91 lines
2.8 KiB
Text
91 lines
2.8 KiB
Text
|
let mp = import "schemas/lib/manifest_plan.ncl" in
|
||
|
|
|
||
|
|
{
|
||
|
|
manifest_plan | mp.ManifestPlan = {
|
||
|
|
init = [
|
||
|
|
# Namespace first — all subsequent resources land here.
|
||
|
|
{ file = "namespace", action = 'apply, skip_if_exists = true },
|
||
|
|
|
||
|
|
# Shared content PVC — all sites share /opt/storage.
|
||
|
|
# skip_if_exists preserves content on reinstall.
|
||
|
|
{ file = "pvc", action = 'apply, skip_if_exists = true },
|
||
|
|
|
||
|
|
# CF API token secret in cert-manager namespace — required by ClusterIssuers.
|
||
|
|
{ action = 'create-cf-secret },
|
||
|
|
|
||
|
|
# One ClusterIssuer per unique dns_zone across all sites.
|
||
|
|
{ file = "clusterissuers", action = 'apply, skip_if_exists = true },
|
||
|
|
|
||
|
|
# One Certificate per site — cert-manager provisions via DNS-01.
|
||
|
|
{ file = "certificates", action = 'apply, skip_if_exists = true },
|
||
|
|
|
||
|
|
# upstreams K8s Secret — generated from SOPS credentials, never a ConfigMap.
|
||
|
|
# Contains auth credentials inline; encrypted at rest by etcd encryption.
|
||
|
|
{ action = 'create-credentials },
|
||
|
|
|
||
|
|
{ file = "fip-pool", action = 'apply, skip_if_exists = true },
|
||
|
|
{ file = "configmap-main", action = 'apply },
|
||
|
|
{ file = "deployment", action = 'apply },
|
||
|
|
{ file = "service", action = 'apply },
|
||
|
|
|
||
|
|
{
|
||
|
|
action = 'wait-ready,
|
||
|
|
post = [
|
||
|
|
{ action = 'protect-volume },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
update = [
|
||
|
|
# CF secret + certs: idempotent; picks up newly added sites.
|
||
|
|
{ action = 'create-cf-secret },
|
||
|
|
{ file = "certificates", action = 'apply, skip_if_exists = true },
|
||
|
|
|
||
|
|
{ file = "configmap-main", action = 'apply },
|
||
|
|
# Regenerate upstreams Secret from _credentials.env — picks up auth changes.
|
||
|
|
{ action = 'create-credentials },
|
||
|
|
{
|
||
|
|
file = "deployment",
|
||
|
|
action = 'rollout-restart,
|
||
|
|
delay = 3,
|
||
|
|
post = [
|
||
|
|
{ action = 'wait-ready },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
delete = [
|
||
|
|
{ file = "service", action = 'delete },
|
||
|
|
{ file = "deployment", action = 'delete },
|
||
|
|
{ action = 'delete-credentials },
|
||
|
|
{ file = "configmap-main", action = 'delete },
|
||
|
|
],
|
||
|
|
|
||
|
|
restart = [
|
||
|
|
{
|
||
|
|
file = "deployment",
|
||
|
|
action = 'rollout-restart,
|
||
|
|
post = [
|
||
|
|
{ action = 'wait-ready },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
|
||
|
|
hooks = {
|
||
|
|
# After a full init completes: register PVC for Longhorn daily snapshots.
|
||
|
|
init = {
|
||
|
|
post = [
|
||
|
|
{ action = 'backup-register },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
# Before restarting: check cert readiness so operator is warned if stale certs
|
||
|
|
# would be served during the window between restart and aralez reloading.
|
||
|
|
restart = {
|
||
|
|
pre = [
|
||
|
|
{ action = 'cert-status-check },
|
||
|
|
],
|
||
|
|
},
|
||
|
|
},
|
||
|
|
},
|
||
|
|
}
|