mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
5f52f2b36b
Part of the Authentik HA pilot (see plan doc). Home's etcd quorum member (StatefulSet, pinned to talos-cp-01 for a stable advertised address) plus a NodePort exposing pg-authentik's current primary - both reachable from the VPS/witness over the already-authenticated Netbird mesh (confirmed live: home nodes are directly reachable from Netbird peers on their real node IP, via the netbird-egress DaemonSet's route). Deliberately NOT going through UniFi/public-internet exposure - this stays entirely inside the private mesh, a materially safer path than the WAN port- forward originally considered. Needs a scoped Kyverno PolicyException (ha-failover-nodeport-exception.yaml) since disallow-nodeport-services is enforced cluster-wide - narrowly scoped to Services named ha-*, matching the existing netbird-egress- exemption.yaml precedent for exceptions.
25 lines
659 B
YAML
25 lines
659 B
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: ha-failover
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "23" # after CNPG/storage (10-14), alongside other security/HA infra
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
project: infrastructure
|
|
source:
|
|
repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
|
|
targetRevision: main
|
|
path: infrastructure/ha-failover/manifests
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: ha-failover
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|