18
0
Fork
You've already forked k8s
0
here we break our infra
  • Shell 66.7%
  • Nix 33.3%
Wilmhit 01746ab762 feat: add hedgedoc ( #46 ) 
Closes #37
Reviewed-on: #46
Reviewed-by: Jacek Pruciak <juniorjpdj@noreply.codeberg.org>
2026年07月01日 13:26:56 +02:00
appprojs chore: add nix shell 2026年05月22日 12:53:02 +02:00
apps feat: add hedgedoc ( #46 ) 2026年07月01日 13:26:56 +02:00
charts feat: add hedgedoc ( #46 ) 2026年07月01日 13:26:56 +02:00
manifests fix(manifests/redirector): add cert-manager annotation for ingress 2026年06月18日 11:22:52 +02:00
.gitignore feat: add authentik 2026年02月26日 21:55:52 +01:00
README.md feat: apps cleanup 2026年04月20日 01:08:16 +02:00
renovate.json feat: add authentik 2026年02月26日 21:55:52 +01:00
shell.nix chore: add nix shell 2026年05月22日 12:53:02 +02:00

Knyfyrtel Hackerspace Poznań kubernetes-based infrastructure repository

Directories

apps/

ArgoCD Application manifests, every application visible in ArgoCD should be here.
Manifests are organized in subdirectories by project name. Contains backup.sh script for loading latest manifests from live ArgoCD - may be useful when you prefer to click application in GUI first.
Be aware to not commit any secrets in manifests.

appprojs/

ArgoCD Application Project manifests.

charts/

Helm Charts, including umbrella charts for applications that needs some secret values encryption.
More about encryption below.

manifests/

Plain Kubernetes manifests to be deployed by apps when Helm Chart is overkill.

Encryption of Helm Chart values

If your application needs some secret values, those should be encrypted.
This is done by using helm-secrets plugin with sops integration built-in to ArgoCD image.
SOPS is a tool that can encrypt YAML and also other text files.
We integrate helm-secrets with sops and use Hashicorp Vault backend for sops to manage encryption keys within OpenBAO.
If you are not in Infra Team and you want to install something, make sure you add age or gpg key when encrypting file as you ain't have access to decrypt the file later.

  1. For encrypted values it's neccessary to create umbrella chart for your application.
    Umbrella chart is a simple helm chart with just a dependency to your application chart.
    Here you can create values.yaml file for your non-sensitive values and secrets.yaml file for sensitive ones.
  2. The next step is to encrypt the secrets.yaml file with sops.
    You first need to login to OpenBAO in CLI for sops to have access to the key.
    vault login -address https://vault.knyfyrtel.pl -method=oidc
    Then encrypt the file.
    Example encryption command:
    sops --encrypt -i --hc-vault-transit https://vault.knyfyrtel.pl/v1/sops/keys/charts --age age1emh3py760fm3sxljcasnhunftplkec8pannqjah0rsxcmdtvhfas534lcd secrets.yaml
    Make sure to replace an age key with your own.
    That will allow ArgoCD and Infra Team to decrypt the file using OpenBAO and you should be able to decrypt using your own age key.
  3. The last step is to create an ArgoCD application for your umbrella chart.
    You need to specify values.yaml and secrets://secrets.yaml as values files. secrets:// prefix is required for ArgoCD to know that you want to use an encrypted file.
  4. To later edit the secrets.yaml file you can use sops edit secrets.yaml command.

Easy way?
Just copy Umbrella Chart directory from charts/authentik to charts/<your-app-name> and rename it to your application name.
Replace all the values, dependencies, wipe the secrets.yaml file, fill it with your own secrets and encrypt it with sops.
Copy application from apps/default/authentik.yaml to apps/default/<your-app-name>.yaml, change the name, destination namespace and directory (path) and you're done.