ahmza.com/k8s-starter-pack
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Align 08-adding-new-apps with Gitea repo and Pod Security lesson

Browse Source
This commit is contained in:
ahmza
2026-09-03 03:50:43 +01:00
parent b45a633b99
commit 574d3032db
1 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/08-adding-new-apps.md
+14 -4
View File
@@ -22,9 +22,10 @@ To add a new app called, say, `whoami`:
2. Create `apps/whoami.yaml`, copied from [`apps/demo.yaml`](../apps/demo.yaml) 2. Create `apps/whoami.yaml`, copied from [`apps/demo.yaml`](../apps/demo.yaml)
with the names changed: `metadata.name`, `spec.source.repoURL` (still with the names changed: `metadata.name`, `spec.source.repoURL` (still
your fork — see [`docs/04-app-of-apps.md`](04-app-of-apps.md#every-application-needs-its-own-repourl) this cluster's public Gitea repository — see
for why every Application needs this set individually), `spec.source.path` [`docs/04-app-of-apps.md`](04-app-of-apps.md#every-application-needs-its-own-repourl)
(→ `apps/whoami`), and `spec.destination.namespace`. for why every Application needs this set individually, not inherited),
`spec.source.path` (→ `apps/whoami`), and `spec.destination.namespace`.
3. Commit and push both. That's it — no `kubectl apply`. The app-of-apps 3. Commit and push both. That's it — no `kubectl apply`. The app-of-apps
(already watching `apps/` — see (already watching `apps/` — see
@@ -40,6 +41,14 @@ If your new app needs storage, request it with a plain
itself as the cluster's default StorageClass, so it's used automatically. itself as the cluster's default StorageClass, so it's used automatically.
See [`docs/06-longhorn.md`](06-longhorn.md). See [`docs/06-longhorn.md`](06-longhorn.md).
If your new app needs `hostNetwork`, `hostPath` volumes, or privileged
containers (uncommon, but real for things like storage or networking
addons), Kubernetes' Pod Security Admission will reject it by default —
see `apps/metallb.yaml` and `apps/longhorn.yaml` for the working pattern:
an Application-level `syncPolicy.managedNamespaceMetadata.labels` opting
just that namespace into the `privileged` profile. Ordinary apps like
`whoami` never need this.
## Manifest-based vs. Helm-based apps ## Manifest-based vs. Helm-based apps
`apps/demo/` is plain Kubernetes manifests — no templating, nothing to `apps/demo/` is plain Kubernetes manifests — no templating, nothing to
@@ -83,7 +92,8 @@ address shows up in it.
- [ ] New app's manifests live in `apps/<name>/` - [ ] New app's manifests live in `apps/<name>/`
- [ ] New `apps/<name>.yaml` Application created, modeled on `demo.yaml` - [ ] New `apps/<name>.yaml` Application created, modeled on `demo.yaml`
- [ ] `repoURL` set to your fork, not left as a placeholder - [ ] `repoURL` set to this cluster's public Gitea repository, not left as
a placeholder
- [ ] Pushed to Git - [ ] Pushed to Git
- [ ] `argocd app list` shows the new app, `Synced`/`Healthy` - [ ] `argocd app list` shows the new app, `Synced`/`Healthy`
- [ ] If it has a `LoadBalancer` Service, its address is recorded in `docs/network.md` - [ ] If it has a `LoadBalancer` Service, its address is recorded in `docs/network.md`