Bernd Rodler
177b2aca57
Direct SSH access to the actual clusters (node1-3 "prod" HA, dev-k8s-1-3
"dev") revealed two things that made the previous design wrong:
1. Neither cluster has vncmail/vnc-ca namespaces or a bulwark ingress at
all - the "live sandbox" referenced in this repo's docs/manifests was
never actually applied anywhere. Both ingress.yaml's ingressClassName
(public) and cert-manager issuer (letsencrypt-prod) were also wrong:
both clusters run Traefik (class is literally named `traefik`), and
only dev-k8s has any ClusterIssuer at all (`letsencrypt-staging`).
node1-3 has zero ClusterIssuers configured.
2. dev-k8s already has ArgoCD installed, idle, zero Applications - more
idiomatic to use it than have GitLab Runner execute kubectl directly.
Pivots .gitlab-ci.yml: build+push image, then commit the tag into a small
per-overlay Component (overlays/{dev,prod}/image-tag/) that ArgoCD's
Application watches - CI never touches the cluster, only the registry and
this repo. dev's Application (vncmail-dev) is registered and applied
already (manual sync for now, until the one-time namespace secret
bootstrap is done - see VNCMAIL-SETUP.md). prod's Application is
scaffolded in deploy/argocd/ but deliberately not applied - it targets a
different cluster (node1-3) that isn't registered with ArgoCD yet, and
there's still no real prod hostname/Stalwart/ClusterIssuer.
Fixes base/ingress.yaml to the real ingressClassName: traefik (was the
nginx-style `public`, which doesn't exist on either cluster) and gives
each overlay its own cert-manager issuer patch instead of one hardcoded
value, since dev and prod need different (or, for prod, nonexistent)
issuers.
31 lines
1.2 KiB
YAML
31 lines
1.2 KiB
YAML
# NOT YET APPLIED to any cluster. Scaffolding only, matching
|
|
# deploy/k8s/overlays/prod's own "inert until Phase D" status.
|
|
#
|
|
# Unlike vncmail-dev-app.yaml, this targets a DIFFERENT cluster (node1-3,
|
|
# the HA "prod" cluster) than the one ArgoCD itself runs on (dev-k8s).
|
|
# That means before this can be applied, node1-3 needs to be registered as
|
|
# an ArgoCD-managed cluster (`argocd cluster add`, or an equivalent
|
|
# ServiceAccount+kubeconfig secret) — deliberately not done yet: there's no
|
|
# reason to wire cross-cluster RBAC into the prod HA cluster before prod
|
|
# hostname/Stalwart/secrets are real and someone's actually promoting.
|
|
#
|
|
# syncPolicy has no automated block at all, and won't get one even later —
|
|
# prod stays manual-sync-only permanently. That's the promotion gate.
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: vncmail-prod
|
|
namespace: argocd
|
|
spec:
|
|
project: default
|
|
source:
|
|
repoURL: git@gitlab.vnc.biz:gitlab-instance-b9b5cf2f/vncmail-plus.git
|
|
targetRevision: main
|
|
path: deploy/k8s/overlays/prod
|
|
destination:
|
|
server: CHANGEME # the node1-3 cluster's registered ArgoCD server URL, once added
|
|
namespace: vncmail-prod
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|