chore: Talos upgrade to v1.13.7

.github/workflows/ci.yml

@@ -47,8 +47,14 @@ jobs:
 
       - name: Install kubeconform
         run: |
-          curl -sL https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz \
-            | tar -xz -C /usr/local/bin kubeconform
+          version="0.8.0"
+          checksum="9bc2bffbf71f261128533edaf912153948b7ff238f9a531ae6d34466ec287883"
+          archive="$(mktemp)"
+          trap 'rm -f "$archive"' EXIT
+          curl -fsSL "https://github.com/yannh/kubeconform/releases/download/v${version}/kubeconform-linux-amd64.tar.gz" \
+            -o "$archive"
+          printf '%s  %s\n' "$checksum" "$archive" | sha256sum --check --status
+          tar -xzf "$archive" -C /usr/local/bin kubeconform
 
       - name: Render and schema-check manifests
         run: |

.gitleaks.toml

@@ -0,0 +1,12 @@
+# Extend the default gitleaks rules and ignore generated inline manifests.
+# These files contain Argo CD chart-generated TLS material (server certs,
+# repo-server certs, etc.) and are not human-managed secrets.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "generated Talos inline manifests"
+paths = [
+  '''omni\/patches\/.*-inline-manifests\.yaml''',
+  '''clusters\/.*\/omni\/inline-manifests\.yaml''',
+]

.mise.toml

@@ -2,10 +2,11 @@
 helm = "3.17.0"
 yq = "4"
 kubectl = "1.34"
+kubeconform = "0.8.0"
 
-[tasks."oci:generate-manifests"]
-description = "Regenerate OCI (oci-talos) Talos inline-manifests: argocd + cilium + appset"
-run = "omni/scripts/generate-manifests.sh oci-talos"
+[tasks."oci-lab:generate-manifests"]
+description = "Regenerate OCI (oci-lab) Talos inline-manifests: argocd + cilium + appset"
+run = "omni/scripts/generate-manifests.sh oci-lab"
 
 [tasks."unraid:generate-manifests"]
 description = "Regenerate unraid-lab Talos inline-manifests: argocd + appset"

README.md

@@ -16,7 +16,7 @@ The `omni/` directory is consumed by Omni tooling, not Argo CD.
 ```text
 bootstrap/              Root-synced Argo CD apps, including App-of-Apps and Tailscale operator
 infrastructure/         Helm charts + values, one directory per app
-clusters/oci/           Cluster-specific kustomize patches
+clusters/oci-lab/       Cluster-specific kustomize patches
 omni/                   Omni machine classes, patches, and cluster templates
 ```
 

apps/cilium/app.yaml

@@ -1,4 +1,4 @@
 chart: cilium
 repoURL: https://helm.cilium.io
-version: "1.17.18"
+version: "1.19.6"
 namespace: kube-system

apps/radar/app.yaml

@@ -0,0 +1,5 @@
+# App coordinates consumed by the layering ApplicationSet.
+chart: radar
+repoURL: https://skyhook-io.github.io/helm-charts
+version: "1.8.6"
+namespace: radar

appset.yaml

@@ -76,10 +76,25 @@ spec:
       destination:
         server: https://kubernetes.default.svc
         namespace: "{{.namespace}}"
+      # Harbor chart 1.15.1 renders empty subPath and annotations keys for its
+      # internal StatefulSets; Kubernetes omits both fields when persisting them.
+      ignoreDifferences:
+        - group: apps
+          kind: StatefulSet
+          name: harbor-database
+          jqPathExpressions:
+            - .spec.template.spec.containers[]?.volumeMounts[]?.subPath
+            - .spec.template.spec.initContainers[]?.volumeMounts[]?.subPath
+            - .spec.volumeClaimTemplates[]?.metadata.annotations
+        - group: apps
+          kind: StatefulSet
+          name: harbor-redis
+          jqPathExpressions:
+            - .spec.template.spec.containers[]?.volumeMounts[]?.subPath
+            - .spec.volumeClaimTemplates[]?.metadata.annotations
       syncPolicy:
         automated:
           prune: true
           selfHeal: true
         syncOptions:
           - CreateNamespace=true
-          - ServerSideApply=true

bootstrap/argocd-cm.yaml

@@ -0,0 +1,19 @@
+# Cilium creates CiliumIdentity resources at runtime from workload labels.
+# Exclude them globally so Argo CD never mistakes a generated identity for an
+# application resource and attempts to prune it.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  resource.exclusions: |
+    - apiGroups:
+        - cilium.io
+      kinds:
+        - CiliumIdentity
+      clusters:
+        - "*"

bootstrap/tailscale-operator.yaml

@@ -14,6 +14,10 @@ spec:
         oauth:
           clientId: ""      # set via Argo CD ApplicationSet or cluster secret
           clientSecret: ""  # set via Argo CD ApplicationSet or cluster secret
+        proxyConfig:
+          # Reuse the tag authorized for the operator; tag:k8s is not allowed
+          # by this tailnet and prevents Ingress proxy provisioning.
+          defaultTags: "tag:k8s-operator"
   destination:
     server: https://kubernetes.default.svc
     namespace: tailscale

clusters/unraid-lab/README.md

@@ -30,8 +30,8 @@ cluster template — see `omni-on-unraid` / the Omni machine config) must sync
   TLS.
 - [ ] Point the inline root Application at `clusters/unraid-lab/app-of-apps.yaml`
   (plus `bootstrap/`).
-- [ ] Set the real MagicDNS name in `apps/harbor/values.yaml`
-  (`externalURL` + `expose.ingress.hosts.core` → `harbor.<tailnet>.ts.net`).
+- [x] Set `values/base/harbor.yaml` to the real MagicDNS name
+  (`externalURL` + `expose.ingress.hosts.core` → `harbor.wind-bearded.ts.net`).
 - [ ] Create the `harbor-admin-password` Secret (`HARBOR_ADMIN_PASSWORD`) in the
   `harbor` namespace before first sync.
 - [ ] Create the `arc-gha-secret` GitHub App Secret in the `arc-runners`

clusters/unraid-lab/apps/arc-runners/application.yaml

@@ -22,7 +22,7 @@ spec:
           #   server: https://kubernetes.default.svc
           #   namespace: arc-runners
           #   scaleSetName: arc-runners-oci
-          #   valuesPath: clusters/oci/apps/arc-runners/values.yaml
+          #   valuesPath: clusters/oci-lab/apps/arc-runners/values.yaml
   template:
     metadata:
       name: "{{ .cluster }}-{{ .scaleSetName }}"

clusters/unraid-lab/apps/radar-pg/application.yaml

@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: radar-pg
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  sources:
+    - repoURL: git@github.com:syscode-labs/radar-postgre.git
+      targetRevision: 9f22278a615c5c2863fa6059c4ab7192c3e57cb6
+      path: deploy/helm/radar
+      helm:
+        releaseName: radar-pg
+        valueFiles:
+          - $values/values/clusters/unraid-lab/radar-pg.yaml
+    - repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: radar-pg
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true