From 5206376e1ca0eff72e7654b3c7e68baa640ac6e6 Mon Sep 17 00:00:00 2001 From: Kargo Date: Wed, 11 Mar 2026 10:20:09 +0000 Subject: [PATCH] promote(infra/test): freight 3a5e73c3518742b8d5039f4024eec9f7438b3f7a --- infra/argo-rollouts/config.yaml | 13 ----- infra/cert-manager/config.yaml | 13 ----- infra/gitea-custom/config.yaml | 2 +- infra/gitea/config.yaml | 2 +- infra/kargo-ci-pipeline/config.yaml | 10 ---- infra/kargo-credentials/config.yaml | 10 ---- infra/kargo-infra-pipeline/config.yaml | 10 ---- infra/kargo-test-env-pipeline/config.yaml | 10 ---- infra/kargo/config.yaml | 14 ----- infra/kargo/values/secret-values.dev.enc.yaml | 27 --------- .../kargo/values/secret-values.prod.enc.yaml | 27 --------- infra/traefik-routes/config.yaml | 10 ---- .../manifests/gitea-ingress.yaml | 41 ------------- infra/traefik-routes/manifests/gitea-ssh.yaml | 14 ----- .../manifests/kargo-ingress.yaml | 21 ------- .../manifests/kargo-transport.yaml | 8 --- .../traefik-routes/manifests/middlewares.yaml | 57 ------------------- .../traefik-routes/manifests/namespaces.yaml | 14 ----- infra/traefik-routes/manifests/tls-store.yaml | 10 ---- .../manifests/traefik-dashboard.yaml | 19 ------- 20 files changed, 2 insertions(+), 330 deletions(-) delete mode 100644 infra/argo-rollouts/config.yaml delete mode 100644 infra/cert-manager/config.yaml delete mode 100644 infra/kargo-ci-pipeline/config.yaml delete mode 100644 infra/kargo-credentials/config.yaml delete mode 100644 infra/kargo-infra-pipeline/config.yaml delete mode 100644 infra/kargo-test-env-pipeline/config.yaml delete mode 100644 infra/kargo/config.yaml delete mode 100644 infra/kargo/values/secret-values.dev.enc.yaml delete mode 100644 infra/kargo/values/secret-values.prod.enc.yaml delete mode 100644 infra/traefik-routes/config.yaml delete mode 100644 infra/traefik-routes/manifests/gitea-ingress.yaml delete mode 100644 infra/traefik-routes/manifests/gitea-ssh.yaml delete mode 100644 infra/traefik-routes/manifests/kargo-ingress.yaml delete mode 100644 infra/traefik-routes/manifests/kargo-transport.yaml delete mode 100644 infra/traefik-routes/manifests/middlewares.yaml delete mode 100644 infra/traefik-routes/manifests/namespaces.yaml delete mode 100644 infra/traefik-routes/manifests/tls-store.yaml delete mode 100644 infra/traefik-routes/manifests/traefik-dashboard.yaml diff --git a/infra/argo-rollouts/config.yaml b/infra/argo-rollouts/config.yaml deleted file mode 100644 index c796de5..0000000 --- a/infra/argo-rollouts/config.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{ - "name": "argo-rollouts", - "namespace": "argo-rollouts", - "step": "2", - "source": { - "repoURL": "https://argoproj.github.io/argo-helm", - "chart": "argo-rollouts", - "targetRevision": 2.40.6 - }, - "helm": { - "values": "dashboard:\n enabled: true\n" - } -} diff --git a/infra/cert-manager/config.yaml b/infra/cert-manager/config.yaml deleted file mode 100644 index 9466e13..0000000 --- a/infra/cert-manager/config.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{ - "name": "cert-manager", - "namespace": "cert-manager", - "step": "1", - "source": { - "repoURL": "https://charts.jetstack.io", - "chart": "cert-manager", - "targetRevision": v1.20.0 - }, - "helm": { - "values": "crds:\n enabled: true\n" - } -} diff --git a/infra/gitea-custom/config.yaml b/infra/gitea-custom/config.yaml index d6ce90f..e11c8cb 100644 --- a/infra/gitea-custom/config.yaml +++ b/infra/gitea-custom/config.yaml @@ -1,7 +1,7 @@ { "name": "gitea-custom", "namespace": "gitea", - "step": "6", + "step": "2", "source": { "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git", "path": "infra/gitea-custom/manifests", diff --git a/infra/gitea/config.yaml b/infra/gitea/config.yaml index 35beed7..a72e156 100644 --- a/infra/gitea/config.yaml +++ b/infra/gitea/config.yaml @@ -1,7 +1,7 @@ { "name": "gitea", "namespace": "gitea", - "step": "4", + "step": "1", "source": { "repoURL": "https://dl.gitea.com/charts", "chart": "gitea", diff --git a/infra/kargo-ci-pipeline/config.yaml b/infra/kargo-ci-pipeline/config.yaml deleted file mode 100644 index fb2e059..0000000 --- a/infra/kargo-ci-pipeline/config.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{ - "name": "kargo-ci-pipeline", - "namespace": "ci", - "step": "5", - "source": { - "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git", - "path": "kargo/ci", - "targetRevision": "main" - } -} diff --git a/infra/kargo-credentials/config.yaml b/infra/kargo-credentials/config.yaml deleted file mode 100644 index 16cfd71..0000000 --- a/infra/kargo-credentials/config.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{ - "name": "kargo-credentials", - "namespace": "default", - "step": "5", - "source": { - "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git", - "path": "kargo/credentials", - "targetRevision": "main" - } -} diff --git a/infra/kargo-infra-pipeline/config.yaml b/infra/kargo-infra-pipeline/config.yaml deleted file mode 100644 index f515bdd..0000000 --- a/infra/kargo-infra-pipeline/config.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{ - "name": "kargo-infra-pipeline", - "namespace": "infra", - "step": "5", - "source": { - "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git", - "path": "kargo/infra", - "targetRevision": "main" - } -} diff --git a/infra/kargo-test-env-pipeline/config.yaml b/infra/kargo-test-env-pipeline/config.yaml deleted file mode 100644 index 1a85bde..0000000 --- a/infra/kargo-test-env-pipeline/config.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{ - "name": "kargo-test-env-pipeline", - "namespace": "test-env", - "step": "5", - "source": { - "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git", - "path": "kargo/test-env", - "targetRevision": "main" - } -} diff --git a/infra/kargo/config.yaml b/infra/kargo/config.yaml deleted file mode 100644 index ac9566c..0000000 --- a/infra/kargo/config.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{ - "name": "kargo", - "namespace": "kargo", - "step": "4", - "syncOptions": ["Replace=true"], - "source": { - "repoURL": "ghcr.io/akuity/kargo-charts", - "chart": "kargo", - "targetRevision": "1.9.5" - }, - "helm": { - "values": "api:\n service:\n type: ClusterIP\n adminAccount:\n enabled: true\n passwordHash: \"$2b$10$jk2IIBCWP.5mEzp30J0kkO1CyCXEBvCWzaPsUGVfsusvH0M2kl2aS\"\n tokenSigningKey: \"d76a6d38c725db844e799224ae2d0a2d38c0d31f5ca510aac44abc87c973b6e3\"\ncontroller:\n argocd:\n integrationEnabled: true\n namespace: argocd\n" - } -} diff --git a/infra/kargo/values/secret-values.dev.enc.yaml b/infra/kargo/values/secret-values.dev.enc.yaml deleted file mode 100644 index 6195ea0..0000000 --- a/infra/kargo/values/secret-values.dev.enc.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# Kargo secrets for dev/test cluster -passwordHash: ENC[AES256_GCM,data:qmQr8l5EK92BZyadoAU0+hrOS2N8evnmxroL13GhQbD9idHKhHwkSt6fn1OgYyu+CtnJ6BxeyDyJCNbN,iv:4tnO8HczTo4GO+NFFQK6JRsOYXkS3wFiJfwYrCmot0M=,tag:LTeO8xl31f4+oLy/FDEyIQ==,type:str] -tokenSigningKey: ENC[AES256_GCM,data:Plf3vK+DJYmFsvS1cHTKtPvsvCC17i2/0lAEnG65CZVcrtux3+BiMY7rukLfW7uw/hQ+6JLB1PS4EWIGMNx/xw==,iv:54mdXGpgJ3f1dkeTyfZbfSoufJE89MUYIQpEz6jUt0E=,tag:KqK4shNvrQ7Dbu0+uYqjPw==,type:str] -sops: - age: - - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwVHNjbmJ2K3ljSHNmdEpE - RzdrL1o5ZXhxQXl0N0ptWk5JWjlCYnVtTXdZCkRWUDl5RkkzYXFBbjRpMmdnY254 - YWhPeEw0MzF6K2VoTEI1R09PV0szQlkKLS0tIG42S0h4VUtsaWN0WTI0V1piYTU5 - MUYvbzVyWUVRZHRYd21MY2dWMzVBTE0KJ0cSonX/lD3PBjz3BFFPkea+XDDPqGAF - gd20j8xOjyV1nu6Dg1qq80ZN3E0rotXnTK5zu/AyW4wcByUTG465Hw== - -----END AGE ENCRYPTED FILE----- - - recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBUmlEM1Z4NDRZaU9LSFF3 - SjZnM0R6U0NlYWtkbGFMdGRXbW9YRjBIeVVjCk9nV05aZk04L0xvUnk4c3hRczZV - ZEY4dmI0NndjWHEvSDJ6OTUrS3owM3cKLS0tIFFhWUk5Qy9GMGNrWGM2WnY4SWNm - UVVUcktPakNYeWVxakp2RjQweG41MVEKoHKCkhsn29s4JuRCfBqoF78/UcShnCAx - sGnz9zTnE+LSVMbknG1+Y3kFdRNXesLFZfyyk3W2atjp7Tw9rGYWTw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-03-11T06:57:04Z" - mac: ENC[AES256_GCM,data:E4jKWJsO9bEMzEjmp+XhBx45heXB7W5op11YyC2TV2KA0PNfAa7eZXIAZ7PVjVIfhbmODv3pd3KG4mY7lJ9I1ly6VfFGl4wMtXZkQlVt5+2DF6GyLGGfjKftRcGni4xP2J4wfzZGiIiQ2G8IUfmGy8Wpegw9lo6/UvES1w1kies=,iv:6fwg2NNoZnKq9jiFHLRQ6FZXrx9OzFEnxWU1VwEVoj0=,tag:CiJAekk+4dp/pyWkqXJKVw==,type:str] - encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$ - version: 3.12.1 diff --git a/infra/kargo/values/secret-values.prod.enc.yaml b/infra/kargo/values/secret-values.prod.enc.yaml deleted file mode 100644 index 579341e..0000000 --- a/infra/kargo/values/secret-values.prod.enc.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# Kargo secrets for prod cluster -passwordHash: ENC[AES256_GCM,data:iYRGwF7yug4fy4q70CoWMJCAIwd5nszzTqXHXe88zGRRYw6YtvAszCpGcecRRFhCwIfycTnciXfN,iv:CwerCu5GfMhpTpeqQ2QmMBMwxf7t2L12PUM4yCT4yIE=,tag:XNhTKS0d6T0VhK6E9BDn1w==,type:str] -tokenSigningKey: ENC[AES256_GCM,data:+05VkEeKatxayA1wK0a19fE6PFc3utOHvvT3Z+4KwfUBI778n5X9rMwSQQSFsbQyduPLITGf5VYKGaC5z3okAQ==,iv:uuS6oHdCLrvh6H38sfYzXTsrZ1lw5CJxjNN/0jchV9Q=,tag:iVuTqL2zew18OMeFwnGqrQ==,type:str] -sops: - age: - - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7 - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEYytrSWhtUWtEQUpQVEhh - S1RvN2N3ZFcvaFVmdU5KQ2pYTitPMUJJQTNFCml4YWMzRWdiZHAxRUoycHRmTU1L - RUhDOEJzSThIVDV0Y1RSQWczeEVXU0UKLS0tIHgwM0k3R2k1V1h5U2tWajdnMElj - SUdhZzh1S3Y3cktwTUJzQk5Lc3BjeTAK4LOXLhfyd4NMWsuUm0/Bjxq+9ni6wntw - 6u2UgYliecKNw4IX+2Ukhp/z4jGlVEayAE8QrfCj7RjBATPUYncPEw== - -----END AGE ENCRYPTED FILE----- - - recipient: age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1bittd3daOE9jWUJKeHB4 - R2k4Q3lNSzNkTDA0RTZlL1JrSFNMalRhWEVVCjNYSDVZU3kvRHlqZTRaOGRkZDJI - RUJiM2RMY0tFU2QvT25tQlFtK1l1NTgKLS0tIGJDYzhFelR1TkpNL2JmMGJ4YXd2 - SGNGTGhGWGovbUJHMHh0QWhIWlhBdVUKAKxeFgOPJRaTl5z0bydzd1nr5SDmqfMx - 7n/OjVadcCg4PLd54eMpgiJ7ts4UeaAK+RxdHtI9Y7jP1ConLffoAg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-03-11T06:57:04Z" - mac: ENC[AES256_GCM,data:Mp01K4uHW7ZFXzURs8nzkfwe6d7xgiOds12/VN1I5qB5OoC3afM1pZRQ7/mM0lTyueVt9hTh4B76zAFp6rB+/ombjJ5JPnwyEayAklovy7R6BFC1podhb78npC2u7K5P7DIFI54nJqj1XfFt4eIMQjkR6AnFeT1pqzquF7SVnLQ=,iv:VesrzDd09vugtzAYjB/oyHm99Dmm8dlDgP0NITvd4Rs=,tag:5z5zBC/7ulnqTRz9UXyrhw==,type:str] - encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$ - version: 3.12.1 diff --git a/infra/traefik-routes/config.yaml b/infra/traefik-routes/config.yaml deleted file mode 100644 index fde26b0..0000000 --- a/infra/traefik-routes/config.yaml +++ /dev/null @@ -1,10 +0,0 @@ -{ - "name": "traefik-routes", - "namespace": "kube-system", - "step": "3", - "source": { - "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git", - "path": "infra/traefik-routes/manifests", - "targetRevision": "main" - } -} diff --git a/infra/traefik-routes/manifests/gitea-ingress.yaml b/infra/traefik-routes/manifests/gitea-ingress.yaml deleted file mode 100644 index 26efecd..0000000 --- a/infra/traefik-routes/manifests/gitea-ingress.yaml +++ /dev/null @@ -1,41 +0,0 @@ -# Gitea HTTPS IngressRoute via Traefik -# Uses default TLS store (wildcard-tls from kube-system via TLSStore) -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: gitea-https - namespace: gitea -spec: - entryPoints: - - websecure - routes: - - match: HostRegexp(`gitea.k3s\..+\.local`) - kind: Rule - middlewares: - - name: sslheader - namespace: kube-system - - name: gitea-buffer-timeout - namespace: gitea - services: - - name: gitea-http - port: 3000 - tls: {} ---- -# HTTP → HTTPS redirect for Gitea -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: gitea-http-redirect - namespace: gitea -spec: - entryPoints: - - web - routes: - - match: HostRegexp(`gitea.k3s\..+\.local`) - kind: Rule - middlewares: - - name: redirect-https - namespace: kube-system - services: - - name: gitea-http - port: 3000 diff --git a/infra/traefik-routes/manifests/gitea-ssh.yaml b/infra/traefik-routes/manifests/gitea-ssh.yaml deleted file mode 100644 index 09938da..0000000 --- a/infra/traefik-routes/manifests/gitea-ssh.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Gitea SSH access via Traefik TCP routing (port 2222) -apiVersion: traefik.io/v1alpha1 -kind: IngressRouteTCP -metadata: - name: gitea-ssh - namespace: gitea -spec: - entryPoints: - - ssh - routes: - - match: HostSNI(`*`) - services: - - name: gitea-ssh - port: 22 diff --git a/infra/traefik-routes/manifests/kargo-ingress.yaml b/infra/traefik-routes/manifests/kargo-ingress.yaml deleted file mode 100644 index dfdcc54..0000000 --- a/infra/traefik-routes/manifests/kargo-ingress.yaml +++ /dev/null @@ -1,21 +0,0 @@ -# Kargo dashboard HTTPS IngressRoute -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: kargo-https - namespace: kargo -spec: - entryPoints: - - websecure - routes: - - match: HostRegexp(`kargo.k3s\..+\.local`) - kind: Rule - middlewares: - - name: kargo-tls-middleware - namespace: kargo - services: - - name: kargo-api - port: 443 - scheme: https - serversTransport: kargo-skip-verify - tls: {} diff --git a/infra/traefik-routes/manifests/kargo-transport.yaml b/infra/traefik-routes/manifests/kargo-transport.yaml deleted file mode 100644 index 9a257a8..0000000 --- a/infra/traefik-routes/manifests/kargo-transport.yaml +++ /dev/null @@ -1,8 +0,0 @@ -# ServersTransport to skip TLS verification for Kargo backend (self-signed cert) -apiVersion: traefik.io/v1alpha1 -kind: ServersTransport -metadata: - name: kargo-skip-verify - namespace: kargo -spec: - insecureSkipVerify: true diff --git a/infra/traefik-routes/manifests/middlewares.yaml b/infra/traefik-routes/manifests/middlewares.yaml deleted file mode 100644 index ab002d7..0000000 --- a/infra/traefik-routes/manifests/middlewares.yaml +++ /dev/null @@ -1,57 +0,0 @@ -# HTTP → HTTPS redirect -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: redirect-https - namespace: kube-system -spec: - redirectScheme: - scheme: https - permanent: true ---- -# Forward X-Forwarded-Proto header for backends behind TLS termination -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: sslheader - namespace: kube-system -spec: - headers: - customRequestHeaders: - X-Forwarded-Proto: "https" ---- -# Gitea: buffer large requests (git push) + timeout for CI builds -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: gitea-buffer-timeout - namespace: gitea -spec: - buffering: - maxRequestBodyBytes: 0 - maxResponseBodyBytes: 0 - memRequestBodyBytes: 20971520 - memResponseBodyBytes: 20971520 - retryExpression: "IsNetworkError()" ---- -# ArgoCD: X-Forwarded-Proto for TLS termination -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: argocd-tls-middleware - namespace: argocd -spec: - headers: - customRequestHeaders: - X-Forwarded-Proto: "https" ---- -# Kargo: X-Forwarded-Proto for TLS termination -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: kargo-tls-middleware - namespace: kargo -spec: - headers: - customRequestHeaders: - X-Forwarded-Proto: "https" diff --git a/infra/traefik-routes/manifests/namespaces.yaml b/infra/traefik-routes/manifests/namespaces.yaml deleted file mode 100644 index 5dea267..0000000 --- a/infra/traefik-routes/manifests/namespaces.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Ensure namespaces exist for cross-namespace middleware references -apiVersion: v1 -kind: Namespace -metadata: - name: gitea - labels: - name: gitea ---- -apiVersion: v1 -kind: Namespace -metadata: - name: kargo - labels: - name: kargo diff --git a/infra/traefik-routes/manifests/tls-store.yaml b/infra/traefik-routes/manifests/tls-store.yaml deleted file mode 100644 index 392297f..0000000 --- a/infra/traefik-routes/manifests/tls-store.yaml +++ /dev/null @@ -1,10 +0,0 @@ -# Default TLS store — uses wildcard-tls from kube-system as default cert. -# All IngressRoutes with tls: {} will use this certificate. -apiVersion: traefik.io/v1alpha1 -kind: TLSStore -metadata: - name: default - namespace: kube-system -spec: - defaultCertificate: - secretName: wildcard-tls diff --git a/infra/traefik-routes/manifests/traefik-dashboard.yaml b/infra/traefik-routes/manifests/traefik-dashboard.yaml deleted file mode 100644 index 096c7b7..0000000 --- a/infra/traefik-routes/manifests/traefik-dashboard.yaml +++ /dev/null @@ -1,19 +0,0 @@ -# Traefik Dashboard IngressRoute -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: traefik-dashboard - namespace: kube-system -spec: - entryPoints: - - websecure - routes: - - match: HostRegexp(`traefik.k3s\..+\.local`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`)) - kind: Rule - middlewares: - - name: sslheader - namespace: kube-system - services: - - name: api@internal - kind: TraefikService - tls: {}