feat(gitops): populate declarative manifests for all 10 workloads and correct destination namespaces

manifests/spaceport/semaphore/semaphore.yaml

@@ -0,0 +1,302 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    meta.helm.sh/release-name: semaphore
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/instance: semaphore
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: semaphore
+    app.kubernetes.io/version: 2.17.34
+    helm.sh/chart: semaphore-16.1.2
+  name: semaphore
+  namespace: infrastructure
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: semaphore
+      app.kubernetes.io/name: semaphore
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        checksum/config: 6db2d80fdda45e7be278174345179b6ece77d6ca957902f08bb3ba861921e4a8
+        checksum/secret-admin: 3c0ad6cefcee43617216b7c1703bdd864766da7cee9e43f18724fe4a70c89545
+        checksum/secret-general: 91136cb91b1e8cc2540294d8ecd541338bffdb2127897e8bea112160e6a3705d
+        checksum/secret-runner: 8e3582b533083a64b4205c22d9b2d476f93d90b27276d88e74fe4c885f7db60a
+        kubectl.kubernetes.io/restartedAt: '2026-10-28T18:13:14.547755+00:00'
+      labels:
+        app.kubernetes.io/instance: semaphore
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: semaphore
+        app.kubernetes.io/version: 2.17.34
+        helm.sh/chart: semaphore-16.1.2
+    spec:
+      containers:
+      - env:
+        - name: SEMAPHORE_PORT
+          value: '3000'
+        - name: SEMAPHORE_GIT_CLIENT
+          value: cmd_git
+        - name: SEMAPHORE_TMP_PATH
+          value: /tmp/semaphore
+        - name: SEMAPHORE_MAX_PARALLEL_TASKS
+          value: '0'
+        - name: SEMAPHORE_PASSWORD_LOGIN_DISABLED
+          value: 'false'
+        - name: SEMAPHORE_NON_ADMIN_CAN_CREATE_PROJECT
+          value: 'false'
+        - name: SEMAPHORE_USE_REMOTE_RUNNER
+          value: 'false'
+        - name: SEMAPHORE_DB_DIALECT
+          value: bolt
+        - name: SEMAPHORE_DB_HOST
+          value: /var/lib/semaphore/database.boltdb
+        - name: SEMAPHORE_LDAP_ENABLE
+          value: 'false'
+        - name: SEMAPHORE_EMAIL_ALERT
+          value: 'false'
+        - name: SEMAPHORE_TELEGRAM_ALERT
+          value: 'false'
+        - name: SEMAPHORE_SLACK_ALERT
+          value: 'false'
+        - name: SEMAPHORE_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: semaphore-runner
+        - name: SEMAPHORE_COOKIE_HASH
+          valueFrom:
+            secretKeyRef:
+              key: cookieHash
+              name: semaphore-general
+        - name: SEMAPHORE_COOKIE_ENCRYPTION
+          valueFrom:
+            secretKeyRef:
+              key: cookieEncryption
+              name: semaphore-general
+        - name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
+          valueFrom:
+            secretKeyRef:
+              key: accesskeyEncryption
+              name: semaphore-general
+        - name: SEMAPHORE_OIDC_PROVIDERS
+          value: '{"authentik": {"display_name": "Sign in with Authentik", "provider_url":
+            "https://authentik.snarfnet.net/application/o/semaphore/", "client_id":
+            "semaphore-2e50dbdf", "client_secret": "V4uazPXN9toUn5Jf2DfsRIFrygf1T0Vcltga-APrzTRjWFN0DIIqNw",
+            "redirect_url": "https://semaphore.snarfnet.net/api/auth/oidc/authentik/redirect/",
+            "username_claim": "preferred_username", "name_claim": "name", "email_claim":
+            "email", "scopes": ["openid", "profile", "email", "groups"]}}'
+        - name: SEMAPHORE_WEB_HOST
+          value: https://semaphore.snarfnet.net
+        image: semaphoreui/semaphore:v2.17.34
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /
+            port: http
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: semaphore
+        ports:
+        - containerPort: 3000
+          name: http
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /
+            port: http
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/semaphore/config.json
+          name: config
+          subPath: config.json
+        - mountPath: /tmp/semaphore
+          name: workdir
+        - mountPath: /var/lib/semaphore
+          name: boltdb
+      dnsPolicy: ClusterFirst
+      initContainers:
+      - command:
+        - sh
+        - -c
+        - "if ! semaphore user get --config=/etc/semaphore/config.json --login $(SEMAPHORE_ADMIN_USERNAME)\
+          \ >/dev/null; then\n  semaphore user add \\\n    --config=/etc/semaphore/config.json\
+          \ \\\n    --admin \\\n    --name=$(SEMAPHORE_ADMIN_FULLNAME) \\\n    --login=$(SEMAPHORE_ADMIN_USERNAME)\
+          \ \\\n    --password=$(SEMAPHORE_ADMIN_PASSWORD) \\\n    --email=$(SEMAPHORE_ADMIN_EMAIL)\n\
+          else\n  echo \"Admin already extists\"\nfi\n"
+        env:
+        - name: SEMAPHORE_ADMIN_FULLNAME
+          valueFrom:
+            secretKeyRef:
+              key: fullname
+              name: semaphore-admin
+        - name: SEMAPHORE_ADMIN_USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: semaphore-admin
+        - name: SEMAPHORE_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: password
+              name: semaphore-admin
+        - name: SEMAPHORE_ADMIN_EMAIL
+          valueFrom:
+            secretKeyRef:
+              key: email
+              name: semaphore-admin
+        - name: SEMAPHORE_PORT
+          value: '3000'
+        - name: SEMAPHORE_GIT_CLIENT
+          value: cmd_git
+        - name: SEMAPHORE_TMP_PATH
+          value: /tmp/semaphore
+        - name: SEMAPHORE_SSH_PATH
+        - name: SEMAPHORE_MAX_PARALLEL_TASKS
+          value: '0'
+        - name: SEMAPHORE_PASSWORD_LOGIN_DISABLED
+          value: 'false'
+        - name: SEMAPHORE_NON_ADMIN_CAN_CREATE_PROJECT
+          value: 'false'
+        - name: SEMAPHORE_USE_REMOTE_RUNNER
+          value: 'false'
+        - name: SEMAPHORE_DB_DIALECT
+          value: bolt
+        - name: SEMAPHORE_DB_HOST
+          value: /var/lib/semaphore/database.boltdb
+        - name: SEMAPHORE_LDAP_ENABLE
+          value: 'false'
+        - name: SEMAPHORE_EMAIL_ALERT
+          value: 'false'
+        - name: SEMAPHORE_TELEGRAM_ALERT
+          value: 'false'
+        - name: SEMAPHORE_SLACK_ALERT
+          value: 'false'
+        - name: SEMAPHORE_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: semaphore-runner
+        - name: SEMAPHORE_COOKIE_HASH
+          valueFrom:
+            secretKeyRef:
+              key: cookieHash
+              name: semaphore-general
+        - name: SEMAPHORE_COOKIE_ENCRYPTION
+          valueFrom:
+            secretKeyRef:
+              key: cookieEncryption
+              name: semaphore-general
+        - name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
+          valueFrom:
+            secretKeyRef:
+              key: accesskeyEncryption
+              name: semaphore-general
+        image: semaphoreui/semaphore:v2.17.34
+        imagePullPolicy: IfNotPresent
+        name: admin
+        resources:
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/semaphore/config.json
+          name: config
+          subPath: config.json
+        - mountPath: /tmp/semaphore
+          name: workdir
+        - mountPath: /var/lib/semaphore
+          name: boltdb
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        fsGroup: 1001
+      serviceAccount: semaphore
+      serviceAccountName: semaphore
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: semaphore-config
+        name: config
+      - name: workdir
+        persistentVolumeClaim:
+          claimName: semaphore-workdir
+      - name: boltdb
+        persistentVolumeClaim:
+          claimName: semaphore-boltdb
+---
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    meta.helm.sh/release-name: semaphore
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/instance: semaphore
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: semaphore
+    app.kubernetes.io/version: 2.17.34
+    helm.sh/chart: semaphore-16.1.2
+  name: semaphore
+  namespace: infrastructure
+spec:
+  clusterIP: 10.43.119.206
+  clusterIPs:
+  - 10.43.119.206
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+  - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+  - name: http
+    port: 3000
+    protocol: TCP
+    targetPort: http
+  selector:
+    app.kubernetes.io/instance: semaphore
+    app.kubernetes.io/name: semaphore
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+data:
+  config.json: '{
+
+    }
+
+    '
+kind: ConfigMap
+metadata:
+  annotations:
+    meta.helm.sh/release-name: semaphore
+    meta.helm.sh/release-namespace: infrastructure
+  labels:
+    app.kubernetes.io/instance: semaphore
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: semaphore
+    app.kubernetes.io/version: 2.17.34
+    helm.sh/chart: semaphore-16.1.2
+  name: semaphore-config
+  namespace: infrastructure