feat: migrate vso-system to ArgoCD

Migrate Vault Secrets Operator from Terragrunt to ArgoCD/Kustomize. Deploys vault-secrets-operator v1.2.0 with 3 replicas, plus ClusterRole, ClusterRoleBindings, and vault-admin ServiceAccount. Note: static service account tokens (kubernetes.io/service-account-token) cannot be stored in git; create manually or via Vault after deployment. 💘 Generated with Crush Assisted-by: Claude Sonnet 4.6 via Crush <crush@charm.land>
feat: migrate vm-system to ArgoCD (#80 )
2026-03-27 17:17:26 +11:00 · 2026-03-27 17:04:15 +11:00 · 2026-03-27 17:00:05 +11:00
18 changed files with 207 additions and 0 deletions
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: elastic-system
+  name: elastic-system
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: vm-system
+  name: vm-system
@@ -0,0 +1,12 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: vault-service-account-admin
+    app.kubernetes.io/part-of: vault-secrets-system
+  name: vso-system-vault-service-account-admin
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
@@ -0,0 +1,32 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: rbac
+    app.kubernetes.io/part-of: vault-secrets-operator
+  name: vso-system-vault-secrets-operator-auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: vault-secrets-operator-controller-manager
+    namespace: vso-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: vso-system-vault-admin-binding
+    app.kubernetes.io/part-of: vault-secrets-system
+  name: vso-system-vault-admin-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vso-system-vault-service-account-admin
+subjects:
+  - kind: ServiceAccount
+    name: vso-system-vault-admin
+    namespace: vso-system
@@ -0,0 +1,9 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount_vault-admin.yaml
+  - clusterrole_vault-service-account-admin.yaml
+  - clusterrolebindings.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: vso-system
+  name: vso-system
@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: vault-admin
+    app.kubernetes.io/part-of: vault-secrets-system
+  name: vso-system-vault-admin
+  namespace: vso-system
@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: elastic-system
+
+resources:
+  - ../../../base/elastic-system
+
+helmCharts:
+  - name: eck-operator
+    repo: https://helm.elastic.co
+    version: "3.2.0"
+    releaseName: elastic-operator
+    namespace: elastic-system
+    valuesFile: values.yaml
@@ -0,0 +1,11 @@
+replicaCount: 2
+resources:
+  limits:
+    cpu: 1
+    memory: 1Gi
+  requests:
+    cpu: 10m
+    memory: 150Mi
+podDisruptionBudget:
+  enabled: true
+  minAvailable: 1
@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vm-system
+
+resources:
+  - ../../../base/vm-system
+
+helmCharts:
+  - name: victoria-metrics-operator
+    repo: https://victoriametrics.github.io/helm-charts/
+    version: "0.57.1"
+    releaseName: victoria-metrics-operator
+    namespace: vm-system
+    valuesFile: values.yaml
@@ -0,0 +1,9 @@
+logLevel: "info"
+replicaCount: 2
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 50m
+    memory: 128Mi
@@ -0,0 +1,24 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vso-system
+
+resources:
+  - ../../../base/vso-system
+
+helmCharts:
+  - name: vault-secrets-operator
+    repo: https://helm.releases.hashicorp.com
+    version: "1.2.0"
+    releaseName: vault-secrets-operator
+    namespace: vso-system
+    valuesFile: values.yaml
+
+patches:
+  - path: patch_vaultauth-remove-namespace.yaml
+    target:
+      group: secrets.hashicorp.com
+      version: v1beta1
+      kind: VaultAuth
+      name: default
@@ -0,0 +1,2 @@
+- op: remove
+  path: /spec/namespace
@@ -0,0 +1,28 @@
+defaultVaultConnection:
+  enabled: true
+  address: "https://vault.service.consul:8200"
+  skipTLSVerify: false
+  caCertSecret: "vault-ca-cert"
+
+defaultAuthMethod:
+  enabled: true
+  method: "kubernetes"
+  mount: "k8s/au/syd1"
+  namespace: ""
+  kubernetes:
+    role: "default"
+    serviceAccount: "vault-secrets-operator-controller-manager"
+    tokenAudiences: ["vault"]
+
+controller:
+  replicas: 3
+  resources:
+    limits:
+      cpu: 500m
+      memory: 256Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+
+globalVaultAuth:
+  enabled: true
@@ -15,6 +15,7 @@ spec:
      - path: apps/overlays/*/cert-manager
      - path: apps/overlays/*/certificates
      - path: apps/overlays/*/cnpg-system
+      - path: apps/overlays/*/elastic-system
      - path: apps/overlays/*/externaldns
      - path: apps/overlays/*/inteldeviceplugins-system
      - path: apps/overlays/*/jfrog
@@ -23,6 +24,8 @@ spec:
      - path: apps/overlays/*/reflector-system
      - path: apps/overlays/*/reloader-system
      - path: apps/overlays/*/reposync
+      - path: apps/overlays/*/vm-system
+      - path: apps/overlays/*/vso-system
      - path: apps/overlays/*/woodpecker
  template:
    metadata:
@@ -10,9 +10,12 @@ spec:
    - https://git.unkin.net/unkin/argocd-apps
    - https://charts.jetstack.io
    - https://cloudnative-pg.github.io/charts
+    - https://helm.elastic.co
+    - https://helm.releases.hashicorp.com
    - https://intel.github.io/helm-charts/
    - https://kubernetes-sigs.github.io/external-dns/
    - https://releases.rancher.com/server-charts/stable
+    - https://victoriametrics.github.io/helm-charts/
    - oci://gcr.io/k8s-staging-nfd/charts
    - oci://ghcr.io/emberstack/helm-charts
    - oci://ghcr.io/woodpecker-ci/helm/woodpecker