Debian
01bd921ced
- New: smart-home/home-assistant-dashboard-conventions (Mushroom cards, view tabs, no Bubble Cards) - Updated: rke2, ceph, galera, proxmox, brainstorming, compound-learning, 1password-cli, smart-home-automation skills - New references: ceph-cluster-administration, docker-volume-forensics, ceph-crush-weight, ceph-ec-mixed-size
67 lines
2.3 KiB
Markdown
67 lines
2.3 KiB
Markdown
# ArgoCD Self-Management Cutover — 2026-07-14
|
|
|
|
## Context
|
|
|
|
Migrating ArgoCD's Git source from external Gitea (CT108, LXC, `10.0.30.105:3000`)
|
|
to K8s-internal Gitea (Helm chart in `gitea` namespace, reachable via
|
|
Traefik VIP `10.0.30.203`). The chicken-and-egg problem: ArgoCD deploys
|
|
Gitea, but ArgoCD also pulls from Gitea.
|
|
|
|
## Sequence
|
|
|
|
### 1. CoreDNS Internal DNS Override
|
|
|
|
Added `hosts` plugin to CoreDNS via `HelmChartConfig` so `git.schoen.codes`
|
|
resolves to `10.0.30.203` (Traefik VIP) inside K8s — no public DNS needed.
|
|
|
|
**File:** `clusters/main/operators/coredns-config.yaml`
|
|
|
|
**Key pitfall:** Initial attempt used `valuesContent: corefile: |` —
|
|
silently ignored. The RKE2 CoreDNS chart uses `servers[].plugins[]`
|
|
structure. Fixed by using the correct chart values structure.
|
|
|
|
**Key pitfall:** HelmChartConfig was synched by ArgoCD but ConfigMap
|
|
didn't update until we directly patched it + waited 30s for CoreDNS
|
|
`reload` plugin to pick up the change.
|
|
|
|
### 2. ArgoCD Repository Secret
|
|
|
|
Created `argocd-repo-k8s-gitea` secret in `argocd` namespace with
|
|
URL, username, password, type=git.
|
|
|
|
**Critical pitfall:** Secret existed but ArgoCD showed
|
|
`authentication required: Unauthorized` because the secret was NOT
|
|
labeled with `argocd.argoproj.io/secret-type=repository`. Without this
|
|
label, ArgoCD does not recognize the secret as a repository credential.
|
|
|
|
### 3. ArgoCD Application URL Patching
|
|
|
|
Patched all 7 Applications (root + 6 children) from
|
|
`http://10.0.30.105:3000/dominik/iac-homelab.git` to
|
|
`http://git.schoen.codes/dominik/iac-homelab.git` using
|
|
`kubectl patch --type json`.
|
|
|
|
### 4. Verification
|
|
|
|
- Root app: `Synced/Healthy` ✅
|
|
- Revision: commit hash from new Gitea ✅
|
|
- All child apps converging ✅
|
|
|
|
## Result
|
|
|
|
ArgoCD now pulls from K8s Gitea via:
|
|
```
|
|
ArgoCD → git.schoen.codes → CoreDNS → 10.0.30.203 (Cilium VIP)
|
|
→ Traefik DaemonSet → Gitea pod
|
|
```
|
|
|
|
The entire GitOps loop is self-contained in K8s. CT108 kept as fallback.
|
|
|
|
## Files Changed
|
|
|
|
- `clusters/main/operators/coredns-config.yaml` — CoreDNS HelmChartConfig
|
|
- `clusters/main/proxy/traefik-lb-service.yaml` — Traefik LoadBalancer VIP
|
|
- `clusters/main/proxy/namespace.yaml` — proxy namespace
|
|
- `clusters/main/apps/proxy.yaml` — ArgoCD app for proxy namespace
|
|
- `docs/plans/2026-07-14-traefik-ct99999-k8s-migration.md` — migration plan
|