diff --git a/CHANGELOG.md b/CHANGELOG.md index bf9a102..1e4a599 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,6 +15,19 @@ What changed in this homelab, when, and why. Newest first. --- +## 2026-09-10 + +**Flux 的 deployment、drift repair 和 scoped prune 闭环验证完成。** + +| area | change | +|---|---| +| GitOps | PR #18 合并后，Flux 自行发现 revision `f257a2a` 并删除已在 `prune: true` 下重新进入 inventory 的测试 ConfigMap；未发送 reconcile annotation，`http-echo` Deployment/Service 保持 Ready，root 继续 `prune: false` | +| Helm migration | 选定 `gitea-actions` 作为第一个 Flux HelmRelease adoption：它不承载 Git、入口、DNS、证书、数据库或 secrets controller。live StatefulSet 与 Git 都使用 regular DinD，但 Helm 保存的 release values/manifest 仍是失败的 rootless 配置；接管先固定 chart `0.1.1` 并验证 live Pod spec 不变，升级另开 PR | + +`Carried forward`: adopt `gitea-actions` with a zero-change HelmRelease; then +order the remaining Helm migrations by dependency and blast radius. Root Flux +prune remains disabled until brownfield ownership is audited. + ## 2026-09-09 **Recorded the brownfield GitOps/IaC redesign before changing live infrastructure.** diff --git a/clusters/homelab/README.md b/clusters/homelab/README.md index 81a97d8..11d9c42 100644 --- a/clusters/homelab/README.md +++ b/clusters/homelab/README.md @@ -35,3 +35,13 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations 四个 controller、GitRepository 和 root Kustomization 都必须为 Ready，随后才能 通过单独 PR 引入低风险 canary workload。 + +## 当前状态 + +- Flux `v2.9.5`、GitRepository 和 root Kustomization 均为 Ready； +- `http-echo` canary 已验证 merge 后自动部署和 replicas 漂移修复； +- `http-echo` 的专用测试 ConfigMap 已在 `prune: true` 生效后重新纳管，并由下一 + revision 自动删除； +- `http-echo` 保持 `prune: true`，root 保持 `prune: false`； +- 下一个接管对象是现有 `gitea-actions` Helm release，先使用相同 chart/version + 完成零变化 adoption，再通过独立 PR 升级。 diff --git a/docs/homelab-gitops-redesign.md b/docs/homelab-gitops-redesign.md index 553d6d7..be0d1b6 100644 --- a/docs/homelab-gitops-redesign.md +++ b/docs/homelab-gitops-redesign.md @@ -1,6 +1,6 @@ # Homelab GitOps and IaC redesign -Status: **implementation in progress; CI and Flux bootstrap are live.** +Status: **implementation in progress; CI、Flux bootstrap、漂移修复与受控 prune 已验证。** Started 2026-09-09. This is the durable record of the redesign discussion. It separates observations, decisions and open work so an assumption cannot silently @@ -35,9 +35,11 @@ or reconcile later CPU, memory, NIC or boot drift. ### Kubernetes and delivery -- Kubernetes is a single-node k3s cluster. -- Helm releases and manifests have historically been applied by hand. -- No Flux or Argo CD installation was found during the initial audit. +- Kubernetes is a single-node k3s `v1.36.4+k3s1` cluster. +- Helm releases and manifests have historically been applied by hand and are now + being adopted by Flux one release at a time. +- Flux `v2.9.5` is live. Its internal Gitea source and root Kustomization are + Ready; `http-echo` proved automatic deployment, drift repair and scoped prune. - Repository history records External Secrets Operator 2.8.0 as deployed. Five `ExternalSecret` resources cover Authelia, Gitea, Cloudflared and SeaweedFS. All five reported `SecretSynced=True` during a live check on 2026-09-09. @@ -208,13 +210,18 @@ offline break-glass path. ESO-generated Secrets are projections, not backups. remaining manually managed Secrets, then migrate them incrementally. 3. **In progress:** the Gitea remote exists; add a one-way off-site mirror and revisit the Terraform State Registry after upgrading beyond Gitea 1.25.5. -4. **In progress:** the reviewed Gitea Runner is deployed and Stage 1 CI is green; - bootstrap Flux on `http-echo` or `marker` without enabling prune until live - ownership is audited. -5. Move Tunnel origins to Envoy and consolidate split DNS through Blocky. -6. Deploy Backstage read-only with Catalog, Kubernetes, Flux and TechDocs. -7. Reconstruct the OCI root to a zero-change plan and add libvirt drift reports. -8. Add dynamic PVE VM workers only when a real job requires one, with TTL cleanup +4. **Complete:** the reviewed Gitea Runner and Stage 1 CI are live. Flux deploys + `http-echo`; automatic deployment, replica drift repair and scoped deletion + were verified. Root prune remains disabled for brownfield safety. +5. **Next:** adopt the existing `gitea-actions` Helm release with the same chart + `0.1.1` and repository values before attempting an upgrade. Its live + StatefulSet and Git both use regular DinD, while Helm's stored release values + still describe the failed rootless attempt. The first Flux reconciliation + must repair this stored-state drift without changing the live Pod spec. +6. Move Tunnel origins to Envoy and consolidate split DNS through Blocky. +7. Deploy Backstage read-only with Catalog, Kubernetes, Flux and TechDocs. +8. Reconstruct the OCI root to a zero-change plan and add libvirt drift reports. +9. Add dynamic PVE VM workers only when a real job requires one, with TTL cleanup and hard concurrency/resource limits first. ## Open decisions @@ -224,7 +231,7 @@ offline break-glass path. ESO-generated Secrets are projections, not backups. - Whether OCI Object Storage passes the concurrent lockfile test. - Whether the OCI VM should later move from its current public subnet. - Schema/generator for the Git-owned service declaration. -- Which live Helm releases are absent from or differ from Git. +- Migration order for Helm releases after the `gitea-actions` adoption. - Whether each local libvirt VM should autostart. - Which first job genuinely requires a dynamic Proxmox VM. diff --git a/platform/gitea-runner/README.md b/platform/gitea-runner/README.md index 5ccf153..606f72e 100644 --- a/platform/gitea-runner/README.md +++ b/platform/gitea-runner/README.md @@ -16,9 +16,19 @@ The runner registration token is authoritative in OpenBao at the `gitea-runner-token` Secret. Never put the token in this directory or a Helm command line. -## Review-first bootstrap +## Flux 接管状态 -This is a one-time manual deployment because Flux is not installed yet: +该 release 最初通过下述 review-first 流程手动 bootstrap。下一个 GitOps 阶段将 +使用 Flux `HelmRelease` 接管它，并首先固定现有 chart `0.1.1`，不在接管 PR 中升级。 + +迁移前审计发现：Helm 保存的 user-supplied values 和 release manifest 仍描述失败的 +rootless DinD 尝试，但 live StatefulSet 与本目录 `values.yaml` 都已经使用 regular +DinD。首次 reconcile 的验收条件是修正 Helm 存储状态，同时 live Pod spec、PVC +identity、runner capacity 和在线状态保持不变。接管稳定后再用独立 PR 升级 chart。 + +## 历史 review-first bootstrap + +这是 Flux 安装前执行过的一次性手动部署流程，保留用于恢复和审计： 1. Merge the reviewed PR. 2. As a Gitea site administrator, create an instance-scoped runner registration