chore(foundry): argocd-only scope + reorg kubernetes/ per-cluster (gr-prod, gr-foundry)

infra/environments/prod/foundry.tf

@@ -1,7 +1,7 @@
 # Foundry (on-prem k3s) cutover resources — the shared Cloudflare Tunnel
 # that connects the on-prem cluster to Cloudflare. Public DNS records for
 # individual hostnames are managed by external-dns on the foundry cluster
-# (see kubernetes/apps-foundry/external-dns.yaml), not here.
+# (see kubernetes/gr-foundry/apps/external-dns.yaml), not here.
 #
 # Design: the tunnel has a single catch-all ingress rule that forwards
 # ALL traffic to the Traefik service. Traefik does Host-based routing
@@ -14,7 +14,7 @@
 # Compute (EKS + ALB + ACM origin cert) still lives in main.tf. Once
 # every hostname is migrated off EKS and the on-prem stack has soaked,
 # delete module.eks / module.argocd / module.origin_cert from main.tf
-# and remove kubernetes/apps/ from the repo.
+# and remove kubernetes/gr-prod/apps/ from the repo.
 #
 # Off-cluster data services (gr-postgres, gr-mqtt, gr-clickhouse) stay
 # in AWS — the on-prem cluster reaches them over the public internet via
@@ -31,20 +31,24 @@
 #          --from-literal=target="$(terraform output -raw foundry_tunnel_id).cfargotunnel.com"
 #        kubectl -n external-dns create secret generic cloudflare-api-token \
 #          --from-literal=api-token="$CLOUDFLARE_API_TOKEN"
-#   3. Apply kubernetes/bootstrap/root-foundry.yaml on the foundry
-#      ArgoCD, populate sentinel-secrets, wait for pods Healthy.
+#   3. Apply kubernetes/gr-foundry/bootstrap/root.yaml on the foundry
+#      ArgoCD, wait for cloudflared / external-dns / argocd-server-ingress
+#      Applications to reach Healthy.
 #   4. Cutover for one hostname:
-#      a. Delete the existing sentinel-v5.gauchoracing.com record via CF
-#         dashboard (or scale EKS external-dns to 0 first — it'll take
-#         its four records with it).
-#      b. Foundry external-dns notices the sentinel Ingress with no
+#      a. Scale EKS external-dns to 0 so it stops recreating its records
+#         (kubectl --context <eks> -n external-dns scale deploy
+#         external-dns --replicas=0).
+#      b. Delete the hostname's CNAME + `ext-cname-<hostname>` TXT
+#         records via CF dashboard.
+#      c. Foundry external-dns notices the matching Ingress with no
 #         record, writes CNAME → <tunnel-id>.cfargotunnel.com within
 #         its --interval (1m default).
-#      c. Traffic starts landing on foundry within CF TTL.
-#   5. Bake. Add mapache/vault/argocd in follow-up PRs — each is a copy
-#      of manifests/<svc>/ into manifests-foundry/<svc>/ with two file
-#      changes (ingress.yaml → Traefik + external-dns annotation,
-#      postgres.yaml → public hostname). No terraform edit.
+#      d. Traffic starts landing on foundry within CF TTL.
+#   5. Bake. Add each remaining hostname (sentinel-v5 / mapache / vault)
+#      in a follow-up PR — copy gr-prod/manifests/<svc>/ into
+#      gr-foundry/manifests/<svc>/ with two file changes (ingress.yaml →
+#      Traefik + external-dns annotation, postgres.yaml → public
+#      hostname). No terraform edit needed.
 
 # Account ID for the tunnel resources. The CF API token used by the
 # provider is scoped to a single account — return that account's ID.

infra/modules/argocd/main.tf

@@ -1,5 +1,5 @@
 # ArgoCD installed via Helm. This is the bootstrap install — ArgoCD takes
-# over self-management once the root Application (kubernetes/bootstrap/root.yaml)
+# over self-management once the root Application (kubernetes/gr-prod/bootstrap/root.yaml)
 # is kubectl-apply'd. From that point, even ArgoCD upgrades happen via Git.
 #
 # SSO (Sentinel OIDC) and RBAC live in the chart values below so a single
@@ -48,7 +48,7 @@ resource "helm_release" "argocd" {
         # Pin every ArgoCD component to the on-demand baseline NodePool.
         # GitOps needs to stay up to drive recovery when the spot pool
         # churns; on-demand is more expensive but worth it for the
-        # control plane. See kubernetes/manifests/on-demand-nodepool/.
+        # control plane. See kubernetes/gr-prod/manifests/on-demand-nodepool/.
         nodeSelector = {
           "capacity-type" = "on-demand-baseline"
         }

kubernetes/apps-foundry/argocd-server-ingress.yaml → kubernetes/gr-foundry/apps/argocd-server-ingress.yaml

@@ -17,7 +17,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/manifests-foundry/argocd-server-ingress
+    path: kubernetes/gr-foundry/manifests/argocd-server-ingress
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd

kubernetes/apps-foundry/cloudflared.yaml → kubernetes/gr-foundry/apps/cloudflared.yaml

@@ -6,7 +6,7 @@
 # Manual one-time Secret bootstrap after this first syncs:
 #
 #   kubectl -n cloudflared create secret generic cloudflared-secrets \
-#     --from-literal=TUNNEL_TOKEN="$(cd ../../infra/environments/prod && terraform output -raw foundry_tunnel_token)"
+#     --from-literal=TUNNEL_TOKEN="$(terraform -chdir=infra/environments/prod && terraform output -raw foundry_tunnel_token)"
 
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -20,7 +20,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/manifests-foundry/cloudflared
+    path: kubernetes/gr-foundry/manifests/cloudflared
   destination:
     server: https://kubernetes.default.svc
     namespace: cloudflared

kubernetes/apps-foundry/external-dns.yaml → kubernetes/gr-foundry/apps/external-dns.yaml

@@ -18,7 +18,7 @@
 #     --from-literal=api-token="$CLOUDFLARE_API_TOKEN"
 #
 #   kubectl -n external-dns create configmap foundry-tunnel-target \
-#     --from-literal=target="$(cd ../../infra/environments/prod && terraform output -raw foundry_tunnel_id).cfargotunnel.com"
+#     --from-literal=target="$(terraform -chdir=infra/environments/prod && terraform output -raw foundry_tunnel_id).cfargotunnel.com"
 
 apiVersion: argoproj.io/v1alpha1
 kind: Application
@@ -83,7 +83,13 @@ spec:
           # says. Traefik on k3s advertises node IPs there via klipper-lb;
           # those aren't publicly routable and are irrelevant since
           # traffic arrives through the tunnel anyway.
+          #
+          # --force-default-targets is required with external-dns >= 0.15:
+          # without it, the source-provided target (the Traefik LB IPs)
+          # wins and --default-targets is only used as a fallback. With
+          # the flag, --default-targets always overrides.
           - "--default-targets=$(FOUNDRY_TUNNEL_TARGET)"
+          - "--force-default-targets"
 
         logLevel: info
         logFormat: json

kubernetes/bootstrap/root-foundry.yaml → kubernetes/gr-foundry/bootstrap/root.yaml

@@ -5,16 +5,16 @@
 # root — one ArgoCD instance, two independently-reconciled trees. Apply
 # once manually on the foundry cluster after the initial cutover prep:
 #
-#   kubectl --context foundry apply -f kubernetes/bootstrap/root-foundry.yaml
+#   kubectl --context foundry apply -f kubernetes/gr-foundry/bootstrap/root.yaml
 #
-# From then on, ArgoCD reads kubernetes/apps-foundry/ from this repo and
+# From then on, ArgoCD reads kubernetes/gr-foundry/apps/ from this repo and
 # reconciles every Application resource it finds there.
 #
-# EKS is still managed by kubernetes/bootstrap/root.yaml → kubernetes/apps/.
+# EKS is still managed by kubernetes/gr-prod/bootstrap/root.yaml → kubernetes/gr-prod/apps/.
 # The two roots do NOT share a cluster; each root's ArgoCD is scoped to
 # its own cluster via server: https://kubernetes.default.svc.
 #
-# See kubernetes/apps-foundry/*.yaml for the per-stack manual bootstrap
+# See kubernetes/gr-foundry/apps/*.yaml for the per-stack manual bootstrap
 # steps (secret creation, DB creation, etc.).
 
 apiVersion: argoproj.io/v1alpha1
@@ -29,7 +29,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/apps-foundry
+    path: kubernetes/gr-foundry/apps
     directory:
       recurse: true
   destination:

kubernetes/apps/argocd-server-ingress.yaml → kubernetes/gr-prod/apps/argocd-server-ingress.yaml

@@ -16,7 +16,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/manifests/argocd-server-ingress
+    path: kubernetes/gr-prod/manifests/argocd-server-ingress
   destination:
     server: https://kubernetes.default.svc
     namespace: argocd

kubernetes/apps/mapache.yaml → kubernetes/gr-prod/apps/mapache.yaml

@@ -38,7 +38,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/manifests/mapache
+    path: kubernetes/gr-prod/manifests/mapache
   destination:
     server: https://kubernetes.default.svc
     namespace: mapache

kubernetes/apps/on-demand-nodepool.yaml → kubernetes/gr-prod/apps/on-demand-nodepool.yaml

@@ -18,7 +18,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/manifests/on-demand-nodepool
+    path: kubernetes/gr-prod/manifests/on-demand-nodepool
   destination:
     server: https://kubernetes.default.svc
     namespace: kube-system

kubernetes/apps/sentinel.yaml → kubernetes/gr-prod/apps/sentinel.yaml

@@ -28,7 +28,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/manifests/sentinel
+    path: kubernetes/gr-prod/manifests/sentinel
   destination:
     server: https://kubernetes.default.svc
     namespace: sentinel

kubernetes/apps/spot-nodepool.yaml → kubernetes/gr-prod/apps/spot-nodepool.yaml

@@ -19,7 +19,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/manifests/spot-nodepool
+    path: kubernetes/gr-prod/manifests/spot-nodepool
   destination:
     server: https://kubernetes.default.svc
     namespace: kube-system

kubernetes/apps/vault.yaml → kubernetes/gr-prod/apps/vault.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/manifests/vault
+    path: kubernetes/gr-prod/manifests/vault
   destination:
     server: https://kubernetes.default.svc
     namespace: vault

kubernetes/bootstrap/root.yaml → kubernetes/gr-prod/bootstrap/root.yaml

@@ -3,13 +3,13 @@
 # After ArgoCD is installed via terraform (infra/modules/argocd), apply
 # this once manually:
 #
-#   kubectl apply -f kubernetes/bootstrap/root.yaml
+#   kubectl apply -f kubernetes/gr-prod/bootstrap/root.yaml
 #
-# From then on, ArgoCD reads kubernetes/apps/ from this repo and
+# From then on, ArgoCD reads kubernetes/gr-prod/apps/ from this repo and
 # reconciles every Application resource it finds there. Adding a new
 # managed system (Sentinel, observability stack, etc.) is just:
 #
-#   1. Add a new Application YAML under kubernetes/apps/
+#   1. Add a new Application YAML under kubernetes/gr-prod/apps/
 #   2. Commit + push
 #   3. ArgoCD picks it up on next sync (~3 min default, or instant via
 #      `argocd app sync root`)
@@ -29,7 +29,7 @@ spec:
   source:
     repoURL: https://github.com/Gaucho-Racing/infrastructure.git
     targetRevision: main
-    path: kubernetes/apps
+    path: kubernetes/gr-prod/apps
     directory:
       recurse: true
   destination: