unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

add ghp (GitHub proxy) deployment #357

Merged
benvin merged 3 commits from benvin/ghp into main 2026-08-13 20:08:31 +10:00
Conversation 0 Commits 3 Files Changed 18
+667
unkin-agent commented 2026-08-13 19:41:44 +10:00
Member
Copy Link
Copy Source

Why

Deploy goodtune/ghp (a GitHub proxy) so estate agents have a controlled GitHub access path. Mirrors the artifactapi app structure and the estate's templated default Vault convention.

How (this PR)

  • Namespace ghp. Runs as the namespace's auto-created default ServiceAccount (no custom SA).
  • CNPG Cluster (named postgres, db/owner ghp) + dedicated cnpg-ghp Ceph RGW backup bucket + nightly ScheduledBackup.
  • Deployment command: ["/ghp","serve"]; GHP_DATABASE_DSN assembled from the CNPG-generated postgres-app Secret via $(VAR) expansion pointing at postgres-rw.ghp.svc.
  • Sync-phase migrate hook Job ghp-migrate (/ghp migrate) at sync-wave 1 so serve replicas never race migrations.
  • VSO wiring on the templated default role: VaultAuth role/SA default; VaultStaticSecrets source kv/kubernetes/namespace/ghp/default/github-app → Secret ghp-github-app and kv/kubernetes/namespace/ghp/default/app → Secret ghp-app. private_key mounted as a file; encryption_key → GHP_ENCRYPTION_KEY.
  • cert-manager Certificate ghp-tls off ClusterIssuer vault-issuer, SANs github.com/api.github.com/codeload.github.com/*.githubcopilot.com/ghp.k8s.syd1.au.unkin.net; mounted for GHP_TLS_CERT_FILE/GHP_TLS_KEY_FILE.
  • Service (443->8443, 80->8080, metrics 9136), PDB, VMServiceScrape, internal Traefik Gateway + HTTPRoute for ghp.k8s.syd1.au.unkin.net.
  • Sync-wave ordering: DB + VSO/cert (wave 0, wait Healthy) -> migrate Job (wave 1) -> serve Deployment + Service/Gateway/HTTPRoute (wave 2). Writable /tmp emptyDir on both pods (root FS is read-only).
  • Registered in the platform ApplicationSet + AppProject.
  • Validation: kustomize build clean, kubeconform 17/17 valid (0 skipped), yamllint + pre-commit clean.

NOTE — prerequisites before ghp goes Healthy

  • GHP_ADMINS placeholder: apps/base/ghp/configmap.yaml has GHP_ADMINS: "REPLACE_ME_ben_github_username" — set it to Ben's GitHub username.
  • Ben's GitHub-App runbook + kv population at the templated paths kv/kubernetes/namespace/ghp/default/github-app (app_id/client_id/client_secret/private_key) and kv/kubernetes/namespace/ghp/default/app (encryption_key).
  • tf-artifactapi #25: the ghcr remote pattern for pulling ghcr/goodtune/ghp.
  • No terraform-vault change needed — the estate's templated default policy already grants read on kv/kubernetes/namespace/<ns>/default/* (the bespoke ghp role PR terraform-vault#120 is closed).
  • DNS overrides (pointing github.com etc. at ghp) are intentionally out of scope — separate deferred bind-operator PR.

Assumptions flagged: metrics env var GHP_METRICS_LISTEN; two Secrets (ghp-github-app + ghp-app) rather than one merged Secret; DSN assumes the CNPG-generated password is URL-safe.

## Why Deploy `goodtune/ghp` (a GitHub proxy) so estate agents have a controlled GitHub access path. Mirrors the artifactapi app structure and the estate's templated `default` Vault convention. ## How (this PR) - Namespace `ghp`. Runs as the namespace's auto-created `default` ServiceAccount (no custom SA). - CNPG `Cluster` (named `postgres`, db/owner `ghp`) + dedicated `cnpg-ghp` Ceph RGW backup bucket + nightly ScheduledBackup. - Deployment `command: ["/ghp","serve"]`; `GHP_DATABASE_DSN` assembled from the CNPG-generated `postgres-app` Secret via `$(VAR)` expansion pointing at `postgres-rw.ghp.svc`. - **Sync-phase migrate hook Job** `ghp-migrate` (`/ghp migrate`) at sync-wave 1 so serve replicas never race migrations. - VSO wiring on the templated `default` role: `VaultAuth` role/SA `default`; `VaultStaticSecret`s source `kv/kubernetes/namespace/ghp/default/github-app` → Secret `ghp-github-app` and `kv/kubernetes/namespace/ghp/default/app` → Secret `ghp-app`. `private_key` mounted as a file; `encryption_key` → `GHP_ENCRYPTION_KEY`. - cert-manager `Certificate` `ghp-tls` off ClusterIssuer `vault-issuer`, SANs github.com/api.github.com/codeload.github.com/*.githubcopilot.com/ghp.k8s.syd1.au.unkin.net; mounted for `GHP_TLS_CERT_FILE`/`GHP_TLS_KEY_FILE`. - Service (443->8443, 80->8080, metrics 9136), PDB, VMServiceScrape, internal Traefik Gateway + HTTPRoute for `ghp.k8s.syd1.au.unkin.net`. - Sync-wave ordering: DB + VSO/cert (wave 0, wait Healthy) -> migrate Job (wave 1) -> serve Deployment + Service/Gateway/HTTPRoute (wave 2). Writable `/tmp` emptyDir on both pods (root FS is read-only). - Registered in the `platform` ApplicationSet + AppProject. - Validation: `kustomize build` clean, kubeconform 17/17 valid (0 skipped), yamllint + pre-commit clean. ## NOTE — prerequisites before ghp goes Healthy - **`GHP_ADMINS` placeholder**: `apps/base/ghp/configmap.yaml` has `GHP_ADMINS: "REPLACE_ME_ben_github_username"` — set it to Ben's GitHub username. - Ben's GitHub-App runbook + kv population at the templated paths `kv/kubernetes/namespace/ghp/default/github-app` (app_id/client_id/client_secret/private_key) and `kv/kubernetes/namespace/ghp/default/app` (encryption_key). - tf-artifactapi #25: the `ghcr` remote pattern for pulling `ghcr/goodtune/ghp`. - **No terraform-vault change needed** — the estate's templated `default` policy already grants read on `kv/kubernetes/namespace/<ns>/default/*` (the bespoke ghp role PR terraform-vault#120 is closed). - DNS overrides (pointing github.com etc. at ghp) are intentionally **out of scope** — separate deferred bind-operator PR. Assumptions flagged: metrics env var `GHP_METRICS_LISTEN`; two Secrets (`ghp-github-app` + `ghp-app`) rather than one merged Secret; DSN assumes the CNPG-generated password is URL-safe.
unkin-agent added 1 commit 2026-08-13 19:41:44 +10:00
add ghp (GitHub proxy) deployment
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
1d5e8edbdd 
Deploy goodtune/ghp so estate agents have a GitHub proxy. Mirrors the
artifactapi app structure under apps/base/ghp with a CNPG Postgres backend,
VSO-synced GitHub App + encryption secrets, an internal Vault-PKI serving cert,
a PreSync migration hook, and platform ApplicationSet/project registration.
unkin-agent added 1 commit 2026-08-13 19:53:20 +10:00
ghp: fix first-install ordering deadlock via sync-waves
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
42c1794d0e 
The migrate Job was a PreSync hook but connects to postgres-rw, whose CNPG
Cluster + generated postgres-app secret apply in the Sync phase (after all
PreSync hooks). On a fresh install migrate ran before Postgres existed, failed,
exhausted backoffLimit, failed PreSync, and blocked the Sync phase that creates
the DB.

- Move migrate off PreSync to a Sync-phase hook at sync-wave 1.
- Put the CNPG Cluster + backup resources, VSO auth/secrets, and Certificate at
  wave 0 so the DB is Healthy (and creds/cert exist) before migrate runs.
- Put the Deployment + Service/Gateway/HTTPRoute/PDB/VMServiceScrape at wave 2
  so serve starts after migrate completes.
- Add a writable /tmp emptyDir to the serve container and migrate Job (root FS
  is read-only) so codeload/staging writes cannot crash the process.
unkin-agent added 1 commit 2026-08-13 20:01:52 +10:00
ghp: use the estate templated default Vault convention
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
5faaff8d19 
Drop the bespoke ghp SA/role/policy (terraform-vault#120 closed). The default
k8s auth role, bound to SA default in every namespace, already has a templated
read grant on kv/kubernetes/namespace/<ns>/default/*, so ghp needs zero
terraform-vault change.

- Remove the custom ServiceAccount; run as the namespace default SA.
- Deployment + migrate Job: serviceAccountName default.
- VaultAuth: role/serviceAccount default (mirrors artifactapi).
- VaultStaticSecrets: source paths move to the templated location
  kubernetes/namespace/ghp/default/{github-app,app}; Secret names unchanged.
benvin merged commit fa1f3e7756 into main 2026-08-13 20:08:31 +10:00
benvin deleted branch benvin/ghp 2026-08-13 20:08:31 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#357
Delete Branch "benvin/ghp"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?