From 86f679798af87dbb2117dbb3e4d0e954c144f667 Mon Sep 17 00:00:00 2001 From: 0xFEEDC0DE64 Date: Tue, 20 Oct 2026 08:53:53 +0200 Subject: [PATCH] Stage Quay GitOps app with dedicated PostgreSQL --- apps/quay/README.md | 29 +++++++++++++++++ apps/quay/resources/ceph-object-user.yaml | 7 +++++ apps/quay/values.yaml | 37 ++++++++++++++++++++++ bootstrap/quay-project.yaml | 38 +++++++++++++++++++++++ bootstrap/quay.yaml | 29 +++++++++++++++++ 5 files changed, 140 insertions(+) create mode 100644 apps/quay/README.md create mode 100644 apps/quay/resources/ceph-object-user.yaml create mode 100644 apps/quay/values.yaml create mode 100644 bootstrap/quay-project.yaml create mode 100644 bootstrap/quay.yaml diff --git a/apps/quay/README.md b/apps/quay/README.md new file mode 100644 index 0000000..462b6d4 --- /dev/null +++ b/apps/quay/README.md @@ -0,0 +1,29 @@ +# Quay registry + +The Quay Application consumes the separately published `quay` chart. The +chart owns Quay's registry and mirror Deployments, Service, Ingress, and +optional PostgreSQL and Valkey subcharts. These values choose the existing +hostname, private configuration Secret, database storage class, and existing +Valkey instance for this cluster. + +The Rook `CephObjectStoreUser/rook-ceph/quay` is adopted by the same Argo +Application without changing its name or spec. Its existing `quay` bucket is +**not** recreated or pruned by Helm or Argo. At migration inventory it had +5,416 objects and bucket ID +`e326b22c-970e-4ff6-bf65-499f3bab92bf.900401.2`. Keep the Ceph user Secret, +bucket, and RGW data during any rollback. + +`default/secret/quay-config` contains Quay's persistent encryption keys and +currently points at the shared PostgreSQL Service. It is retained as rollback +data. `quay-config-next` contains the same keys and S3 credentials with only +`DB_URI` changed to `quay-postgresql.default.svc.cluster.local`; neither +Secret's contents belongs in this public repository. `quay-postgres` holds the +dedicated PostgreSQL passwords. Restore those Secrets from the encrypted +administrator backup before enabling `quay.enabled` in a new cluster. + +The migration starts with `quay.enabled: false`, deploying only dedicated +PostgreSQL. Stop both legacy Quay Deployments before the final database dump, +restore that dump to `quay-postgresql`, switch the config Secret, then enable +Quay in this values file. Preserve the old shared database and PVC for rollback +until backups and live pulls/pushes have been verified. The old direct Gitea CD +writer must be removed after Argo adopts and verifies both Deployments. diff --git a/apps/quay/resources/ceph-object-user.yaml b/apps/quay/resources/ceph-object-user.yaml new file mode 100644 index 0000000..b2ef408 --- /dev/null +++ b/apps/quay/resources/ceph-object-user.yaml @@ -0,0 +1,7 @@ +apiVersion: ceph.rook.io/v1 +kind: CephObjectStoreUser +metadata: + name: quay + namespace: rook-ceph +spec: + store: my-store diff --git a/apps/quay/values.yaml b/apps/quay/values.yaml new file mode 100644 index 0000000..77ee430 --- /dev/null +++ b/apps/quay/values.yaml @@ -0,0 +1,37 @@ +# Start with only the dedicated PostgreSQL instance. Enable Quay after the +# final dump/restore, while both old Deployments are stopped. +quay: + enabled: false + configSecretName: quay-config-next + debugLog: true + +repomirror: + enabled: true + +ingress: + enabled: true + className: traefik + host: registry.brunner.ninja + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + +postgresql: + enabled: true + auth: + username: quay + database: quay + existingSecret: quay-postgres + secretKeys: + adminPasswordKey: postgres-password + userPasswordKey: database-password + primary: + persistence: + storageClass: rook-ceph-block-ec + size: 8Gi + persistentVolumeClaimRetentionPolicy: + enabled: true + whenDeleted: Retain + whenScaled: Retain + +valkey: + enabled: false diff --git a/bootstrap/quay-project.yaml b/bootstrap/quay-project.yaml new file mode 100644 index 0000000..fa2b4d7 --- /dev/null +++ b/bootstrap/quay-project.yaml @@ -0,0 +1,38 @@ +apiVersion: argoproj.io/v1alpha1 +kind: AppProject +metadata: + name: quay + namespace: argocd +spec: + description: Quay registry and its existing Ceph object-store user + sourceRepos: + - https://brunner.ninja/charts + - https://code.brunner.ninja/feedc0de/homelab-gitops.git + destinations: + - namespace: default + server: https://kubernetes.default.svc + - namespace: rook-ceph + server: https://kubernetes.default.svc + namespaceResourceWhitelist: + - group: "" + kind: ConfigMap + - group: "" + kind: PersistentVolumeClaim + - group: "" + kind: Secret + - group: "" + kind: Service + - group: "" + kind: ServiceAccount + - group: apps + kind: Deployment + - group: apps + kind: StatefulSet + - group: networking.k8s.io + kind: Ingress + - group: networking.k8s.io + kind: NetworkPolicy + - group: policy + kind: PodDisruptionBudget + - group: ceph.rook.io + kind: CephObjectStoreUser diff --git a/bootstrap/quay.yaml b/bootstrap/quay.yaml new file mode 100644 index 0000000..ac2612d --- /dev/null +++ b/bootstrap/quay.yaml @@ -0,0 +1,29 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: quay + namespace: argocd +spec: + project: quay + sources: + - repoURL: https://brunner.ninja/charts + chart: quay + targetRevision: 3.18.0 + helm: + releaseName: quay + valueFiles: + - $values/apps/quay/values.yaml + - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git + targetRevision: main + ref: values + - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git + targetRevision: main + path: apps/quay/resources + destination: + server: https://kubernetes.default.svc + namespace: default + syncPolicy: + automated: + enabled: true + prune: false + selfHeal: true