0dee133377
- Move Keycloak off Helm to plain Crossplane Object manifests (PostgreSQL + Keycloak deployment) - Add Vaultwarden SSO/OIDC config with Keycloak, fix Recreate deployment strategy for RWO volumes - Switch routing from Helm-based Pomerium to pomerium-allinone with all service routes - Deploy Argo Workflows (controller, server, CRDs, RBAC) with KEDA queue-depth autoscaling - Add Civo cluster autoscaler with pool-scaler for zero-to-one scale-up via Civo API - Add node-labeler to auto-tag nodes by pool membership for nodeSelector scheduling - Set up mTLS container registry at registry.nge6.com (Forgejo built-in, client cert required) - Add internal registry route (registry-internal.nge6.com) for in-cluster image pulls - Fix DNS records for new Emissary LB IP (212.2.241.28) - Fix CoreDNS crash from invalid custom config - Fix Emissary apiext expired webhook CA certificate Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
37 lines
No EOL
722 B
YAML
37 lines
No EOL
722 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
# Core infrastructure
|
|
- providers.yaml
|
|
- provider-configs.yaml
|
|
- namespaces.yaml
|
|
- external-dns.yaml
|
|
- ambassador-listeners.yaml
|
|
|
|
# Certificate management
|
|
- cert-manager/
|
|
|
|
# Authentication system
|
|
- auth/
|
|
- keycloak-config.yaml
|
|
|
|
# Secret management
|
|
- sealed-secrets.yaml
|
|
|
|
# Applications
|
|
- forgejo-k8s.yaml
|
|
- pomerium-allinone.yaml
|
|
- pomerium-dns.yaml
|
|
- vaultwarden.yaml
|
|
- keycloak-nge6-dns.yaml
|
|
|
|
# Argo Workflows
|
|
- argo-workflows/
|
|
|
|
# Exclude problematic directories:
|
|
# - flux/ (managed by Flux itself)
|
|
# - pomerium/ (Helm chart)
|
|
# - gitea/ (legacy, replaced by forgejo)
|
|
# - bin/ (binaries)
|
|
# - cookies.txt, DEPLOYMENT.md (not Kubernetes manifests) |