Repository navigation
feat(gitops): base→type→cluster layering via ApplicationSet - #17
Merged
Merged
Conversation
Self-managed Argo per cluster. Inline manifests install Argo + seed 3 roots:
apps (layering ApplicationSet, chart-apps, values base->type->cluster),
bootstrap (shared raw), <cluster>-raw (custom ApplicationSets like arc-runners).
Migrates cert-manager+cilium (shared) and harbor+arc-controller (unraid) to
app.yaml coords + values/{base,types,clusters}. Supersedes app-of-apps.
Design: docs/architecture/gitops-layering.md. Not cluster-validated.
On the layering branch the chart-apps are apps/*/app.yaml coord files driven by appset.yaml, not plain Applications — so validate.py rendered nothing for them (false green). Render each coord the way the ApplicationSet would: chart + base values.
syscod3
force-pushed
the
feat/gitops-applicationset-layering
branch
from
July 21, 2026 23:16
0fb4b04 to
67f0b89
Compare
…jection) Rewrite generate-manifests.sh to fill only the generated blocks (argocd install, argocd-apps appset with THIS cluster's identity substituted, cilium for CNI-none clusters) in place via yq — static blocks and comments untouched. Parameterized per cluster: oci-talos/cloud (+cilium) and unraid-lab/homelab-kvm. Add .mise.toml with oci:generate-manifests and unraid:generate-manifests tasks. Committed manifests keep their placeholders; run the task at deploy to fill them (version-pinned, boots the cluster). Verified end-to-end: both clusters render, identity substituted, valid YAML, 0 yamllint errors.
…bor -> PAT revoke)
Upstream argo install.yaml carries no namespace on its 50 namespaced resources (it relies on `kubectl apply -n argocd`). Talos applies inline manifests verbatim with no namespace default, so those resources — including all 6 controller Deployments — never landed in argocd and Argo's runtime never came up (only the cluster-scoped CRDs applied). Stamp namespace via `kubectl kustomize` (also rewrites the RBAC binding subjects) and prepend the Namespace. Root-caused on unraid-lab bootstrap; same bug affected the OCI generate path.
inject-secrets.sh reads a gitignored omni/secrets.env, builds the Secret manifests each app expects (harbor-admin-password, arc-gha-secret, operator-oauth), wraps them in a Talos inline-manifest ConfigPatch, applied to Omni for unraid-lab. Secrets live only in Omni's encrypted config + the cluster, never committed. harbor-mirror-robot deferred (Harbor robot). Dry-run verified.
Adds Longhorn 1.12.0 as the homelab-kvm type storage provider (unraid-lab), the first half of the per-type storage decision; cloud clusters will use OCI Block Volume CSI. Longhorn is the default StorageClass so Harbor's PVCs bind automatically. Talos-ready (image ships iscsi-tools/util-linux-tools); longhorn-system namespace is labeled privileged (Talos enforces baseline PSA). Retain reclaim + 2 replicas (2/3 nodes schedulable).
…rage)" This reverts commit 8cec8fb.
Replaces reverted Longhorn. PVs backed by unraid NFS export (/mnt/user/unraid-talos-pv-store) on the parity-protected array — no replicated block storage, none of Longhorn's host/etcd risk. NFS client in-kernel: no Talos extension. Default SC 'nfs' so Harbor PVCs bind. Scoped to types/homelab-kvm.
syscod3
added a commit
that referenced
this pull request
Aug 8, 2026
…ayering feat(gitops): base→type→cluster layering via ApplicationSet
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reworks the repo from per-cluster app-of-apps into the consensus layered model: self-managed Argo per cluster + one layering ApplicationSet + kustomize/valueFiles overrides.
Model (see
docs/architecture/gitops-layering.md)Inline manifests install Argo, then seed 3 roots:
apps(ApplicationSet) — chart-apps fromapps/*(shared) +types/<type>/apps/*+clusters/<name>/apps/*, values deep-mergedbase → type → cluster.bootstrap(Application) — shared raw manifests (tailscale operator).<cluster>-raw(Application) — custom ApplicationSets that aren't chart-apps (arc-runners), keyed onapplication.yamlso the two lanes never collide.What changed
appset.yaml,apps/{cert-manager,cilium}/app.yaml,clusters/unraid-lab/apps/{harbor,arc-controller}/app.yaml,values/{base,types,clusters}/….values/base/<app>.yaml.bootstrap/argocd-app-of-apps.yaml,infrastructure/*/application.yaml,clusters/unraid-lab/app-of-apps.yaml.arc-runnerskept as its own ApplicationSet on the raw lane.Needs: the generate step wired to inject
appset.yaml(with per-cluster identity) into theargocd-appsinline block; a real sync onunraid-labonce Argo is bootstrapped there; a no-op re-sync check on OCI before this replaces the live setup.Supersedes PR #16's app-of-apps structure. Consensus refs in the design doc.