gitea_admin/Homelabv4
1
0
Fork 0
mirror of https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git synced 2026-08-20 23:16:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix ArgoCD ServerSideDiff permanent OutOfSync diffs

Browse Source 
Add explicit CRD/API defaults to manifests that were causing ArgoCD's
SSA dry-run to produce results different from live state:

- HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs
- Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations
- Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults
- Gateway certificateRefs: add group="" default
- Guacamole Gateway: add group="" to certificateRefs

Add ignoreDifferences for resources that legitimately differ:
- Cilium cert Secrets (auto-generated, data always differs)
- Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates)
- Crowdsec LAPI Secrets (randomly generated)
- ServiceMonitor/PodMonitor relabeling action defaults
- StatefulSet volumeClaimTemplates apiVersion/kind defaults

Persist argocd-cm ignoreDifferences config in ArgoCD Helm values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
2026-03-10 17:32:59 -05:00
co-authored by Claude Opus 4.6
parent 4270309224
commit 131cbca4a6
39 changed files with 248 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/argocd/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: argocd
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: argocd-server
- group: ""
kind: Service
name: argocd-server
port: 80
weight: 1
apps/argocd/values.yaml
+30
View File
@@ -6,6 +6,36 @@ global:
configs:
cm:
url: https://argocd.kube.huskypup.net
resource.customizations.ignoreDifferences.all: |
managedFieldsManagers:
- external-secrets
- istio-system
jqPathExpressions:
- .metadata.finalizers
resource.customizations.ignoreDifferences.external-secrets.io_ExternalSecret: |
jqPathExpressions:
- .metadata.annotations."force-sync"
- .metadata.annotations."reconcile.external-secrets.io/force-sync"
- .metadata.finalizers
- .spec.data[].remoteRef.conversionStrategy
- .spec.data[].remoteRef.decodingStrategy
- .spec.data[].remoteRef.metadataPolicy
resource.customizations.ignoreDifferences.gateway.networking.k8s.io_HTTPRoute: |
jqPathExpressions:
- .metadata.annotations
- .spec.parentRefs[].port
resource.customizations.ignoreDifferences.monitoring.coreos.com_ServiceMonitor: |
jqPathExpressions:
- .spec.endpoints[].relabelings[].action
- .spec.endpoints[].metricRelabelings[].action
resource.customizations.ignoreDifferences.monitoring.coreos.com_PodMonitor: |
jqPathExpressions:
- .spec.podMetricsEndpoints[].relabelings[].action
- .spec.podMetricsEndpoints[].metricRelabelings[].action
resource.customizations.ignoreDifferences.apps_StatefulSet: |
jqPathExpressions:
- .spec.volumeClaimTemplates[].apiVersion
- .spec.volumeClaimTemplates[].kind
oidc.config: |
name: Authentik
issuer: https://auth.kube.huskypup.net/application/o/argocd/
apps/frigate/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: frigate
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: frigate
- group: ""
kind: Service
name: frigate
port: 5000
weight: 1
apps/gitlab/manifests/envoy-routes.yaml
+28 -8
View File
@@ -5,7 +5,9 @@ metadata:
namespace: gitlab
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,8 +18,11 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: gitlab-webservice-default
- group: ""
kind: Service
name: gitlab-webservice-default
port: 8181
weight: 1
---
apiVersion: gateway.networking.k8s.io/v1
@@ -27,7 +32,9 @@ metadata:
namespace: gitlab
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -38,8 +45,11 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: gitlab-registry
- group: ""
kind: Service
name: gitlab-registry
port: 5000
weight: 1
---
apiVersion: gateway.networking.k8s.io/v1
@@ -49,7 +59,9 @@ metadata:
namespace: gitlab
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -60,8 +72,11 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: gitlab-minio-svc
- group: ""
kind: Service
name: gitlab-minio-svc
port: 9000
weight: 1
---
apiVersion: gateway.networking.k8s.io/v1
@@ -71,7 +86,9 @@ metadata:
namespace: gitlab
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -82,5 +99,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: gitlab-kas
- group: ""
kind: Service
name: gitlab-kas
port: 8154
weight: 1
apps/guacamole/manifests/envoy-gateway.yaml
+13 -4
View File
@@ -27,7 +27,8 @@ spec:
tls:
mode: Terminate
certificateRefs:
- kind: Secret
- group: ""
kind: Secret
name: guacamole-envoy-tls
---
@@ -38,7 +39,9 @@ metadata:
namespace: guacamole
spec:
parentRefs:
- name: guacamole
- group: gateway.networking.k8s.io
kind: Gateway
name: guacamole
sectionName: https
hostnames:
- guacamole.kube.huskypup.net
@@ -55,13 +58,19 @@ spec:
type: ReplacePrefixMatch
replacePrefixMatch: /
backendRefs:
- name: guacamole
- group: ""
kind: Service
name: guacamole
port: 8080
weight: 1
# Standard root routing
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: guacamole
- group: ""
kind: Service
name: guacamole
port: 8080
weight: 1
apps/home-assistant/esphome/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: home-assistant
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: esphome
- group: ""
kind: Service
name: esphome
port: 6052
weight: 1
apps/home-assistant/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: home-assistant
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: home-assistant
- group: ""
kind: Service
name: home-assistant
port: 8123
weight: 1
apps/n8n/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: n8n
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: n8n
- group: ""
kind: Service
name: n8n
port: 80
weight: 1
apps/nextcloud/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: nextcloud
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: nextcloud
- group: ""
kind: Service
name: nextcloud
port: 8080
weight: 1
apps/teslamate/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: teslamate
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: teslamate
- group: ""
kind: Service
name: teslamate
port: 4000
weight: 1
argocd-apps/infrastructure/cilium.yaml
+20
View File
@@ -9,6 +9,26 @@ metadata:
- resources-finalizer.argocd.argoproj.io
spec:
project: infrastructure
ignoreDifferences:
- group: ""
kind: Secret
name: cilium-ca
jsonPointers:
- /data
- group: ""
kind: Secret
name: hubble-relay-client-certs
jsonPointers:
- /data
- group: ""
kind: Secret
name: hubble-server-certs
jsonPointers:
- /data
- group: monitoring.coreos.com
kind: ServiceMonitor
jqPathExpressions:
- .spec.endpoints[].relabelings[].action
sources:
- repoURL: https://helm.cilium.io
chart: cilium
argocd-apps/infrastructure/crowdsec.yaml
+6
View File
@@ -9,6 +9,12 @@ metadata:
- resources-finalizer.argocd.argoproj.io
spec:
project: infrastructure
ignoreDifferences:
- group: ""
kind: Secret
name: crowdsec-lapi-secrets
jsonPointers:
- /data
sources:
- repoURL: https://crowdsecurity.github.io/helm-charts
chart: crowdsec
argocd-apps/infrastructure/istio-base.yaml
+5
View File
@@ -9,6 +9,11 @@ metadata:
- resources-finalizer.argocd.argoproj.io
spec:
project: infrastructure
ignoreDifferences:
- group: admissionregistration.k8s.io
kind: ValidatingWebhookConfiguration
jqPathExpressions:
- .webhooks[].failurePolicy
source:
repoURL: https://istio-release.storage.googleapis.com/charts
chart: base
argocd-apps/infrastructure/istiod.yaml
+5
View File
@@ -9,6 +9,11 @@ metadata:
- resources-finalizer.argocd.argoproj.io
spec:
project: infrastructure
ignoreDifferences:
- group: admissionregistration.k8s.io
kind: ValidatingWebhookConfiguration
jqPathExpressions:
- .webhooks[].failurePolicy
sources:
- repoURL: https://istio-release.storage.googleapis.com/charts
chart: istiod
infrastructure/authentik/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: authentik
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: authentik-server
- group: ""
kind: Service
name: authentik-server
port: 80
weight: 1
infrastructure/envoy-gateway/manifests/edge.yaml
+2 -1
View File
@@ -82,7 +82,8 @@ spec:
tls:
mode: Terminate
certificateRefs:
- kind: Secret
- group: ""
kind: Secret
name: edge-wildcard-kube-huskypup-net
allowedRoutes:
namespaces:
infrastructure/grafana/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: grafana
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: grafana
- group: ""
kind: Service
name: grafana
port: 80
weight: 1
infrastructure/kyverno/policies/disallow-automount-sa-token.yaml
+2
View File
@@ -16,6 +16,7 @@ spec:
background: true
rules:
- name: validate-automount
skipBackgroundRequests: true
match:
any:
- resources:
@@ -60,6 +61,7 @@ spec:
- n8n
- nessus
validate:
allowExistingViolations: true
message: >-
Pods should set automountServiceAccountToken to false unless API
access is required (STIG V-242382).
infrastructure/kyverno/policies/disallow-default-namespace.yaml
+2
View File
@@ -14,6 +14,7 @@ spec:
background: true
rules:
- name: validate-namespace
skipBackgroundRequests: true
match:
any:
- resources:
@@ -27,6 +28,7 @@ spec:
namespaces:
- default
validate:
allowExistingViolations: true
message: >-
Workloads must not run in the default namespace (STIG V-242383).
Create a dedicated namespace for your application.
infrastructure/kyverno/policies/disallow-host-namespaces.yaml
+2
View File
@@ -15,6 +15,7 @@ spec:
background: true
rules:
- name: host-namespaces
skipBackgroundRequests: true
match:
any:
- resources:
@@ -31,6 +32,7 @@ spec:
- kyverno
- crowdsec
validate:
allowExistingViolations: true
message: >-
Sharing host PID, IPC, or network namespaces is not allowed (STIG V-242386).
pattern:
infrastructure/kyverno/policies/disallow-latest-tag.yaml
+2
View File
@@ -11,6 +11,7 @@ spec:
background: true
rules:
- name: disallow-latest
skipBackgroundRequests: true
match:
any:
- resources:
@@ -25,6 +26,7 @@ spec:
- crowdsec
- home-assistant
validate:
allowExistingViolations: true
message: "Using ':latest' image tag is not allowed. Specify an explicit tag."
pattern:
spec:
infrastructure/kyverno/policies/disallow-nodeport.yaml
+2
View File
@@ -11,6 +11,7 @@ spec:
background: true
rules:
- name: disallow-nodeport
skipBackgroundRequests: true
match:
any:
- resources:
@@ -23,6 +24,7 @@ spec:
- kube-system
- istio-system
validate:
allowExistingViolations: true
message: "NodePort services are not allowed. Use ClusterIP or LoadBalancer."
pattern:
spec:
infrastructure/kyverno/policies/disallow-privileged.yaml
+2
View File
@@ -11,6 +11,7 @@ spec:
background: true
rules:
- name: disallow-privileged
skipBackgroundRequests: true
match:
any:
- resources:
@@ -29,6 +30,7 @@ spec:
- tetragon
- crowdsec
validate:
allowExistingViolations: true
message: "Privileged containers are not allowed."
pattern:
spec:
infrastructure/kyverno/policies/require-drop-all-capabilities.yaml
+2
View File
@@ -15,6 +15,7 @@ spec:
background: true
rules:
- name: require-drop-all
skipBackgroundRequests: true
match:
any:
- resources:
@@ -55,6 +56,7 @@ spec:
- checkov
- external-secrets
validate:
allowExistingViolations: true
message: >-
Containers must drop ALL capabilities (STIG V-242398).
Add securityContext.capabilities.drop: ["ALL"] to each container.
infrastructure/kyverno/policies/require-istio-ambient.yaml
+2
View File
@@ -14,6 +14,7 @@ spec:
background: true
rules:
- name: check-namespace-ambient-label
skipBackgroundRequests: true
match:
any:
- resources:
@@ -74,6 +75,7 @@ spec:
- user-*
- cluster-fleet-*
validate:
allowExistingViolations: true
message: "Application namespaces must have istio.io/dataplane-mode=ambient for zero-trust mTLS."
pattern:
metadata:
infrastructure/kyverno/policies/require-labels.yaml
+2
View File
@@ -11,6 +11,7 @@ spec:
background: true
rules:
- name: require-app-label
skipBackgroundRequests: true
match:
any:
- resources:
@@ -33,6 +34,7 @@ spec:
- scylla-operator
- cert-manager
validate:
allowExistingViolations: true
message: "The label 'app' or 'app.kubernetes.io/name' is required."
anyPattern:
- metadata:
infrastructure/kyverno/policies/require-non-root.yaml
+2
View File
@@ -11,6 +11,7 @@ spec:
background: true
rules:
- name: require-run-as-non-root
skipBackgroundRequests: true
match:
any:
- resources:
@@ -27,6 +28,7 @@ spec:
- kyverno
- tetragon
validate:
allowExistingViolations: true
message: "Containers must run as non-root. Set runAsNonRoot to true."
pattern:
spec:
infrastructure/kyverno/policies/require-probes.yaml
+2
View File
@@ -11,6 +11,7 @@ spec:
background: true
rules:
- name: require-probes
skipBackgroundRequests: true
match:
any:
- resources:
@@ -44,6 +45,7 @@ spec:
- nextcloud
- scylla-manager
validate:
allowExistingViolations: true
message: "Liveness and readiness probes are required for all containers."
pattern:
spec:
infrastructure/kyverno/policies/require-resource-limits.yaml
+2
View File
@@ -11,6 +11,7 @@ spec:
background: true
rules:
- name: require-limits
skipBackgroundRequests: true
match:
any:
- resources:
@@ -53,6 +54,7 @@ spec:
- checkov
- scylla-manager
validate:
allowExistingViolations: true
message: "All containers must have CPU and memory limits defined."
pattern:
spec:
infrastructure/kyverno/policies/require-ro-rootfs.yaml
+2
View File
@@ -11,6 +11,7 @@ spec:
background: true
rules:
- name: require-ro-rootfs
skipBackgroundRequests: true
match:
any:
- resources:
@@ -31,6 +32,7 @@ spec:
- nextcloud
- home-assistant
validate:
allowExistingViolations: true
message: "Containers should use a read-only root filesystem."
pattern:
spec:
infrastructure/kyverno/policies/restrict-image-registries.yaml
+2
View File
@@ -16,6 +16,7 @@ spec:
background: true
rules:
- name: validate-container-registries
skipBackgroundRequests: true
match:
any:
- resources:
@@ -29,6 +30,7 @@ spec:
- kube-node-lease
- kyverno
validate:
allowExistingViolations: true
message: >-
Images must come from allowed registries: docker.io, ghcr.io, quay.io,
registry.k8s.io, gcr.io, lscr.io, registry.gitlab.com, cr.fluentbit.io,
infrastructure/prometheus/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: prometheus
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: kube-prometheus-stack-prometheus
- group: ""
kind: Service
name: kube-prometheus-stack-prometheus
port: 9090
weight: 1
infrastructure/rook-ceph/manifests/envoy-route.yaml
+4 -1
View File
@@ -5,7 +5,9 @@ metadata:
namespace: rook-ceph
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -19,3 +21,4 @@ spec:
- group: gateway.envoyproxy.io
kind: Backend
name: ceph-dashboard
weight: 1
infrastructure/tetragon/tracing-policies/kubernetes-api-access.yaml
+4
View File
@@ -6,9 +6,13 @@ spec:
kprobes:
- call: tcp_connect
syscall: false
return: false
args:
- index: 0
type: sock
maxData: false
resolve: ""
returnCopy: false
selectors:
- matchArgs:
- index: 0
infrastructure/tetragon/tracing-policies/network-monitoring.yaml
+8
View File
@@ -6,17 +6,25 @@ spec:
kprobes:
- call: tcp_connect
syscall: false
return: false
args:
- index: 0
type: sock
maxData: false
resolve: ""
returnCopy: false
selectors:
- matchActions:
- action: Post
- call: tcp_close
syscall: false
return: false
args:
- index: 0
type: sock
maxData: false
resolve: ""
returnCopy: false
selectors:
- matchActions:
- action: Post
infrastructure/tetragon/tracing-policies/privilege-escalation.yaml
+8
View File
@@ -6,9 +6,13 @@ spec:
kprobes:
- call: __x64_sys_setuid
syscall: true
return: false
args:
- index: 0
type: int
maxData: false
resolve: ""
returnCopy: false
selectors:
- matchArgs:
- index: 0
@@ -19,9 +23,13 @@ spec:
- action: Post
- call: __x64_sys_setgid
syscall: true
return: false
args:
- index: 0
type: int
maxData: false
resolve: ""
returnCopy: false
selectors:
- matchArgs:
- index: 0
infrastructure/tetragon/tracing-policies/process-execution.yaml
+3
View File
@@ -9,6 +9,9 @@ spec:
args:
- index: 4
type: syscall64
maxData: false
resolve: ""
returnCopy: false
selectors:
- matchArgs:
- index: 4
infrastructure/tetragon/tracing-policies/sensitive-file-access.yaml
+7
View File
@@ -6,11 +6,18 @@ spec:
kprobes:
- call: fd_install
syscall: false
return: false
args:
- index: 0
type: int
maxData: false
resolve: ""
returnCopy: false
- index: 1
type: file
maxData: false
resolve: ""
returnCopy: false
selectors:
- matchArgs:
- index: 1
infrastructure/vault/manifests/envoy-route.yaml
+7 -2
View File
@@ -5,7 +5,9 @@ metadata:
namespace: vault
spec:
parentRefs:
- name: edge
- group: gateway.networking.k8s.io
kind: Gateway
name: edge
namespace: gateway
sectionName: https
hostnames:
@@ -16,5 +18,8 @@ spec:
type: PathPrefix
value: /
backendRefs:
- name: vault
- group: ""
kind: Service
name: vault
port: 8200
weight: 1