- Check ArgoCD healthz endpoint
- Check k8s-pg PostgreSQL via pg_isready
- Verify all ArgoCD apps are synced
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Rename from generic "default" to descriptive "crio-compat"
- Add detailed comments explaining why this ProxyClass exists
- Update all Service/Ingress annotations to use new name
- Remove invalid `default: true` field (not a real ProxyClass field)
The ProxyClass exists because CRI-O cannot resolve short image names.
Each Tailscale Service/Ingress needs the annotation to use it.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Set `default: true` on ProxyClass so all Services/Ingresses use it
- Remove explicit proxy-class annotation from databases service
- Fixes CRI-O short image name issue globally for Tailscale resources
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add proxy-class annotation to use default ProxyClass
- Fixes CRI-O image name resolution issue
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Expose k8s-pg.tail8d86e.ts.net for testing during migration
- Temporary service until Phase 4 when pg.tail8d86e.ts.net switches
- Update README with connection info and cleanup notes
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create blumeops-pg Cluster with CloudNativePG
- Add eblume superuser role (matches current brew pg setup)
- Configure pg_hba for password auth from any IP (Tailscale handles security)
- Add secret template for eblume password from 1Password
- Create ArgoCD Application with manual sync policy
- Update Phase 1 plan with implementation notes
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Configures minikube's CRI-O to use zot on indri as a pull-through cache
for docker.io, ghcr.io, and quay.io. Uses host.containers.internal:5050
which is stable across restarts.
This reduces external bandwidth, speeds up pulls, and provides resilience
if upstream registries are unreachable.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add CloudNativePG Application using multi-source Helm pattern
- Helm chart from upstream cloudnative-pg repo
- Values file from our git repo for customization
- Manual sync policy consistent with other workload apps
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add argocd CLI to Brewfile
- Create argocd.yaml for ArgoCD self-management (manual sync)
- Create apps.yaml app-of-apps root (auto-sync for Application resources)
- Convert tailscale-operator to kustomize
- Update READMEs with bootstrap steps and ArgoCD CLI commands
- Change all workload Applications to manual sync policy
App-of-apps auto-syncs to pick up new Application manifests, but child
apps require manual sync for actual workload deployments.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Adds ArgoCD Application to manage Tailscale operator from forge:
- ArgoCD Application sourced from internal Forgejo via SSH
- DNS config for cluster-to-tailnet name resolution
- Egress proxy for accessing forge on indri
- ACL grants for k8s workloads to reach forge (ports 3001, 2200)
- Template for repository secret with 1Password SSH key reference
Key discovery: 1Password op read requires ?ssh-format=openssh parameter
to get keys in OpenSSH format that ArgoCD's SSH client can read.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Uses kustomize with remote base from upstream ArgoCD
- Adds Tailscale LoadBalancer service for external access
- Exposed at https://argocd.tail8d86e.ts.net
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
CRI-O cannot resolve short image names like 'tailscale/tailscale:stable'.
The ProxyClass 'default' sets fully-qualified image references.
Services must use annotation: tailscale.com/proxy-class: "default"
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
ACL changes:
- Added tag:k8s-operator for the Tailscale K8s Operator
- Made tag:k8s-operator an owner of tag:k8s so the operator can
assign that tag to resources it creates
Phase 1 plan updates:
- Added Kubernetes Tags Overview section explaining all three tags
- Expanded OAuth client creation instructions
- Added 1Password storage instructions
- Added verification and rollback sections
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Added:
- tag:k8s to tagOwners for k8s workload management
- Grant for tag:k8s -> tag:registry access (for CI pushing images)
- ACL test case for k8s registry access
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Reorganized the monolithic migration plan into separate files:
- 00_overview.md: Architecture, technical decisions, shared info
- P0_foundation.complete.md: Phase 0 (complete)
- P1_k8s_infrastructure.md: Phase 1 (in progress)
- P2-P9: Remaining phases (pending)
This makes the plan easier to navigate and track progress.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
