jakman85andClaude Opus 4.8
a02c0e2d1a
Restores the four semaphore resources a peer temp-disabled in 0abadd3 to unblock
the apps Kustomization while the crashloop was diagnosed. Both root causes are now
fixed and verified against the live image:
1. permission-denied writing /etc/semaphore/config.json (non-root UID 1001 vs
root-owned Longhorn PVC) -> podSecurityContext.fsGroup=1001 (schema 1.3.0);
verified the pod got past config write and successfully pinged its PostgreSQL.
2. config panic on SEMAPHORE_PORT=tcp://<svcIP>:3000 (kubelet Docker-link
injection for the same-named Service colliding with Semaphore's listen port)
-> explicit SEMAPHORE_PORT=":3000" env shadowing the service-link var.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
42 lines
2.8 KiB
YAML
42 lines
2.8 KiB
YAML
---
|
|
# Onboarded services (WS-APPS). Each app is rendered from its catalog/ ServiceDefinition by
|
|
# catalog/render.py and committed here; the `apps` Flux Kustomization (clusters/base/apps.yaml,
|
|
# dependsOn platform-config) reconciles this directory. Image-automation CRs are omitted for now
|
|
# (--no-image-automation) until the Flux image controllers are installed.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- pihole.yaml
|
|
- gitea.yaml
|
|
- gitea-bootstrap-secret.sops.yaml # SOPS: fixed SECRET_KEY + break-glass admin creds (decrypted by Flux)
|
|
- gitea-actions.yaml # Phase 6 CI/CD: in-cluster act_runner (ns gitea-actions) + DinD
|
|
- gitea-actions-runner-secret.sops.yaml # SOPS: act_runner registration token (decrypted by Flux)
|
|
- sonarr.yaml
|
|
- radarr.yaml
|
|
- plex.yaml
|
|
- qbittorrent.yaml
|
|
- jackett.yaml
|
|
- seerr.yaml
|
|
- nextcloud.yaml
|
|
- nextcloud-db.yaml # CNPG PostgreSQL Cluster (ns nextcloud-db) — first CNPG-DB app
|
|
- nextcloud-db-app.sops.yaml # SOPS: CNPG owner credentials (basic-auth) for initdb
|
|
- nextcloud-bootstrap-secret.sops.yaml # SOPS: break-glass admin + mirrored db-password (ns nextcloud)
|
|
# RE-ENABLED: the two crashloop root causes are now fixed (both verified against the live image).
|
|
# (1) permission-denied writing /etc/semaphore/config.json — the image runs as non-root UID 1001;
|
|
# fixed by podSecurityContext.fsGroup=1001 (schema 1.3.0) so the mounted Longhorn PVC is
|
|
# group-writable (verified: the pod got past config write and successfully pinged the DB).
|
|
# (2) config panic "field 'Port' is not valid: tcp://<svcIP>:3000" — the kubelet injects a
|
|
# Docker-link SEMAPHORE_PORT for the same-named Service, colliding with Semaphore's own listen
|
|
# port; fixed by an explicit SEMAPHORE_PORT=":3000" env that shadows the service-link var.
|
|
# The env-driven config IS non-interactive (the wizard text is the wrapper echoing while auto-
|
|
# answering from env). OIDC remains deferred (break-glass local admin), same as gitea/nextcloud.
|
|
- semaphore.yaml
|
|
- semaphore-db.yaml # CNPG PostgreSQL Cluster (ns semaphore-db) — second CNPG-DB app
|
|
- semaphore-db-app.sops.yaml # SOPS: CNPG owner credentials (basic-auth) for initdb
|
|
- semaphore-bootstrap-secret.sops.yaml # SOPS: break-glass admin + mirrored db-password + access-key-encryption (ns semaphore)
|
|
# Gitea's headless-install env + break-glass admin postStart hook are now first-class in the
|
|
# ServiceDefinition (catalog/gitea.yaml env/lifecycle, schema >=1.2.0) and rendered inline into
|
|
# apps/gitea.yaml, so the former gitea-bootstrap-patch.yaml strategic-merge patch is retired.
|
|
# gitea-bootstrap-secret.sops.yaml is KEPT — the env still sources the fixed SECRET_KEY + admin
|
|
# creds from it via secretKeyRef.
|