Migrate k8s config from Terraform to Argo CD + ESO
Phase 1: Install External Secrets Operator via Argo CD app - apps/external-secrets.yaml — ESO Helm chart install - apps/external-secrets-config.yaml — ClusterSecretStore deployment - k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret Phase 2: Create k8s manifests for all services - k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress - k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress - k8s/github-runner/ — ExternalSecret (github-runner-secret) - k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret) - k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress - k8s/postgres/ — ExternalSecret (postgres-passwords) - k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault) - k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret - k8s/ollama/ — PVC, Ingress - k8s/headscale/ — PVC - k8s/packages/ — PVCs, ConfigMap, Ingresses - k8s/registry/ — PVC, Ingresses - k8s/backup/ — CronJob, ExternalSecret (backup-credentials) New Argo CD apps for Helm releases: - apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml - apps/postgres.yaml, redis.yaml, vault.yaml New Argo CD apps for k8s config paths: - apps/neuron-config, gitea-config, ci-config, gitea-runner-config - apps/monitoring-config, adguard-config, ollama-config, headscale-config - apps/packages-config, registry-config, postgres-config, vault-config, backup Phase 3: Strip Terraform to infrastructure-only - All kubernetes_* and helm_release resources removed from service .tf files - Each service .tf now contains only kubernetes_namespace (bootstrap dependency) - variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token - namespaces.tf gains external-secrets namespace - ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/) - cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)
This commit is contained in:
Will Anderson
+2
-137
@@ -1,137 +1,2 @@
|
||||
# Legion backup — restic to Cloudflare R2
|
||||
# Dumps all Postgres databases + Gitea data nightly at 2am
|
||||
# Retains 30 daily / 12 weekly / 6 monthly snapshots
|
||||
|
||||
resource "kubernetes_secret" "backup_credentials" {
|
||||
metadata {
|
||||
name = "backup-credentials"
|
||||
namespace = "git"
|
||||
}
|
||||
|
||||
data = {
|
||||
RESTIC_PASSWORD = "gitea-restic-2026"
|
||||
AWS_ACCESS_KEY_ID = var.r2_access_key_id
|
||||
AWS_SECRET_ACCESS_KEY = var.r2_secret_access_key
|
||||
RESTIC_REPOSITORY = "s3:${var.r2_endpoint}/legion-gitea-backup"
|
||||
PGPASSWORD = var.postgres_password
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_cron_job_v1" "gitea_backup" {
|
||||
metadata {
|
||||
name = "gitea-backup"
|
||||
namespace = "git"
|
||||
}
|
||||
|
||||
spec {
|
||||
schedule = "0 2 * * *"
|
||||
concurrency_policy = "Forbid"
|
||||
failed_jobs_history_limit = 3
|
||||
successful_jobs_history_limit = 3
|
||||
|
||||
job_template {
|
||||
metadata {}
|
||||
spec {
|
||||
backoff_limit = 2
|
||||
template {
|
||||
metadata {}
|
||||
spec {
|
||||
restart_policy = "OnFailure"
|
||||
|
||||
# Dump all Postgres databases before restic runs
|
||||
init_container {
|
||||
name = "pg-dump"
|
||||
image = "postgres:18-alpine"
|
||||
|
||||
command = ["/bin/sh", "-c",
|
||||
"pg_dumpall -h postgres-postgresql.platform.svc.cluster.local -U postgres --no-role-passwords > /dump/all-databases.sql && echo 'DB dump complete, size:' $(du -sh /dump/all-databases.sql)"
|
||||
]
|
||||
|
||||
env_from {
|
||||
secret_ref {
|
||||
name = kubernetes_secret.backup_credentials.metadata[0].name
|
||||
}
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
name = "dump"
|
||||
mount_path = "/dump"
|
||||
}
|
||||
|
||||
resources {
|
||||
requests = { memory = "128Mi", cpu = "100m" }
|
||||
limits = { memory = "256Mi" }
|
||||
}
|
||||
}
|
||||
|
||||
container {
|
||||
name = "backup"
|
||||
image = "restic/restic:latest"
|
||||
|
||||
command = ["/bin/sh", "-c", <<-EOT
|
||||
set -e
|
||||
|
||||
# Init repo if first run
|
||||
restic snapshots 2>/dev/null || restic init
|
||||
|
||||
# Back up Gitea data + full DB dump
|
||||
echo "Running restic backup..."
|
||||
restic backup \
|
||||
/gitea-data \
|
||||
/dump/all-databases.sql \
|
||||
--tag legion \
|
||||
--host legion
|
||||
|
||||
# Prune old snapshots
|
||||
restic forget \
|
||||
--keep-daily 30 \
|
||||
--keep-weekly 12 \
|
||||
--keep-monthly 6 \
|
||||
--prune
|
||||
|
||||
echo "Backup complete."
|
||||
restic snapshots --latest 3
|
||||
EOT
|
||||
]
|
||||
|
||||
env_from {
|
||||
secret_ref {
|
||||
name = kubernetes_secret.backup_credentials.metadata[0].name
|
||||
}
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
name = "gitea-data"
|
||||
mount_path = "/gitea-data"
|
||||
read_only = true
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
name = "dump"
|
||||
mount_path = "/dump"
|
||||
}
|
||||
|
||||
resources {
|
||||
requests = { memory = "256Mi", cpu = "100m" }
|
||||
limits = { memory = "512Mi" }
|
||||
}
|
||||
}
|
||||
|
||||
volume {
|
||||
name = "gitea-data"
|
||||
persistent_volume_claim {
|
||||
claim_name = "gitea-data"
|
||||
read_only = true
|
||||
}
|
||||
}
|
||||
|
||||
volume {
|
||||
name = "dump"
|
||||
empty_dir {}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
# Legion backup — CronJob and secret managed by Argo CD + ESO
|
||||
# See: apps/backup.yaml, k8s/backup/
|
||||
|
||||
Reference in New Issue
Block a user