From dc02b3eebd990f18419153957e86af5330a3e09e Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 14 Aug 2026 00:29:15 +1000 Subject: [PATCH] Deploy k8up backup operator (platform, k8up-system) (#363) The k8up CRDs already exist in the cluster (owned by a separate `k8up-crds` Helm release) but the k8up operator itself was never deployed, so no k8up backup/restore custom resources are reconciled. This installs the operator following the cnpg-system pattern (Helm inflated via kustomize `helmCharts`) in the `platform` ArgoCD project, namespace `k8up-system`. - Add `apps/base/k8up-system/` (Namespace + kustomization). - Add `apps/overlays/au-syd1/k8up-system/` inflating the **k8up chart `4.10.0`** (pinned) from the artifactapi virtual-helm proxy: `replicaCount: 2` (leader election with hot-standby follower), operator resource requests/limits (20m/128Mi req, 500m/256Mi lim), and ServiceMonitor/PrometheusRule disabled (require Prometheus Operator CRDs). - Add a `PodDisruptionBudget` (`minAvailable: 1`) in the overlay, since the k8up chart exposes no native PDB value. - Register `apps/overlays/*/k8up-system` in the platform ApplicationSet. **CRD management:** The k8up chart ships its CRDs via the Helm `crds/` directory (there is no `installCRDs`/`skipCrds`/`enableCRDCreation` value). The kustomize helm inflator does not emit `crds/`, so `kustomize build` renders only the operator (Deployment, RBAC, SA, Service) and no CRDs. ArgoCD therefore does not fight the existing `k8up-crds` Helm release over CRD ownership. **platform.yaml (AppProject):** no change needed. The virtual-helm sourceRepo, the `*-system` destination, and the ClusterRole/ClusterRoleBinding/CRD/webhook clusterResourceWhitelist entries are already present and cover everything this app renders. **Validation:** `kustomize build --enable-helm apps/overlays/au-syd1/k8up-system` succeeds (Deployment replicas 2, PDB, Namespace, RBAC; 0 CRDs). `make kubeconform` reports k8up-system 14/14 valid; the only failure is the pre-existing, unrelated `cattle-system` rancher chart kubeVersion issue. pre-commit passes. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/363 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/k8up-system/kustomization.yaml | 6 ++++++ apps/base/k8up-system/namespace.yaml | 5 +++++ .../au-syd1/k8up-system/kustomization.yaml | 15 +++++++++++++++ .../k8up-system/poddisruptionbudget.yaml | 12 ++++++++++++ apps/overlays/au-syd1/k8up-system/values.yaml | 18 ++++++++++++++++++ argocd/applicationsets/platform.yaml | 1 + 6 files changed, 57 insertions(+) create mode 100644 apps/base/k8up-system/kustomization.yaml create mode 100644 apps/base/k8up-system/namespace.yaml create mode 100644 apps/overlays/au-syd1/k8up-system/kustomization.yaml create mode 100644 apps/overlays/au-syd1/k8up-system/poddisruptionbudget.yaml create mode 100644 apps/overlays/au-syd1/k8up-system/values.yaml diff --git a/apps/base/k8up-system/kustomization.yaml b/apps/base/k8up-system/kustomization.yaml new file mode 100644 index 0000000..5122f9e --- /dev/null +++ b/apps/base/k8up-system/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - namespace.yaml diff --git a/apps/base/k8up-system/namespace.yaml b/apps/base/k8up-system/namespace.yaml new file mode 100644 index 0000000..2ede6b2 --- /dev/null +++ b/apps/base/k8up-system/namespace.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: k8up-system diff --git a/apps/overlays/au-syd1/k8up-system/kustomization.yaml b/apps/overlays/au-syd1/k8up-system/kustomization.yaml new file mode 100644 index 0000000..585cac1 --- /dev/null +++ b/apps/overlays/au-syd1/k8up-system/kustomization.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - ../../../base/k8up-system + - poddisruptionbudget.yaml + +helmCharts: + - name: k8up + repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm + version: "4.10.0" + releaseName: k8up + namespace: k8up-system + valuesFile: values.yaml diff --git a/apps/overlays/au-syd1/k8up-system/poddisruptionbudget.yaml b/apps/overlays/au-syd1/k8up-system/poddisruptionbudget.yaml new file mode 100644 index 0000000..8a9cf76 --- /dev/null +++ b/apps/overlays/au-syd1/k8up-system/poddisruptionbudget.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: k8up + namespace: k8up-system +spec: + minAvailable: 1 + selector: + matchLabels: + app.kubernetes.io/name: k8up + app.kubernetes.io/instance: k8up diff --git a/apps/overlays/au-syd1/k8up-system/values.yaml b/apps/overlays/au-syd1/k8up-system/values.yaml new file mode 100644 index 0000000..e736888 --- /dev/null +++ b/apps/overlays/au-syd1/k8up-system/values.yaml @@ -0,0 +1,18 @@ +# CRDs are managed by the separate `k8up-crds` Helm release already present in +# the cluster; the k8up chart ships CRDs via its crds/ directory, which the +# kustomize helm inflator does not emit, so ArgoCD does not fight CRD ownership. +replicaCount: 2 + +resources: + limits: + cpu: 500m + memory: 256Mi + requests: + cpu: 20m + memory: 128Mi + +metrics: + serviceMonitor: + enabled: false # Requires Prometheus Operator CRDs. + prometheusRule: + enabled: false # Requires Prometheus Operator CRDs. diff --git a/argocd/applicationsets/platform.yaml b/argocd/applicationsets/platform.yaml index 22f8e08..97a4c39 100644 --- a/argocd/applicationsets/platform.yaml +++ b/argocd/applicationsets/platform.yaml @@ -31,6 +31,7 @@ spec: - path: apps/overlays/*/grafana-system - path: apps/overlays/*/inteldeviceplugins-system - path: apps/overlays/*/jfrog + - path: apps/overlays/*/k8up-system - path: apps/overlays/*/kanidm - path: apps/overlays/*/netbox - path: apps/overlays/*/node-feature-discovery