
env:
|
||||
- name: ARGOCD_API_SERVER_REPLICAS
|
||||
value: '2'
|
||||
|
||||
repoServer:
|
||||
replicas: 1
|
||||
metrics:
|
||||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
applicationSet:
|
||||
metrics:
|
||||
enabled: false
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
redis:
|
||||
enabled: false
|
||||
|
||||
global:
|
||||
logging:
|
||||
level: "warn"
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
path: /
|
||||
hosts:
|
||||
- argo.junv.cc
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
kubernetes.io/tls-acme: "true"
|
||||
labels: {}
|
||||
tls:
|
||||
- secretName: argocc-tls
|
||||
hosts:
|
||||
- argo.junv.cc
|
||||
+1
-2
@@ -71,8 +71,7 @@ scp AI-BOT-USAGE.md 192.168.1.10:~/
|
||||
## 📋 Related
|
||||
|
||||
- **AI Namespace Manifests**: `/ai/` directory (monitored by ArgoCD)
|
||||
- **Terraform Configuration**: `/terraform/` directory
|
||||
- **ArgoCD Values**: `/argocd-values.yaml`
|
||||
- **Terraform Configuration**: `/terraform/` directory (includes ArgoCD's Helm values in `terraform/argocd.tf`)
|
||||
|
||||
## 🔄 Setup History
|
||||
|
||||
|
||||
+69
-62
@@ -136,84 +136,91 @@ resource "null_resource" "wait_for_cert_manager_crds" {
|
||||
# We've already created it manually with the setup_argocd.sh script
|
||||
|
||||
# Install ArgoCD
|
||||
# This is the single source of truth for the ArgoCD deployment (previously
|
||||
# also managed ad-hoc via `helm upgrade -f argocd-values.yaml`, which has been
|
||||
# retired in favor of Terraform).
|
||||
resource "helm_release" "argocd" {
|
||||
name = "argocd"
|
||||
repository = "https://argoproj.github.io/argo-helm"
|
||||
chart = "argo-cd"
|
||||
version = "9.5.14"
|
||||
version = "10.1.1"
|
||||
namespace = kubernetes_namespace.argocd.metadata[0].name
|
||||
|
||||
set {
|
||||
name = "server.service.type"
|
||||
value = "ClusterIP"
|
||||
}
|
||||
# Homelab: single-node K3s, no HA needed.
|
||||
values = [<<-EOT
|
||||
# Dex/notifications disabled - neither SSO federation nor notification
|
||||
# channels are configured, so avoid running two extra pods for nothing.
|
||||
dex:
|
||||
enabled: false
|
||||
|
||||
set {
|
||||
name = "server.ingress.enabled"
|
||||
value = "true"
|
||||
}
|
||||
notifications:
|
||||
enabled: false
|
||||
|
||||
set {
|
||||
name = "server.ingress.hosts[0]"
|
||||
value = "argo.junv.cc"
|
||||
}
|
||||
redis-ha:
|
||||
enabled: false
|
||||
|
||||
set {
|
||||
name = "server.ingress.ingressClassName"
|
||||
value = "nginx"
|
||||
}
|
||||
redis:
|
||||
enabled: false
|
||||
|
||||
set {
|
||||
name = "server.ingress.annotations.cert-manager\\.io/cluster-issuer"
|
||||
value = "letsencrypt-prod"
|
||||
}
|
||||
# Use the Redis instance running on the K3s host itself instead of the
|
||||
# chart's bundled redis.
|
||||
# NOTE: this Redis has no auth (`requirepass` empty) and listens on
|
||||
# 0.0.0.0:6379 - reachable by anything on 192.168.1.0/24.
|
||||
externalRedis:
|
||||
host: 192.168.1.2
|
||||
port: 6379
|
||||
|
||||
set {
|
||||
name = "server.ingress.tls[0].hosts[0]"
|
||||
value = "argo.junv.cc"
|
||||
}
|
||||
controller:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
set {
|
||||
name = "server.ingress.tls[0].secretName"
|
||||
value = "argocd-server-tls"
|
||||
}
|
||||
configs:
|
||||
cm:
|
||||
timeout.reconciliation: 60s
|
||||
|
||||
set {
|
||||
name = "server.extraArgs[0]"
|
||||
value = "--insecure"
|
||||
}
|
||||
server:
|
||||
replicas: 1
|
||||
# Ingress terminates TLS, so the server can listen over plain HTTP.
|
||||
extraArgs:
|
||||
- --insecure
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
kubernetes.io/tls-acme: "true"
|
||||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 102400m
|
||||
nginx.ingress.kubernetes.io/auth-url: "https://pass.junv.cc/oauth2/auth"
|
||||
nginx.ingress.kubernetes.io/auth-signin: "https://pass.junv.cc/oauth2/start?rd=https://$host$escaped_request_uri"
|
||||
hostname: "argo.junv.cc"
|
||||
# `tls` is a boolean for this chart (not a list) - the actual secret
|
||||
# is always named `argocd-server-tls`.
|
||||
tls: true
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
set {
|
||||
name = "server.insecure"
|
||||
value = "true"
|
||||
}
|
||||
repoServer:
|
||||
replicas: 1
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
# Disable components not needed for single-node homelab
|
||||
set {
|
||||
name = "dex.enabled"
|
||||
value = "false"
|
||||
}
|
||||
applicationSet:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
set {
|
||||
name = "notifications.enabled"
|
||||
value = "false"
|
||||
}
|
||||
|
||||
# Use external Redis instead of the built-in one
|
||||
set {
|
||||
name = "redis.enabled"
|
||||
value = "false"
|
||||
}
|
||||
|
||||
set {
|
||||
name = "externalRedis.host"
|
||||
value = "192.168.1.2"
|
||||
}
|
||||
|
||||
set {
|
||||
name = "externalRedis.port"
|
||||
value = "6379"
|
||||
}
|
||||
global:
|
||||
logging:
|
||||
level: "warn"
|
||||
EOT
|
||||
]
|
||||
|
||||
depends_on = [
|
||||
helm_release.cert_manager,
|
||||
|
||||
Reference in New Issue
Block a user