arcodange
11b894d45f
Helm Charts / Detect changed charts (push) Successful in 9s
Helm Charts / Library charts tool (push) Skipped
Helm Charts / Application charts alloy (push) Skipped
Helm Charts / Application charts crowdsec (push) Skipped
Helm Charts / Application charts grafana (push) Skipped
Helm Charts / Application charts hashicorp-vault (push) Skipped
Helm Charts / Application charts loki (push) Skipped
Helm Charts / Application charts prometheus (push) Skipped
Helm Charts / Application charts minio (push) Skipped
Helm Charts / Application charts pgbouncer (push) Skipped
Helm Charts / Application charts pgcat (push) Skipped
Helm Charts / Application charts redis (push) Skipped
Helm Charts / Application charts chart (push) Successful in 11s
Co-authored-by: Gabriel Radureau <[email protected]>
43 lines
1.9 KiB
YAML
43 lines
1.9 KiB
YAML
# https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#projects
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: AppProject
|
|
metadata:
|
|
name: tools
|
|
namespace: argocd
|
|
# Finalizer that ensures that project is not deleted until it is not referenced by any application
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
description: Arcodange tools (monitoring, cache, connection pool, secret management...)
|
|
sourceRepos:
|
|
- 'https://gitea.arcodange.lab/arcodange-org/tools'
|
|
# Only permit applications to deploy to the tools namespace in the same cluster
|
|
destinations:
|
|
- namespace: tools
|
|
server: https://kubernetes.default.svc
|
|
|
|
clusterResourceWhitelist:
|
|
- group: '*'
|
|
kind: ClusterRoleBinding
|
|
- group: '*'
|
|
kind: ClusterRole
|
|
- group: '*'
|
|
kind: MutatingWebhookConfiguration
|
|
- group: 'apiextensions.k8s.io'
|
|
kind: CustomResourceDefinition
|
|
# PriorityClass — ajoutée le 2026-09-11, et une seule raison la justifie.
|
|
# `hashicorp-vault/templates/priorityclass.yaml` déclare `vault-critical`, qui sort
|
|
# Vault de la classe `BestEffort` où il était le premier pod évincé du cluster (il y
|
|
# est resté SCELLÉ onze jours après l'éviction du 30/08). Une PriorityClass est
|
|
# cluster-scoped : sans cette ligne ArgoCD refuse la synchronisation ENTIÈRE de
|
|
# l'application — constaté, `hashicorp-vault` est resté OutOfSync sur
|
|
# « resource scheduling.k8s.io:PriorityClass is not permitted in project tools »,
|
|
# après 5 tentatives.
|
|
#
|
|
# Cette liste est un GARDE-FOU, pas une formalité : elle borne ce qu'une application
|
|
# de `tools` peut créer hors de son namespace. On y ajoute donc un kind à la fois,
|
|
# avec sa raison. Une PriorityClass ne porte ni droit ni donnée : elle ne fait
|
|
# qu'ordonner l'éviction et la préemption.
|
|
- group: 'scheduling.k8s.io'
|
|
kind: PriorityClass
|