feat: migrate cnpg-system from Terraform to ArgoCD

- Add cnpg-system base ArgoCD application with namespace
- Create cnpg-system overlay for au-syd1 with CloudNativePG Helm chart
- Update platform ApplicationSet to include cnpg-system deployment
- Configure cloudnative-pg operator v0.27.0 with HA and resource limits
- Maintain one-to-one migration from Terraform configuration

.woodpecker/kubeconform.yaml

@@ -3,6 +3,6 @@ when:
 
 steps:
   - name: kubeconform
-    image: git.unkin.net/unkin/almalinux9-kubetest:20260319
+    image: git.unkin.net/unkin/almalinux9-kubetest:20260308
     commands:
       - make kubeconform

apps/base/cattle-system/ingress.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: rancher
-  namespace: cattle-system
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-        - rancher.k8s.syd1.au.unkin.net
-      secretName: rancher-tls
-  rules:
-    - host: rancher.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: rancher
-                port:
-                  number: 80

apps/base/cattle-system/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-  - ingress.yaml

apps/base/cattle-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cattle-system

apps/base/cattle-system/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: rancher
-  namespace: cattle-system
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - cattle-system
-  kubernetes:
-    role: rancher
-    serviceAccount: rancher
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600

apps/base/cattle-system/vaultstaticsecret.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: rancher-bootstrap-secret
-  namespace: cattle-system
-spec:
-  vaultAuthRef: rancher
-  mount: kv
-  type: kv-v2
-  path: service/kubernetes/au/syd1/rancher/bootstrap-password
-  refreshAfter: 5m
-  destination:
-    name: rancher-bootstrap-secret
-    create: true

apps/base/cert-manager/clusterrole.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: cert-manager-vault-token-creator
-  labels:
-    app.kubernetes.io/name: "cert-manager-config"
-    app.kubernetes.io/instance: "cert-manager-config"
-rules:
-- apiGroups: [""]
-  resources: ["serviceaccounts/token"]
-  verbs: ["create"]

apps/base/cert-manager/clusterrolebinding.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: cert-manager-vault-token-creator
-  labels:
-    app.kubernetes.io/name: "cert-manager-config"
-    app.kubernetes.io/instance: "cert-manager-config"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cert-manager-vault-token-creator
-subjects:
-- kind: ServiceAccount
-  name: cert-manager
-  namespace: cert-manager

apps/base/cert-manager/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - serviceaccount.yaml
-  - clusterrole.yaml
-  - clusterrolebinding.yaml

apps/base/cert-manager/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager

apps/base/cert-manager/serviceaccount.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault-issuer
-  namespace: cert-manager
-  labels:
-    app.kubernetes.io/name: "cert-manager-config"
-    app.kubernetes.io/instance: "cert-manager-config"
-    app.kubernetes.io/component: "vault-issuer"
-automountServiceAccountToken: true

apps/base/certificates/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vault-ca-cert.yaml

apps/base/certificates/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: certificates

apps/base/certificates/vault-ca-cert.yaml

@@ -1,59 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: vault-ca-cert
-  namespace: certificates
-  labels:
-    app.kubernetes.io/name: vault-ca-cert
-    app.kubernetes.io/part-of: vault-secrets-operator
-  annotations:
-    description: "Vault CA certificate replicated to all namespaces"
-    reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
-    reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
-    reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: ""
-type: Opaque
-stringData:
-  ca.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIDujCCAqKgAwIBAgIULZAR/QcvAnxdi04S6bXhNeazozYwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMzcyMloXDTI5MDQy
-    NjExMzc1MlowKzEpMCcGA1UEAxMgdW5raW4ubmV0IEludGVybWVkaWF0ZSBBdXRo
-    b3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDq0ZU2DnuYW5s
-    E3lPjVe2Ns6cPu64yx1GLVqB5VbOUs71ThRjPjvEwE98YtGMza8ok0CQSqS2qX8z
-    vnMbnVCaWKjCnem/dtQtB+8WCu5uQuNHhwqxgw1tD/klAkVLWGgTPDEgasvjDMkc
-    sW8in/BhtrV9YA/lQGpge+j9/MFXhlnvaLCPybFifPRX9Yc5CcnhSzLSzFPO4PJx
-    VH4Qu9eByyKHMTvgcCy6p9qjjzz+8dtAlxeIsgfTEdvtfCPowsF+v2XooutTsJt0
-    xUDvUDu4xV6tVCEOYRA2cZHkLRBhV289M0hocHrsGqMmA1+j0skwwt/6UkVHqlCT
-    mitItX+RAgMBAAGjgewwgekwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFEp/+grAdVqRSeb9xJjSeZYNW32MMB8GA1UdIwQYMBaAFBqc
-    v6Y+hfHt4EjgKa/uoQGEHTknMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAoYr
-    aHR0cHM6Ly92YXVsdC5zZXJ2aWNlLmNvbnN1bC92MS9wa2lfcm9vdC9jYTA9BgNV
-    HR8ENjA0MDKgMKAuhixodHRwczovL3ZhdWx0LnNlcnZpY2UuY29uc3VsL3YxL3Br
-    aV9yb290L2NybDANBgkqhkiG9w0BAQsFAAOCAQEAM0FS8tscZe7yly/gM7jO6lx5
-    muMFusifjUIrcQGnZBkoECeuUVPNTs3e/Th+XaxjCnmSpqSNT3z9Irr6Hhxf7n03
-    4+hpF3G0bf1yh4DRex/0ua3szvgo91RwyKVQM1BHIA1PwdF8csO+LT4FTMILzo4U
-    DdSVvDEIaxYYQCDNfAD81n+8lmFbabupfsKbkSTR+sNTS+TMnLpN8YwSXdB0e+RU
-    eEZRNVu0jKmbE8U/66Sc33YLe6cxbCclHA+G4giGwEP+lYZk+rFjmr6ci9bj5yyN
-    Sznr7xdW0ofOdACAQFFy5KTZqCDjIrvk12vUn4bSsXmWVIQEd+jPx6wuxD/rSw==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
-    NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
-    AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
-    2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
-    Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
-    8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
-    lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
-    tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
-    Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
-    r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
-    BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
-    UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
-    xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
-    zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
-    UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
-    EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
-    4gqd
-    -----END CERTIFICATE-----

apps/base/externaldns/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml

apps/base/externaldns/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: externaldns

apps/base/externaldns/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: externaldns
-spec:
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default
-  allowedNamespaces:
-    - externaldns
-  kubernetes:
-    role: externaldns
-    serviceAccount: externaldns
-    audiences:
-      - vault
-    tokenExpirationSeconds: 600

apps/base/externaldns/vaultstaticsecret.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: externaldns-tsig
-  namespace: externaldns
-spec:
-  vaultAuthRef: default
-  mount: kv
-  type: kv-v2
-  path: service/kubernetes/au/syd1/externaldns/tsig
-  refreshAfter: 5m
-  destination:
-    name: externaldns-tsig
-    create: true
-  rolloutRestartTargets:
-    - kind: Deployment
-      name: externaldns

apps/overlays/au-syd1/cattle-system/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/cattle-system
-
-helmCharts:
-  - name: rancher
-    repo: https://releases.rancher.com/server-charts/stable
-    version: "2.13.1"
-    releaseName: rancher
-    namespace: cattle-system
-    valuesFile: values.yaml

apps/overlays/au-syd1/cattle-system/values.yaml

@@ -1,40 +0,0 @@
-hostname: rancher.k8s.syd1.au.unkin.net
-
-bootstrapPassword: ""
-
-extraEnv:
-  - name: CATTLE_BOOTSTRAP_PASSWORD
-    valueFrom:
-      secretKeyRef:
-        name: rancher-bootstrap-secret
-        key: password
-
-ingress:
-  enabled: false
-
-tls: external
-
-replicas: 3
-
-priorityClassName: rancher-critical
-
-# Resource limits for production
-resources:
-  limits:
-    cpu: 2000m
-    memory: 8Gi
-  requests:
-    cpu: 50m
-    memory: 256Mi
-
-# Additional security settings
-antiAffinity: preferred
-
-# Audit logging configuration
-auditLog:
-  enabled: true
-  destination: sidecar
-  level: 1
-  maxAge: 7
-  maxBackup: 3
-  maxSize: 100

apps/overlays/au-syd1/cert-manager/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/cert-manager
-
-helmCharts:
-  - name: cert-manager
-    repo: https://charts.jetstack.io
-    version: "v1.19.2"
-    releaseName: cert-manager
-    namespace: cert-manager
-    valuesFile: values.yaml

apps/overlays/au-syd1/cert-manager/values.yaml

@@ -1,29 +0,0 @@
-crds:
-  enabled: true
-
-replicaCount: 2
-
-resources:
-  requests:
-    cpu: 10m
-    memory: 32Mi
-
-strategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxSurge: 0
-    maxUnavailable: 1
-
-webhook:
-  replicaCount: 2
-  resources:
-    requests:
-      cpu: 10m
-      memory: 32Mi
-
-cainjector:
-  replicaCount: 2
-  resources:
-    requests:
-      cpu: 10m
-      memory: 32Mi

apps/overlays/au-syd1/certificates/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/certificates

apps/overlays/au-syd1/externaldns/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/externaldns
-
-helmCharts:
-  - name: external-dns
-    repo: https://kubernetes-sigs.github.io/external-dns/
-    version: "1.19.0"
-    releaseName: externaldns
-    namespace: externaldns
-    valuesFile: values.yaml

apps/overlays/au-syd1/externaldns/values.yaml

@@ -1,51 +0,0 @@
-# Service account configuration
-serviceAccount:
-  create: true
-  name: externaldns
-  annotations: {}
-
-# Provider configuration - using new format
-provider:
-  name: rfc2136
-
-# Domain filtering
-domainFilters:
-  - "k8s.syd1.au.unkin.net"
-  - "200.18.198.in-addr.arpa"
-
-# TXT registry configuration
-txtOwnerId: "k8s"
-registry: "txt"
-
-# Enable deletion of records for dedicated DNS server
-policy: "sync"
-
-# Keep default sources
-sources:
-  - service
-  - ingress
-
-# Environment variables for TSIG secret and algorithm from Vault
-env:
-  - name: EXTERNAL_DNS_RFC2136_TSIG_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: externaldns-tsig
-        key: secret
-  - name: EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM
-    valueFrom:
-      secretKeyRef:
-        name: externaldns-tsig
-        key: algorithm
-
-# RFC2136 configuration as arguments
-extraArgs:
-  - --rfc2136-host=ausyd1nxvm2127.main.unkin.net
-  - --rfc2136-port=53
-  - --rfc2136-zone=k8s.syd1.au.unkin.net
-  - --rfc2136-zone=200.18.198.in-addr.arpa
-  - --rfc2136-tsig-keyname=externaldns-key
-  - --rfc2136-tsig-secret-alg=$(EXTERNAL_DNS_RFC2136_TSIG_ALGORITHM)
-  - --rfc2136-tsig-axfr
-  - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
-  - --ingress-class=nginx

argocd/applicationsets/platform.yaml

@@ -11,11 +11,7 @@ spec:
       revision: HEAD
       directories:
       - path: apps/overlays/*/artifactapi
-      - path: apps/overlays/*/cattle-system
-      - path: apps/overlays/*/certificates
-      - path: apps/overlays/*/cert-manager
       - path: apps/overlays/*/cnpg-system
-      - path: apps/overlays/*/externaldns
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/jfrog

argocd/projects/platform.yaml

@@ -10,21 +10,12 @@ spec:
     - https://git.unkin.net/unkin/argocd-apps
     - oci://ghcr.io/emberstack/helm-charts
     - oci://ghcr.io/woodpecker-ci/helm/woodpecker
-    - https://releases.rancher.com/server-charts/stable
-    - https://charts.jetstack.io
-    - https://kubernetes-sigs.github.io/external-dns/
     - https://cloudnative-pg.github.io/charts
   destinations:
     - namespace: '*-system'
       server: https://kubernetes.default.svc
     - namespace: 'artifactapi'
       server: https://kubernetes.default.svc
-    - namespace: 'cert-manager'
-      server: https://kubernetes.default.svc
-    - namespace: 'certificates'
-      server: https://kubernetes.default.svc
-    - namespace: 'externaldns'
-      server: https://kubernetes.default.svc
     - namespace: 'jfrog'
       server: https://kubernetes.default.svc
     - namespace: 'puppet'
@@ -40,12 +31,6 @@ spec:
       kind: ClusterRoleBinding
     - group: 'apiextensions.k8s.io'
       kind: CustomResourceDefinition
-    - group: 'admissionregistration.k8s.io'
-      kind: MutatingWebhookConfiguration
-    - group: 'admissionregistration.k8s.io'
-      kind: ValidatingWebhookConfiguration
-    - group: 'scheduling.k8s.io'
-      kind: PriorityClass
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'