unkin-agent
7db66455c9
Adds WatchState (arabcoders/watchstate v1.10.3) as a new media-project app, fronted 1:1 by the logviewer oauth2-proxy admin-gate pattern. - ghcr.io/arabcoders/watchstate:v1.10.3 (canonical image; containerd mirrors route ghcr via artifactapi), replicas 1 + Recreate, single 5Gi cephrbd-fast-delete RWO PVC at /config (sqlite + in-container cron/redis are single-writer). - oauth2-proxy fronts every path; Authentik OIDC issuer identity.k8s.syd1.au.unkin.net, authorization enforced Authentik-side (akR-global-admin only), so no oauth2-proxy group allowlist. - Internal-only Gateway (traefik-internal) for watchstate.k8s.syd1.au.unkin.net, vault-issuer TLS leaf, external-dns to 198.18.200.4. - VaultStaticSecret pulls the seeded OIDC creds; vault-ca-cert auto-reflects. - Registered in the media ApplicationSet + AppProject. No VMPodScrape: WatchState exposes no /metrics endpoint.
28 lines
677 B
YAML
28 lines
677 B
YAML
---
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: AppProject
|
|
metadata:
|
|
name: media
|
|
namespace: argocd
|
|
spec:
|
|
description: Media services
|
|
sourceRepos:
|
|
- https://git.unkin.net/unkin/argocd-apps
|
|
destinations:
|
|
- namespace: 'fafflix'
|
|
server: https://kubernetes.default.svc
|
|
- namespace: 'cheeztv'
|
|
server: https://kubernetes.default.svc
|
|
- namespace: 'arrstack'
|
|
server: https://kubernetes.default.svc
|
|
- namespace: 'watchstate'
|
|
server: https://kubernetes.default.svc
|
|
clusterResourceWhitelist:
|
|
- group: ''
|
|
kind: Namespace
|
|
- group: ''
|
|
kind: PersistentVolume
|
|
namespaceResourceWhitelist:
|
|
- group: '*'
|
|
kind: '*'
|