chemavxandClaude Opus 4.8
c459eb3930
The multi-source variant ($values git ref) caused the infisical app to prune its own Application object on first sync (controller pruned Application/argocd/infisical, orphaning the workloads). Switch to a single-source Helm app with inline valuesObject (same chart 1.9.0, same DB/Redis passwords) and drop the hand-written tracking-id annotation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
77 lines
2.4 KiB
YAML
77 lines
2.4 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: infisical
|
|
namespace: argocd
|
|
spec:
|
|
destination:
|
|
namespace: infisical
|
|
server: https://kubernetes.default.svc
|
|
project: default
|
|
# Single-source Helm: remote chart + inline values. (Multi-source $values ref
|
|
# caused the app to prune its own Application object on first sync.)
|
|
source:
|
|
repoURL: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/
|
|
chart: infisical-standalone
|
|
targetRevision: 1.9.0
|
|
helm:
|
|
valuesObject:
|
|
# Crown-jewel secrets (ENCRYPTION_KEY, AUTH_SECRET, SITE_URL) are NOT here —
|
|
# they live in the out-of-band 'infisical-secrets' Secret (kubectl, IgnoreExtraneous).
|
|
# Postgres/Redis passwords below guard ClusterIP-only services in the isolated
|
|
# infisical namespace; the DB stores only ciphertext (useless without ENCRYPTION_KEY).
|
|
infisical:
|
|
enabled: true
|
|
replicaCount: 1
|
|
kubeSecretRef: infisical-secrets
|
|
autoBootstrap:
|
|
enabled: false
|
|
image:
|
|
tag: "v0.158.0"
|
|
pullPolicy: IfNotPresent
|
|
resources:
|
|
limits:
|
|
memory: 1000Mi
|
|
requests:
|
|
cpu: 350m
|
|
ingress:
|
|
enabled: true
|
|
nginx:
|
|
enabled: false
|
|
ingressClassName: traefik
|
|
hostName: infisical.chemavx.xyz
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
tls:
|
|
- secretName: infisical-tls
|
|
hosts:
|
|
- infisical.chemavx.xyz
|
|
postgresql:
|
|
enabled: true
|
|
name: postgresql
|
|
fullnameOverride: postgresql
|
|
auth:
|
|
username: infisical
|
|
password: "eeb3d0ec1a98f8582253e74b8f22f7ad9f4b56eaf94679aa"
|
|
database: infisicalDB
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
storageClass: local-path
|
|
size: 8Gi
|
|
redis:
|
|
enabled: true
|
|
name: redis
|
|
fullnameOverride: redis
|
|
architecture: standalone
|
|
usePassword: true
|
|
auth:
|
|
password: "b10e20323896054ddacbafffa6b3d71b350c826e6ce3e06f"
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|