promote(infra/test): freight 3a5e73c3518742b8d5039f4024eec9f7438b3f7a

infra/argo-rollouts/config.yaml

@@ -1,13 +0,0 @@
-{
-  "name": "argo-rollouts",
-  "namespace": "argo-rollouts",
-  "step": "2",
-  "source": {
-    "repoURL": "https://argoproj.github.io/argo-helm",
-    "chart": "argo-rollouts",
-    "targetRevision": 2.40.6
-  },
-  "helm": {
-    "values": "dashboard:\n  enabled: true\n"
-  }
-}

infra/cert-manager/config.yaml

@@ -1,13 +0,0 @@
-{
-  "name": "cert-manager",
-  "namespace": "cert-manager",
-  "step": "1",
-  "source": {
-    "repoURL": "https://charts.jetstack.io",
-    "chart": "cert-manager",
-    "targetRevision": v1.20.0
-  },
-  "helm": {
-    "values": "crds:\n  enabled: true\n"
-  }
-}

infra/gitea-custom/config.yaml

@@ -1,7 +1,7 @@
 {
   "name": "gitea-custom",
   "namespace": "gitea",
-  "step": "6",
+  "step": "2",
   "source": {
     "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git",
     "path": "infra/gitea-custom/manifests",

infra/gitea/config.yaml

@@ -1,7 +1,7 @@
 {
   "name": "gitea",
   "namespace": "gitea",
-  "step": "4",
+  "step": "1",
   "source": {
     "repoURL": "https://dl.gitea.com/charts",
     "chart": "gitea",

infra/kargo-ci-pipeline/config.yaml

@@ -1,10 +0,0 @@
-{
-  "name": "kargo-ci-pipeline",
-  "namespace": "ci",
-  "step": "5",
-  "source": {
-    "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git",
-    "path": "kargo/ci",
-    "targetRevision": "main"
-  }
-}

infra/kargo-credentials/config.yaml

@@ -1,10 +0,0 @@
-{
-  "name": "kargo-credentials",
-  "namespace": "default",
-  "step": "5",
-  "source": {
-    "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git",
-    "path": "kargo/credentials",
-    "targetRevision": "main"
-  }
-}

infra/kargo-infra-pipeline/config.yaml

@@ -1,10 +0,0 @@
-{
-  "name": "kargo-infra-pipeline",
-  "namespace": "infra",
-  "step": "5",
-  "source": {
-    "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git",
-    "path": "kargo/infra",
-    "targetRevision": "main"
-  }
-}

infra/kargo-test-env-pipeline/config.yaml

@@ -1,10 +0,0 @@
-{
-  "name": "kargo-test-env-pipeline",
-  "namespace": "test-env",
-  "step": "5",
-  "source": {
-    "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git",
-    "path": "kargo/test-env",
-    "targetRevision": "main"
-  }
-}

infra/kargo/config.yaml

@@ -1,14 +0,0 @@
-{
-    "name": "kargo",
-    "namespace": "kargo",
-    "step": "4",
-    "syncOptions": ["Replace=true"],
-    "source": {
-        "repoURL": "ghcr.io/akuity/kargo-charts",
-        "chart": "kargo",
-        "targetRevision": "1.9.5"
-    },
-    "helm": {
-        "values": "api:\n  service:\n    type: ClusterIP\n  adminAccount:\n    enabled: true\n    passwordHash: \"$2b$10$jk2IIBCWP.5mEzp30J0kkO1CyCXEBvCWzaPsUGVfsusvH0M2kl2aS\"\n    tokenSigningKey: \"d76a6d38c725db844e799224ae2d0a2d38c0d31f5ca510aac44abc87c973b6e3\"\ncontroller:\n  argocd:\n    integrationEnabled: true\n    namespace: argocd\n"
-    }
-}

infra/kargo/values/secret-values.dev.enc.yaml

@@ -1,27 +0,0 @@
-# Kargo secrets for dev/test cluster
-passwordHash: ENC[AES256_GCM,data:qmQr8l5EK92BZyadoAU0+hrOS2N8evnmxroL13GhQbD9idHKhHwkSt6fn1OgYyu+CtnJ6BxeyDyJCNbN,iv:4tnO8HczTo4GO+NFFQK6JRsOYXkS3wFiJfwYrCmot0M=,tag:LTeO8xl31f4+oLy/FDEyIQ==,type:str]
-tokenSigningKey: ENC[AES256_GCM,data:Plf3vK+DJYmFsvS1cHTKtPvsvCC17i2/0lAEnG65CZVcrtux3+BiMY7rukLfW7uw/hQ+6JLB1PS4EWIGMNx/xw==,iv:54mdXGpgJ3f1dkeTyfZbfSoufJE89MUYIQpEz6jUt0E=,tag:KqK4shNvrQ7Dbu0+uYqjPw==,type:str]
-sops:
-    age:
-        - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwVHNjbmJ2K3ljSHNmdEpE
-            RzdrL1o5ZXhxQXl0N0ptWk5JWjlCYnVtTXdZCkRWUDl5RkkzYXFBbjRpMmdnY254
-            YWhPeEw0MzF6K2VoTEI1R09PV0szQlkKLS0tIG42S0h4VUtsaWN0WTI0V1piYTU5
-            MUYvbzVyWUVRZHRYd21MY2dWMzVBTE0KJ0cSonX/lD3PBjz3BFFPkea+XDDPqGAF
-            gd20j8xOjyV1nu6Dg1qq80ZN3E0rotXnTK5zu/AyW4wcByUTG465Hw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ame2tp44sq9rmkqzqvxy77eu7qd2035kmlgcsfjfxj2jughv3clqlku03g
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBUmlEM1Z4NDRZaU9LSFF3
-            SjZnM0R6U0NlYWtkbGFMdGRXbW9YRjBIeVVjCk9nV05aZk04L0xvUnk4c3hRczZV
-            ZEY4dmI0NndjWHEvSDJ6OTUrS3owM3cKLS0tIFFhWUk5Qy9GMGNrWGM2WnY4SWNm
-            UVVUcktPakNYeWVxakp2RjQweG41MVEKoHKCkhsn29s4JuRCfBqoF78/UcShnCAx
-            sGnz9zTnE+LSVMbknG1+Y3kFdRNXesLFZfyyk3W2atjp7Tw9rGYWTw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-11T06:57:04Z"
-    mac: ENC[AES256_GCM,data:E4jKWJsO9bEMzEjmp+XhBx45heXB7W5op11YyC2TV2KA0PNfAa7eZXIAZ7PVjVIfhbmODv3pd3KG4mY7lJ9I1ly6VfFGl4wMtXZkQlVt5+2DF6GyLGGfjKftRcGni4xP2J4wfzZGiIiQ2G8IUfmGy8Wpegw9lo6/UvES1w1kies=,iv:6fwg2NNoZnKq9jiFHLRQ6FZXrx9OzFEnxWU1VwEVoj0=,tag:CiJAekk+4dp/pyWkqXJKVw==,type:str]
-    encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
-    version: 3.12.1

infra/kargo/values/secret-values.prod.enc.yaml

@@ -1,27 +0,0 @@
-# Kargo secrets for prod cluster
-passwordHash: ENC[AES256_GCM,data:iYRGwF7yug4fy4q70CoWMJCAIwd5nszzTqXHXe88zGRRYw6YtvAszCpGcecRRFhCwIfycTnciXfN,iv:CwerCu5GfMhpTpeqQ2QmMBMwxf7t2L12PUM4yCT4yIE=,tag:XNhTKS0d6T0VhK6E9BDn1w==,type:str]
-tokenSigningKey: ENC[AES256_GCM,data:+05VkEeKatxayA1wK0a19fE6PFc3utOHvvT3Z+4KwfUBI778n5X9rMwSQQSFsbQyduPLITGf5VYKGaC5z3okAQ==,iv:uuS6oHdCLrvh6H38sfYzXTsrZ1lw5CJxjNN/0jchV9Q=,tag:iVuTqL2zew18OMeFwnGqrQ==,type:str]
-sops:
-    age:
-        - recipient: age1xmnaqlrjzpk5hl7uhel9sehqh7zdz8p59qte2myt97aqd7lyeuxszuess7
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEYytrSWhtUWtEQUpQVEhh
-            S1RvN2N3ZFcvaFVmdU5KQ2pYTitPMUJJQTNFCml4YWMzRWdiZHAxRUoycHRmTU1L
-            RUhDOEJzSThIVDV0Y1RSQWczeEVXU0UKLS0tIHgwM0k3R2k1V1h5U2tWajdnMElj
-            SUdhZzh1S3Y3cktwTUJzQk5Lc3BjeTAK4LOXLhfyd4NMWsuUm0/Bjxq+9ni6wntw
-            6u2UgYliecKNw4IX+2Ukhp/z4jGlVEayAE8QrfCj7RjBATPUYncPEw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age16p0gwk8vt90vy2gm8jjca8rcyd2drv5526e997ukdelnv5ek8unqm0smuk
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1bittd3daOE9jWUJKeHB4
-            R2k4Q3lNSzNkTDA0RTZlL1JrSFNMalRhWEVVCjNYSDVZU3kvRHlqZTRaOGRkZDJI
-            RUJiM2RMY0tFU2QvT25tQlFtK1l1NTgKLS0tIGJDYzhFelR1TkpNL2JmMGJ4YXd2
-            SGNGTGhGWGovbUJHMHh0QWhIWlhBdVUKAKxeFgOPJRaTl5z0bydzd1nr5SDmqfMx
-            7n/OjVadcCg4PLd54eMpgiJ7ts4UeaAK+RxdHtI9Y7jP1ConLffoAg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-11T06:57:04Z"
-    mac: ENC[AES256_GCM,data:Mp01K4uHW7ZFXzURs8nzkfwe6d7xgiOds12/VN1I5qB5OoC3afM1pZRQ7/mM0lTyueVt9hTh4B76zAFp6rB+/ombjJ5JPnwyEayAklovy7R6BFC1podhb78npC2u7K5P7DIFI54nJqj1XfFt4eIMQjkR6AnFeT1pqzquF7SVnLQ=,iv:VesrzDd09vugtzAYjB/oyHm99Dmm8dlDgP0NITvd4Rs=,tag:5z5zBC/7ulnqTRz9UXyrhw==,type:str]
-    encrypted_regex: ^(password|token|secret|key|privateKey|admin-password|db-password|passwordHash|tokenSigningKey)$
-    version: 3.12.1

infra/traefik-routes/config.yaml

@@ -1,10 +0,0 @@
-{
-  "name": "traefik-routes",
-  "namespace": "kube-system",
-  "step": "3",
-  "source": {
-    "repoURL": "https://github.com/Kargones/deploy-app-kargo-private.git",
-    "path": "infra/traefik-routes/manifests",
-    "targetRevision": "main"
-  }
-}

infra/traefik-routes/manifests/gitea-ingress.yaml

@@ -1,41 +0,0 @@
-# Gitea HTTPS IngressRoute via Traefik
-# Uses default TLS store (wildcard-tls from kube-system via TLSStore)
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gitea-https
-  namespace: gitea
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`gitea.k3s\..+\.local`)
-      kind: Rule
-      middlewares:
-        - name: sslheader
-          namespace: kube-system
-        - name: gitea-buffer-timeout
-          namespace: gitea
-      services:
-        - name: gitea-http
-          port: 3000
-  tls: {}
----
-# HTTP → HTTPS redirect for Gitea
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: gitea-http-redirect
-  namespace: gitea
-spec:
-  entryPoints:
-    - web
-  routes:
-    - match: HostRegexp(`gitea.k3s\..+\.local`)
-      kind: Rule
-      middlewares:
-        - name: redirect-https
-          namespace: kube-system
-      services:
-        - name: gitea-http
-          port: 3000

infra/traefik-routes/manifests/gitea-ssh.yaml

@@ -1,14 +0,0 @@
-# Gitea SSH access via Traefik TCP routing (port 2222)
-apiVersion: traefik.io/v1alpha1
-kind: IngressRouteTCP
-metadata:
-  name: gitea-ssh
-  namespace: gitea
-spec:
-  entryPoints:
-    - ssh
-  routes:
-    - match: HostSNI(`*`)
-      services:
-        - name: gitea-ssh
-          port: 22

infra/traefik-routes/manifests/kargo-ingress.yaml

@@ -1,21 +0,0 @@
-# Kargo dashboard HTTPS IngressRoute
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: kargo-https
-  namespace: kargo
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`kargo.k3s\..+\.local`)
-      kind: Rule
-      middlewares:
-        - name: kargo-tls-middleware
-          namespace: kargo
-      services:
-        - name: kargo-api
-          port: 443
-          scheme: https
-          serversTransport: kargo-skip-verify
-  tls: {}

infra/traefik-routes/manifests/kargo-transport.yaml

@@ -1,8 +0,0 @@
-# ServersTransport to skip TLS verification for Kargo backend (self-signed cert)
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: kargo-skip-verify
-  namespace: kargo
-spec:
-  insecureSkipVerify: true

infra/traefik-routes/manifests/middlewares.yaml

@@ -1,57 +0,0 @@
-# HTTP → HTTPS redirect
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: redirect-https
-  namespace: kube-system
-spec:
-  redirectScheme:
-    scheme: https
-    permanent: true
----
-# Forward X-Forwarded-Proto header for backends behind TLS termination
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: sslheader
-  namespace: kube-system
-spec:
-  headers:
-    customRequestHeaders:
-      X-Forwarded-Proto: "https"
----
-# Gitea: buffer large requests (git push) + timeout for CI builds
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: gitea-buffer-timeout
-  namespace: gitea
-spec:
-  buffering:
-    maxRequestBodyBytes: 0
-    maxResponseBodyBytes: 0
-    memRequestBodyBytes: 20971520
-    memResponseBodyBytes: 20971520
-    retryExpression: "IsNetworkError()"
----
-# ArgoCD: X-Forwarded-Proto for TLS termination
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: argocd-tls-middleware
-  namespace: argocd
-spec:
-  headers:
-    customRequestHeaders:
-      X-Forwarded-Proto: "https"
----
-# Kargo: X-Forwarded-Proto for TLS termination
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: kargo-tls-middleware
-  namespace: kargo
-spec:
-  headers:
-    customRequestHeaders:
-      X-Forwarded-Proto: "https"

infra/traefik-routes/manifests/namespaces.yaml

@@ -1,14 +0,0 @@
-# Ensure namespaces exist for cross-namespace middleware references
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitea
-  labels:
-    name: gitea
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kargo
-  labels:
-    name: kargo

infra/traefik-routes/manifests/tls-store.yaml

@@ -1,10 +0,0 @@
-# Default TLS store — uses wildcard-tls from kube-system as default cert.
-# All IngressRoutes with tls: {} will use this certificate.
-apiVersion: traefik.io/v1alpha1
-kind: TLSStore
-metadata:
-  name: default
-  namespace: kube-system
-spec:
-  defaultCertificate:
-    secretName: wildcard-tls

infra/traefik-routes/manifests/traefik-dashboard.yaml

@@ -1,19 +0,0 @@
-# Traefik Dashboard IngressRoute
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: traefik-dashboard
-  namespace: kube-system
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: HostRegexp(`traefik.k3s\..+\.local`) && (PathPrefix(`/dashboard`) || PathPrefix(`/api`))
-      kind: Rule
-      middlewares:
-        - name: sslheader
-          namespace: kube-system
-      services:
-        - name: api@internal
-          kind: TraefikService
-  tls: {}