infra-k8s-apps

Holds the Kubernetes manifests for base infrastructure and applications deployed to the SGF k3s cluster via Argo CD.

Scope

• Owns: Kubernetes desired state for bootstrap components and app workloads in the SGF k3s cluster.

Structure

• src/k8s/bootstrap/: Argo CD projects and platform operators required before their custom resources.
• src/k8s/platform/: Cluster configuration, storage, identity, observability, and shared services.
• src/k8s/apps/: The primary set of applications deployed to the cluster.

Applications can use either of these layouts:

• Flat applications place kustomization.yaml directly under src/k8s/apps/<app>/.
• Applications with overlays place shared resources under src/k8s/apps/<app>/base/ and each deployable environment in a sibling directory containing its own kustomization.yaml.

The application generator discovers top-level Kustomizations and nested overlay Kustomizations, excluding directories named base. An overlay application must not have a Kustomization at its application root.

Public ingress model

• Public *.sgf.dev hostnames resolve to the shared public edge node.
• The edge cluster forwards *.sgf.dev traffic to the three internal SGF k3s nodes.
• HTTPS is SNI passthrough at the edge, so TLS terminates on the destination workload cluster ingress with Let's Encrypt certificates.
• This repo defines destination ingresses and services; DNS is owned by sgfdevs/infra-dns and edge forwarding by glitchedmob/infra-public-edge.

Identity

• Dex uses the GitHub sgfdevs organization and loads the infra-platform-admins and infra-maintainers teams.
• Argo CD, Grafana, oauth2-proxy, and OpenBao use Dex clients generated by infra-vm-workloads.
• Protected administrative UIs use one oauth2-proxy deployment with per-application ForwardAuth policies.

Application backups

• K8up uses src/k8s/platform/services/backup-base/ for shared scheduling and retention through Backblaze's S3-compatible API in sgfdevs-on-prem-k3s-backups.
• OpenBao uses logical Raft snapshots and restores the latest snapshot only when all three current PVCs are empty.
• A new empty backup repository permits first-time initialization; missing credentials and inaccessible or invalid existing repositories fail closed.
• OpenBao initialization is a one-time operator step after the first platform bootstrap; infra-app-config manages OIDC and backup authentication afterward.