mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby HuskyandClaude Opus 4.6
131cbca4a6
Add explicit CRD/API defaults to manifests that were causing ArgoCD's SSA dry-run to produce results different from live state: - HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs - Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations - Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults - Gateway certificateRefs: add group="" default - Guacamole Gateway: add group="" to certificateRefs Add ignoreDifferences for resources that legitimately differ: - Cilium cert Secrets (auto-generated, data always differs) - Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates) - Crowdsec LAPI Secrets (randomly generated) - ServiceMonitor/PodMonitor relabeling action defaults - StatefulSet volumeClaimTemplates apiVersion/kind defaults Persist argocd-cm ignoreDifferences config in ArgoCD Helm values. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
127 lines
3.3 KiB
YAML
127 lines
3.3 KiB
YAML
# values/argocd.values.yaml
|
|
|
|
global:
|
|
domain: argocd.kube.huskypup.net
|
|
|
|
configs:
|
|
cm:
|
|
url: https://argocd.kube.huskypup.net
|
|
resource.customizations.ignoreDifferences.all: |
|
|
managedFieldsManagers:
|
|
- external-secrets
|
|
- istio-system
|
|
jqPathExpressions:
|
|
- .metadata.finalizers
|
|
resource.customizations.ignoreDifferences.external-secrets.io_ExternalSecret: |
|
|
jqPathExpressions:
|
|
- .metadata.annotations."force-sync"
|
|
- .metadata.annotations."reconcile.external-secrets.io/force-sync"
|
|
- .metadata.finalizers
|
|
- .spec.data[].remoteRef.conversionStrategy
|
|
- .spec.data[].remoteRef.decodingStrategy
|
|
- .spec.data[].remoteRef.metadataPolicy
|
|
resource.customizations.ignoreDifferences.gateway.networking.k8s.io_HTTPRoute: |
|
|
jqPathExpressions:
|
|
- .metadata.annotations
|
|
- .spec.parentRefs[].port
|
|
resource.customizations.ignoreDifferences.monitoring.coreos.com_ServiceMonitor: |
|
|
jqPathExpressions:
|
|
- .spec.endpoints[].relabelings[].action
|
|
- .spec.endpoints[].metricRelabelings[].action
|
|
resource.customizations.ignoreDifferences.monitoring.coreos.com_PodMonitor: |
|
|
jqPathExpressions:
|
|
- .spec.podMetricsEndpoints[].relabelings[].action
|
|
- .spec.podMetricsEndpoints[].metricRelabelings[].action
|
|
resource.customizations.ignoreDifferences.apps_StatefulSet: |
|
|
jqPathExpressions:
|
|
- .spec.volumeClaimTemplates[].apiVersion
|
|
- .spec.volumeClaimTemplates[].kind
|
|
oidc.config: |
|
|
name: Authentik
|
|
issuer: https://auth.kube.huskypup.net/application/o/argocd/
|
|
clientID: $oidc.authentik.clientId
|
|
clientSecret: $oidc.authentik.clientSecret
|
|
requestedScopes:
|
|
- openid
|
|
- profile
|
|
- email
|
|
- groups
|
|
|
|
rbac:
|
|
policy.default: role:readonly
|
|
scopes: '[groups, preferred_username]'
|
|
policy.csv: |
|
|
g, Authentik Admins, role:admin
|
|
g, ArgoCD Admins, role:admin
|
|
g, Scooby, role:admin
|
|
|
|
server:
|
|
extraArgs:
|
|
- --insecure # TLS is terminated at Istio gateway
|
|
|
|
hostAliases:
|
|
- ip: "172.28.101.244"
|
|
hostnames:
|
|
- auth.kube.huskypup.net
|
|
- gitlab.kube.huskypup.net
|
|
|
|
ingress:
|
|
enabled: false
|
|
|
|
env:
|
|
- name: oidc.authentik.clientId
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: argocd-oauth-secret
|
|
key: client-id
|
|
- name: oidc.authentik.clientSecret
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: argocd-oauth-secret
|
|
key: client-secret
|
|
|
|
dex:
|
|
enabled: false # using Authentik instead of built-in Dex
|
|
|
|
# Enable Prometheus metrics
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus
|
|
|
|
controller:
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus
|
|
|
|
repoServer:
|
|
hostAliases:
|
|
- ip: "172.28.101.244"
|
|
hostnames:
|
|
- gitlab.kube.huskypup.net
|
|
- auth.kube.huskypup.net
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus
|
|
|
|
applicationSet:
|
|
hostAliases:
|
|
- ip: "172.28.101.244"
|
|
hostnames:
|
|
- gitlab.kube.huskypup.net
|
|
- auth.kube.huskypup.net
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
additionalLabels:
|
|
release: prometheus
|