unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 6 Actions Packages Projects Releases Wiki Activity
344 Commits 30 Branches 0 Tags
f268c4d9ba775b26e484349d39e06d9f445f4194
Commit Graph

3 Commits

Author SHA1 Message Date
unkin-agent f268c4d9ba ghp: probe/scrape over HTTPS to match TLS metrics endpoint
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details 
ghp serves metrics over HTTPS (TLS configured globally), but the
liveness/readiness probes used the default HTTP scheme, so the kubelet
probe hit an HTTPS-server error and pods never went Ready. Set
scheme: HTTPS on both probes (kubelet does not verify the probe cert).

The VMServiceScrape targets that same HTTPS endpoint, so set scheme:
https with tlsConfig.insecureSkipVerify (internal-CA cert, pod-IP target
not in the cert SANs); otherwise VM scraping of ghp fails.

- deployment.yaml: liveness+readiness probes scheme HTTP -> HTTPS
- vmservicescrape.yaml: scheme https + tlsConfig.insecureSkipVerify
 2026-08-13 21:39:38 +10:00
unkin-agent 2969b6145c ghp: use direct ghcr.io image + set GHP_ADMINS 
Kubelet pulls hit ImagePullBackOff on the artifactapi ghcr pull-through
because ghcr.io's per-scope token auth is not proxied for anonymous
pulls. Switch the serve Deployment and migrate Job to the direct public
image (pulls anonymously) and set the admin to neoloc.

- deployment.yaml: image -> ghcr.io/goodtune/ghp:0.20.0
- migrate-job.yaml: image -> ghcr.io/goodtune/ghp:0.20.0
- configmap.yaml: GHP_ADMINS -> neoloc
 2026-08-13 21:35:37 +10:00
unkin-agent fa1f3e7756 add ghp (GitHub proxy) deployment (#357) 
## Why
Deploy `goodtune/ghp` (a GitHub proxy) so estate agents have a controlled GitHub access path. Mirrors the artifactapi app structure and the estate's templated `default` Vault convention.

## How (this PR)
- Namespace `ghp`. Runs as the namespace's auto-created `default` ServiceAccount (no custom SA).
- CNPG `Cluster` (named `postgres`, db/owner `ghp`) + dedicated `cnpg-ghp` Ceph RGW backup bucket + nightly ScheduledBackup.
- Deployment `command: ["/ghp","serve"]`; `GHP_DATABASE_DSN` assembled from the CNPG-generated `postgres-app` Secret via `$(VAR)` expansion pointing at `postgres-rw.ghp.svc`.
- **Sync-phase migrate hook Job** `ghp-migrate` (`/ghp migrate`) at sync-wave 1 so serve replicas never race migrations.
- VSO wiring on the templated `default` role: `VaultAuth` role/SA `default`; `VaultStaticSecret`s source `kv/kubernetes/namespace/ghp/default/github-app` → Secret `ghp-github-app` and `kv/kubernetes/namespace/ghp/default/app` → Secret `ghp-app`. `private_key` mounted as a file; `encryption_key` → `GHP_ENCRYPTION_KEY`.
- cert-manager `Certificate` `ghp-tls` off ClusterIssuer `vault-issuer`, SANs github.com/api.github.com/codeload.github.com/*.githubcopilot.com/ghp.k8s.syd1.au.unkin.net; mounted for `GHP_TLS_CERT_FILE`/`GHP_TLS_KEY_FILE`.
- Service (443->8443, 80->8080, metrics 9136), PDB, VMServiceScrape, internal Traefik Gateway + HTTPRoute for `ghp.k8s.syd1.au.unkin.net`.
- Sync-wave ordering: DB + VSO/cert (wave 0, wait Healthy) -> migrate Job (wave 1) -> serve Deployment + Service/Gateway/HTTPRoute (wave 2). Writable `/tmp` emptyDir on both pods (root FS is read-only).
- Registered in the `platform` ApplicationSet + AppProject.
- Validation: `kustomize build` clean, kubeconform 17/17 valid (0 skipped), yamllint + pre-commit clean.

## NOTE — prerequisites before ghp goes Healthy
- **`GHP_ADMINS` placeholder**: `apps/base/ghp/configmap.yaml` has `GHP_ADMINS: "REPLACE_ME_ben_github_username"` — set it to Ben's GitHub username.
- Ben's GitHub-App runbook + kv population at the templated paths `kv/kubernetes/namespace/ghp/default/github-app` (app_id/client_id/client_secret/private_key) and `kv/kubernetes/namespace/ghp/default/app` (encryption_key).
- tf-artifactapi #25: the `ghcr` remote pattern for pulling `ghcr/goodtune/ghp`.
- **No terraform-vault change needed** — the estate's templated `default` policy already grants read on `kv/kubernetes/namespace/<ns>/default/*` (the bespoke ghp role PR terraform-vault#120 is closed).
- DNS overrides (pointing github.com etc. at ghp) are intentionally **out of scope** — separate deferred bind-operator PR.

Assumptions flagged: metrics env var `GHP_METRICS_LISTEN`; two Secrets (`ghp-github-app` + `ghp-app`) rather than one merged Secret; DSN assumes the CNPG-generated password is URL-safe.

Reviewed-on: #357
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
 2026-08-13 20:08:30 +10:00