Stage Quay GitOps app with dedicated PostgreSQL

2026-10-20 08:53:53 +02:00
parent c2092bc33e
commit 86f679798a
5 changed files with 140 additions and 0 deletions
@@ -0,0 +1,29 @@
+# Quay registry
+
+The Quay Application consumes the separately published `quay` chart. The
+chart owns Quay's registry and mirror Deployments, Service, Ingress, and
+optional PostgreSQL and Valkey subcharts. These values choose the existing
+hostname, private configuration Secret, database storage class, and existing
+Valkey instance for this cluster.
+
+The Rook `CephObjectStoreUser/rook-ceph/quay` is adopted by the same Argo
+Application without changing its name or spec. Its existing `quay` bucket is
+**not** recreated or pruned by Helm or Argo. At migration inventory it had
+5,416 objects and bucket ID
+`e326b22c-970e-4ff6-bf65-499f3bab92bf.900401.2`. Keep the Ceph user Secret,
+bucket, and RGW data during any rollback.
+
+`default/secret/quay-config` contains Quay's persistent encryption keys and
+currently points at the shared PostgreSQL Service. It is retained as rollback
+data. `quay-config-next` contains the same keys and S3 credentials with only
+`DB_URI` changed to `quay-postgresql.default.svc.cluster.local`; neither
+Secret's contents belongs in this public repository. `quay-postgres` holds the
+dedicated PostgreSQL passwords. Restore those Secrets from the encrypted
+administrator backup before enabling `quay.enabled` in a new cluster.
+
+The migration starts with `quay.enabled: false`, deploying only dedicated
+PostgreSQL. Stop both legacy Quay Deployments before the final database dump,
+restore that dump to `quay-postgresql`, switch the config Secret, then enable
+Quay in this values file. Preserve the old shared database and PVC for rollback
+until backups and live pulls/pushes have been verified. The old direct Gitea CD
+writer must be removed after Argo adopts and verifies both Deployments.
@@ -0,0 +1,7 @@
+apiVersion: ceph.rook.io/v1
+kind: CephObjectStoreUser
+metadata:
+  name: quay
+  namespace: rook-ceph
+spec:
+  store: my-store
@@ -0,0 +1,37 @@
+# Start with only the dedicated PostgreSQL instance. Enable Quay after the
+# final dump/restore, while both old Deployments are stopped.
+quay:
+  enabled: false
+  configSecretName: quay-config-next
+  debugLog: true
+
+repomirror:
+  enabled: true
+
+ingress:
+  enabled: true
+  className: traefik
+  host: registry.brunner.ninja
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+
+postgresql:
+  enabled: true
+  auth:
+    username: quay
+    database: quay
+    existingSecret: quay-postgres
+    secretKeys:
+      adminPasswordKey: postgres-password
+      userPasswordKey: database-password
+  primary:
+    persistence:
+      storageClass: rook-ceph-block-ec
+      size: 8Gi
+    persistentVolumeClaimRetentionPolicy:
+      enabled: true
+      whenDeleted: Retain
+      whenScaled: Retain
+
+valkey:
+  enabled: false
@@ -0,0 +1,38 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: quay
+  namespace: argocd
+spec:
+  description: Quay registry and its existing Ceph object-store user
+  sourceRepos:
+  - https://brunner.ninja/charts
+  - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  destinations:
+  - namespace: default
+    server: https://kubernetes.default.svc
+  - namespace: rook-ceph
+    server: https://kubernetes.default.svc
+  namespaceResourceWhitelist:
+  - group: ""
+    kind: ConfigMap
+  - group: ""
+    kind: PersistentVolumeClaim
+  - group: ""
+    kind: Secret
+  - group: ""
+    kind: Service
+  - group: ""
+    kind: ServiceAccount
+  - group: apps
+    kind: Deployment
+  - group: apps
+    kind: StatefulSet
+  - group: networking.k8s.io
+    kind: Ingress
+  - group: networking.k8s.io
+    kind: NetworkPolicy
+  - group: policy
+    kind: PodDisruptionBudget
+  - group: ceph.rook.io
+    kind: CephObjectStoreUser
@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: quay
+  namespace: argocd
+spec:
+  project: quay
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: quay
+    targetRevision: 3.18.0
+    helm:
+      releaseName: quay
+      valueFiles:
+      - $values/apps/quay/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    path: apps/quay/resources
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true