2026-09-10 04:55:50 +00:00
4 changed files with 54 additions and 14 deletions
@@ -15,6 +15,19 @@ What changed in this homelab, when, and why. Newest first.

 ---

+## 2026-09-10
+
+**Flux 的 deployment、drift repair 和 scoped prune 闭环验证完成。**
+
+| area | change |
+|---|---|
+| GitOps | PR #18 合并后，Flux 自行发现 revision `f257a2a` 并删除已在 `prune: true` 下重新进入 inventory 的测试 ConfigMap；未发送 reconcile annotation，`http-echo` Deployment/Service 保持 Ready，root 继续 `prune: false` |
+| Helm migration | 选定 `gitea-actions` 作为第一个 Flux HelmRelease adoption：它不承载 Git、入口、DNS、证书、数据库或 secrets controller。live StatefulSet 与 Git 都使用 regular DinD，但 Helm 保存的 release values/manifest 仍是失败的 rootless 配置；接管先固定 chart `0.1.1` 并验证 live Pod spec 不变，升级另开 PR |
+
+`Carried forward`: adopt `gitea-actions` with a zero-change HelmRelease; then
+order the remaining Helm migrations by dependency and blast radius. Root Flux
+prune remains disabled until brownfield ownership is audited.
+
 ## 2026-09-09

 **Recorded the brownfield GitOps/IaC redesign before changing live infrastructure.**
@@ -35,3 +35,13 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations

 四个 controller、GitRepository 和 root Kustomization 都必须为 Ready，随后才能
 通过单独 PR 引入低风险 canary workload。
+
+## 当前状态
+
+- Flux `v2.9.5`、GitRepository 和 root Kustomization 均为 Ready；
+- `http-echo` canary 已验证 merge 后自动部署和 replicas 漂移修复；
+- `http-echo` 的专用测试 ConfigMap 已在 `prune: true` 生效后重新纳管，并由下一
+  revision 自动删除；
+- `http-echo` 保持 `prune: true`，root 保持 `prune: false`；
+- 下一个接管对象是现有 `gitea-actions` Helm release，先使用相同 chart/version
+  完成零变化 adoption，再通过独立 PR 升级。
@@ -1,6 +1,6 @@
 # Homelab GitOps and IaC redesign

-Status: **implementation in progress; CI and Flux bootstrap are live.**
+Status: **implementation in progress; CI、Flux bootstrap、漂移修复与受控 prune 已验证。**

 Started 2026-09-09. This is the durable record of the redesign discussion. It
 separates observations, decisions and open work so an assumption cannot silently
@@ -35,9 +35,11 @@ or reconcile later CPU, memory, NIC or boot drift.

 ### Kubernetes and delivery

- Kubernetes is a single-node k3s cluster.
- Helm releases and manifests have historically been applied by hand.
- No Flux or Argo CD installation was found during the initial audit.
+- Kubernetes is a single-node k3s `v1.36.4+k3s1` cluster.
+- Helm releases and manifests have historically been applied by hand and are now
+  being adopted by Flux one release at a time.
+- Flux `v2.9.5` is live. Its internal Gitea source and root Kustomization are
+  Ready; `http-echo` proved automatic deployment, drift repair and scoped prune.
 - Repository history records External Secrets Operator 2.8.0 as deployed. Five
  `ExternalSecret` resources cover Authelia, Gitea, Cloudflared and SeaweedFS.
  All five reported `SecretSynced=True` during a live check on 2026-09-09.
@@ -208,13 +210,18 @@ offline break-glass path. ESO-generated Secrets are projections, not backups.
   remaining manually managed Secrets, then migrate them incrementally.
 3. **In progress:** the Gitea remote exists; add a one-way off-site mirror and
   revisit the Terraform State Registry after upgrading beyond Gitea 1.25.5.
-4. **In progress:** the reviewed Gitea Runner is deployed and Stage 1 CI is green;
-   bootstrap Flux on `http-echo` or `marker` without enabling prune until live
-   ownership is audited.
-5. Move Tunnel origins to Envoy and consolidate split DNS through Blocky.
-6. Deploy Backstage read-only with Catalog, Kubernetes, Flux and TechDocs.
-7. Reconstruct the OCI root to a zero-change plan and add libvirt drift reports.
-8. Add dynamic PVE VM workers only when a real job requires one, with TTL cleanup
+4. **Complete:** the reviewed Gitea Runner and Stage 1 CI are live. Flux deploys
+   `http-echo`; automatic deployment, replica drift repair and scoped deletion
+   were verified. Root prune remains disabled for brownfield safety.
+5. **Next:** adopt the existing `gitea-actions` Helm release with the same chart
+   `0.1.1` and repository values before attempting an upgrade. Its live
+   StatefulSet and Git both use regular DinD, while Helm's stored release values
+   still describe the failed rootless attempt. The first Flux reconciliation
+   must repair this stored-state drift without changing the live Pod spec.
+6. Move Tunnel origins to Envoy and consolidate split DNS through Blocky.
+7. Deploy Backstage read-only with Catalog, Kubernetes, Flux and TechDocs.
+8. Reconstruct the OCI root to a zero-change plan and add libvirt drift reports.
+9. Add dynamic PVE VM workers only when a real job requires one, with TTL cleanup
   and hard concurrency/resource limits first.

 ## Open decisions
@@ -224,7 +231,7 @@ offline break-glass path. ESO-generated Secrets are projections, not backups.
 - Whether OCI Object Storage passes the concurrent lockfile test.
 - Whether the OCI VM should later move from its current public subnet.
 - Schema/generator for the Git-owned service declaration.
- Which live Helm releases are absent from or differ from Git.
+- Migration order for Helm releases after the `gitea-actions` adoption.
 - Whether each local libvirt VM should autostart.
 - Which first job genuinely requires a dynamic Proxmox VM.

@@ -16,9 +16,19 @@ The runner registration token is authoritative in OpenBao at
 the `gitea-runner-token` Secret. Never put the token in this directory or a Helm
 command line.

-## Review-first bootstrap
+## Flux 接管状态

-This is a one-time manual deployment because Flux is not installed yet:
+该 release 最初通过下述 review-first 流程手动 bootstrap。下一个 GitOps 阶段将
+使用 Flux `HelmRelease` 接管它，并首先固定现有 chart `0.1.1`，不在接管 PR 中升级。
+
+迁移前审计发现：Helm 保存的 user-supplied values 和 release manifest 仍描述失败的
+rootless DinD 尝试，但 live StatefulSet 与本目录 `values.yaml` 都已经使用 regular
+DinD。首次 reconcile 的验收条件是修正 Helm 存储状态，同时 live Pod spec、PVC
+identity、runner capacity 和在线状态保持不变。接管稳定后再用独立 PR 升级 chart。
+
+## 历史 review-first bootstrap
+
+这是 Flux 安装前执行过的一次性手动部署流程，保留用于恢复和审计：

 1. Merge the reviewed PR.
 2. As a Gitea site administrator, create an instance-scoped runner registration