85 lines
5.0 KiB
YAML
85 lines
5.0 KiB
YAML
# The entry point for `kubectl apply -k` and for Argo CD.
|
|
#
|
|
# It exists so that a GitOps tool has ONE path to point at, and so that the two images are pinned in
|
|
# ONE place instead of three. The manifests beside it are unchanged and still apply individually
|
|
# with `kubectl apply -f` — this aggregates them, it does not replace them.
|
|
#
|
|
# ─── WHAT IS DELIBERATELY NOT HERE ────────────────────────────────────────────────────────────
|
|
#
|
|
# `01-secret.example.yaml`, and its absence is the most important line in this file.
|
|
#
|
|
# It is a TEMPLATE carrying placeholder values. A GitOps controller applies what it is pointed at,
|
|
# continuously, without asking — so a Secret full of `REPLACE_ME` inside the source of truth is a
|
|
# controller that will overwrite your real credentials with placeholders on its next reconcile, and
|
|
# then keep putting them back every time you fix them. The api would fail to reach its database, the
|
|
# vault key would be wrong, and nothing in the sync would look unhealthy.
|
|
#
|
|
# Write `jarvis-secrets` into the cluster by another route entirely: by hand, or through
|
|
# SealedSecrets, ExternalSecrets or Vault — anything whose ciphertext is safe to commit. The
|
|
# generated half (`jarvis-generated`) is minted in-cluster by the hook in `01-secret-job.yaml` and
|
|
# is likewise never in git.
|
|
#
|
|
# ─── ORDER ────────────────────────────────────────────────────────────────────────────────────
|
|
#
|
|
# Filenames do not order anything: `kubectl apply -k` and Argo both read this list as a set. The
|
|
# order is carried by `argocd.argoproj.io/sync-wave` annotations on the resources themselves, so
|
|
# that it lives beside the thing being ordered rather than in a list somebody has to keep in step.
|
|
# See the table in README.md.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- 00-namespace.yaml
|
|
# The identity that mints the generated secrets, and the Job that uses it. The Job is a sync hook;
|
|
# its ServiceAccount, Role and RoleBinding are ordinary resources in an earlier wave.
|
|
- 01-secret-job.yaml
|
|
- 02-config.yaml
|
|
- 03-migrate-job.yaml
|
|
- 04-api.yaml
|
|
- 05-web.yaml
|
|
- 06-ingress.yaml
|
|
# Uploads get their own Ingress so their larger body ceiling reaches no other path. Patch its
|
|
# host along with the main one.
|
|
- 06b-ingress-uploads.yaml
|
|
- 07-disruption.yaml
|
|
# Three Redis processes and three sentinels; see the README on what that costs on three nodes.
|
|
# 02-config.yaml's two REDIS_SENTINEL* lines point the api at them. For a managed Redis instead,
|
|
# remove this line AND those two lines, and set REDIS_URL there to your Redis.
|
|
- 08-redis-sentinel.yaml
|
|
# The headless browser and the NetworkPolicy that isolates it. COMMENTED OUT: web access is a
|
|
# decision rather than a default, and an assistant that can read the internet is a new class of
|
|
# input into a system that administers customers. Uncomment this AND set BROWSER_URL in
|
|
# 02-config.yaml to enable it; leaving both alone changes nothing.
|
|
# - 09-browser.yaml
|
|
|
|
# ─── THE THREE IMAGES ───────────────────────────────────────────────────────────────────────────
|
|
#
|
|
# By DIGEST, not by tag, and the manifests carry `@sha256:REPLACE_ME` so that an unedited copy fails
|
|
# loudly rather than quietly pulling something.
|
|
#
|
|
# A tag is a name that can be repointed; a digest is the bytes. It matters more here than in most
|
|
# places because the migration Job and the api Deployment must be the SAME BUILD — a schema applied
|
|
# by one version and served by another is the failure this whole ordering exists to prevent, and two
|
|
# copies of a mutable tag pulled a minute apart can be two different images.
|
|
#
|
|
# `dev` and `stable` are channels, so they are exactly the kind of name not to pin to. Resolve one
|
|
# to its digest and put that here:
|
|
#
|
|
# docker buildx imagetools inspect git.luxit.be/luxit/jarvis-api:stable --format '{{.Manifest.Digest}}'
|
|
#
|
|
# This is also the whole of a version bump: change these lines, commit, and let the controller do
|
|
# the rest.
|
|
#
|
|
# THREE, not two. `jarvis-agent-dist` is easy to miss — it is an initContainer in 04-api.yaml rather
|
|
# than a container of its own — and missing it is the worst possible half-fix: two images pinned
|
|
# from here and one left carrying `REPLACE_ME` in the file, so the render succeeds and the api pod
|
|
# never starts. It is also the one that may legitimately be absent: leaving that initContainer out
|
|
# is supported, and the installer then answers 503 saying no agent build is published.
|
|
images:
|
|
- name: git.luxit.be/luxit/jarvis-api
|
|
digest: sha256:REPLACE_ME
|
|
- name: git.luxit.be/luxit/jarvis-web
|
|
digest: sha256:REPLACE_ME
|
|
- name: git.luxit.be/luxit/jarvis-agent-dist
|
|
digest: sha256:REPLACE_ME
|