make ready for argo cd

.gitignore

@@ -0,0 +1 @@
+services/argocd/install.yaml

bootstrap/root-app.yaml

@@ -0,0 +1,21 @@
+# bootstrap/root-app.yaml — de "app-of-apps"
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: root
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.zb-kw.duckdns.org/willemjan/cluster.git
+    targetRevision: main
+    path: apps                  # elke yaml hierin = één Application
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true               # wat uit Git verdwijnt, verdwijnt uit het cluster
+      selfHeal: true             # handmatige kubectl-wijzigingen worden teruggedraaid

infrastructure/cert-manager/duckdns-issuer.yaml

@@ -1,24 +1,3 @@
-# infrastructure/cert-manager/duckdns-issuer.yaml
-# apiVersion: cert-manager.io/v1
-# kind: ClusterIssuer
-# metadata:
-#   name: duckdns
-# spec:
-#   acme:
-#     server: https://acme-v02.api.letsencrypt.org/directory
-#     email: [email protected]
-#     privateKeySecretRef:
-#       name: duckdns-account-key        # account-key wordt hierin opgeslagen
-#     solvers:
-#     - dns01:
-#         webhook:
-#           groupName: acme.duckdns.org   # <-- dit is de juiste waarde
-#           solverName: duckdns
-#           config:
-#             apiTokenSecretRef:          # <-- let op: niet secretName/subdomain!
-#               name: duckdns-token
-#               key: token
-
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:

infrastructure/cert-manager/webhook-rbac.yaml

@@ -0,0 +1,25 @@
+# infrastructure/cert-manager/webhook-rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cert-manager-webhook-duckdns-token-reader
+  namespace: cert-manager
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["duckdns-token"]
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cert-manager-webhook-duckdns-token-reader
+  namespace: cert-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cert-manager-webhook-duckdns-token-reader
+subjects:
+- kind: ServiceAccount
+  name: cert-manager-webhook-duckdns
+  namespace: cert-manager

infrastructure/namespaces/00-namespaces.yaml

@@ -1,25 +0,0 @@
-# infrastructure/namespaces/00-namespaces.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: networking    # adguard, traefik-config
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: auth
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: dashboards
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ci
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring