eb99ee5635
After fixing the postgresql-lb MetalLB flap (deleted stuck
ServiceL2Status CR l2-rgt9d), Tier 1 CI can apply again. Combined
commit:
* Bucket A (16 stacks): re-append CI retrigger marker so the
previously-pending applies pick up:
blog calico cyberchef descheduler f1-stream homepage jsoncrack
k8s-dashboard k8s-version-upgrade kms local-path osm_routing
real-estate-crawler travel_blog vault webhook_handler
* Bucket D (5 module-nested stacks): keel.sh/enrolled label on
namespace + KYVERNO_LIFECYCLE_V2 on Deployments inside the module:
postiz instagram-poster k8s-portal uptime-kuma vaultwarden
Bucket C (raw-deploy apps without V1 marker on their Deployment
lifecycles) deferred — needs per-Deployment lifecycle block additions
that the bulk script can't safely automate:
beads-server immich llama-cpp novelapp plotting-book trading-bot
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
79 lines
2.9 KiB
HCL
79 lines
2.9 KiB
HCL
# Calico CNI
|
|
#
|
|
# Calico has underpinned this cluster's pod networking since 2024-07-30, installed
|
|
# as raw kubectl manifests (tigera-operator Deployment + CRDs + Installation CR).
|
|
# Bringing the full stack under Terraform is high-blast — the operator and its
|
|
# Deployment must never flap during node pressure or during any apply, because
|
|
# new pod scheduling breaks within ~seconds of a CNI outage.
|
|
#
|
|
# This stack (created 2026-04-18 Wave 5b) adopts the three namespaces only:
|
|
# calico-system, calico-apiserver, tigera-operator. The `tigera-operator`
|
|
# Deployment, the 20+ CRDs it manages, and the `Installation` CR itself are
|
|
# intentionally *not* adopted yet — they require a low-traffic window and a
|
|
# careful ignore_changes set to cover operator-generated defaults on the
|
|
# Installation CR. Follow-up tracked in beads code-3ad.
|
|
#
|
|
# The namespaces are safe to adopt (no networking impact — they're just label
|
|
# containers) and give TF an audit trail entry for the labels/tier Kyverno
|
|
# cares about.
|
|
|
|
resource "kubernetes_namespace" "calico_system" {
|
|
metadata {
|
|
name = "calico-system"
|
|
labels = {
|
|
name = "calico-system"
|
|
# calico-system namespace is managed by tigera-operator — auto-update is
|
|
# incompatible (operator reverts DaemonSet image from its Installation CR).
|
|
# "keel.sh/enrolled" = "true"
|
|
}
|
|
}
|
|
lifecycle {
|
|
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode label on every namespace.
|
|
# pod-security.kubernetes.io/* labels are applied by the tigera-operator
|
|
# reconciler on calico-system + calico-apiserver for PSA 'privileged'.
|
|
ignore_changes = [
|
|
metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"],
|
|
metadata[0].labels["pod-security.kubernetes.io/enforce"],
|
|
metadata[0].labels["pod-security.kubernetes.io/enforce-version"],
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_namespace" "calico_apiserver" {
|
|
metadata {
|
|
name = "calico-apiserver"
|
|
labels = {
|
|
name = "calico-apiserver"
|
|
}
|
|
}
|
|
lifecycle {
|
|
# KYVERNO_LIFECYCLE_V1 + PSA labels applied by tigera-operator (see calico_system).
|
|
ignore_changes = [
|
|
metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"],
|
|
metadata[0].labels["pod-security.kubernetes.io/enforce"],
|
|
metadata[0].labels["pod-security.kubernetes.io/enforce-version"],
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_namespace" "tigera_operator" {
|
|
metadata {
|
|
name = "tigera-operator"
|
|
labels = {
|
|
name = "tigera-operator"
|
|
}
|
|
}
|
|
lifecycle {
|
|
# KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
|
|
ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
|
|
}
|
|
}
|
|
|
|
# CI retrigger 2026-05-16T13:42:57+00:00 — bulk enrollment apply (pipeline #689 killed)
|
|
# CI retrigger v2 2026-05-16T13:46:35+00:00
|
|
|
|
# CI retrigger v3 2026-05-16T14:06:39Z
|
|
|
|
# CI retrigger v4 2026-05-16T14:13:59Z
|
|
|
|
# CI retrigger v5 2026-05-16T23:10:38Z
|