ahmza.com/k8s-starter-pack
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Point Argo CD at Gitea and configure storage workers

Browse Source
This commit is contained in:
ahmza
2026-09-03 01:54:37 +01:00
parent a5ddf11992
commit b6f8f36c5b
8 changed files with 47 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/demo.yaml
+1 -1
View File
@@ -28,7 +28,7 @@ spec:
project: default
source:
repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git
repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
targetRevision: main
path: apps/demo
apps/longhorn.yaml
+2 -2
View File
@@ -3,7 +3,7 @@
# (apps/longhorn/) that pulls in the official upstream chart. Once this
# syncs, any app in this cluster can request persistent storage (a
# PersistentVolumeClaim) and actually get real, replicated storage backed
# by the dedicated disk each node prepared in
# by the dedicated disk each worker prepared with
# talos/patch-longhorn.yaml — see docs/06-longhorn.md.
#
# Longhorn needs privileged Pods (it manages block devices directly) and
@@ -20,7 +20,7 @@ spec:
project: default
source:
repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git
repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
targetRevision: main
path: apps/longhorn
apps/longhorn/values.yaml
+8
View File
@@ -8,6 +8,14 @@ longhorn:
# on the root filesystem, which on Talos is ephemeral/unsuited for
# real data anyway.
defaultDataPath: /var/mnt/longhorn
# Only nodes explicitly labelled `node.longhorn.io/create-default-disk=true`
# become storage nodes. This keeps Longhorn from trying to create a disk on
# the Raspberry Pi control planes, which deliberately have no data disk.
createDefaultDiskLabeledNodes: true
# There are two independent storage workers, one on Gimli and one on
# Titus. Three replicas could never schedule; two keeps one complete copy
# on each host and remains readable if either worker fails.
defaultReplicaCount: 2
# Longhorn's own headroom settings, kept conservative: stop scheduling
# new replicas onto a disk once free space drops below these
# thresholds, so the cluster degrades gracefully instead of actually
apps/metallb.yaml
+1 -1
View File
@@ -25,7 +25,7 @@ spec:
project: default
source:
repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git
repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
targetRevision: main
path: apps/metallb
argocd/README.md
+8 -6
View File
@@ -83,16 +83,18 @@ argocd account update-password
[`app-of-apps/app-of-apps.yaml`](app-of-apps/app-of-apps.yaml) is the one
manifest in this whole repo you apply by hand — everything after it, Argo
CD applies for you. First, every Application manifest needs its own
`repoURL` pointed at your fork (they don't inherit it from each other):
CD applies for you. Every Application manifest has its own `repoURL`
because child Applications do not inherit it from their parent. Verify they
all point at this cluster's public Gitea repository:
```sh
grep -rl YOUR_GITHUB_USERNAME .
grep -R "repoURL:" argocd/app-of-apps apps/*.yaml
git ls-remote https://tea.ahmza.com/ahmza/k8s-starter-pack.git HEAD
```
Edit `spec.source.repoURL` in each file that command finds, commit, and
push — the child Applications are read from Git, not your local disk, so
this has to land in your fork before the next step. Then:
The remote check must succeed without credentials. Commit and push any
pending changes before continuing — child Applications read from Git, not
your local disk. Then:
```sh
kubectl apply -f argocd/app-of-apps/app-of-apps.yaml
argocd/app-of-apps/app-of-apps.yaml
+4 -4
View File
@@ -4,9 +4,9 @@
# gets applied automatically, because this Application's job is to watch
# that folder.
#
# Before applying this file, edit spec.source.repoURL below to point at YOUR
# fork of this repo (Argo CD needs to clone it, so it must be a real URL it
# can reach — not this template's URL).
# The repoURL below is this cluster's public Gitea repository. Argo CD clones
# it over HTTPS from inside the cluster, so anonymous read access must keep
# working even though pushes still authenticate over SSH.
#
# >> Ask Claude: "why does the app-of-apps live in argocd/app-of-apps
# instead of inside apps/ with everything else?" before moving on — the
@@ -20,7 +20,7 @@ spec:
project: default
source:
repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git
repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
targetRevision: main
path: apps
directory:
docs/04-app-of-apps.md
+18 -19
View File
@@ -54,30 +54,29 @@ already doing.
## Every Application needs its own `repoURL`
Applications don't inherit `repoURL` from whatever applied them — each one
declares its own source repo independently. That means the placeholder
`https://github.com/YOUR_GITHUB_USERNAME/...` needs fixing in *every* file
that has it, not just the one you apply by hand:
declares its own source repo independently. All four initial Applications
therefore point explicitly at this cluster's public Gitea repository:
`https://tea.ahmza.com/ahmza/k8s-starter-pack.git`. Anonymous read access is
required because Argo CD clones it from inside the cluster without a stored
Git credential.
Verify every source before applying the app-of-apps:
```sh
grep -rl YOUR_GITHUB_USERNAME .
grep -R "repoURL:" argocd/app-of-apps apps/*.yaml
```
You should see four files: `argocd/app-of-apps/app-of-apps.yaml`,
`apps/demo.yaml`, `apps/metallb.yaml`, and `apps/longhorn.yaml`. Edit
`spec.source.repoURL` in each to point at your fork.
The command should show the same Gitea URL in
`argocd/app-of-apps/app-of-apps.yaml`, `apps/demo.yaml`, `apps/metallb.yaml`,
and `apps/longhorn.yaml`.
## Steps
1. Fix `repoURL` in all four files (above).
2. Commit and push — this part matters more than it looks: the
app-of-apps reads `apps/demo.yaml`, `apps/metallb.yaml`, and
`apps/longhorn.yaml` *from Git*, not from your local edits, so they
have to be pushed before you apply anything.
```sh
git add argocd/app-of-apps/app-of-apps.yaml apps/demo.yaml apps/metallb.yaml apps/longhorn.yaml
git commit -m "Point Applications at my fork"
git push
```
1. Verify `repoURL` in all four files (above) and confirm anonymous access
with `git ls-remote https://tea.ahmza.com/ahmza/k8s-starter-pack.git HEAD`.
2. Commit and push any pending configuration first. This matters more than it
looks: the app-of-apps reads its children *from Git*, not from your local
checkout, so local-only edits cannot affect the cluster.
3. Apply the app-of-apps — the one manifest you apply by hand:
```sh
kubectl apply -f argocd/app-of-apps/app-of-apps.yaml
@@ -112,8 +111,8 @@ end to end; you just can't see the demo app in a browser yet.
## Checklist
- [ ] `repoURL` fixed in all four files listed above
- [ ] Fix committed and pushed
- [ ] The public Gitea `repoURL` is present in all four files listed above
- [ ] Anonymous `git ls-remote` succeeds and all pending changes are pushed
- [ ] `app-of-apps` applied and shows `Synced`/`Healthy`
- [ ] `demo`, `metallb`, and `longhorn` Applications appeared
automatically, all `Synced`/`Healthy`
docs/network.md
+5 -5
View File
@@ -25,11 +25,11 @@ on every node.
| Address | What | Port(s) | URL(s) |
|---|---|---|---|
| `10.10.10.200` | `talos-m4x-o87` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.200:6443`, `https://10.10.10.200:50000` |
| `10.10.10.201` | `talos-woj-ep6` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.201:6443`, `https://10.10.10.201:50000` |
| `10.10.10.202` | `talos-s2g-djt` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.202:6443`, `https://10.10.10.202:50000` |
| `10.10.10.203` | `worker01` — worker (Proxmox VM) | 50000 | `https://10.10.10.203:50000` |
| `10.10.10.204` | `worker02` — worker (Proxmox VM) | 50000 | `https://10.10.10.204:50000` |
| `10.10.10.200` | `talos-455-i3b` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.200:6443`, `https://10.10.10.200:50000` |
| `10.10.10.201` | `talos-9xy-iuk` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.201:6443`, `https://10.10.10.201:50000` |
| `10.10.10.202` | `talos-k1b-7j5` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.202:6443`, `https://10.10.10.202:50000` |
| `10.10.10.203` | `talos-rss-v5l` — worker01 (Proxmox VM on Gimli) | 50000 | `https://10.10.10.203:50000` |
| `10.10.10.204` | `talos-vba-ood` — worker02 (Proxmox VM on Titus) | 50000 | `https://10.10.10.204:50000` |
| `10.10.10.210` | Cluster VIP (use this one, not a node's own address) | 6443 | `https://10.10.10.210:6443` |
## MetalLB pool