unkin-agent
d2ee72823d
The k8up CRDs already exist in the cluster (managed by a separate k8up-crds Helm release) but the operator itself was never deployed. Install it following the cnpg-system pattern so k8up backup/restore custom resources are actually reconciled. - Add apps/base/k8up-system Namespace + kustomization - Add au-syd1 overlay inflating the k8up chart 4.10.0 from the artifactapi virtual-helm proxy (replicaCount 2 with leader election, PDB minAvailable 1, sane operator resource requests/limits, ServiceMonitor/PrometheusRule off) - Do not emit the chart CRDs: they live in the chart crds/ directory which the kustomize helm inflator skips, leaving CRD ownership with the existing k8up-crds Helm release so ArgoCD does not fight over them - Register apps/overlays/*/k8up-system in the platform ApplicationSet
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |
| ca-rotation.md | Rolling the internal unkin.net PKI CA (vault-ca-cert): what Reloader restarts automatically vs. manual/CNPG restarts. |