mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Opus 4.6
5163403e24
Reduce replicas to 1 for workloads that don't need HA in a homelab: - Prometheus 2→1, Alertmanager 2→1 (~4.4GB RAM saved) - cert-manager 3→1 - GitLab: registry 2→1, kas 2→1, sidekiq 2→1, praefect 2→1, pgbouncer-ro 3→1 - Guacamole + guacd 2→1 - Kiali 2→1, ArgoCD server 2→1 - Kyverno background-controller 2→1 - Scylla operator 2→1 - ext-authz-proxy 2→1, netbird-cluster-router 2→1 Kept multi-replica: coredns, envoy-gateway, kyverno admission, vault, argocd-repo-server, gitlab-webservice, istiod, rook-ceph CSI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
129 lines
3.4 KiB
YAML
129 lines
3.4 KiB
YAML
# values/argocd.values.yaml
|
|
|
|
global:
|
|
domain: argocd.kube.huskypup.net
|
|
|
|
configs:
|
|
cm:
|
|
url: https://argocd.kube.huskypup.net
|
|
resource.customizations.ignoreDifferences.all: |
|
|
managedFieldsManagers:
|
|
- external-secrets
|
|
- istio-system
|
|
jqPathExpressions:
|
|
- .metadata.finalizers
|
|
resource.customizations.ignoreDifferences.external-secrets.io_ExternalSecret: |
|
|
jqPathExpressions:
|
|
- .metadata.annotations."force-sync"
|
|
- .metadata.annotations."reconcile.external-secrets.io/force-sync"
|
|
- .metadata.finalizers
|
|
- .spec.data[].remoteRef.conversionStrategy
|
|
- .spec.data[].remoteRef.decodingStrategy
|
|
- .spec.data[].remoteRef.metadataPolicy
|
|
resource.customizations.ignoreDifferences.gateway.networking.k8s.io_HTTPRoute: |
|
|
jqPathExpressions:
|
|
- .metadata.annotations
|
|
- .spec.parentRefs[].port
|
|
resource.customizations.ignoreDifferences.monitoring.coreos.com_ServiceMonitor: |
|
|
jqPathExpressions:
|
|
- .spec.endpoints[].relabelings[].action
|
|
- .spec.endpoints[].metricRelabelings[].action
|
|
resource.customizations.ignoreDifferences.monitoring.coreos.com_PodMonitor: |
|
|
jqPathExpressions:
|
|
- .spec.podMetricsEndpoints[].relabelings[].action
|
|
- .spec.podMetricsEndpoints[].metricRelabelings[].action
|
|
resource.customizations.ignoreDifferences.apps_StatefulSet: |
|
|
jqPathExpressions:
|
|
- .spec.volumeClaimTemplates[].apiVersion
|
|
- .spec.volumeClaimTemplates[].kind
|
|
oidc.config: |
|
|
name: Authentik
|
|
issuer: https://auth.kube.huskypup.net/application/o/argocd/
|
|
clientID: $oidc.authentik.clientId
|
|
clientSecret: $oidc.authentik.clientSecret
|
|
requestedScopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- groups
|
|
|
|
rbac:
|
|
policy.default: role:readonly
|
|
scopes: '[groups, preferred_username]'
|
|
policy.csv: |
|
|
g, Authentik Admins, role:admin
|
|
g, ArgoCD Admins, role:admin
|
|
g, Scooby, role:admin
|
|
|
|
server:
|
|
replicas: 1
|
|
extraArgs:
|
|
- --insecure # TLS is terminated at Istio gateway
|
|
|
|
hostAliases:
|
|
- ip: "172.28.101.244"
|
|
hostnames:
|
|
- auth.kube.huskypup.net
|
|
- gitlab.kube.huskypup.net
|
|
|
|
ingress:
|
|
enabled: false
|
|
|
|
env:
|
|
- name: oidc.authentik.clientId
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: argocd-oauth-secret
|
|
key: client-id
|
|
- name: oidc.authentik.clientSecret
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: argocd-oauth-secret
|
|
key: client-secret
|
|
|
|
dex:
|
|
enabled: false # using Authentik instead of built-in Dex
|
|
|
|
# Enable Prometheus metrics
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus
|
|
|
|
controller:
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus
|
|
|
|
repoServer:
|
|
replicas: 2
|
|
hostAliases:
|
|
- ip: "172.28.101.244"
|
|
hostnames:
|
|
- gitlab.kube.huskypup.net
|
|
- auth.kube.huskypup.net
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus
|
|
|
|
applicationSet:
|
|
hostAliases:
|
|
- ip: "172.28.101.244"
|
|
hostnames:
|
|
- gitlab.kube.huskypup.net
|
|
- auth.kube.huskypup.net
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus
|