From 1987bb5aa7d2d1c109937a30554f2bb0b5867d3c Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Sun, 5 Jul 2026 23:42:16 -0700 Subject: [PATCH 1/3] chore(foundry): scope tree to argocd + cloudflared only, fix external-dns targets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Remove sentinel Application and manifest set from apps-foundry/ and manifests-foundry/. Focusing on argocd cutover first; sentinel comes back in a follow-up PR once the tunnel + external-dns path is proven end-to-end. - Add --force-default-targets to the external-dns Helm extraArgs. Without it, external-dns 0.15+ treats --default-targets as a fallback and the Ingress's LoadBalancer status wins — for Traefik on k3s that's the private LAN IPs (192.168.1.100-104) which would publish as A records for public hostnames. The flag forces the CNAME-to-tunnel target to always win. After merge: - root-foundry prunes the sentinel Application, which prunes its workloads. The sentinel namespace may linger with the manually-created sentinel-secrets Secret; delete manually if desired. - external-dns pod restarts with the new flag, writes fdry-prefixed ownership TXT records and (once EKS's ext- records are gone) claims the tunnel CNAME for argocd.gauchoracing.com. --- kubernetes/apps-foundry/external-dns.yaml | 6 + kubernetes/apps-foundry/sentinel.yaml | 48 ----- .../sentinel/configmap-kerbecs.yaml | 194 ------------------ .../manifests-foundry/sentinel/core.yaml | 86 -------- .../manifests-foundry/sentinel/discord.yaml | 90 -------- .../manifests-foundry/sentinel/google.yaml | 105 ---------- .../manifests-foundry/sentinel/ingress.yaml | 31 --- .../manifests-foundry/sentinel/kerbecs.yaml | 79 ------- .../sentinel/kustomization.yaml | 47 ----- .../manifests-foundry/sentinel/namespace.yaml | 4 - .../manifests-foundry/sentinel/oauth.yaml | 115 ----------- .../manifests-foundry/sentinel/postgres.yaml | 17 -- .../manifests-foundry/sentinel/saml.yaml | 101 --------- .../manifests-foundry/sentinel/web.yaml | 49 ----- 14 files changed, 6 insertions(+), 966 deletions(-) delete mode 100644 kubernetes/apps-foundry/sentinel.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/configmap-kerbecs.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/core.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/discord.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/google.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/ingress.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/kerbecs.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/kustomization.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/namespace.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/oauth.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/postgres.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/saml.yaml delete mode 100644 kubernetes/manifests-foundry/sentinel/web.yaml diff --git a/kubernetes/apps-foundry/external-dns.yaml b/kubernetes/apps-foundry/external-dns.yaml index 03d7ed2..cdce56d 100644 --- a/kubernetes/apps-foundry/external-dns.yaml +++ b/kubernetes/apps-foundry/external-dns.yaml @@ -83,7 +83,13 @@ spec: # says. Traefik on k3s advertises node IPs there via klipper-lb; # those aren't publicly routable and are irrelevant since # traffic arrives through the tunnel anyway. + # + # --force-default-targets is required with external-dns >= 0.15: + # without it, the source-provided target (the Traefik LB IPs) + # wins and --default-targets is only used as a fallback. With + # the flag, --default-targets always overrides. - "--default-targets=$(FOUNDRY_TUNNEL_TARGET)" + - "--force-default-targets" logLevel: info logFormat: json diff --git a/kubernetes/apps-foundry/sentinel.yaml b/kubernetes/apps-foundry/sentinel.yaml deleted file mode 100644 index 9bb91a8..0000000 --- a/kubernetes/apps-foundry/sentinel.yaml +++ /dev/null @@ -1,48 +0,0 @@ -# Sentinel on the foundry k3s cluster. Same manifest set as the EKS tree -# (kubernetes/manifests/sentinel/), diverging only in ingress.yaml -# (Traefik instead of ALB) and postgres.yaml (public Cloudflare hostname -# for the gr-postgres EC2 instead of the internal EC2 hostname). -# -# Manual Secret needed once after this Application first syncs. Copy the -# external-facing values from the EKS cluster verbatim so identity state -# (Discord, INTERNAL_BOOTSTRAP_SECRET) stays coherent across environments -# during cutover: -# -# kubectl --context eks -n sentinel get secret sentinel-secrets -o yaml \ -# | grep -v '^\s*resourceVersion:\|^\s*uid:\|^\s*creationTimestamp:\|^\s*namespace:' \ -# | kubectl --context foundry apply -f - -# -# Or create from scratch: -# -# kubectl -n sentinel create secret generic sentinel-secrets \ -# --from-literal=POSTGRES_PASSWORD="$(cd ../../infra/environments/prod && terraform output -raw postgres_password)" \ -# --from-literal=INTERNAL_BOOTSTRAP_SECRET=... \ -# --from-literal=KERBECS_PASSWORD=... \ -# --from-literal=DISCORD_TOKEN=... \ -# --from-literal=DISCORD_CLIENT_ID=... \ -# --from-literal=DISCORD_CLIENT_SECRET=... \ -# --from-literal=GOOGLE_SERVICE_ACCOUNT=... - -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: sentinel - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: default - source: - repoURL: https://github.com/Gaucho-Racing/infrastructure.git - targetRevision: main - path: kubernetes/manifests-foundry/sentinel - destination: - server: https://kubernetes.default.svc - namespace: sentinel - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - - ServerSideApply=true diff --git a/kubernetes/manifests-foundry/sentinel/configmap-kerbecs.yaml b/kubernetes/manifests-foundry/sentinel/configmap-kerbecs.yaml deleted file mode 100644 index 3525624..0000000 --- a/kubernetes/manifests-foundry/sentinel/configmap-kerbecs.yaml +++ /dev/null @@ -1,194 +0,0 @@ -# Kerbecs gateway routing rules. Mounted into the kerbecs pod at -# /etc/kerbecs/kerbecs.yaml — KERBECS_CONFIG points the binary at it. -# -# Upstreams reference the in-cluster Services by name (cross-namespace -# resolution not needed since everything lives in `sentinel`). The web -# upstream points at port 80 (the nginx-served prod build), unlike the -# docker-compose dev setup where vite serves on 5173. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: kerbecs-config - namespace: sentinel -data: - kerbecs.yaml: | - gateway: - name: sentinel-gateway - version: 0.1.0 - env: ${ENV:PROD} - timeouts: - dial: 5s - headers: 30s - idle: 50s - overall: 0 - - listeners: - gateway: - port: "10310" - cors: - enabled: true - allowed_origins: ["*"] - allow_credentials: false - admin: - port: "10300" - auth: - type: basic - username: ${KERBECS_USER:admin} - password: ${KERBECS_PASSWORD:admin} - - providers: - static: - # Hot-reload the config on ConfigMap updates (kerbecs >= 3.1.0). The - # watcher reacts to the kubelet ..data symlink swap, so route changes - # apply without restarting the pod. - watch: true - - upstreams: - core: - name: sentinel-core - version: 0.1.0 - instances: - - http://core.sentinel.svc.cluster.local:9999 - - oauth: - name: sentinel-oauth - version: 0.1.0 - instances: - - http://oauth.sentinel.svc.cluster.local:9997 - - discord: - name: sentinel-discord - version: 0.1.0 - instances: - - http://discord.sentinel.svc.cluster.local:9998 - - saml: - name: sentinel-saml - version: 0.1.0 - instances: - - http://saml.sentinel.svc.cluster.local:9996 - - google: - name: sentinel-google - version: 0.1.0 - instances: - - http://google.sentinel.svc.cluster.local:9995 - - web: - name: sentinel-web - version: 0.1.0 - instances: - - http://web.sentinel.svc.cluster.local:80 - - routes: - - name: core-internal - match: - path: /api/core/* - upstream: core - rewrite: - strip_prefix: /api - envelope: passthrough - - - name: core-users - match: - path: /api/users/* - upstream: core - rewrite: - strip_prefix: /api - envelope: passthrough - - - name: core-applications - match: - path: /api/applications/* - upstream: core - rewrite: - strip_prefix: /api - envelope: passthrough - - - name: core-groups - match: - path: /api/groups/* - upstream: core - rewrite: - strip_prefix: /api - envelope: passthrough - - - name: core-entities - match: - path: /api/entities/* - upstream: core - rewrite: - strip_prefix: /api - envelope: passthrough - - - name: oauth - match: - path: /api/oauth/* - upstream: oauth - rewrite: - strip_prefix: /api - envelope: passthrough - - - name: auth - match: - path: /api/auth/* - upstream: oauth - rewrite: - strip_prefix: /api - envelope: passthrough - - - name: discord - match: - path: /api/discord/* - upstream: discord - rewrite: - strip_prefix: /api - envelope: passthrough - - - name: google - match: - path: /api/google/* - upstream: google - rewrite: - strip_prefix: /api - envelope: passthrough - - # SAML consent endpoints — the SPA calls these through the /api prefix. - - name: saml - match: - path: /api/saml/* - upstream: saml - rewrite: - strip_prefix: /api - envelope: passthrough - - # OIDC discovery must live at the issuer root (no /api prefix), so route - # it straight to oauth without stripping anything. - - name: well-known - match: - path: /.well-known/* - upstream: oauth - envelope: passthrough - - # SAML IdP metadata and SSO endpoint live at the issuer root (no /api - # prefix) so the URLs published in metadata are clean and stable. The - # SPA-served /saml/authorize consent page is NOT listed here, so it falls - # through to the web frontend below. - - name: saml-metadata - match: - path: /saml/metadata - upstream: saml - envelope: passthrough - - - name: saml-sso - match: - path: /saml/sso - upstream: saml - envelope: passthrough - - - name: web-frontend - match: - path: /* - upstream: web - envelope: passthrough diff --git a/kubernetes/manifests-foundry/sentinel/core.yaml b/kubernetes/manifests-foundry/sentinel/core.yaml deleted file mode 100644 index 805afa1..0000000 --- a/kubernetes/manifests-foundry/sentinel/core.yaml +++ /dev/null @@ -1,86 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: core - namespace: sentinel -spec: - replicas: 1 - selector: - matchLabels: - app: core - template: - metadata: - labels: - app: core - spec: - # Spread across at least 2 nodes (minDomains) but tolerate skew - # up to 1 (so 3 replicas → [2,1], not forced [1,1,1]). minDomains - # makes the scheduler treat the missing-domain count as 0 when - # only one node currently has matching pods, so the second - # replica blocks on schedule and Karpenter provisions a node - # (requires k8s ≥ 1.30 — we're on 1.35). - topologySpreadConstraints: - - maxSkew: 1 - minDomains: 2 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app: core - containers: - - name: core - # Tag is set by kustomization.yaml's images block. - image: ghcr.io/gaucho-racing/sentinel-core:latest - ports: - - containerPort: 9999 - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - env: - - name: ENV - value: PROD - - name: PORT - value: "9999" - - name: DATABASE_HOST - value: postgres.sentinel.svc.cluster.local - - name: DATABASE_PORT - value: "5432" - - name: DATABASE_USER - value: postgres - - name: DATABASE_NAME - value: sentinel - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: POSTGRES_PASSWORD - # OIDC issuer — the public base URL. MUST match oauth's ISSUER - # exactly; it's the `iss` claim stamped into signed tokens and the - # `issuer` advertised by the OAuth discovery document. - - name: ISSUER - value: https://sentinel-v5.gauchoracing.com - # Shared secret each non-core service exchanges at startup - # for its pre-seeded bearer JWT. Same value as on every - # other sentinel-* deployment. Rotating it requires a - # rolling restart of every service so each can re-fetch. - - name: INTERNAL_BOOTSTRAP_SECRET - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: INTERNAL_BOOTSTRAP_SECRET ---- -apiVersion: v1 -kind: Service -metadata: - name: core - namespace: sentinel -spec: - selector: - app: core - ports: - - port: 9999 - targetPort: 9999 diff --git a/kubernetes/manifests-foundry/sentinel/discord.yaml b/kubernetes/manifests-foundry/sentinel/discord.yaml deleted file mode 100644 index 2078a57..0000000 --- a/kubernetes/manifests-foundry/sentinel/discord.yaml +++ /dev/null @@ -1,90 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: discord - namespace: sentinel -spec: - # Stays at 1 — multiple replicas would each open their own gateway - # connection and double-process every Discord event. - replicas: 1 - selector: - matchLabels: - app: discord - template: - metadata: - labels: - app: discord - spec: - containers: - - name: discord - # Tag is set by kustomization.yaml's images block. - image: ghcr.io/gaucho-racing/sentinel-discord:latest - ports: - - containerPort: 9998 - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - env: - - name: ENV - value: PROD - - name: PORT - value: "9998" - - name: DATABASE_HOST - value: postgres.sentinel.svc.cluster.local - - name: DATABASE_PORT - value: "5432" - - name: DATABASE_USER - value: postgres - - name: DATABASE_NAME - value: sentinel - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: POSTGRES_PASSWORD - # Resolve inter-service calls through the kerbecs gateway's admin - # API (replaces the rincon registry). Same admin creds the kerbecs - # deployment uses. - - name: KERBECS_ENDPOINT - value: http://kerbecs.sentinel.svc.cluster.local:10300 - - name: KERBECS_USER - value: admin - - name: KERBECS_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: KERBECS_PASSWORD - - name: DISCORD_GUILD - value: "756738476887638107" - - name: DISCORD_PREFIX - value: "!" - - name: WEB_BASE_URL - value: https://sentinel-v5.gauchoracing.com - - name: DISCORD_TOKEN - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: DISCORD_TOKEN - # Same value as on core; used at startup to exchange for - # this service's pre-seeded bearer JWT. - - name: INTERNAL_BOOTSTRAP_SECRET - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: INTERNAL_BOOTSTRAP_SECRET ---- -apiVersion: v1 -kind: Service -metadata: - name: discord - namespace: sentinel -spec: - selector: - app: discord - ports: - - port: 9998 - targetPort: 9998 diff --git a/kubernetes/manifests-foundry/sentinel/google.yaml b/kubernetes/manifests-foundry/sentinel/google.yaml deleted file mode 100644 index 845f125..0000000 --- a/kubernetes/manifests-foundry/sentinel/google.yaml +++ /dev/null @@ -1,105 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: google - namespace: sentinel -spec: - # Single replica: the service runs a reconcile cron that mirrors group - # membership out to Google Groups. With >1 replica each pod runs its own - # cron, so two sweeps could write the same Google Group concurrently. The - # writes are idempotent, but the cancel-and-restart coalescing and the - # GOOGLE_SYNC_MAX_REMOVALS guard are per-process — keep one cron owner. This - # is low-volume periodic work, so one replica is plenty. - replicas: 1 - selector: - matchLabels: - app: google - template: - metadata: - labels: - app: google - spec: - # Topology spread — see comment in core.yaml. Inert at replicas: 1. - topologySpreadConstraints: - - maxSkew: 1 - minDomains: 2 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app: google - containers: - - name: google - # Tag is set by kustomization.yaml's images block. - image: ghcr.io/gaucho-racing/sentinel-google:latest - ports: - - containerPort: 9995 - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - env: - - name: ENV - value: PROD - - name: PORT - value: "9995" - - name: DATABASE_HOST - value: postgres.sentinel.svc.cluster.local - - name: DATABASE_PORT - value: "5432" - - name: DATABASE_USER - value: postgres - - name: DATABASE_NAME - value: sentinel - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: POSTGRES_PASSWORD - # Resolve inter-service calls through the kerbecs gateway's admin - # API. Same admin creds the kerbecs deployment uses. - - name: KERBECS_ENDPOINT - value: http://kerbecs.sentinel.svc.cluster.local:10300 - - name: KERBECS_USER - value: admin - - name: KERBECS_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: KERBECS_PASSWORD - # Shared secret exchanged at startup for this service's pre-seeded - # bearer JWT. Same value as every other sentinel-* deployment. - - name: INTERNAL_BOOTSTRAP_SECRET - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: INTERNAL_BOOTSTRAP_SECRET - # Service-account JSON key for domain-wide delegation (scope - # admin.directory.group.member). The only real secret here — marked - # optional so the pod still boots before it's populated; sync just - # no-ops until it's set (then restart the pod to pick it up). - - name: GOOGLE_SERVICE_ACCOUNT - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: GOOGLE_SERVICE_ACCOUNT - optional: true - # The super-admin the service account impersonates. Just an email, - # not a credential, so it's a plain value rather than a secret. - - name: GOOGLE_ADMIN_SUBJECT - value: admin@gauchoracing.com ---- -apiVersion: v1 -kind: Service -metadata: - name: google - namespace: sentinel -spec: - selector: - app: google - ports: - - port: 9995 - targetPort: 9995 diff --git a/kubernetes/manifests-foundry/sentinel/ingress.yaml b/kubernetes/manifests-foundry/sentinel/ingress.yaml deleted file mode 100644 index 4ac88bc..0000000 --- a/kubernetes/manifests-foundry/sentinel/ingress.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Public entrypoint on the foundry k3s cluster. Traefik receives plain -# HTTP forwarded by the in-cluster cloudflared tunnel; TLS terminates at -# the Cloudflare edge. Host-based routing to the kerbecs gateway, which -# then routes to core/oauth/discord/saml/google/web internally. -# -# DNS is managed by the foundry external-dns instance: -# - hostname is derived from spec.rules[].host -# - cloudflare-proxied annotation flips the CF record to orange-cloud -# - the record's CNAME target comes from external-dns's -# --default-targets flag (points at the gr-foundry tunnel) - -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: sentinel - namespace: sentinel - annotations: - external-dns.alpha.kubernetes.io/cloudflare-proxied: "true" -spec: - ingressClassName: traefik - rules: - - host: sentinel-v5.gauchoracing.com - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: kerbecs - port: - number: 10310 diff --git a/kubernetes/manifests-foundry/sentinel/kerbecs.yaml b/kubernetes/manifests-foundry/sentinel/kerbecs.yaml deleted file mode 100644 index a8ec737..0000000 --- a/kubernetes/manifests-foundry/sentinel/kerbecs.yaml +++ /dev/null @@ -1,79 +0,0 @@ -# Gateway. Public traffic enters through the ALB (see ingress.yaml), -# kerbecs routes to the right upstream Service based on its config in -# the kerbecs-config ConfigMap. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: kerbecs - namespace: sentinel -spec: - replicas: 1 - selector: - matchLabels: - app: kerbecs - template: - metadata: - labels: - app: kerbecs - spec: - # Topology spread — see comment in core.yaml. - topologySpreadConstraints: - - maxSkew: 1 - minDomains: 2 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app: kerbecs - containers: - - name: kerbecs - image: bk1031/kerbecs:latest - ports: - - containerPort: 10310 - name: gateway - - containerPort: 10300 - name: admin - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - env: - - name: KERBECS_CONFIG - value: /etc/kerbecs/kerbecs.yaml - - name: ENV - value: PROD - - name: KERBECS_USER - value: admin - - name: KERBECS_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: KERBECS_PASSWORD - volumeMounts: - - name: kerbecs-config - mountPath: /etc/kerbecs - readOnly: true - volumes: - - name: kerbecs-config - configMap: - name: kerbecs-config ---- -apiVersion: v1 -kind: Service -metadata: - name: kerbecs - namespace: sentinel -spec: - selector: - app: kerbecs - ports: - - name: gateway - port: 10310 - targetPort: 10310 - - name: admin - port: 10300 - targetPort: 10300 diff --git a/kubernetes/manifests-foundry/sentinel/kustomization.yaml b/kubernetes/manifests-foundry/sentinel/kustomization.yaml deleted file mode 100644 index 224aa4f..0000000 --- a/kubernetes/manifests-foundry/sentinel/kustomization.yaml +++ /dev/null @@ -1,47 +0,0 @@ -# Kustomize entrypoint — ArgoCD auto-detects this file and runs -# `kustomize build` instead of treating the dir as a flat manifest set. -# -# The `images` block below is the single source of truth for sentinel -# service versions. Bumping a release looks like: -# -# kustomize edit set image \ -# ghcr.io/gaucho-racing/sentinel-core=ghcr.io/gaucho-racing/sentinel-core:5.2.0 -# -# (Run from this directory; CI can wrap it across all four images on -# tag push.) That edit only touches this file — the Deployment YAMLs -# stay unchanged, so the diff in a release PR is one block. -# -# rincon and kerbecs are on independent version streams from the -# sentinel services — bump them separately when there's a reason to. - -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - namespace.yaml - - configmap-kerbecs.yaml - - postgres.yaml - - kerbecs.yaml - - core.yaml - - oauth.yaml - - discord.yaml - - saml.yaml - - google.yaml - - web.yaml - - ingress.yaml - -images: - - name: ghcr.io/gaucho-racing/sentinel-core - newTag: 5.8.1 - - name: ghcr.io/gaucho-racing/sentinel-oauth - newTag: 5.8.1 - - name: ghcr.io/gaucho-racing/sentinel-discord - newTag: 5.8.1 - - name: ghcr.io/gaucho-racing/sentinel-saml - newTag: 5.8.1 - - name: ghcr.io/gaucho-racing/sentinel-google - newTag: 5.8.1 - - name: ghcr.io/gaucho-racing/sentinel-web - newTag: 5.8.1 - - name: bk1031/kerbecs - newTag: 3.2.0 diff --git a/kubernetes/manifests-foundry/sentinel/namespace.yaml b/kubernetes/manifests-foundry/sentinel/namespace.yaml deleted file mode 100644 index a9464d0..0000000 --- a/kubernetes/manifests-foundry/sentinel/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: sentinel diff --git a/kubernetes/manifests-foundry/sentinel/oauth.yaml b/kubernetes/manifests-foundry/sentinel/oauth.yaml deleted file mode 100644 index e2b1969..0000000 --- a/kubernetes/manifests-foundry/sentinel/oauth.yaml +++ /dev/null @@ -1,115 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: oauth - namespace: sentinel -spec: - replicas: 1 - selector: - matchLabels: - app: oauth - template: - metadata: - labels: - app: oauth - spec: - # Topology spread — see comment in core.yaml. - topologySpreadConstraints: - - maxSkew: 1 - minDomains: 2 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app: oauth - containers: - - name: oauth - # Tag is set by kustomization.yaml's images block. - image: ghcr.io/gaucho-racing/sentinel-oauth:latest - ports: - - containerPort: 9997 - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - env: - - name: ENV - value: PROD - - name: PORT - value: "9997" - - name: DATABASE_HOST - value: postgres.sentinel.svc.cluster.local - - name: DATABASE_PORT - value: "5432" - - name: DATABASE_USER - value: postgres - - name: DATABASE_NAME - value: sentinel - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: POSTGRES_PASSWORD - # Resolve inter-service calls through the kerbecs gateway's admin - # API (replaces the rincon registry). Same admin creds the kerbecs - # deployment uses. - - name: KERBECS_ENDPOINT - value: http://kerbecs.sentinel.svc.cluster.local:10300 - - name: KERBECS_USER - value: admin - - name: KERBECS_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: KERBECS_PASSWORD - # OIDC issuer — the public base URL. MUST match core's ISSUER - # exactly; the discovery document's `issuer` and the `iss` claim in - # ID tokens have to be byte-identical for relying parties. - - name: ISSUER - value: https://sentinel-v5.gauchoracing.com - # Discord OAuth client config for the "Continue with Discord" - # login button. Client id/secret are the Discord application's - # credentials; the redirect URI must byte-match what the web - # client sends in its authorize call (and what's registered - # on the Discord application's OAuth2 settings). - - name: DISCORD_CLIENT_ID - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: DISCORD_CLIENT_ID - - name: DISCORD_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: DISCORD_CLIENT_SECRET - - name: DISCORD_REDIRECT_URI - value: https://sentinel-v5.gauchoracing.com/auth/login/discord - # Shared secret exchanged at startup for this service's - # pre-seeded bearer JWT. Same value as every other - # sentinel-* deployment. - - name: INTERNAL_BOOTSTRAP_SECRET - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: INTERNAL_BOOTSTRAP_SECRET - # client_id of the shared Google Workspace account application - # (team@gauchoracing.com). The oauth service overrides identity - # claims for this client so authorized users sign in as the shared - # account. Not a secret — the client_secret is what's sensitive. - - name: TEAM_GOOGLE_CLIENT_ID - value: uozOEnbeoJ2t ---- -apiVersion: v1 -kind: Service -metadata: - name: oauth - namespace: sentinel -spec: - selector: - app: oauth - ports: - - port: 9997 - targetPort: 9997 diff --git a/kubernetes/manifests-foundry/sentinel/postgres.yaml b/kubernetes/manifests-foundry/sentinel/postgres.yaml deleted file mode 100644 index a207d06..0000000 --- a/kubernetes/manifests-foundry/sentinel/postgres.yaml +++ /dev/null @@ -1,17 +0,0 @@ -# In-cluster handle for the gr-postgres EC2 (still in AWS after the -# compute migration — same instance backing mapache + vault). -# -# From on-prem, this resolves via the Cloudflare A record -# gr-postgres.gauchoracing.com (gray-cloud, unproxied) to the EIP -# 52.32.150.44. Traffic goes over the public internet on 5432; the -# 32-char scram-sha-256 password is the only gate. The SG on the EC2 -# allows 0.0.0.0/0 on 5432 (admin_cidr_blocks in modules/postgres-ec2). - -apiVersion: v1 -kind: Service -metadata: - name: postgres - namespace: sentinel -spec: - type: ExternalName - externalName: gr-postgres.gauchoracing.com diff --git a/kubernetes/manifests-foundry/sentinel/saml.yaml b/kubernetes/manifests-foundry/sentinel/saml.yaml deleted file mode 100644 index 7709345..0000000 --- a/kubernetes/manifests-foundry/sentinel/saml.yaml +++ /dev/null @@ -1,101 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: saml - namespace: sentinel -spec: - # Single replica for now: on the very first boot the service generates and - # persists its SAML signing key + self-signed cert (saml_signing_key table). - # With >1 replica racing an empty table, two pods could each insert an active - # key and serve different certs, breaking SP signature verification. Once the - # row exists every replica loads the same key, so this can safely go to 2 - # after the first successful deploy. The IdP is interactive and low-volume, so - # one replica is fine in the meantime. - replicas: 1 - selector: - matchLabels: - app: saml - template: - metadata: - labels: - app: saml - spec: - # Topology spread — see comment in core.yaml. Inert at replicas: 1, - # kept so scaling up later spreads pods without an edit here. - topologySpreadConstraints: - - maxSkew: 1 - minDomains: 2 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app: saml - containers: - - name: saml - # Tag is set by kustomization.yaml's images block. - image: ghcr.io/gaucho-racing/sentinel-saml:latest - ports: - - containerPort: 9996 - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - cpu: 500m - memory: 512Mi - env: - - name: ENV - value: PROD - - name: PORT - value: "9996" - - name: DATABASE_HOST - value: postgres.sentinel.svc.cluster.local - - name: DATABASE_PORT - value: "5432" - - name: DATABASE_USER - value: postgres - - name: DATABASE_NAME - value: sentinel - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: POSTGRES_PASSWORD - # Resolve inter-service calls through the kerbecs gateway's admin - # API (replaces the rincon registry). Same admin creds the kerbecs - # deployment uses. - - name: KERBECS_ENDPOINT - value: http://kerbecs.sentinel.svc.cluster.local:10300 - - name: KERBECS_USER - value: admin - - name: KERBECS_PASSWORD - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: KERBECS_PASSWORD - # Public base URL. Doubles as the SAML IdP entityID (the metadata - # URL is derived from it), so it MUST match core's ISSUER exactly - # and stay byte-stable — changing it invalidates trust with every - # registered service provider. - - name: ISSUER - value: https://sentinel-v5.gauchoracing.com - # Shared secret exchanged at startup for this service's - # pre-seeded bearer JWT. Same value as every other - # sentinel-* deployment. - - name: INTERNAL_BOOTSTRAP_SECRET - valueFrom: - secretKeyRef: - name: sentinel-secrets - key: INTERNAL_BOOTSTRAP_SECRET ---- -apiVersion: v1 -kind: Service -metadata: - name: saml - namespace: sentinel -spec: - selector: - app: saml - ports: - - port: 9996 - targetPort: 9996 diff --git a/kubernetes/manifests-foundry/sentinel/web.yaml b/kubernetes/manifests-foundry/sentinel/web.yaml deleted file mode 100644 index f6a30a0..0000000 --- a/kubernetes/manifests-foundry/sentinel/web.yaml +++ /dev/null @@ -1,49 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: web - namespace: sentinel -spec: - replicas: 1 - selector: - matchLabels: - app: web - template: - metadata: - labels: - app: web - spec: - # Topology spread — see comment in core.yaml. - topologySpreadConstraints: - - maxSkew: 1 - minDomains: 2 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app: web - containers: - - name: web - # Tag is set by kustomization.yaml's images block. - image: ghcr.io/gaucho-racing/sentinel-web:latest - ports: - - containerPort: 80 - resources: - requests: - cpu: 10m - memory: 32Mi - limits: - cpu: 100m - memory: 128Mi ---- -apiVersion: v1 -kind: Service -metadata: - name: web - namespace: sentinel -spec: - selector: - app: web - ports: - - port: 80 - targetPort: 80 From 6fb8ee2e0759099b11ac69548bcd327c137490cc Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Sun, 5 Jul 2026 23:50:21 -0700 Subject: [PATCH 2/3] refactor(kubernetes): reorg tree per-cluster and drop empty dirs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Structure: kubernetes/ foundry/{apps,bootstrap,manifests}/ (was apps-foundry/, manifests-foundry/, bootstrap/root-foundry.yaml) prod/{apps,bootstrap,manifests}/ (was apps/, manifests/, bootstrap/root.yaml) - Each cluster is fully self-contained under one top-level dir; no more -foundry suffix collisions vs the EKS tree. - Update every ArgoCD Application's spec.source.path to the new location. - Update runbook + manual-bootstrap comments to reference the new paths and to use `terraform -chdir=infra/environments/prod` instead of cwd-relative `cd ../../infra/...` (which changed depth after the move). - Delete kubernetes/charts/.gitkeep (never populated) and kubernetes/envs/prod/.gitkeep (empty env dir). Manual step after merge — the root Applications live in the cluster with the OLD spec.source.path (kubernetes/apps and kubernetes/apps-foundry). Re-apply each so ArgoCD picks up the new location: kubectl --context apply -f kubernetes/prod/bootstrap/root.yaml kubectl --context foundry apply -f kubernetes/foundry/bootstrap/root.yaml Child Applications will then update in-place with new manifest paths. --- infra/environments/prod/foundry.tf | 30 +++++++++++-------- infra/modules/argocd/main.tf | 4 +-- kubernetes/charts/.gitkeep | 0 kubernetes/envs/prod/.gitkeep | 0 .../apps}/argocd-server-ingress.yaml | 2 +- .../apps}/cloudflared.yaml | 4 +-- .../apps}/external-dns.yaml | 2 +- .../bootstrap/root.yaml} | 10 +++---- .../argocd-server-ingress/ingress.yaml | 0 .../manifests}/cloudflared/deployment.yaml | 0 .../manifests}/cloudflared/namespace.yaml | 0 .../apps/argocd-server-ingress.yaml | 2 +- kubernetes/{ => prod}/apps/external-dns.yaml | 0 kubernetes/{ => prod}/apps/mapache.yaml | 2 +- .../{ => prod}/apps/metrics-server.yaml | 0 .../{ => prod}/apps/on-demand-nodepool.yaml | 2 +- kubernetes/{ => prod}/apps/sentinel.yaml | 2 +- kubernetes/{ => prod}/apps/spot-nodepool.yaml | 2 +- .../{ => prod}/apps/vault-k8s-operator.yaml | 0 kubernetes/{ => prod}/apps/vault.yaml | 2 +- kubernetes/{ => prod}/bootstrap/root.yaml | 8 ++--- .../argocd-server-ingress/ingress.yaml | 0 .../argocd-server-ingress/ingressclass.yaml | 0 .../{ => prod}/manifests/mapache/auth.yaml | 0 .../manifests/mapache/configmap-kerbecs.yaml | 0 .../manifests/mapache/dashboard.yaml | 0 .../{ => prod}/manifests/mapache/foreman.yaml | 0 .../{ => prod}/manifests/mapache/gr26.yaml | 0 .../{ => prod}/manifests/mapache/ingress.yaml | 0 .../{ => prod}/manifests/mapache/kerbecs.yaml | 0 .../manifests/mapache/kustomization.yaml | 0 .../{ => prod}/manifests/mapache/live.yaml | 0 .../manifests/mapache/namespace.yaml | 0 .../manifests/mapache/postgres.yaml | 0 .../{ => prod}/manifests/mapache/query.yaml | 0 .../{ => prod}/manifests/mapache/vehicle.yaml | 0 .../on-demand-nodepool/nodepool.yaml | 0 .../manifests/sentinel/configmap-kerbecs.yaml | 0 .../{ => prod}/manifests/sentinel/core.yaml | 0 .../manifests/sentinel/discord.yaml | 0 .../{ => prod}/manifests/sentinel/google.yaml | 0 .../manifests/sentinel/ingress.yaml | 0 .../manifests/sentinel/kerbecs.yaml | 0 .../manifests/sentinel/kustomization.yaml | 0 .../manifests/sentinel/namespace.yaml | 0 .../{ => prod}/manifests/sentinel/oauth.yaml | 0 .../manifests/sentinel/postgres.yaml | 0 .../{ => prod}/manifests/sentinel/saml.yaml | 0 .../{ => prod}/manifests/sentinel/web.yaml | 0 .../manifests/spot-nodepool/nodepool.yaml | 0 .../manifests/vault/configmap-kerbecs.yaml | 0 .../{ => prod}/manifests/vault/ingress.yaml | 0 .../{ => prod}/manifests/vault/kerbecs.yaml | 0 .../manifests/vault/kustomization.yaml | 0 .../{ => prod}/manifests/vault/namespace.yaml | 0 .../{ => prod}/manifests/vault/postgres.yaml | 0 .../{ => prod}/manifests/vault/server.yaml | 0 .../{ => prod}/manifests/vault/web.yaml | 0 58 files changed, 38 insertions(+), 34 deletions(-) delete mode 100644 kubernetes/charts/.gitkeep delete mode 100644 kubernetes/envs/prod/.gitkeep rename kubernetes/{apps-foundry => foundry/apps}/argocd-server-ingress.yaml (92%) rename kubernetes/{apps-foundry => foundry/apps}/cloudflared.yaml (83%) rename kubernetes/{apps-foundry => foundry/apps}/external-dns.yaml (96%) rename kubernetes/{bootstrap/root-foundry.yaml => foundry/bootstrap/root.yaml} (77%) rename kubernetes/{manifests-foundry => foundry/manifests}/argocd-server-ingress/ingress.yaml (100%) rename kubernetes/{manifests-foundry => foundry/manifests}/cloudflared/deployment.yaml (100%) rename kubernetes/{manifests-foundry => foundry/manifests}/cloudflared/namespace.yaml (100%) rename kubernetes/{ => prod}/apps/argocd-server-ingress.yaml (93%) rename kubernetes/{ => prod}/apps/external-dns.yaml (100%) rename kubernetes/{ => prod}/apps/mapache.yaml (97%) rename kubernetes/{ => prod}/apps/metrics-server.yaml (100%) rename kubernetes/{ => prod}/apps/on-demand-nodepool.yaml (93%) rename kubernetes/{ => prod}/apps/sentinel.yaml (96%) rename kubernetes/{ => prod}/apps/spot-nodepool.yaml (94%) rename kubernetes/{ => prod}/apps/vault-k8s-operator.yaml (100%) rename kubernetes/{ => prod}/apps/vault.yaml (92%) rename kubernetes/{ => prod}/bootstrap/root.yaml (82%) rename kubernetes/{ => prod}/manifests/argocd-server-ingress/ingress.yaml (100%) rename kubernetes/{ => prod}/manifests/argocd-server-ingress/ingressclass.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/auth.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/configmap-kerbecs.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/dashboard.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/foreman.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/gr26.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/ingress.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/kerbecs.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/kustomization.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/live.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/namespace.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/postgres.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/query.yaml (100%) rename kubernetes/{ => prod}/manifests/mapache/vehicle.yaml (100%) rename kubernetes/{ => prod}/manifests/on-demand-nodepool/nodepool.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/configmap-kerbecs.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/core.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/discord.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/google.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/ingress.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/kerbecs.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/kustomization.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/namespace.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/oauth.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/postgres.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/saml.yaml (100%) rename kubernetes/{ => prod}/manifests/sentinel/web.yaml (100%) rename kubernetes/{ => prod}/manifests/spot-nodepool/nodepool.yaml (100%) rename kubernetes/{ => prod}/manifests/vault/configmap-kerbecs.yaml (100%) rename kubernetes/{ => prod}/manifests/vault/ingress.yaml (100%) rename kubernetes/{ => prod}/manifests/vault/kerbecs.yaml (100%) rename kubernetes/{ => prod}/manifests/vault/kustomization.yaml (100%) rename kubernetes/{ => prod}/manifests/vault/namespace.yaml (100%) rename kubernetes/{ => prod}/manifests/vault/postgres.yaml (100%) rename kubernetes/{ => prod}/manifests/vault/server.yaml (100%) rename kubernetes/{ => prod}/manifests/vault/web.yaml (100%) diff --git a/infra/environments/prod/foundry.tf b/infra/environments/prod/foundry.tf index d8f6115..4b67d18 100644 --- a/infra/environments/prod/foundry.tf +++ b/infra/environments/prod/foundry.tf @@ -1,7 +1,7 @@ # Foundry (on-prem k3s) cutover resources — the shared Cloudflare Tunnel # that connects the on-prem cluster to Cloudflare. Public DNS records for # individual hostnames are managed by external-dns on the foundry cluster -# (see kubernetes/apps-foundry/external-dns.yaml), not here. +# (see kubernetes/foundry/apps/external-dns.yaml), not here. # # Design: the tunnel has a single catch-all ingress rule that forwards # ALL traffic to the Traefik service. Traefik does Host-based routing @@ -14,7 +14,7 @@ # Compute (EKS + ALB + ACM origin cert) still lives in main.tf. Once # every hostname is migrated off EKS and the on-prem stack has soaked, # delete module.eks / module.argocd / module.origin_cert from main.tf -# and remove kubernetes/apps/ from the repo. +# and remove kubernetes/prod/apps/ from the repo. # # Off-cluster data services (gr-postgres, gr-mqtt, gr-clickhouse) stay # in AWS — the on-prem cluster reaches them over the public internet via @@ -31,20 +31,24 @@ # --from-literal=target="$(terraform output -raw foundry_tunnel_id).cfargotunnel.com" # kubectl -n external-dns create secret generic cloudflare-api-token \ # --from-literal=api-token="$CLOUDFLARE_API_TOKEN" -# 3. Apply kubernetes/bootstrap/root-foundry.yaml on the foundry -# ArgoCD, populate sentinel-secrets, wait for pods Healthy. +# 3. Apply kubernetes/foundry/bootstrap/root.yaml on the foundry +# ArgoCD, wait for cloudflared / external-dns / argocd-server-ingress +# Applications to reach Healthy. # 4. Cutover for one hostname: -# a. Delete the existing sentinel-v5.gauchoracing.com record via CF -# dashboard (or scale EKS external-dns to 0 first — it'll take -# its four records with it). -# b. Foundry external-dns notices the sentinel Ingress with no +# a. Scale EKS external-dns to 0 so it stops recreating its records +# (kubectl --context -n external-dns scale deploy +# external-dns --replicas=0). +# b. Delete the hostname's CNAME + `ext-cname-` TXT +# records via CF dashboard. +# c. Foundry external-dns notices the matching Ingress with no # record, writes CNAME → .cfargotunnel.com within # its --interval (1m default). -# c. Traffic starts landing on foundry within CF TTL. -# 5. Bake. Add mapache/vault/argocd in follow-up PRs — each is a copy -# of manifests// into manifests-foundry// with two file -# changes (ingress.yaml → Traefik + external-dns annotation, -# postgres.yaml → public hostname). No terraform edit. +# d. Traffic starts landing on foundry within CF TTL. +# 5. Bake. Add each remaining hostname (sentinel-v5 / mapache / vault) +# in a follow-up PR — copy prod/manifests// into +# foundry/manifests// with two file changes (ingress.yaml → +# Traefik + external-dns annotation, postgres.yaml → public +# hostname). No terraform edit needed. # Account ID for the tunnel resources. The CF API token used by the # provider is scoped to a single account — return that account's ID. diff --git a/infra/modules/argocd/main.tf b/infra/modules/argocd/main.tf index fa1954b..634d942 100644 --- a/infra/modules/argocd/main.tf +++ b/infra/modules/argocd/main.tf @@ -1,5 +1,5 @@ # ArgoCD installed via Helm. This is the bootstrap install — ArgoCD takes -# over self-management once the root Application (kubernetes/bootstrap/root.yaml) +# over self-management once the root Application (kubernetes/prod/bootstrap/root.yaml) # is kubectl-apply'd. From that point, even ArgoCD upgrades happen via Git. # # SSO (Sentinel OIDC) and RBAC live in the chart values below so a single @@ -48,7 +48,7 @@ resource "helm_release" "argocd" { # Pin every ArgoCD component to the on-demand baseline NodePool. # GitOps needs to stay up to drive recovery when the spot pool # churns; on-demand is more expensive but worth it for the - # control plane. See kubernetes/manifests/on-demand-nodepool/. + # control plane. See kubernetes/prod/manifests/on-demand-nodepool/. nodeSelector = { "capacity-type" = "on-demand-baseline" } diff --git a/kubernetes/charts/.gitkeep b/kubernetes/charts/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/kubernetes/envs/prod/.gitkeep b/kubernetes/envs/prod/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/kubernetes/apps-foundry/argocd-server-ingress.yaml b/kubernetes/foundry/apps/argocd-server-ingress.yaml similarity index 92% rename from kubernetes/apps-foundry/argocd-server-ingress.yaml rename to kubernetes/foundry/apps/argocd-server-ingress.yaml index c359283..4741ab6 100644 --- a/kubernetes/apps-foundry/argocd-server-ingress.yaml +++ b/kubernetes/foundry/apps/argocd-server-ingress.yaml @@ -17,7 +17,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/manifests-foundry/argocd-server-ingress + path: kubernetes/foundry/manifests/argocd-server-ingress destination: server: https://kubernetes.default.svc namespace: argocd diff --git a/kubernetes/apps-foundry/cloudflared.yaml b/kubernetes/foundry/apps/cloudflared.yaml similarity index 83% rename from kubernetes/apps-foundry/cloudflared.yaml rename to kubernetes/foundry/apps/cloudflared.yaml index 82c8fa6..b222cc4 100644 --- a/kubernetes/apps-foundry/cloudflared.yaml +++ b/kubernetes/foundry/apps/cloudflared.yaml @@ -6,7 +6,7 @@ # Manual one-time Secret bootstrap after this first syncs: # # kubectl -n cloudflared create secret generic cloudflared-secrets \ -# --from-literal=TUNNEL_TOKEN="$(cd ../../infra/environments/prod && terraform output -raw foundry_tunnel_token)" +# --from-literal=TUNNEL_TOKEN="$(terraform -chdir=infra/environments/prod && terraform output -raw foundry_tunnel_token)" apiVersion: argoproj.io/v1alpha1 kind: Application @@ -20,7 +20,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/manifests-foundry/cloudflared + path: kubernetes/foundry/manifests/cloudflared destination: server: https://kubernetes.default.svc namespace: cloudflared diff --git a/kubernetes/apps-foundry/external-dns.yaml b/kubernetes/foundry/apps/external-dns.yaml similarity index 96% rename from kubernetes/apps-foundry/external-dns.yaml rename to kubernetes/foundry/apps/external-dns.yaml index cdce56d..b1af3ba 100644 --- a/kubernetes/apps-foundry/external-dns.yaml +++ b/kubernetes/foundry/apps/external-dns.yaml @@ -18,7 +18,7 @@ # --from-literal=api-token="$CLOUDFLARE_API_TOKEN" # # kubectl -n external-dns create configmap foundry-tunnel-target \ -# --from-literal=target="$(cd ../../infra/environments/prod && terraform output -raw foundry_tunnel_id).cfargotunnel.com" +# --from-literal=target="$(terraform -chdir=infra/environments/prod && terraform output -raw foundry_tunnel_id).cfargotunnel.com" apiVersion: argoproj.io/v1alpha1 kind: Application diff --git a/kubernetes/bootstrap/root-foundry.yaml b/kubernetes/foundry/bootstrap/root.yaml similarity index 77% rename from kubernetes/bootstrap/root-foundry.yaml rename to kubernetes/foundry/bootstrap/root.yaml index 4792bdb..597e076 100644 --- a/kubernetes/bootstrap/root-foundry.yaml +++ b/kubernetes/foundry/bootstrap/root.yaml @@ -5,16 +5,16 @@ # root — one ArgoCD instance, two independently-reconciled trees. Apply # once manually on the foundry cluster after the initial cutover prep: # -# kubectl --context foundry apply -f kubernetes/bootstrap/root-foundry.yaml +# kubectl --context foundry apply -f kubernetes/foundry/bootstrap/root.yaml # -# From then on, ArgoCD reads kubernetes/apps-foundry/ from this repo and +# From then on, ArgoCD reads kubernetes/foundry/apps/ from this repo and # reconciles every Application resource it finds there. # -# EKS is still managed by kubernetes/bootstrap/root.yaml → kubernetes/apps/. +# EKS is still managed by kubernetes/prod/bootstrap/root.yaml → kubernetes/prod/apps/. # The two roots do NOT share a cluster; each root's ArgoCD is scoped to # its own cluster via server: https://kubernetes.default.svc. # -# See kubernetes/apps-foundry/*.yaml for the per-stack manual bootstrap +# See kubernetes/foundry/apps/*.yaml for the per-stack manual bootstrap # steps (secret creation, DB creation, etc.). apiVersion: argoproj.io/v1alpha1 @@ -29,7 +29,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/apps-foundry + path: kubernetes/foundry/apps directory: recurse: true destination: diff --git a/kubernetes/manifests-foundry/argocd-server-ingress/ingress.yaml b/kubernetes/foundry/manifests/argocd-server-ingress/ingress.yaml similarity index 100% rename from kubernetes/manifests-foundry/argocd-server-ingress/ingress.yaml rename to kubernetes/foundry/manifests/argocd-server-ingress/ingress.yaml diff --git a/kubernetes/manifests-foundry/cloudflared/deployment.yaml b/kubernetes/foundry/manifests/cloudflared/deployment.yaml similarity index 100% rename from kubernetes/manifests-foundry/cloudflared/deployment.yaml rename to kubernetes/foundry/manifests/cloudflared/deployment.yaml diff --git a/kubernetes/manifests-foundry/cloudflared/namespace.yaml b/kubernetes/foundry/manifests/cloudflared/namespace.yaml similarity index 100% rename from kubernetes/manifests-foundry/cloudflared/namespace.yaml rename to kubernetes/foundry/manifests/cloudflared/namespace.yaml diff --git a/kubernetes/apps/argocd-server-ingress.yaml b/kubernetes/prod/apps/argocd-server-ingress.yaml similarity index 93% rename from kubernetes/apps/argocd-server-ingress.yaml rename to kubernetes/prod/apps/argocd-server-ingress.yaml index 23e717c..d172e2b 100644 --- a/kubernetes/apps/argocd-server-ingress.yaml +++ b/kubernetes/prod/apps/argocd-server-ingress.yaml @@ -16,7 +16,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/manifests/argocd-server-ingress + path: kubernetes/prod/manifests/argocd-server-ingress destination: server: https://kubernetes.default.svc namespace: argocd diff --git a/kubernetes/apps/external-dns.yaml b/kubernetes/prod/apps/external-dns.yaml similarity index 100% rename from kubernetes/apps/external-dns.yaml rename to kubernetes/prod/apps/external-dns.yaml diff --git a/kubernetes/apps/mapache.yaml b/kubernetes/prod/apps/mapache.yaml similarity index 97% rename from kubernetes/apps/mapache.yaml rename to kubernetes/prod/apps/mapache.yaml index 0f54a88..ff73e56 100644 --- a/kubernetes/apps/mapache.yaml +++ b/kubernetes/prod/apps/mapache.yaml @@ -38,7 +38,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/manifests/mapache + path: kubernetes/prod/manifests/mapache destination: server: https://kubernetes.default.svc namespace: mapache diff --git a/kubernetes/apps/metrics-server.yaml b/kubernetes/prod/apps/metrics-server.yaml similarity index 100% rename from kubernetes/apps/metrics-server.yaml rename to kubernetes/prod/apps/metrics-server.yaml diff --git a/kubernetes/apps/on-demand-nodepool.yaml b/kubernetes/prod/apps/on-demand-nodepool.yaml similarity index 93% rename from kubernetes/apps/on-demand-nodepool.yaml rename to kubernetes/prod/apps/on-demand-nodepool.yaml index ea41a49..634d903 100644 --- a/kubernetes/apps/on-demand-nodepool.yaml +++ b/kubernetes/prod/apps/on-demand-nodepool.yaml @@ -18,7 +18,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/manifests/on-demand-nodepool + path: kubernetes/prod/manifests/on-demand-nodepool destination: server: https://kubernetes.default.svc namespace: kube-system diff --git a/kubernetes/apps/sentinel.yaml b/kubernetes/prod/apps/sentinel.yaml similarity index 96% rename from kubernetes/apps/sentinel.yaml rename to kubernetes/prod/apps/sentinel.yaml index b18e8f1..e7f1bfd 100644 --- a/kubernetes/apps/sentinel.yaml +++ b/kubernetes/prod/apps/sentinel.yaml @@ -28,7 +28,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/manifests/sentinel + path: kubernetes/prod/manifests/sentinel destination: server: https://kubernetes.default.svc namespace: sentinel diff --git a/kubernetes/apps/spot-nodepool.yaml b/kubernetes/prod/apps/spot-nodepool.yaml similarity index 94% rename from kubernetes/apps/spot-nodepool.yaml rename to kubernetes/prod/apps/spot-nodepool.yaml index 9c62690..d8a2a87 100644 --- a/kubernetes/apps/spot-nodepool.yaml +++ b/kubernetes/prod/apps/spot-nodepool.yaml @@ -19,7 +19,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/manifests/spot-nodepool + path: kubernetes/prod/manifests/spot-nodepool destination: server: https://kubernetes.default.svc namespace: kube-system diff --git a/kubernetes/apps/vault-k8s-operator.yaml b/kubernetes/prod/apps/vault-k8s-operator.yaml similarity index 100% rename from kubernetes/apps/vault-k8s-operator.yaml rename to kubernetes/prod/apps/vault-k8s-operator.yaml diff --git a/kubernetes/apps/vault.yaml b/kubernetes/prod/apps/vault.yaml similarity index 92% rename from kubernetes/apps/vault.yaml rename to kubernetes/prod/apps/vault.yaml index 954d098..d94243b 100644 --- a/kubernetes/apps/vault.yaml +++ b/kubernetes/prod/apps/vault.yaml @@ -10,7 +10,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/manifests/vault + path: kubernetes/prod/manifests/vault destination: server: https://kubernetes.default.svc namespace: vault diff --git a/kubernetes/bootstrap/root.yaml b/kubernetes/prod/bootstrap/root.yaml similarity index 82% rename from kubernetes/bootstrap/root.yaml rename to kubernetes/prod/bootstrap/root.yaml index cfb8b30..cbd69a5 100644 --- a/kubernetes/bootstrap/root.yaml +++ b/kubernetes/prod/bootstrap/root.yaml @@ -3,13 +3,13 @@ # After ArgoCD is installed via terraform (infra/modules/argocd), apply # this once manually: # -# kubectl apply -f kubernetes/bootstrap/root.yaml +# kubectl apply -f kubernetes/prod/bootstrap/root.yaml # -# From then on, ArgoCD reads kubernetes/apps/ from this repo and +# From then on, ArgoCD reads kubernetes/prod/apps/ from this repo and # reconciles every Application resource it finds there. Adding a new # managed system (Sentinel, observability stack, etc.) is just: # -# 1. Add a new Application YAML under kubernetes/apps/ +# 1. Add a new Application YAML under kubernetes/prod/apps/ # 2. Commit + push # 3. ArgoCD picks it up on next sync (~3 min default, or instant via # `argocd app sync root`) @@ -29,7 +29,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/apps + path: kubernetes/prod/apps directory: recurse: true destination: diff --git a/kubernetes/manifests/argocd-server-ingress/ingress.yaml b/kubernetes/prod/manifests/argocd-server-ingress/ingress.yaml similarity index 100% rename from kubernetes/manifests/argocd-server-ingress/ingress.yaml rename to kubernetes/prod/manifests/argocd-server-ingress/ingress.yaml diff --git a/kubernetes/manifests/argocd-server-ingress/ingressclass.yaml b/kubernetes/prod/manifests/argocd-server-ingress/ingressclass.yaml similarity index 100% rename from kubernetes/manifests/argocd-server-ingress/ingressclass.yaml rename to kubernetes/prod/manifests/argocd-server-ingress/ingressclass.yaml diff --git a/kubernetes/manifests/mapache/auth.yaml b/kubernetes/prod/manifests/mapache/auth.yaml similarity index 100% rename from kubernetes/manifests/mapache/auth.yaml rename to kubernetes/prod/manifests/mapache/auth.yaml diff --git a/kubernetes/manifests/mapache/configmap-kerbecs.yaml b/kubernetes/prod/manifests/mapache/configmap-kerbecs.yaml similarity index 100% rename from kubernetes/manifests/mapache/configmap-kerbecs.yaml rename to kubernetes/prod/manifests/mapache/configmap-kerbecs.yaml diff --git a/kubernetes/manifests/mapache/dashboard.yaml b/kubernetes/prod/manifests/mapache/dashboard.yaml similarity index 100% rename from kubernetes/manifests/mapache/dashboard.yaml rename to kubernetes/prod/manifests/mapache/dashboard.yaml diff --git a/kubernetes/manifests/mapache/foreman.yaml b/kubernetes/prod/manifests/mapache/foreman.yaml similarity index 100% rename from kubernetes/manifests/mapache/foreman.yaml rename to kubernetes/prod/manifests/mapache/foreman.yaml diff --git a/kubernetes/manifests/mapache/gr26.yaml b/kubernetes/prod/manifests/mapache/gr26.yaml similarity index 100% rename from kubernetes/manifests/mapache/gr26.yaml rename to kubernetes/prod/manifests/mapache/gr26.yaml diff --git a/kubernetes/manifests/mapache/ingress.yaml b/kubernetes/prod/manifests/mapache/ingress.yaml similarity index 100% rename from kubernetes/manifests/mapache/ingress.yaml rename to kubernetes/prod/manifests/mapache/ingress.yaml diff --git a/kubernetes/manifests/mapache/kerbecs.yaml b/kubernetes/prod/manifests/mapache/kerbecs.yaml similarity index 100% rename from kubernetes/manifests/mapache/kerbecs.yaml rename to kubernetes/prod/manifests/mapache/kerbecs.yaml diff --git a/kubernetes/manifests/mapache/kustomization.yaml b/kubernetes/prod/manifests/mapache/kustomization.yaml similarity index 100% rename from kubernetes/manifests/mapache/kustomization.yaml rename to kubernetes/prod/manifests/mapache/kustomization.yaml diff --git a/kubernetes/manifests/mapache/live.yaml b/kubernetes/prod/manifests/mapache/live.yaml similarity index 100% rename from kubernetes/manifests/mapache/live.yaml rename to kubernetes/prod/manifests/mapache/live.yaml diff --git a/kubernetes/manifests/mapache/namespace.yaml b/kubernetes/prod/manifests/mapache/namespace.yaml similarity index 100% rename from kubernetes/manifests/mapache/namespace.yaml rename to kubernetes/prod/manifests/mapache/namespace.yaml diff --git a/kubernetes/manifests/mapache/postgres.yaml b/kubernetes/prod/manifests/mapache/postgres.yaml similarity index 100% rename from kubernetes/manifests/mapache/postgres.yaml rename to kubernetes/prod/manifests/mapache/postgres.yaml diff --git a/kubernetes/manifests/mapache/query.yaml b/kubernetes/prod/manifests/mapache/query.yaml similarity index 100% rename from kubernetes/manifests/mapache/query.yaml rename to kubernetes/prod/manifests/mapache/query.yaml diff --git a/kubernetes/manifests/mapache/vehicle.yaml b/kubernetes/prod/manifests/mapache/vehicle.yaml similarity index 100% rename from kubernetes/manifests/mapache/vehicle.yaml rename to kubernetes/prod/manifests/mapache/vehicle.yaml diff --git a/kubernetes/manifests/on-demand-nodepool/nodepool.yaml b/kubernetes/prod/manifests/on-demand-nodepool/nodepool.yaml similarity index 100% rename from kubernetes/manifests/on-demand-nodepool/nodepool.yaml rename to kubernetes/prod/manifests/on-demand-nodepool/nodepool.yaml diff --git a/kubernetes/manifests/sentinel/configmap-kerbecs.yaml b/kubernetes/prod/manifests/sentinel/configmap-kerbecs.yaml similarity index 100% rename from kubernetes/manifests/sentinel/configmap-kerbecs.yaml rename to kubernetes/prod/manifests/sentinel/configmap-kerbecs.yaml diff --git a/kubernetes/manifests/sentinel/core.yaml b/kubernetes/prod/manifests/sentinel/core.yaml similarity index 100% rename from kubernetes/manifests/sentinel/core.yaml rename to kubernetes/prod/manifests/sentinel/core.yaml diff --git a/kubernetes/manifests/sentinel/discord.yaml b/kubernetes/prod/manifests/sentinel/discord.yaml similarity index 100% rename from kubernetes/manifests/sentinel/discord.yaml rename to kubernetes/prod/manifests/sentinel/discord.yaml diff --git a/kubernetes/manifests/sentinel/google.yaml b/kubernetes/prod/manifests/sentinel/google.yaml similarity index 100% rename from kubernetes/manifests/sentinel/google.yaml rename to kubernetes/prod/manifests/sentinel/google.yaml diff --git a/kubernetes/manifests/sentinel/ingress.yaml b/kubernetes/prod/manifests/sentinel/ingress.yaml similarity index 100% rename from kubernetes/manifests/sentinel/ingress.yaml rename to kubernetes/prod/manifests/sentinel/ingress.yaml diff --git a/kubernetes/manifests/sentinel/kerbecs.yaml b/kubernetes/prod/manifests/sentinel/kerbecs.yaml similarity index 100% rename from kubernetes/manifests/sentinel/kerbecs.yaml rename to kubernetes/prod/manifests/sentinel/kerbecs.yaml diff --git a/kubernetes/manifests/sentinel/kustomization.yaml b/kubernetes/prod/manifests/sentinel/kustomization.yaml similarity index 100% rename from kubernetes/manifests/sentinel/kustomization.yaml rename to kubernetes/prod/manifests/sentinel/kustomization.yaml diff --git a/kubernetes/manifests/sentinel/namespace.yaml b/kubernetes/prod/manifests/sentinel/namespace.yaml similarity index 100% rename from kubernetes/manifests/sentinel/namespace.yaml rename to kubernetes/prod/manifests/sentinel/namespace.yaml diff --git a/kubernetes/manifests/sentinel/oauth.yaml b/kubernetes/prod/manifests/sentinel/oauth.yaml similarity index 100% rename from kubernetes/manifests/sentinel/oauth.yaml rename to kubernetes/prod/manifests/sentinel/oauth.yaml diff --git a/kubernetes/manifests/sentinel/postgres.yaml b/kubernetes/prod/manifests/sentinel/postgres.yaml similarity index 100% rename from kubernetes/manifests/sentinel/postgres.yaml rename to kubernetes/prod/manifests/sentinel/postgres.yaml diff --git a/kubernetes/manifests/sentinel/saml.yaml b/kubernetes/prod/manifests/sentinel/saml.yaml similarity index 100% rename from kubernetes/manifests/sentinel/saml.yaml rename to kubernetes/prod/manifests/sentinel/saml.yaml diff --git a/kubernetes/manifests/sentinel/web.yaml b/kubernetes/prod/manifests/sentinel/web.yaml similarity index 100% rename from kubernetes/manifests/sentinel/web.yaml rename to kubernetes/prod/manifests/sentinel/web.yaml diff --git a/kubernetes/manifests/spot-nodepool/nodepool.yaml b/kubernetes/prod/manifests/spot-nodepool/nodepool.yaml similarity index 100% rename from kubernetes/manifests/spot-nodepool/nodepool.yaml rename to kubernetes/prod/manifests/spot-nodepool/nodepool.yaml diff --git a/kubernetes/manifests/vault/configmap-kerbecs.yaml b/kubernetes/prod/manifests/vault/configmap-kerbecs.yaml similarity index 100% rename from kubernetes/manifests/vault/configmap-kerbecs.yaml rename to kubernetes/prod/manifests/vault/configmap-kerbecs.yaml diff --git a/kubernetes/manifests/vault/ingress.yaml b/kubernetes/prod/manifests/vault/ingress.yaml similarity index 100% rename from kubernetes/manifests/vault/ingress.yaml rename to kubernetes/prod/manifests/vault/ingress.yaml diff --git a/kubernetes/manifests/vault/kerbecs.yaml b/kubernetes/prod/manifests/vault/kerbecs.yaml similarity index 100% rename from kubernetes/manifests/vault/kerbecs.yaml rename to kubernetes/prod/manifests/vault/kerbecs.yaml diff --git a/kubernetes/manifests/vault/kustomization.yaml b/kubernetes/prod/manifests/vault/kustomization.yaml similarity index 100% rename from kubernetes/manifests/vault/kustomization.yaml rename to kubernetes/prod/manifests/vault/kustomization.yaml diff --git a/kubernetes/manifests/vault/namespace.yaml b/kubernetes/prod/manifests/vault/namespace.yaml similarity index 100% rename from kubernetes/manifests/vault/namespace.yaml rename to kubernetes/prod/manifests/vault/namespace.yaml diff --git a/kubernetes/manifests/vault/postgres.yaml b/kubernetes/prod/manifests/vault/postgres.yaml similarity index 100% rename from kubernetes/manifests/vault/postgres.yaml rename to kubernetes/prod/manifests/vault/postgres.yaml diff --git a/kubernetes/manifests/vault/server.yaml b/kubernetes/prod/manifests/vault/server.yaml similarity index 100% rename from kubernetes/manifests/vault/server.yaml rename to kubernetes/prod/manifests/vault/server.yaml diff --git a/kubernetes/manifests/vault/web.yaml b/kubernetes/prod/manifests/vault/web.yaml similarity index 100% rename from kubernetes/manifests/vault/web.yaml rename to kubernetes/prod/manifests/vault/web.yaml From cb634d34bf467d8ca9ef7f5cff748e83fab9f5e3 Mon Sep 17 00:00:00 2001 From: Bharat Kathi Date: Sun, 5 Jul 2026 23:53:53 -0700 Subject: [PATCH 3/3] refactor(kubernetes): rename foundry/prod dirs to gr-foundry/gr-prod MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Match the cluster names used in terraform: - EKS cluster is `gr-prod` (local.cluster_name) - Foundry k3s tunnel is `gr-foundry` kubernetes/foundry/ → kubernetes/gr-foundry/ kubernetes/prod/ → kubernetes/gr-prod/ All ArgoCD Application spec.source.path values + runbook comments updated to the new prefix. --- infra/environments/prod/foundry.tf | 10 +++++----- infra/modules/argocd/main.tf | 4 ++-- .../apps/argocd-server-ingress.yaml | 2 +- .../{foundry => gr-foundry}/apps/cloudflared.yaml | 2 +- .../{foundry => gr-foundry}/apps/external-dns.yaml | 0 kubernetes/{foundry => gr-foundry}/bootstrap/root.yaml | 10 +++++----- .../manifests/argocd-server-ingress/ingress.yaml | 0 .../manifests/cloudflared/deployment.yaml | 0 .../manifests/cloudflared/namespace.yaml | 0 .../{prod => gr-prod}/apps/argocd-server-ingress.yaml | 2 +- kubernetes/{prod => gr-prod}/apps/external-dns.yaml | 0 kubernetes/{prod => gr-prod}/apps/mapache.yaml | 2 +- kubernetes/{prod => gr-prod}/apps/metrics-server.yaml | 0 .../{prod => gr-prod}/apps/on-demand-nodepool.yaml | 2 +- kubernetes/{prod => gr-prod}/apps/sentinel.yaml | 2 +- kubernetes/{prod => gr-prod}/apps/spot-nodepool.yaml | 2 +- .../{prod => gr-prod}/apps/vault-k8s-operator.yaml | 0 kubernetes/{prod => gr-prod}/apps/vault.yaml | 2 +- kubernetes/{prod => gr-prod}/bootstrap/root.yaml | 8 ++++---- .../manifests/argocd-server-ingress/ingress.yaml | 0 .../manifests/argocd-server-ingress/ingressclass.yaml | 0 .../{prod => gr-prod}/manifests/mapache/auth.yaml | 0 .../manifests/mapache/configmap-kerbecs.yaml | 0 .../{prod => gr-prod}/manifests/mapache/dashboard.yaml | 0 .../{prod => gr-prod}/manifests/mapache/foreman.yaml | 0 .../{prod => gr-prod}/manifests/mapache/gr26.yaml | 0 .../{prod => gr-prod}/manifests/mapache/ingress.yaml | 0 .../{prod => gr-prod}/manifests/mapache/kerbecs.yaml | 0 .../manifests/mapache/kustomization.yaml | 0 .../{prod => gr-prod}/manifests/mapache/live.yaml | 0 .../{prod => gr-prod}/manifests/mapache/namespace.yaml | 0 .../{prod => gr-prod}/manifests/mapache/postgres.yaml | 0 .../{prod => gr-prod}/manifests/mapache/query.yaml | 0 .../{prod => gr-prod}/manifests/mapache/vehicle.yaml | 0 .../manifests/on-demand-nodepool/nodepool.yaml | 0 .../manifests/sentinel/configmap-kerbecs.yaml | 0 .../{prod => gr-prod}/manifests/sentinel/core.yaml | 0 .../{prod => gr-prod}/manifests/sentinel/discord.yaml | 0 .../{prod => gr-prod}/manifests/sentinel/google.yaml | 0 .../{prod => gr-prod}/manifests/sentinel/ingress.yaml | 0 .../{prod => gr-prod}/manifests/sentinel/kerbecs.yaml | 0 .../manifests/sentinel/kustomization.yaml | 0 .../manifests/sentinel/namespace.yaml | 0 .../{prod => gr-prod}/manifests/sentinel/oauth.yaml | 0 .../{prod => gr-prod}/manifests/sentinel/postgres.yaml | 0 .../{prod => gr-prod}/manifests/sentinel/saml.yaml | 0 .../{prod => gr-prod}/manifests/sentinel/web.yaml | 0 .../manifests/spot-nodepool/nodepool.yaml | 0 .../manifests/vault/configmap-kerbecs.yaml | 0 .../{prod => gr-prod}/manifests/vault/ingress.yaml | 0 .../{prod => gr-prod}/manifests/vault/kerbecs.yaml | 0 .../manifests/vault/kustomization.yaml | 0 .../{prod => gr-prod}/manifests/vault/namespace.yaml | 0 .../{prod => gr-prod}/manifests/vault/postgres.yaml | 0 .../{prod => gr-prod}/manifests/vault/server.yaml | 0 kubernetes/{prod => gr-prod}/manifests/vault/web.yaml | 0 56 files changed, 24 insertions(+), 24 deletions(-) rename kubernetes/{foundry => gr-foundry}/apps/argocd-server-ingress.yaml (92%) rename kubernetes/{foundry => gr-foundry}/apps/cloudflared.yaml (94%) rename kubernetes/{foundry => gr-foundry}/apps/external-dns.yaml (100%) rename kubernetes/{foundry => gr-foundry}/bootstrap/root.yaml (75%) rename kubernetes/{foundry => gr-foundry}/manifests/argocd-server-ingress/ingress.yaml (100%) rename kubernetes/{foundry => gr-foundry}/manifests/cloudflared/deployment.yaml (100%) rename kubernetes/{foundry => gr-foundry}/manifests/cloudflared/namespace.yaml (100%) rename kubernetes/{prod => gr-prod}/apps/argocd-server-ingress.yaml (92%) rename kubernetes/{prod => gr-prod}/apps/external-dns.yaml (100%) rename kubernetes/{prod => gr-prod}/apps/mapache.yaml (97%) rename kubernetes/{prod => gr-prod}/apps/metrics-server.yaml (100%) rename kubernetes/{prod => gr-prod}/apps/on-demand-nodepool.yaml (93%) rename kubernetes/{prod => gr-prod}/apps/sentinel.yaml (96%) rename kubernetes/{prod => gr-prod}/apps/spot-nodepool.yaml (94%) rename kubernetes/{prod => gr-prod}/apps/vault-k8s-operator.yaml (100%) rename kubernetes/{prod => gr-prod}/apps/vault.yaml (91%) rename kubernetes/{prod => gr-prod}/bootstrap/root.yaml (81%) rename kubernetes/{prod => gr-prod}/manifests/argocd-server-ingress/ingress.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/argocd-server-ingress/ingressclass.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/auth.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/configmap-kerbecs.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/dashboard.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/foreman.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/gr26.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/ingress.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/kerbecs.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/kustomization.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/live.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/namespace.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/postgres.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/query.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/mapache/vehicle.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/on-demand-nodepool/nodepool.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/configmap-kerbecs.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/core.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/discord.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/google.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/ingress.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/kerbecs.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/kustomization.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/namespace.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/oauth.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/postgres.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/saml.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/sentinel/web.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/spot-nodepool/nodepool.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/vault/configmap-kerbecs.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/vault/ingress.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/vault/kerbecs.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/vault/kustomization.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/vault/namespace.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/vault/postgres.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/vault/server.yaml (100%) rename kubernetes/{prod => gr-prod}/manifests/vault/web.yaml (100%) diff --git a/infra/environments/prod/foundry.tf b/infra/environments/prod/foundry.tf index 4b67d18..32cf3af 100644 --- a/infra/environments/prod/foundry.tf +++ b/infra/environments/prod/foundry.tf @@ -1,7 +1,7 @@ # Foundry (on-prem k3s) cutover resources — the shared Cloudflare Tunnel # that connects the on-prem cluster to Cloudflare. Public DNS records for # individual hostnames are managed by external-dns on the foundry cluster -# (see kubernetes/foundry/apps/external-dns.yaml), not here. +# (see kubernetes/gr-foundry/apps/external-dns.yaml), not here. # # Design: the tunnel has a single catch-all ingress rule that forwards # ALL traffic to the Traefik service. Traefik does Host-based routing @@ -14,7 +14,7 @@ # Compute (EKS + ALB + ACM origin cert) still lives in main.tf. Once # every hostname is migrated off EKS and the on-prem stack has soaked, # delete module.eks / module.argocd / module.origin_cert from main.tf -# and remove kubernetes/prod/apps/ from the repo. +# and remove kubernetes/gr-prod/apps/ from the repo. # # Off-cluster data services (gr-postgres, gr-mqtt, gr-clickhouse) stay # in AWS — the on-prem cluster reaches them over the public internet via @@ -31,7 +31,7 @@ # --from-literal=target="$(terraform output -raw foundry_tunnel_id).cfargotunnel.com" # kubectl -n external-dns create secret generic cloudflare-api-token \ # --from-literal=api-token="$CLOUDFLARE_API_TOKEN" -# 3. Apply kubernetes/foundry/bootstrap/root.yaml on the foundry +# 3. Apply kubernetes/gr-foundry/bootstrap/root.yaml on the foundry # ArgoCD, wait for cloudflared / external-dns / argocd-server-ingress # Applications to reach Healthy. # 4. Cutover for one hostname: @@ -45,8 +45,8 @@ # its --interval (1m default). # d. Traffic starts landing on foundry within CF TTL. # 5. Bake. Add each remaining hostname (sentinel-v5 / mapache / vault) -# in a follow-up PR — copy prod/manifests// into -# foundry/manifests// with two file changes (ingress.yaml → +# in a follow-up PR — copy gr-prod/manifests// into +# gr-foundry/manifests// with two file changes (ingress.yaml → # Traefik + external-dns annotation, postgres.yaml → public # hostname). No terraform edit needed. diff --git a/infra/modules/argocd/main.tf b/infra/modules/argocd/main.tf index 634d942..ef72dc7 100644 --- a/infra/modules/argocd/main.tf +++ b/infra/modules/argocd/main.tf @@ -1,5 +1,5 @@ # ArgoCD installed via Helm. This is the bootstrap install — ArgoCD takes -# over self-management once the root Application (kubernetes/prod/bootstrap/root.yaml) +# over self-management once the root Application (kubernetes/gr-prod/bootstrap/root.yaml) # is kubectl-apply'd. From that point, even ArgoCD upgrades happen via Git. # # SSO (Sentinel OIDC) and RBAC live in the chart values below so a single @@ -48,7 +48,7 @@ resource "helm_release" "argocd" { # Pin every ArgoCD component to the on-demand baseline NodePool. # GitOps needs to stay up to drive recovery when the spot pool # churns; on-demand is more expensive but worth it for the - # control plane. See kubernetes/prod/manifests/on-demand-nodepool/. + # control plane. See kubernetes/gr-prod/manifests/on-demand-nodepool/. nodeSelector = { "capacity-type" = "on-demand-baseline" } diff --git a/kubernetes/foundry/apps/argocd-server-ingress.yaml b/kubernetes/gr-foundry/apps/argocd-server-ingress.yaml similarity index 92% rename from kubernetes/foundry/apps/argocd-server-ingress.yaml rename to kubernetes/gr-foundry/apps/argocd-server-ingress.yaml index 4741ab6..dda2161 100644 --- a/kubernetes/foundry/apps/argocd-server-ingress.yaml +++ b/kubernetes/gr-foundry/apps/argocd-server-ingress.yaml @@ -17,7 +17,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/foundry/manifests/argocd-server-ingress + path: kubernetes/gr-foundry/manifests/argocd-server-ingress destination: server: https://kubernetes.default.svc namespace: argocd diff --git a/kubernetes/foundry/apps/cloudflared.yaml b/kubernetes/gr-foundry/apps/cloudflared.yaml similarity index 94% rename from kubernetes/foundry/apps/cloudflared.yaml rename to kubernetes/gr-foundry/apps/cloudflared.yaml index b222cc4..6acd9e5 100644 --- a/kubernetes/foundry/apps/cloudflared.yaml +++ b/kubernetes/gr-foundry/apps/cloudflared.yaml @@ -20,7 +20,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/foundry/manifests/cloudflared + path: kubernetes/gr-foundry/manifests/cloudflared destination: server: https://kubernetes.default.svc namespace: cloudflared diff --git a/kubernetes/foundry/apps/external-dns.yaml b/kubernetes/gr-foundry/apps/external-dns.yaml similarity index 100% rename from kubernetes/foundry/apps/external-dns.yaml rename to kubernetes/gr-foundry/apps/external-dns.yaml diff --git a/kubernetes/foundry/bootstrap/root.yaml b/kubernetes/gr-foundry/bootstrap/root.yaml similarity index 75% rename from kubernetes/foundry/bootstrap/root.yaml rename to kubernetes/gr-foundry/bootstrap/root.yaml index 597e076..2682924 100644 --- a/kubernetes/foundry/bootstrap/root.yaml +++ b/kubernetes/gr-foundry/bootstrap/root.yaml @@ -5,16 +5,16 @@ # root — one ArgoCD instance, two independently-reconciled trees. Apply # once manually on the foundry cluster after the initial cutover prep: # -# kubectl --context foundry apply -f kubernetes/foundry/bootstrap/root.yaml +# kubectl --context foundry apply -f kubernetes/gr-foundry/bootstrap/root.yaml # -# From then on, ArgoCD reads kubernetes/foundry/apps/ from this repo and +# From then on, ArgoCD reads kubernetes/gr-foundry/apps/ from this repo and # reconciles every Application resource it finds there. # -# EKS is still managed by kubernetes/prod/bootstrap/root.yaml → kubernetes/prod/apps/. +# EKS is still managed by kubernetes/gr-prod/bootstrap/root.yaml → kubernetes/gr-prod/apps/. # The two roots do NOT share a cluster; each root's ArgoCD is scoped to # its own cluster via server: https://kubernetes.default.svc. # -# See kubernetes/foundry/apps/*.yaml for the per-stack manual bootstrap +# See kubernetes/gr-foundry/apps/*.yaml for the per-stack manual bootstrap # steps (secret creation, DB creation, etc.). apiVersion: argoproj.io/v1alpha1 @@ -29,7 +29,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/foundry/apps + path: kubernetes/gr-foundry/apps directory: recurse: true destination: diff --git a/kubernetes/foundry/manifests/argocd-server-ingress/ingress.yaml b/kubernetes/gr-foundry/manifests/argocd-server-ingress/ingress.yaml similarity index 100% rename from kubernetes/foundry/manifests/argocd-server-ingress/ingress.yaml rename to kubernetes/gr-foundry/manifests/argocd-server-ingress/ingress.yaml diff --git a/kubernetes/foundry/manifests/cloudflared/deployment.yaml b/kubernetes/gr-foundry/manifests/cloudflared/deployment.yaml similarity index 100% rename from kubernetes/foundry/manifests/cloudflared/deployment.yaml rename to kubernetes/gr-foundry/manifests/cloudflared/deployment.yaml diff --git a/kubernetes/foundry/manifests/cloudflared/namespace.yaml b/kubernetes/gr-foundry/manifests/cloudflared/namespace.yaml similarity index 100% rename from kubernetes/foundry/manifests/cloudflared/namespace.yaml rename to kubernetes/gr-foundry/manifests/cloudflared/namespace.yaml diff --git a/kubernetes/prod/apps/argocd-server-ingress.yaml b/kubernetes/gr-prod/apps/argocd-server-ingress.yaml similarity index 92% rename from kubernetes/prod/apps/argocd-server-ingress.yaml rename to kubernetes/gr-prod/apps/argocd-server-ingress.yaml index d172e2b..14b598d 100644 --- a/kubernetes/prod/apps/argocd-server-ingress.yaml +++ b/kubernetes/gr-prod/apps/argocd-server-ingress.yaml @@ -16,7 +16,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/prod/manifests/argocd-server-ingress + path: kubernetes/gr-prod/manifests/argocd-server-ingress destination: server: https://kubernetes.default.svc namespace: argocd diff --git a/kubernetes/prod/apps/external-dns.yaml b/kubernetes/gr-prod/apps/external-dns.yaml similarity index 100% rename from kubernetes/prod/apps/external-dns.yaml rename to kubernetes/gr-prod/apps/external-dns.yaml diff --git a/kubernetes/prod/apps/mapache.yaml b/kubernetes/gr-prod/apps/mapache.yaml similarity index 97% rename from kubernetes/prod/apps/mapache.yaml rename to kubernetes/gr-prod/apps/mapache.yaml index ff73e56..261a183 100644 --- a/kubernetes/prod/apps/mapache.yaml +++ b/kubernetes/gr-prod/apps/mapache.yaml @@ -38,7 +38,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/prod/manifests/mapache + path: kubernetes/gr-prod/manifests/mapache destination: server: https://kubernetes.default.svc namespace: mapache diff --git a/kubernetes/prod/apps/metrics-server.yaml b/kubernetes/gr-prod/apps/metrics-server.yaml similarity index 100% rename from kubernetes/prod/apps/metrics-server.yaml rename to kubernetes/gr-prod/apps/metrics-server.yaml diff --git a/kubernetes/prod/apps/on-demand-nodepool.yaml b/kubernetes/gr-prod/apps/on-demand-nodepool.yaml similarity index 93% rename from kubernetes/prod/apps/on-demand-nodepool.yaml rename to kubernetes/gr-prod/apps/on-demand-nodepool.yaml index 634d903..bcde867 100644 --- a/kubernetes/prod/apps/on-demand-nodepool.yaml +++ b/kubernetes/gr-prod/apps/on-demand-nodepool.yaml @@ -18,7 +18,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/prod/manifests/on-demand-nodepool + path: kubernetes/gr-prod/manifests/on-demand-nodepool destination: server: https://kubernetes.default.svc namespace: kube-system diff --git a/kubernetes/prod/apps/sentinel.yaml b/kubernetes/gr-prod/apps/sentinel.yaml similarity index 96% rename from kubernetes/prod/apps/sentinel.yaml rename to kubernetes/gr-prod/apps/sentinel.yaml index e7f1bfd..3156595 100644 --- a/kubernetes/prod/apps/sentinel.yaml +++ b/kubernetes/gr-prod/apps/sentinel.yaml @@ -28,7 +28,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/prod/manifests/sentinel + path: kubernetes/gr-prod/manifests/sentinel destination: server: https://kubernetes.default.svc namespace: sentinel diff --git a/kubernetes/prod/apps/spot-nodepool.yaml b/kubernetes/gr-prod/apps/spot-nodepool.yaml similarity index 94% rename from kubernetes/prod/apps/spot-nodepool.yaml rename to kubernetes/gr-prod/apps/spot-nodepool.yaml index d8a2a87..941afb3 100644 --- a/kubernetes/prod/apps/spot-nodepool.yaml +++ b/kubernetes/gr-prod/apps/spot-nodepool.yaml @@ -19,7 +19,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/prod/manifests/spot-nodepool + path: kubernetes/gr-prod/manifests/spot-nodepool destination: server: https://kubernetes.default.svc namespace: kube-system diff --git a/kubernetes/prod/apps/vault-k8s-operator.yaml b/kubernetes/gr-prod/apps/vault-k8s-operator.yaml similarity index 100% rename from kubernetes/prod/apps/vault-k8s-operator.yaml rename to kubernetes/gr-prod/apps/vault-k8s-operator.yaml diff --git a/kubernetes/prod/apps/vault.yaml b/kubernetes/gr-prod/apps/vault.yaml similarity index 91% rename from kubernetes/prod/apps/vault.yaml rename to kubernetes/gr-prod/apps/vault.yaml index d94243b..79592b1 100644 --- a/kubernetes/prod/apps/vault.yaml +++ b/kubernetes/gr-prod/apps/vault.yaml @@ -10,7 +10,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/prod/manifests/vault + path: kubernetes/gr-prod/manifests/vault destination: server: https://kubernetes.default.svc namespace: vault diff --git a/kubernetes/prod/bootstrap/root.yaml b/kubernetes/gr-prod/bootstrap/root.yaml similarity index 81% rename from kubernetes/prod/bootstrap/root.yaml rename to kubernetes/gr-prod/bootstrap/root.yaml index cbd69a5..84edc30 100644 --- a/kubernetes/prod/bootstrap/root.yaml +++ b/kubernetes/gr-prod/bootstrap/root.yaml @@ -3,13 +3,13 @@ # After ArgoCD is installed via terraform (infra/modules/argocd), apply # this once manually: # -# kubectl apply -f kubernetes/prod/bootstrap/root.yaml +# kubectl apply -f kubernetes/gr-prod/bootstrap/root.yaml # -# From then on, ArgoCD reads kubernetes/prod/apps/ from this repo and +# From then on, ArgoCD reads kubernetes/gr-prod/apps/ from this repo and # reconciles every Application resource it finds there. Adding a new # managed system (Sentinel, observability stack, etc.) is just: # -# 1. Add a new Application YAML under kubernetes/prod/apps/ +# 1. Add a new Application YAML under kubernetes/gr-prod/apps/ # 2. Commit + push # 3. ArgoCD picks it up on next sync (~3 min default, or instant via # `argocd app sync root`) @@ -29,7 +29,7 @@ spec: source: repoURL: https://github.com/Gaucho-Racing/infrastructure.git targetRevision: main - path: kubernetes/prod/apps + path: kubernetes/gr-prod/apps directory: recurse: true destination: diff --git a/kubernetes/prod/manifests/argocd-server-ingress/ingress.yaml b/kubernetes/gr-prod/manifests/argocd-server-ingress/ingress.yaml similarity index 100% rename from kubernetes/prod/manifests/argocd-server-ingress/ingress.yaml rename to kubernetes/gr-prod/manifests/argocd-server-ingress/ingress.yaml diff --git a/kubernetes/prod/manifests/argocd-server-ingress/ingressclass.yaml b/kubernetes/gr-prod/manifests/argocd-server-ingress/ingressclass.yaml similarity index 100% rename from kubernetes/prod/manifests/argocd-server-ingress/ingressclass.yaml rename to kubernetes/gr-prod/manifests/argocd-server-ingress/ingressclass.yaml diff --git a/kubernetes/prod/manifests/mapache/auth.yaml b/kubernetes/gr-prod/manifests/mapache/auth.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/auth.yaml rename to kubernetes/gr-prod/manifests/mapache/auth.yaml diff --git a/kubernetes/prod/manifests/mapache/configmap-kerbecs.yaml b/kubernetes/gr-prod/manifests/mapache/configmap-kerbecs.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/configmap-kerbecs.yaml rename to kubernetes/gr-prod/manifests/mapache/configmap-kerbecs.yaml diff --git a/kubernetes/prod/manifests/mapache/dashboard.yaml b/kubernetes/gr-prod/manifests/mapache/dashboard.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/dashboard.yaml rename to kubernetes/gr-prod/manifests/mapache/dashboard.yaml diff --git a/kubernetes/prod/manifests/mapache/foreman.yaml b/kubernetes/gr-prod/manifests/mapache/foreman.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/foreman.yaml rename to kubernetes/gr-prod/manifests/mapache/foreman.yaml diff --git a/kubernetes/prod/manifests/mapache/gr26.yaml b/kubernetes/gr-prod/manifests/mapache/gr26.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/gr26.yaml rename to kubernetes/gr-prod/manifests/mapache/gr26.yaml diff --git a/kubernetes/prod/manifests/mapache/ingress.yaml b/kubernetes/gr-prod/manifests/mapache/ingress.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/ingress.yaml rename to kubernetes/gr-prod/manifests/mapache/ingress.yaml diff --git a/kubernetes/prod/manifests/mapache/kerbecs.yaml b/kubernetes/gr-prod/manifests/mapache/kerbecs.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/kerbecs.yaml rename to kubernetes/gr-prod/manifests/mapache/kerbecs.yaml diff --git a/kubernetes/prod/manifests/mapache/kustomization.yaml b/kubernetes/gr-prod/manifests/mapache/kustomization.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/kustomization.yaml rename to kubernetes/gr-prod/manifests/mapache/kustomization.yaml diff --git a/kubernetes/prod/manifests/mapache/live.yaml b/kubernetes/gr-prod/manifests/mapache/live.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/live.yaml rename to kubernetes/gr-prod/manifests/mapache/live.yaml diff --git a/kubernetes/prod/manifests/mapache/namespace.yaml b/kubernetes/gr-prod/manifests/mapache/namespace.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/namespace.yaml rename to kubernetes/gr-prod/manifests/mapache/namespace.yaml diff --git a/kubernetes/prod/manifests/mapache/postgres.yaml b/kubernetes/gr-prod/manifests/mapache/postgres.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/postgres.yaml rename to kubernetes/gr-prod/manifests/mapache/postgres.yaml diff --git a/kubernetes/prod/manifests/mapache/query.yaml b/kubernetes/gr-prod/manifests/mapache/query.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/query.yaml rename to kubernetes/gr-prod/manifests/mapache/query.yaml diff --git a/kubernetes/prod/manifests/mapache/vehicle.yaml b/kubernetes/gr-prod/manifests/mapache/vehicle.yaml similarity index 100% rename from kubernetes/prod/manifests/mapache/vehicle.yaml rename to kubernetes/gr-prod/manifests/mapache/vehicle.yaml diff --git a/kubernetes/prod/manifests/on-demand-nodepool/nodepool.yaml b/kubernetes/gr-prod/manifests/on-demand-nodepool/nodepool.yaml similarity index 100% rename from kubernetes/prod/manifests/on-demand-nodepool/nodepool.yaml rename to kubernetes/gr-prod/manifests/on-demand-nodepool/nodepool.yaml diff --git a/kubernetes/prod/manifests/sentinel/configmap-kerbecs.yaml b/kubernetes/gr-prod/manifests/sentinel/configmap-kerbecs.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/configmap-kerbecs.yaml rename to kubernetes/gr-prod/manifests/sentinel/configmap-kerbecs.yaml diff --git a/kubernetes/prod/manifests/sentinel/core.yaml b/kubernetes/gr-prod/manifests/sentinel/core.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/core.yaml rename to kubernetes/gr-prod/manifests/sentinel/core.yaml diff --git a/kubernetes/prod/manifests/sentinel/discord.yaml b/kubernetes/gr-prod/manifests/sentinel/discord.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/discord.yaml rename to kubernetes/gr-prod/manifests/sentinel/discord.yaml diff --git a/kubernetes/prod/manifests/sentinel/google.yaml b/kubernetes/gr-prod/manifests/sentinel/google.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/google.yaml rename to kubernetes/gr-prod/manifests/sentinel/google.yaml diff --git a/kubernetes/prod/manifests/sentinel/ingress.yaml b/kubernetes/gr-prod/manifests/sentinel/ingress.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/ingress.yaml rename to kubernetes/gr-prod/manifests/sentinel/ingress.yaml diff --git a/kubernetes/prod/manifests/sentinel/kerbecs.yaml b/kubernetes/gr-prod/manifests/sentinel/kerbecs.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/kerbecs.yaml rename to kubernetes/gr-prod/manifests/sentinel/kerbecs.yaml diff --git a/kubernetes/prod/manifests/sentinel/kustomization.yaml b/kubernetes/gr-prod/manifests/sentinel/kustomization.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/kustomization.yaml rename to kubernetes/gr-prod/manifests/sentinel/kustomization.yaml diff --git a/kubernetes/prod/manifests/sentinel/namespace.yaml b/kubernetes/gr-prod/manifests/sentinel/namespace.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/namespace.yaml rename to kubernetes/gr-prod/manifests/sentinel/namespace.yaml diff --git a/kubernetes/prod/manifests/sentinel/oauth.yaml b/kubernetes/gr-prod/manifests/sentinel/oauth.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/oauth.yaml rename to kubernetes/gr-prod/manifests/sentinel/oauth.yaml diff --git a/kubernetes/prod/manifests/sentinel/postgres.yaml b/kubernetes/gr-prod/manifests/sentinel/postgres.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/postgres.yaml rename to kubernetes/gr-prod/manifests/sentinel/postgres.yaml diff --git a/kubernetes/prod/manifests/sentinel/saml.yaml b/kubernetes/gr-prod/manifests/sentinel/saml.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/saml.yaml rename to kubernetes/gr-prod/manifests/sentinel/saml.yaml diff --git a/kubernetes/prod/manifests/sentinel/web.yaml b/kubernetes/gr-prod/manifests/sentinel/web.yaml similarity index 100% rename from kubernetes/prod/manifests/sentinel/web.yaml rename to kubernetes/gr-prod/manifests/sentinel/web.yaml diff --git a/kubernetes/prod/manifests/spot-nodepool/nodepool.yaml b/kubernetes/gr-prod/manifests/spot-nodepool/nodepool.yaml similarity index 100% rename from kubernetes/prod/manifests/spot-nodepool/nodepool.yaml rename to kubernetes/gr-prod/manifests/spot-nodepool/nodepool.yaml diff --git a/kubernetes/prod/manifests/vault/configmap-kerbecs.yaml b/kubernetes/gr-prod/manifests/vault/configmap-kerbecs.yaml similarity index 100% rename from kubernetes/prod/manifests/vault/configmap-kerbecs.yaml rename to kubernetes/gr-prod/manifests/vault/configmap-kerbecs.yaml diff --git a/kubernetes/prod/manifests/vault/ingress.yaml b/kubernetes/gr-prod/manifests/vault/ingress.yaml similarity index 100% rename from kubernetes/prod/manifests/vault/ingress.yaml rename to kubernetes/gr-prod/manifests/vault/ingress.yaml diff --git a/kubernetes/prod/manifests/vault/kerbecs.yaml b/kubernetes/gr-prod/manifests/vault/kerbecs.yaml similarity index 100% rename from kubernetes/prod/manifests/vault/kerbecs.yaml rename to kubernetes/gr-prod/manifests/vault/kerbecs.yaml diff --git a/kubernetes/prod/manifests/vault/kustomization.yaml b/kubernetes/gr-prod/manifests/vault/kustomization.yaml similarity index 100% rename from kubernetes/prod/manifests/vault/kustomization.yaml rename to kubernetes/gr-prod/manifests/vault/kustomization.yaml diff --git a/kubernetes/prod/manifests/vault/namespace.yaml b/kubernetes/gr-prod/manifests/vault/namespace.yaml similarity index 100% rename from kubernetes/prod/manifests/vault/namespace.yaml rename to kubernetes/gr-prod/manifests/vault/namespace.yaml diff --git a/kubernetes/prod/manifests/vault/postgres.yaml b/kubernetes/gr-prod/manifests/vault/postgres.yaml similarity index 100% rename from kubernetes/prod/manifests/vault/postgres.yaml rename to kubernetes/gr-prod/manifests/vault/postgres.yaml diff --git a/kubernetes/prod/manifests/vault/server.yaml b/kubernetes/gr-prod/manifests/vault/server.yaml similarity index 100% rename from kubernetes/prod/manifests/vault/server.yaml rename to kubernetes/gr-prod/manifests/vault/server.yaml diff --git a/kubernetes/prod/manifests/vault/web.yaml b/kubernetes/gr-prod/manifests/vault/web.yaml similarity index 100% rename from kubernetes/prod/manifests/vault/web.yaml rename to kubernetes/gr-prod/manifests/vault/web.yaml