From 573a4fab3ab201da0ae16a8cd8ead5436637bfba Mon Sep 17 00:00:00 2001 From: Jackson Loper Date: Thu, 10 Sep 2026 13:52:05 -0400 Subject: [PATCH] Take fider out of ArgoCD Hands fider and fider-db to Flux. Removing the config.json files takes both Applications out of the ApplicationSet; removing the values.yaml files leaves nothing dead behind, since the Flux manifests carry their own copies. DO NOT MERGE until #73 has landed. Without preserveResourcesOnDeletion, this commit deletes the fider database: the Application owns the CNPG Cluster, the Cluster owns the PVC through an ownerReference, and that PV reclaims with Delete. Nothing in secrets/ changes. The `fider` and `fider-db-creds` Secrets come from the standalone bootstrap-secrets app, which is not part of this ApplicationSet and is unaffected. Flux consumes those Secrets rather than managing them. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01MeFy2jujRA8ScQqRAshc1f --- applications/fider-db/config.json | 18 ------- applications/fider-db/values.yaml | 34 ------------- applications/fider/config.json | 18 ------- applications/fider/values.yaml | 83 ------------------------------- 4 files changed, 153 deletions(-) delete mode 100644 applications/fider-db/config.json delete mode 100644 applications/fider-db/values.yaml delete mode 100644 applications/fider/config.json delete mode 100644 applications/fider/values.yaml diff --git a/applications/fider-db/config.json b/applications/fider-db/config.json deleted file mode 100644 index 0f2498e..0000000 --- a/applications/fider-db/config.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "cluster": { - "name": "in-cluster", - "namespace": "fider" - }, - "application": { - "chartName": "cluster", - "chartURL": "https://cloudnative-pg.github.io/charts", - "name": "fider-db", - "phase": "post", - "revision": "0.8.1", - "valuesRevision": "HEAD", - "valuesURL": "https://github.com/Equal-Vote/argocd.git" - }, - "argocd": { - "project": "default" - } -} diff --git a/applications/fider-db/values.yaml b/applications/fider-db/values.yaml deleted file mode 100644 index ccfb079..0000000 --- a/applications/fider-db/values.yaml +++ /dev/null @@ -1,34 +0,0 @@ -# dyff between <(yq . <(helm show values cnpg/cluster --version 0.8.1)) <(yq eval '. * load("values.yaml")' <(helm show values cnpg/cluster --version 0.8.1)) -# vim -O <(helm show values cnpg/cluster --version 0.8.1) values.yaml - -fullnameOverride: fider-db -type: postgresql -mode: standalone -cluster: - instances: 1 - # With one instance the operator's default PDB (minAvailable: 1) can never be - # satisfied: it sits at 0 allowed disruptions permanently, so node drains hang - # and AKS cluster upgrades stall. Disabling it lets the pod be evicted and - # rescheduled -- a brief outage, but unavoidable for a single-instance cluster. - # https://cloudnative-pg.io/documentation/current/kubernetes_upgrade/#pod-disruption-budgets - enablePDB: false - storage: - size: 1Gi - resources: - requests: - cpu: 10m - memory: 256Mi - limits: - memory: 256Mi - initdb: - database: fider - owner: fider - # Password lives in git (SOPS) rather than being generated by the - # operator. With this set, CNPG does NOT create a fider-db-app secret, - # so anything needing the credentials must read fider-db-creds. - # Only consulted at bootstrap: changing it later will not rotate the - # password on an already-initialized cluster. - secret: - name: fider-db-creds -backups: - enabled: false diff --git a/applications/fider/config.json b/applications/fider/config.json deleted file mode 100644 index 12a5c2d..0000000 --- a/applications/fider/config.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "cluster": { - "name": "in-cluster", - "namespace": "fider" - }, - "application": { - "chartName": "app", - "chartURL": "registry.gitlab.com/devopscoop/charts", - "name": "fider", - "phase": "post", - "revision": "0.11.1", - "valuesRevision": "HEAD", - "valuesURL": "https://github.com/Equal-Vote/argocd.git" - }, - "argocd": { - "project": "default" - } -} diff --git a/applications/fider/values.yaml b/applications/fider/values.yaml deleted file mode 100644 index b790fa9..0000000 --- a/applications/fider/values.yaml +++ /dev/null @@ -1,83 +0,0 @@ -# dyff between <(yq . <(helm show values oci://registry.gitlab.com/devopscoop/charts/app --version 0.11.1)) <(yq eval '. * load("values.yaml")' <(helm show values oci://registry.gitlab.com/devopscoop/charts/app --version 0.11.1)) -# vim -O <(helm show values oci://registry.gitlab.com/devopscoop/charts/app --version 0.11.1) values.yaml - -replicaCount: 1 -image: - repository: getfider/fider - tag: stable -ingress: - enabled: true - annotations: - cert-manager.io/cluster-issuer: "letsencrypt-prod" - hosts: - - host: feedback.prod.equal.vote - paths: - - path: / - pathType: ImplementationSpecific - tls: - - secretName: fider-tls - hosts: - - feedback.prod.equal.vote -env: - - name: BASE_URL - value: "https://feedback.prod.equal.vote" - - name: JWT_SECRET - valueFrom: - secretKeyRef: - name: fider - key: JWT_SECRET - # The password is declared in git (secrets/fider-db-secrets.enc.yaml) and - # handed to CNPG via cluster.initdb.secret, so the operator no longer - # publishes a fider-db-app secret with a ready-made `uri`. Assemble the URL - # here instead, injecting the one stored copy of the password via Kubernetes - # dependent-env expansion -- FIDER_DB_PASSWORD must stay above DATABASE_URL - # for $() to resolve. The password is deliberately alphanumeric: this is - # string interpolation, not URL encoding (see #43). - # No sslmode, so lib/pq defaults to `require`; CNPG always serves TLS. - - name: FIDER_DB_PASSWORD - valueFrom: - secretKeyRef: - name: fider-db-creds - key: password - - name: DATABASE_URL - value: "postgresql://fider:$(FIDER_DB_PASSWORD)@fider-db-rw.fider:5432/fider" - - name: EMAIL_NOREPLY - value: "noreply@bettervoting.com" - - name: EMAIL_SMTP_HOST - value: "smtp.sendgrid.net" - - name: EMAIL_SMTP_PORT - value: "587" - - name: EMAIL_SMTP_USERNAME - value: "apikey" - - name: EMAIL_SMTP_PASSWORD - valueFrom: - secretKeyRef: - name: fider - key: EMAIL_SMTP_PASSWORD - - name: LOG_LEVEL - value: "info" - - name: BLOB_STORAGE - value: "sql" -service: - port: 3000 -# Fider calls lingua-go for language detection on every post insert -# (addNewPost -> detectPostLanguage), which lazily loads n-gram models for all -# 18 locales in enum.AllLocales. Measured on getfider/fider:stable -# (dev-67c5282): idle 14MB, first insert 3.1s and +338MB, and the models stay -# resident -- so ~356MB is the real steady state, not a transient spike, and it -# is reached the moment anyone submits a suggestion. At the old 200Mi limit the -# pod was OOMKilled mid-request on every first post, which reads to the user as -# the submit hanging forever. The request matters as much as the limit: at -# 100Mi the scheduler was sizing this pod at under a third of what it holds. -resources: - requests: - cpu: 10m - memory: 384Mi - limits: - memory: 640Mi -livenessProbe: - httpGet: - port: 3000 -readinessProbe: - httpGet: - port: 3000