GitOps Runbook

Boundaries

Terraform owns Talos machine configuration, cluster bootstrap, and the Argo CD Helm release. Argo CD owns resources under infrastructure/ and services/ after the ApplicationSets are registered. The existing Compose stacks remain independent under compose-services/.

First bootstrap

Confirm Talos v1.14.0, a supported Kubernetes version, the control-plane endpoint, and both node addresses.
Confirm the Gitea URL is reachable from the cluster and its certificate is trusted.
Run Terraform from terraform/ using a local variable file that is not committed.
Verify the argocd namespace and Argo CD pods.
Verify the gitea-repository Secret has the Argo CD repository label and does not expose credentials in Git.
Apply bootstrap/applicationsets/ once.

Reconciliation order

Cilium must become healthy before workloads depending on its networking features. Longhorn must have a usable disk before PVC-backed workloads are considered ready. ApplicationSets use automated sync, pruning, self-healing, and namespace creation, so deleting a chart directory intentionally removes its generated Application resources.

SOPS workflow

Use an age recipient in .sops.yaml, encrypt secret manifests as *.sops.yaml, and provision the matching private key out-of-band. Do not place age private keys, plaintext values, tokens, or passwords in this repository.

Recovery

If Gitea is unavailable, existing resources remain at their last reconciled state but new changes cannot be applied. Restore repository access, inspect Argo CD Application health, and allow reconciliation to resume. For a workload rollback, revert the Git commit and let Argo CD reconcile the known-good revision.

Two-node limitation

This is not a highly available control plane with one control-plane node. Storage replica counts are intentionally set to one until a second suitable storage node and disk policy are confirmed.

1.9 KiB Raw Blame History