mirror of
https://github.com/ghndrx/homelab-gitops.git
synced 2026-02-10 06:44:57 +00:00
124a29a0a9
- Add root ApplicationSet using Git Directory Generator - Configure AppProjects for infrastructure and apps separation - Add cert-manager with Let's Encrypt ClusterIssuers (staging/prod) - Add SOPS configuration for age-encrypted secrets - Add bootstrap documentation (docs/BOOTSTRAP.md) - Scaffold infrastructure dirs (networking, storage, monitoring) - Update README with quick start and architecture GitOps pattern: directories auto-discovered by ArgoCD ApplicationSets Reference: CNCF App-of-Apps best practices 2025
49 lines
1.2 KiB
YAML
49 lines
1.2 KiB
YAML
# infrastructure/cert-manager/kustomization.yaml
|
|
# Cert-Manager with Let's Encrypt ClusterIssuers
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: cert-manager
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- clusterissuers.yaml
|
|
|
|
helmCharts:
|
|
- name: cert-manager
|
|
repo: https://charts.jetstack.io
|
|
version: v1.14.4
|
|
releaseName: cert-manager
|
|
namespace: cert-manager
|
|
valuesInline:
|
|
installCRDs: true
|
|
replicaCount: 1
|
|
# Pod Security Standards compliance
|
|
podSecurityPolicy:
|
|
enabled: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containerSecurityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
webhook:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
cainjector:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
# Prometheus ServiceMonitor
|
|
prometheus:
|
|
enabled: true
|
|
servicemonitor:
|
|
enabled: true
|