add: configure argocd sync lifecycle hooks

argocd/application-sets/homelab-backend.yaml

@@ -48,6 +48,10 @@ spec:
         server: https://kubernetes.default.svc
         namespace: '{{ .namespace }}'
 
+      syncPolicy:
+        syncOptions:
+          - PruneLast=true
+
   templatePatch: |
     {{- if .autoSync }}
     spec:
@@ -56,4 +60,11 @@ spec:
           enabled: true
           prune: true
           selfHeal: true
-    {{- end }}
+        retry:
+          limit: 3
+          refresh: true
+          backoff:
+            duration: 10s
+            factor: 2
+            maxDuration: 1m
+    {{- end }}

kubernetes/helm/templates/deployment.yaml

@@ -7,6 +7,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ .Release.Name }}-app
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
   labels:
     {{- include "homelab-backend.labels" . | nindent 4 }}
 spec:

kubernetes/helm/templates/post-sync-smoke-test.yaml

@@ -0,0 +1,44 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .Release.Name }}-post-sync-smoke-test
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
+spec:
+  template:
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: post-sync-smoke-test
+          image: {{ .Values.hooks.image | quote }}
+          imagePullPolicy: IfNotPresent
+          command:
+            - "wget"
+            - "--spider"
+            - "-T"
+            - "5"
+            - "http://{{ .Release.Name }}-service:{{ .Values.service.port }}/health/ready"
+          securityContext:
+            privileged: false
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "16Mi"
+            limits:
+              cpu: "100m"
+              memory: "32Mi"
+  backoffLimit: 0
+  activeDeadlineSeconds: 60

kubernetes/helm/templates/pre-sync-runtime-check.yaml

@@ -0,0 +1,51 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ .Release.Name }}-pre-sync-runtime-check
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
+spec:
+  template:
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: pre-sync-runtime-check
+          image: {{ .Values.hooks.image | quote }}
+          imagePullPolicy: IfNotPresent
+          command:
+            - "test"
+            - "-s"
+            - "/run/secrets/BEARER_TOKEN"
+          securityContext:
+            privileged: false
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: runtime-secrets
+              mountPath: /run/secrets
+              readOnly: true
+          resources:
+            requests:
+              cpu: "50m"
+              memory: "16Mi"
+            limits:
+              cpu: "100m"
+              memory: "32Mi"
+      volumes:
+        - name: runtime-secrets
+          secret:
+            secretName: homelab-backend-runtime
+            defaultMode: 0444
+  backoffLimit: 0
+  activeDeadlineSeconds: 60

kubernetes/helm/values.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft-07/schema#",
   "type": "object",
   "additionalProperties": false,
-  "required": ["replicaCount", "image", "config", "service", "resources"],
+  "required": ["replicaCount", "image", "config", "service", "resources", "hooks"],
   "properties": {
     "config": {
       "type": "object",
@@ -98,6 +98,17 @@
           }
         }
       }
+    },
+    "hooks": {
+      "type": "object",
+      "required": ["image"],
+      "additionalProperties": false,
+      "properties": {
+        "image": {
+          "type": "string",
+          "pattern": "^.+@sha256:[a-f0-9]{64}$"
+        }
+      }
     }
   }
 }

kubernetes/helm/values.yaml

@@ -20,4 +20,7 @@ resources:
     memory: "32Mi"
   limits:
     cpu: "500m"
-    memory: "128Mi"
+    memory: "128Mi"
+
+hooks:
+  image: "docker.io/library/busybox:1.38.0@sha256:dc2d74b28e4cf8984fa52af1f39bc7c3d9c73760b41a74d629f5d11b1ab28616"