From b6f8f36c5bd2801082352abda11bff7d7d77452f Mon Sep 17 00:00:00 2001 From: ahmza Date: Thu, 3 Sep 2026 01:54:37 +0100 Subject: [PATCH] Point Argo CD at Gitea and configure storage workers --- apps/demo.yaml | 2 +- apps/longhorn.yaml | 4 ++-- apps/longhorn/values.yaml | 8 +++++++ apps/metallb.yaml | 2 +- argocd/README.md | 14 ++++++----- argocd/app-of-apps/app-of-apps.yaml | 8 +++---- docs/04-app-of-apps.md | 37 ++++++++++++++--------------- docs/network.md | 10 ++++---- 8 files changed, 47 insertions(+), 38 deletions(-) diff --git a/apps/demo.yaml b/apps/demo.yaml index e1e6ac5..d3ba055 100644 --- a/apps/demo.yaml +++ b/apps/demo.yaml @@ -28,7 +28,7 @@ spec: project: default source: - repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git + repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git targetRevision: main path: apps/demo diff --git a/apps/longhorn.yaml b/apps/longhorn.yaml index 70af09c..f3b9e1a 100644 --- a/apps/longhorn.yaml +++ b/apps/longhorn.yaml @@ -3,7 +3,7 @@ # (apps/longhorn/) that pulls in the official upstream chart. Once this # syncs, any app in this cluster can request persistent storage (a # PersistentVolumeClaim) and actually get real, replicated storage backed -# by the dedicated disk each node prepared in +# by the dedicated disk each worker prepared with # talos/patch-longhorn.yaml — see docs/06-longhorn.md. # # Longhorn needs privileged Pods (it manages block devices directly) and @@ -20,7 +20,7 @@ spec: project: default source: - repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git + repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git targetRevision: main path: apps/longhorn diff --git a/apps/longhorn/values.yaml b/apps/longhorn/values.yaml index 4d8d550..47fba81 100644 --- a/apps/longhorn/values.yaml +++ b/apps/longhorn/values.yaml @@ -8,6 +8,14 @@ longhorn: # on the root filesystem, which on Talos is ephemeral/unsuited for # real data anyway. defaultDataPath: /var/mnt/longhorn + # Only nodes explicitly labelled `node.longhorn.io/create-default-disk=true` + # become storage nodes. This keeps Longhorn from trying to create a disk on + # the Raspberry Pi control planes, which deliberately have no data disk. + createDefaultDiskLabeledNodes: true + # There are two independent storage workers, one on Gimli and one on + # Titus. Three replicas could never schedule; two keeps one complete copy + # on each host and remains readable if either worker fails. + defaultReplicaCount: 2 # Longhorn's own headroom settings, kept conservative: stop scheduling # new replicas onto a disk once free space drops below these # thresholds, so the cluster degrades gracefully instead of actually diff --git a/apps/metallb.yaml b/apps/metallb.yaml index 0311e99..c9a56d6 100644 --- a/apps/metallb.yaml +++ b/apps/metallb.yaml @@ -25,7 +25,7 @@ spec: project: default source: - repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git + repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git targetRevision: main path: apps/metallb diff --git a/argocd/README.md b/argocd/README.md index 8cbc574..dbca6bf 100644 --- a/argocd/README.md +++ b/argocd/README.md @@ -83,16 +83,18 @@ argocd account update-password [`app-of-apps/app-of-apps.yaml`](app-of-apps/app-of-apps.yaml) is the one manifest in this whole repo you apply by hand — everything after it, Argo -CD applies for you. First, every Application manifest needs its own -`repoURL` pointed at your fork (they don't inherit it from each other): +CD applies for you. Every Application manifest has its own `repoURL` +because child Applications do not inherit it from their parent. Verify they +all point at this cluster's public Gitea repository: ```sh -grep -rl YOUR_GITHUB_USERNAME . +grep -R "repoURL:" argocd/app-of-apps apps/*.yaml +git ls-remote https://tea.ahmza.com/ahmza/k8s-starter-pack.git HEAD ``` -Edit `spec.source.repoURL` in each file that command finds, commit, and -push — the child Applications are read from Git, not your local disk, so -this has to land in your fork before the next step. Then: +The remote check must succeed without credentials. Commit and push any +pending changes before continuing — child Applications read from Git, not +your local disk. Then: ```sh kubectl apply -f argocd/app-of-apps/app-of-apps.yaml diff --git a/argocd/app-of-apps/app-of-apps.yaml b/argocd/app-of-apps/app-of-apps.yaml index 605798a..4012781 100644 --- a/argocd/app-of-apps/app-of-apps.yaml +++ b/argocd/app-of-apps/app-of-apps.yaml @@ -4,9 +4,9 @@ # gets applied automatically, because this Application's job is to watch # that folder. # -# Before applying this file, edit spec.source.repoURL below to point at YOUR -# fork of this repo (Argo CD needs to clone it, so it must be a real URL it -# can reach — not this template's URL). +# The repoURL below is this cluster's public Gitea repository. Argo CD clones +# it over HTTPS from inside the cluster, so anonymous read access must keep +# working even though pushes still authenticate over SSH. # # >> Ask Claude: "why does the app-of-apps live in argocd/app-of-apps # instead of inside apps/ with everything else?" before moving on — the @@ -20,7 +20,7 @@ spec: project: default source: - repoURL: https://github.com/YOUR_GITHUB_USERNAME/k8s-starter-pack.git + repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git targetRevision: main path: apps directory: diff --git a/docs/04-app-of-apps.md b/docs/04-app-of-apps.md index 301c408..b7e2ea7 100644 --- a/docs/04-app-of-apps.md +++ b/docs/04-app-of-apps.md @@ -54,30 +54,29 @@ already doing. ## Every Application needs its own `repoURL` Applications don't inherit `repoURL` from whatever applied them — each one -declares its own source repo independently. That means the placeholder -`https://github.com/YOUR_GITHUB_USERNAME/...` needs fixing in *every* file -that has it, not just the one you apply by hand: +declares its own source repo independently. All four initial Applications +therefore point explicitly at this cluster's public Gitea repository: +`https://tea.ahmza.com/ahmza/k8s-starter-pack.git`. Anonymous read access is +required because Argo CD clones it from inside the cluster without a stored +Git credential. + +Verify every source before applying the app-of-apps: ```sh -grep -rl YOUR_GITHUB_USERNAME . +grep -R "repoURL:" argocd/app-of-apps apps/*.yaml ``` -You should see four files: `argocd/app-of-apps/app-of-apps.yaml`, -`apps/demo.yaml`, `apps/metallb.yaml`, and `apps/longhorn.yaml`. Edit -`spec.source.repoURL` in each to point at your fork. +The command should show the same Gitea URL in +`argocd/app-of-apps/app-of-apps.yaml`, `apps/demo.yaml`, `apps/metallb.yaml`, +and `apps/longhorn.yaml`. ## Steps -1. Fix `repoURL` in all four files (above). -2. Commit and push — this part matters more than it looks: the - app-of-apps reads `apps/demo.yaml`, `apps/metallb.yaml`, and - `apps/longhorn.yaml` *from Git*, not from your local edits, so they - have to be pushed before you apply anything. - ```sh - git add argocd/app-of-apps/app-of-apps.yaml apps/demo.yaml apps/metallb.yaml apps/longhorn.yaml - git commit -m "Point Applications at my fork" - git push - ``` +1. Verify `repoURL` in all four files (above) and confirm anonymous access + with `git ls-remote https://tea.ahmza.com/ahmza/k8s-starter-pack.git HEAD`. +2. Commit and push any pending configuration first. This matters more than it + looks: the app-of-apps reads its children *from Git*, not from your local + checkout, so local-only edits cannot affect the cluster. 3. Apply the app-of-apps — the one manifest you apply by hand: ```sh kubectl apply -f argocd/app-of-apps/app-of-apps.yaml @@ -112,8 +111,8 @@ end to end; you just can't see the demo app in a browser yet. ## Checklist -- [ ] `repoURL` fixed in all four files listed above -- [ ] Fix committed and pushed +- [ ] The public Gitea `repoURL` is present in all four files listed above +- [ ] Anonymous `git ls-remote` succeeds and all pending changes are pushed - [ ] `app-of-apps` applied and shows `Synced`/`Healthy` - [ ] `demo`, `metallb`, and `longhorn` Applications appeared automatically, all `Synced`/`Healthy` diff --git a/docs/network.md b/docs/network.md index 6664fd6..c704b27 100644 --- a/docs/network.md +++ b/docs/network.md @@ -25,11 +25,11 @@ on every node. | Address | What | Port(s) | URL(s) | |---|---|---|---| -| `10.10.10.200` | `talos-m4x-o87` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.200:6443`, `https://10.10.10.200:50000` | -| `10.10.10.201` | `talos-woj-ep6` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.201:6443`, `https://10.10.10.201:50000` | -| `10.10.10.202` | `talos-s2g-djt` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.202:6443`, `https://10.10.10.202:50000` | -| `10.10.10.203` | `worker01` — worker (Proxmox VM) | 50000 | `https://10.10.10.203:50000` | -| `10.10.10.204` | `worker02` — worker (Proxmox VM) | 50000 | `https://10.10.10.204:50000` | +| `10.10.10.200` | `talos-455-i3b` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.200:6443`, `https://10.10.10.200:50000` | +| `10.10.10.201` | `talos-9xy-iuk` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.201:6443`, `https://10.10.10.201:50000` | +| `10.10.10.202` | `talos-k1b-7j5` — control plane (Raspberry Pi 4) | 6443, 50000 | `https://10.10.10.202:6443`, `https://10.10.10.202:50000` | +| `10.10.10.203` | `talos-rss-v5l` — worker01 (Proxmox VM on Gimli) | 50000 | `https://10.10.10.203:50000` | +| `10.10.10.204` | `talos-vba-ood` — worker02 (Proxmox VM on Titus) | 50000 | `https://10.10.10.204:50000` | | `10.10.10.210` | Cluster VIP (use this one, not a node's own address) | 6443 | `https://10.10.10.210:6443` | ## MetalLB pool