Migrate k8s config from Terraform to Argo CD + ESO
Phase 1: Install External Secrets Operator via Argo CD app - apps/external-secrets.yaml — ESO Helm chart install - apps/external-secrets-config.yaml — ClusterSecretStore deployment - k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret Phase 2: Create k8s manifests for all services - k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress - k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress - k8s/github-runner/ — ExternalSecret (github-runner-secret) - k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret) - k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress - k8s/postgres/ — ExternalSecret (postgres-passwords) - k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault) - k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret - k8s/ollama/ — PVC, Ingress - k8s/headscale/ — PVC - k8s/packages/ — PVCs, ConfigMap, Ingresses - k8s/registry/ — PVC, Ingresses - k8s/backup/ — CronJob, ExternalSecret (backup-credentials) New Argo CD apps for Helm releases: - apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml - apps/postgres.yaml, redis.yaml, vault.yaml New Argo CD apps for k8s config paths: - apps/neuron-config, gitea-config, ci-config, gitea-runner-config - apps/monitoring-config, adguard-config, ollama-config, headscale-config - apps/packages-config, registry-config, postgres-config, vault-config, backup Phase 3: Strip Terraform to infrastructure-only - All kubernetes_* and helm_release resources removed from service .tf files - Each service .tf now contains only kubernetes_namespace (bootstrap dependency) - variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token - namespaces.tf gains external-secrets namespace - ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/) - cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)
This commit is contained in:
Will Anderson
+4
-243
@@ -1,243 +1,4 @@
|
||||
# Traefik ingress routes for all services — TLS via cert-manager + Cloudflare DNS-01
|
||||
# Kong and open-webui ingresses moved to inactive/ — restore when needed
|
||||
|
||||
resource "kubernetes_ingress_v1" "ollama" {
|
||||
metadata {
|
||||
name = "ollama"
|
||||
namespace = kubernetes_namespace.ollama.metadata[0].name
|
||||
annotations = {
|
||||
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
||||
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
tls {
|
||||
hosts = ["ollama.${var.infra_domain}"]
|
||||
secret_name = "ollama-tls"
|
||||
}
|
||||
rule {
|
||||
host = "ollama.${var.infra_domain}"
|
||||
http {
|
||||
path {
|
||||
path = "/"
|
||||
path_type = "Prefix"
|
||||
backend {
|
||||
service {
|
||||
name = "ollama"
|
||||
port { number = 11434 }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
depends_on = [helm_release.cert_manager]
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_ingress_v1" "registry" {
|
||||
metadata {
|
||||
name = "registry"
|
||||
namespace = kubernetes_namespace.registry.metadata[0].name
|
||||
annotations = {
|
||||
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
||||
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
||||
"traefik.ingress.kubernetes.io/router.middlewares" = "registry-chunked@kubernetescrd"
|
||||
"nginx.ingress.kubernetes.io/proxy-body-size" = "0"
|
||||
"nginx.ingress.kubernetes.io/proxy-read-timeout" = "600"
|
||||
"nginx.ingress.kubernetes.io/proxy-send-timeout" = "600"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
tls {
|
||||
hosts = ["registry.${var.infra_domain}"]
|
||||
secret_name = "registry-tls"
|
||||
}
|
||||
rule {
|
||||
host = "registry.${var.infra_domain}"
|
||||
http {
|
||||
path {
|
||||
path = "/"
|
||||
path_type = "Prefix"
|
||||
backend {
|
||||
service {
|
||||
name = "registry"
|
||||
port { number = 5000 }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
depends_on = [helm_release.cert_manager]
|
||||
}
|
||||
|
||||
resource "kubernetes_ingress_v1" "registry_ui" {
|
||||
metadata {
|
||||
name = "registry-ui"
|
||||
namespace = kubernetes_namespace.registry.metadata[0].name
|
||||
annotations = {
|
||||
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
||||
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
tls {
|
||||
hosts = ["docker.neuralplatform.ai"]
|
||||
secret_name = "docker-ui-tls"
|
||||
}
|
||||
rule {
|
||||
host = "docker.neuralplatform.ai"
|
||||
http {
|
||||
path {
|
||||
path = "/"
|
||||
path_type = "Prefix"
|
||||
backend {
|
||||
service {
|
||||
name = "registry-ui"
|
||||
port { number = 80 }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
depends_on = [helm_release.cert_manager]
|
||||
}
|
||||
|
||||
# npm registry — Verdaccio (proxies npmjs.org, caches locally)
|
||||
resource "kubernetes_ingress_v1" "npm_registry" {
|
||||
metadata {
|
||||
name = "npm-registry"
|
||||
namespace = kubernetes_namespace.packages.metadata[0].name
|
||||
annotations = {
|
||||
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
||||
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
tls {
|
||||
hosts = ["npm.neuralplatform.ai"]
|
||||
secret_name = "npm-registry-tls"
|
||||
}
|
||||
rule {
|
||||
host = "npm.neuralplatform.ai"
|
||||
http {
|
||||
path {
|
||||
path = "/"
|
||||
path_type = "Prefix"
|
||||
backend {
|
||||
service {
|
||||
name = "verdaccio"
|
||||
port { number = 4873 }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
depends_on = [helm_release.cert_manager]
|
||||
}
|
||||
|
||||
# Alloy OTLP HTTP ingress — external log/trace ingestion from RunPod pods
|
||||
# Auth: HTTP Basic Auth (username: pantheon, password: ALLOY_PUSH_TOKEN from Vault)
|
||||
# Pods set: Authorization: Basic base64(pantheon:<token>)
|
||||
# Traefik middleware strips auth before forwarding to Alloy.
|
||||
resource "kubernetes_manifest" "alloy_otlp_basicauth_middleware" {
|
||||
manifest = {
|
||||
apiVersion = "traefik.io/v1alpha1"
|
||||
kind = "Middleware"
|
||||
metadata = {
|
||||
name = "alloy-otlp-auth"
|
||||
namespace = "monitoring"
|
||||
}
|
||||
spec = {
|
||||
basicAuth = {
|
||||
secret = "alloy-otlp-auth"
|
||||
}
|
||||
}
|
||||
}
|
||||
depends_on = [kubernetes_secret.alloy_otlp_auth]
|
||||
}
|
||||
|
||||
resource "kubernetes_ingress_v1" "alloy_otlp" {
|
||||
metadata {
|
||||
name = "alloy-otlp"
|
||||
namespace = "monitoring"
|
||||
annotations = {
|
||||
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
||||
"traefik.ingress.kubernetes.io/router.middlewares" = "monitoring-alloy-otlp-auth@kubernetescrd"
|
||||
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
tls {
|
||||
hosts = ["alloy.${var.infra_domain}"]
|
||||
secret_name = "alloy-otlp-tls"
|
||||
}
|
||||
rule {
|
||||
host = "alloy.${var.infra_domain}"
|
||||
http {
|
||||
path {
|
||||
path = "/"
|
||||
path_type = "Prefix"
|
||||
backend {
|
||||
service {
|
||||
name = "alloy-otlp"
|
||||
port { number = 4318 }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
depends_on = [
|
||||
kubernetes_manifest.alloy_otlp_basicauth_middleware,
|
||||
kubernetes_service.alloy_otlp,
|
||||
helm_release.cert_manager,
|
||||
]
|
||||
}
|
||||
|
||||
# PyPI registry — devpi (proxies pypi.org, caches locally)
|
||||
resource "kubernetes_ingress_v1" "pypi_registry" {
|
||||
metadata {
|
||||
name = "pypi-registry"
|
||||
namespace = kubernetes_namespace.packages.metadata[0].name
|
||||
annotations = {
|
||||
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
||||
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
tls {
|
||||
hosts = ["pypi.neuralplatform.ai"]
|
||||
secret_name = "pypi-registry-tls"
|
||||
}
|
||||
rule {
|
||||
host = "pypi.neuralplatform.ai"
|
||||
http {
|
||||
path {
|
||||
path = "/"
|
||||
path_type = "Prefix"
|
||||
backend {
|
||||
service {
|
||||
name = "devpi"
|
||||
port { number = 3141 }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
depends_on = [helm_release.cert_manager]
|
||||
}
|
||||
# Ingresses — all moved to k8s/<service>/ingress.yaml, managed by Argo CD
|
||||
# See: k8s/neuron/ingress.yaml, k8s/gitea/ingress.yaml, k8s/ollama/ingress.yaml,
|
||||
# k8s/registry/ingress.yaml, k8s/packages/ingress.yaml,
|
||||
# k8s/monitoring/ingress.yaml, k8s/adguard/ingress.yaml
|
||||
|
||||
Reference in New Issue
Block a user