feature/multicluster

Co-authored-by: Danijel Simeunovic <danijel.simeunovic@trumf.no>
Reviewed-on: #4
Reviewed-by: gitea_admin <admin@forteapps.net>

infra/base/enterprise-apps.yaml

@@ -18,7 +18,7 @@ spec:
   source:
     repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD
-    path: apps
+    path: apps/overlays/upc-dev
   destination:
     server: https://kubernetes.default.svc
     namespace: apps

infra/base/fluent-bit.yaml

@@ -21,7 +21,7 @@ spec:
     helm:
       releaseName: fluent-bit
       valueFiles:
-      - $values/infra/values/fluent-bit-values.yaml
+      - $values/infra/values/base/fluent-bit-values.yaml
 
   - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD

infra/base/gitea-actions.yaml

@@ -21,7 +21,7 @@ spec:
     helm:
       releaseName: gitea-actions
       valueFiles:
-      - $values/infra/values/gitea-actions-values.yaml
+      - $values/infra/values/base/gitea-actions-values.yaml
 
   - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD

infra/base/gitea.yaml

@@ -21,7 +21,7 @@ spec:
     helm:
       releaseName: gitea
       valueFiles:
-      - $values/infra/values/gitea-values.yaml
+      - $values/infra/values/base/gitea-values.yaml
 
   - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD

infra/base/grafana.yaml

@@ -21,7 +21,8 @@ spec:
     helm:
       releaseName: grafana
       valueFiles:
-      - $values/infra/values/grafana-values.yaml
+      - $values/infra/values/base/grafana-values.yaml
+      - $values/infra/values/upc-dev/grafana-values.yaml
 
   - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD

infra/base/keycloak.yaml

@@ -21,7 +21,8 @@ spec:
     helm:
       releaseName: keycloak
       valueFiles:
-      - $values/infra/values/keycloak-values.yaml
+      - $values/infra/values/base/keycloak-values.yaml
+      - $values/infra/values/upc-dev/keycloak-values.yaml
 
   - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD

infra/base/kustomization.yaml

@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- traefik-application.yaml
+- keycloak.yaml
+- grafana.yaml
+- cert-manager-application.yaml
+- kyverno.yaml
+- sealedsecrets.yaml
+- prometheus.yaml
+- loki.yaml
+- fluent-bit.yaml
+- trivy.yaml
+- enterprise-apps.yaml
+- cluster-resources-application.yaml
+- kyverno-policies.yaml
+- secrets.yaml
+- gitea.yaml
+- gitea-actions.yaml
+- renovate.yaml
+- tempo.yaml
+- grafana-dashboards.yaml
+- network-policies-application.yaml

infra/base/loki.yaml

@@ -21,7 +21,7 @@ spec:
     helm:
       releaseName: loki
       valueFiles:
-      - $values/infra/values/loki-values.yaml
+      - $values/infra/values/base/loki-values.yaml
 
   - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD

infra/base/prometheus.yaml

@@ -21,7 +21,7 @@ spec:
     helm:
       releaseName: prometheus
       valueFiles:
-      - $values/infra/values/prometheus-values.yaml
+      - $values/infra/values/base/prometheus-values.yaml
 
   - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD

infra/base/renovate.yaml

@@ -21,7 +21,7 @@ spec:
     helm:
       releaseName: renovate
       valueFiles:
-      - $values/infra/values/renovate-values.yaml
+      - $values/infra/values/base/renovate-values.yaml
 
   - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD

infra/base/secrets.yaml

@@ -18,7 +18,7 @@ spec:
   project: default
   source:
     repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
-    path: secrets
+    path: secrets/upc-dev
   destination:
     server: https://kubernetes.default.svc
     namespace: secrets

infra/base/tempo.yaml

@@ -21,7 +21,7 @@ spec:
     helm:
       releaseName: tempo
       valueFiles:
-      - $values/infra/values/tempo-values.yaml
+      - $values/infra/values/base/tempo-values.yaml
 
   - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
     targetRevision: HEAD

infra/base/traefik-application.yaml

@@ -1,13 +1,20 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik-system
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+---
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: opencost
+  name: traefik
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "1"
   labels:
-    app.kubernetes.io/name: opencost
-    app.kubernetes.io/part-of: monitoring
+    app.kubernetes.io/name: traefik
+    app.kubernetes.io/part-of: platform
     app.kubernetes.io/managed-by: argocd
   finalizers:
   - resources-finalizer.argocd.argoproj.io
@@ -15,27 +22,29 @@ spec:
   project: default
 
   sources:
-  - repoURL: https://opencost.github.io/opencost-helm-chart
-    chart: opencost
-    targetRevision: "1.42.0"
+  - repoURL: https://traefik.github.io/charts
+    chart: traefik
+    targetRevision: "28.0.0"
     helm:
-      releaseName: opencost
+      releaseName: traefik
       valueFiles:
-      - $values/infra/values/opencost-values.yaml
+      - $values/infra/values/base/traefik-values.yaml
+      - $values/infra/values/upc-dev/traefik-values.yaml
 
-  - repoURL: ssh://git@git.forteapps.net:2222/Forte/launchpad.git
+  - repoURL: git@github.com:fortedigital/sturdy-adventure.git
     targetRevision: HEAD
     ref: values
 
   destination:
     server: https://kubernetes.default.svc
-    namespace: monitoring
+    namespace: traefik-system
 
   syncPolicy:
     automated:
       prune: true
       selfHeal: true
       allowEmpty: false
+
     syncOptions:
     - CreateNamespace=true
     - Validate=true

infra/overlays/upc-dev/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../base
+
+# No patches needed — base already has "upc-dev" paths
+# upc-dev is the default/base cluster

infra/overlays/upc-prod/kustomization.yaml

@@ -0,0 +1,50 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../base
+
+patches:
+# Traefik: swap upc-dev → upc-prod in valueFiles
+- target:
+    kind: Application
+    name: traefik
+  patch: |
+    - op: replace
+      path: /spec/sources/0/helm/valueFiles/1
+      value: $values/infra/values/upc-prod/traefik-values.yaml
+
+# Keycloak: swap upc-dev → upc-prod
+- target:
+    kind: Application
+    name: keycloak
+  patch: |
+    - op: replace
+      path: /spec/sources/0/helm/valueFiles/1
+      value: $values/infra/values/upc-prod/keycloak-values.yaml
+
+# Grafana: swap upc-dev → upc-prod
+- target:
+    kind: Application
+    name: grafana
+  patch: |
+    - op: replace
+      path: /spec/sources/0/helm/valueFiles/1
+      value: $values/infra/values/upc-prod/grafana-values.yaml
+
+# Secrets: change path to upc-prod
+- target:
+    kind: Application
+    name: secrets
+  patch: |
+    - op: replace
+      path: /spec/source/path
+      value: secrets/upc-prod
+
+# Enterprise-apps: point to upc-prod overlay
+- target:
+    kind: Application
+    name: enterprise-apps
+  patch: |
+    - op: replace
+      path: /spec/source/path
+      value: apps/overlays/upc-prod

infra/traefik-application.yaml

@@ -1,159 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: traefik-system
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: traefik
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-  labels:
-    app.kubernetes.io/name: traefik
-    app.kubernetes.io/part-of: platform
-    app.kubernetes.io/managed-by: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-
-  source:
-    repoURL: https://traefik.github.io/charts
-    chart: traefik
-    targetRevision: "28.0.0"
-
-    helm:
-      values: |
-        metrics:
-          addInternals: true
-        tracing:
-          otlp:
-            enabled: true
-        logs:
-          general:
-            level: DEBUG
-          access:
-            format: json
-            enabled: true
-
-        additionalArguments:
-          - "--tracing.otlp.http.endpoint=http://tempo.monitoring.svc.cluster.local:4318/v1/traces"
-
-        providers:
-          kubernetesIngress:
-            publishedService: # Fixes ArgoCD health checks for LoadBalancer services
-              enabled: true
-        deployment:
-          replicas: 2
-
-        ingressRoute:
-          dashboard:
-            enabled: true
-            # Optional: specify entrypoint
-            entrypoint: traefik
-
-        api:
-          dashboard: true
-          debug: false
-
-        service:
-          type: LoadBalancer
-          annotations:
-            traefik.ingress.kubernetes.io/router.entrypoints: websecure
-            traefik.ingress.kubernetes.io/router.priority: "42"
-            traefik.ingress.kubernetes.io/router.tls: "true"
-            service.beta.kubernetes.io/upcloud-load-balancer-config: |
-              {
-                  "frontends": [
-                      {
-                          "name": "web",
-                          "mode": "tcp"
-                      },
-                      {
-                          "name": "websecure",
-                          "mode": "tcp"
-                      },
-                      {
-                          "name": "giteassh",
-                          "mode": "tcp"
-                      }
-                  ],
-                  "backends": [
-                      {
-                          "name": "web",
-                          "properties": {
-                              "outbound_proxy_protocol": "v2"
-                          }
-                      },
-                      {
-                          "name": "websecure",
-                          "properties": {
-                              "outbound_proxy_protocol": "v2"
-                          }
-                      },
-                      {
-                          "name": "giteassh"
-                      }
-                  ]
-              }
-
-        ingressClass:
-          enabled: true
-          isDefaultClass: true
-
-        # Configure entry points
-        ports:
-          metrics:
-            expose: 
-              default: true
-            observability:
-              accessLogs: true
-              metrics: true
-              tracing: true
-              traceVerbosity: detailed
-          web:
-            proxyProtocol:
-              trustedIPs: "172.16.1.0/24"
-            forwardedHeaders:
-              trustedIPs: "172.16.1.0/24"
-            http:
-              redirections:
-                entrypoint:
-                  to: websecure
-                  scheme: https
-
-          websecure:
-            proxyProtocol:
-              trustedIPs: "172.16.1.0/24"
-            forwardedHeaders:
-              trustedIPs: "172.16.1.0/24"
-            observability:
-              accessLogs: true
-              metrics: true
-              tracing: true
-
-          giteassh:
-            port: 2222
-            expose:
-              default: true
-            exposedPort: 2222
-            protocol: TCP
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: traefik-system
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-      allowEmpty: false
-
-    syncOptions:
-    - CreateNamespace=true
-    - Validate=true
-    - ServerSideApply=true

infra/values/base/argocd-values.yaml

@@ -1,5 +1,3 @@
-global:
-  domain: argocd.127.0.0.1.nip.io
 configs:
   secret:
     createSecret: true
@@ -22,10 +20,6 @@ notifications:
   secret:
     create: false
 
-  # Shared context variables available in all templates
-  context:
-    clusterName: "dev-fd-no-svg1"
-
   # Define notification templates
   templates:
     template.app-syncing: |

infra/values/base/dot-ai-stack-values.yaml

@@ -0,0 +1,11 @@
+dot-ai:
+  ingress:
+    enabled: true
+    className: traefik
+dot-ai-ui:
+  uiAuth:
+    secretRef:
+      name: dot-ai-secrets
+  ingress:
+    enabled: true
+    className: traefik

infra/values/base/grafana-values.yaml

@@ -1,7 +1,5 @@
 ingress:
   enabled: true
-  hosts:
-  - grafana.127.0.0.1.nip.io
 resources:
   requests:
     cpu: 50m

infra/values/base/keycloak-values.yaml

@@ -1,5 +1,4 @@
 # Bitnami Keycloak Helm Chart Values
-# Host: id.forteapps.net
 # Chart version: 25.2.0
 
 image:
@@ -15,7 +14,6 @@ auth:
 
 ingress:
   enabled: true
-  hostname: id.forteapps.net
   tls: true
   ingressClassName: traefik
   annotations:

infra/values/base/traefik-values.yaml

@@ -0,0 +1,50 @@
+providers:
+  kubernetesIngress:
+    publishedService: # Fixes ArgoCD health checks for LoadBalancer services
+      enabled: true
+deployment:
+  replicas: 2
+
+ingressRoute:
+  dashboard:
+    enabled: true
+    # Optional: specify entrypoint
+    entrypoint: traefik
+
+api:
+  dashboard: true
+  debug: false
+
+service:
+  type: LoadBalancer
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.priority: "42"
+    traefik.ingress.kubernetes.io/router.tls: "true"
+
+ingressClass:
+  enabled: true
+  isDefaultClass: true
+
+# Configure entry points
+ports:
+  metrics:
+    expose:
+      default: true
+    observability:
+      accessLogs: true
+      metrics: true
+      tracing: true
+      traceVerbosity: detailed
+  web:
+    http:
+      redirections:
+        entrypoint:
+          to: websecure
+          scheme: https
+
+  websecure:
+    observability:
+      accessLogs: true
+      metrics: true
+      tracing: true

infra/values/upc-dev/argocd-values.yaml

@@ -0,0 +1,5 @@
+global:
+  domain: argocd.127.0.0.1.nip.io
+notifications:
+  context:
+    clusterName: "dev-fd-eu-no-svg1"

infra/values/upc-dev/dot-ai-stack-values.yaml

@@ -0,0 +1,8 @@
+dot-ai:
+  ingress:
+    host: kubemcp.forteapps.net
+  webUI:
+    baseUrl: http://kubemcpui.forteapps.net
+dot-ai-ui:
+  ingress:
+    host: kubemcpui.forteapps.net

infra/values/upc-dev/grafana-values.yaml

@@ -0,0 +1,3 @@
+ingress:
+  hosts:
+  - grafana.forteapps.net

infra/values/upc-dev/keycloak-values.yaml

@@ -0,0 +1,2 @@
+ingress:
+  hostname: id.forteapps.net

infra/values/upc-dev/traefik-values.yaml

@@ -0,0 +1,40 @@
+service:
+  annotations:
+    service.beta.kubernetes.io/upcloud-load-balancer-config: |
+      {
+          "frontends": [
+              {
+                  "name": "web",
+                  "mode": "tcp"
+              },
+              {
+                  "name": "websecure",
+                  "mode": "tcp"
+              }
+          ],
+          "backends": [
+              {
+                  "name": "web",
+                  "properties": {
+                      "outbound_proxy_protocol": "v2"
+                  }
+              },
+              {
+                  "name": "websecure",
+                  "properties": {
+                      "outbound_proxy_protocol": "v2"
+                  }
+              }
+          ]
+      }
+ports:
+  web:
+    proxyProtocol:
+      trustedIPs: "172.16.1.0/24"
+    forwardedHeaders:
+      trustedIPs: "172.16.1.0/24"
+  websecure:
+    proxyProtocol:
+      trustedIPs: "172.16.1.0/24"
+    forwardedHeaders:
+      trustedIPs: "172.16.1.0/24"

infra/values/upc-prod/argocd-values.yaml

@@ -0,0 +1,5 @@
+global:
+  domain: argocd.us.forteapps.net
+notifications:
+  context:
+    clusterName: "dev-fd-us-east1"

infra/values/upc-prod/dot-ai-stack-values.yaml

@@ -0,0 +1,8 @@
+dot-ai:
+  ingress:
+    host: kubemcp.us.forteapps.net
+  webUI:
+    baseUrl: http://kubemcpui.us.forteapps.net
+dot-ai-ui:
+  ingress:
+    host: kubemcpui.us.forteapps.net

infra/values/upc-prod/grafana-values.yaml

@@ -0,0 +1,3 @@
+ingress:
+  hosts:
+  - grafana.us.forteapps.net

infra/values/upc-prod/keycloak-values.yaml

@@ -0,0 +1,2 @@
+ingress:
+  hostname: id.us.forteapps.net

infra/values/upc-prod/traefik-values.yaml

@@ -0,0 +1,13 @@
+service:
+  annotations: {}
+ports:
+  web:
+    proxyProtocol:
+      trustedIPs: "10.0.0.0/16"
+    forwardedHeaders:
+      trustedIPs: "10.0.0.0/16"
+  websecure:
+    proxyProtocol:
+      trustedIPs: "10.0.0.0/16"
+    forwardedHeaders:
+      trustedIPs: "10.0.0.0/16"