diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index f25314a..f283a4b 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -130,6 +130,7 @@ Before proposing deploy commands, check whether the change targets the host Comp - Before editing a chart's `values.yaml`, check the schema for the exact chart/dependency version declared in its `Chart.yaml`. Prefer a schema shipped with that exact chart package; never use a schema from `main`, `latest`, or a different version as if it were authoritative. - Current chart schema/reference locations: - Cilium: `infrastructure/cilium/Chart.yaml` pins the Cilium dependency. Its matching upstream schema is [`values.schema.json` for Cilium v1.17.6](https://raw.githubusercontent.com/cilium/cilium/v1.17.6/install/kubernetes/cilium/values.schema.json). Keep this reference aligned with the dependency version when upgrading. + - cert-manager: `infrastructure/cert-manager/Chart.yaml` pins the Jetstack cert-manager chart. Its matching upstream schema is [`values.schema.json` for cert-manager v1.21.2](https://raw.githubusercontent.com/cert-manager/cert-manager/v1.21.2/deploy/charts/cert-manager/values.schema.json). Keep this reference aligned with the dependency version when upgrading; cert-manager's CRDs are enabled and retained by this chart. - Longhorn: `infrastructure/longhorn/Chart.yaml` pins the Longhorn dependency. The matching [v1.8.1 chart directory](https://github.com/longhorn/longhorn/tree/v1.8.1/chart) does not include `values.schema.json`; use that release's [`values.yaml`](https://raw.githubusercontent.com/longhorn/longhorn/v1.8.1/chart/values.yaml) and chart documentation alongside this repository's values and templates. Do not substitute a schema from another Longhorn release. - Vaultwarden: this is a repository-maintained chart under `services/vaultwarden/`, not an upstream chart dependency, and it currently has no `values.schema.json`. Use the [Gabe565 Vaultwarden chart values](https://github.com/gabe565/charts/blob/main/charts/vaultwarden/values.yaml) as a reference for upstream configuration options, but treat this repository's `services/vaultwarden/values.yaml` and templates as the actual contract. The upstream chart has its own structure and common-library dependency, so do not copy its values or assume they work here without checking the local templates. If changing or adding local chart values, add or update `services/vaultwarden/values.schema.json` to validate the local contract. - Pin versions for deployed software and build/deployment dependencies. Avoid `latest`, floating tags, and unversioned references; for container images, use an explicit version tag and prefer a digest where practical for immutable deployments. If a floating reference is necessary, explain why and its update risk. diff --git a/README.md b/README.md index 63f5d6f..42817e2 100644 --- a/README.md +++ b/README.md @@ -39,7 +39,7 @@ flowchart LR subgraph gitops[GitOps repository directories] appsetFiles[bootstrap/applicationsets] - infra[infrastructure/*
Cilium and Longhorn charts] + infra[infrastructure/*
Cilium, cert-manager, and Longhorn charts] services[services/*
Vaultwarden and other charts] appsetFiles -. registers .-> appsets infra --> apps @@ -204,9 +204,11 @@ The Kubernetes path accepts a `nodes` list containing any number of control-plan kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d ``` -11. Confirm Argo CD discovers `infrastructure/cilium`, `infrastructure/longhorn`, and `services/vaultwarden`, and that the Longhorn StorageClass is available before relying on Vaultwarden persistence. +11. Confirm Argo CD discovers `infrastructure/cilium`, `infrastructure/cert-manager`, `infrastructure/longhorn`, and `services/vaultwarden`, and that the Longhorn StorageClass is available before relying on Vaultwarden persistence. -Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Cilium's Envoy ingress controller is enabled in shared-load-balancer mode; Ingress resources must set `spec.ingressClassName: cilium`. The Cilium LoadBalancer IP pool is `10.0.0.10–10.0.0.89`, announced over `enp1s0` with an L2 announcement policy. Keep that range reserved from DHCP and other static assignments, and recheck the interface and pool if the node network changes. Longhorn also requires a validated disk or mount on the storage node. +Talos uses its default CNI during bootstrap so Argo CD can start. Cilium is then reconciled as the first infrastructure application. Cilium's Envoy ingress controller is enabled in shared-load-balancer mode; Ingress resources must set `spec.ingressClassName: cilium`. The Cilium LoadBalancer IP pool is configured in `infrastructure/cilium/templates/loadbalancer-ippool.yaml` and announced over `enp1s0` with an L2 announcement policy. Keep the configured range reserved from DHCP and other static assignments, and recheck the interface and pool if the node network changes. + +cert-manager is installed from the pinned Jetstack chart under `infrastructure/cert-manager/`, with its CRDs enabled and retained on uninstall. This installs the certificate controller but does not create an Issuer, ClusterIssuer, or application Certificates; configure those resources and any required DNS or ACME account settings before requesting certificates. The chart version is pinned in `infrastructure/cert-manager/Chart.yaml`; use the matching [cert-manager v1.21.2 values schema](https://raw.githubusercontent.com/cert-manager/cert-manager/v1.21.2/deploy/charts/cert-manager/values.schema.json) and [Helm installation documentation](https://cert-manager.io/docs/installation/helm/) when changing chart values. Longhorn also requires a validated disk or mount on the storage node. The Terraform Talos provider uses one generated machine-secrets bundle for the whole node list. If the nodes were previously configured with another Talos CA, reset/reinstall them or restore the matching Terraform state before applying. Terraform state contains the generated Talos credentials and must remain private. diff --git a/infrastructure/cert-manager/Chart.lock b/infrastructure/cert-manager/Chart.lock new file mode 100644 index 0000000..492fe85 --- /dev/null +++ b/infrastructure/cert-manager/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: cert-manager + repository: oci://quay.io/jetstack/charts + version: v1.21.2 +digest: sha256:76871d34668a844055ed19c78b9fd543d1fa061946a52360faf05282360e4fb3 +generated: "2026-10-09T13:17:54.794093438-06:00" diff --git a/infrastructure/cert-manager/Chart.yaml b/infrastructure/cert-manager/Chart.yaml new file mode 100644 index 0000000..d3b3ea7 --- /dev/null +++ b/infrastructure/cert-manager/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +name: cert-manager-infrastructure +description: cert-manager installation and configuration for the home-services cluster. +type: application +version: 0.1.0 +appVersion: "v1.21.2" +dependencies: + - name: cert-manager + version: v1.21.2 + repository: oci://quay.io/jetstack/charts diff --git a/infrastructure/cert-manager/values.yaml b/infrastructure/cert-manager/values.yaml new file mode 100644 index 0000000..204f7e0 --- /dev/null +++ b/infrastructure/cert-manager/values.yaml @@ -0,0 +1,4 @@ +cert-manager: + crds: + enabled: true + keep: true