The myorg-assistant Deployment's Settings() requires WEB_SECRET_KEY (and the
GIT_* set for git-sync/deadline-checker). The cronjobs only carried a subset,
so every run crashed at import with:
pydantic_core._pydantic_core.ValidationError: 1 validation error for Settings
web_secret_key [type=missing]
myorg-git-sync was crash-looping (4.19 restarts/15m, pod 29731995-wbdnx).
deadline-checker/evening-summary/morning-briefing/waiting-followup were also
missing the full env set (git-sync already had GIT_*, but lacked WEB_SECRET_KEY;
the others lacked both GIT_* and WEB_SECRET_KEY).
Mirror the Deployment's full required env (GIT_REPO_URL/USERNAME/TOKEN/BRANCH
from secret/configmap, WEB_SECRET_KEY from secret) into every cronjob so
import-time Settings() validation passes for all. Supersedes the incomplete
PRs #19/#20/#21 (which added only WEB_SECRET_KEY and left the GIT_* gap).
Roger: merge -> ArgoCD self-heals, loop stops.
CronJob pods were stuck in ImagePullBackOff because they referenced
the local-only image 'myorg-assistant:latest' which is not present
on the node. Switch all 5 cronjobs to the Gitea registry image
git.rogi.casa/roger/myorg-assistant/myorg-assistant:fcf79bf
(matching the Deployment), set imagePullPolicy: Always, and add
imagePullSecrets: gitea-registry so they can authenticate to the
private registry.
The k3s-cluster-root app-of-apps has been in a continuous Synced<->OutOfSync
oscillation (489 transitions in 24h). Each cycle, ArgoCD syncs the 'argocd'
Application CRD, succeeds, then immediately detects drift because ArgoCD
adds status/operation fields to Application resources at runtime.
Adding ignoreDifferences for /status and /operation on Application resources
stops the drift loop while keeping the app-of-apps functional.
Survey of dashboards that could be built from existing and not-yet-enabled
metrics across the cluster's services (traefik, coredns, metallb, cert-manager,
phoenix, litellm, gitea, postgres, etc.), with per-service enable steps and
a recommended priority order.
Minecraft Java Edition uses raw TCP on port 25565, not HTTP. The previous
ClusterIP Service + HTTP Ingress (Traefik 80/443) could not carry TCP 25565
traffic, so minecraft.rogi.casa:25565 was unreachable.
- Change Service to LoadBalancer with fixed IP 10.88.20.103 (dmz-pool),
matching the pihole-dns pattern, so port 25565 is exposed directly.
- Remove the dead HTTP ingress (it routed HTTP to a TCP game port).
HA runs with hostNetwork on roger-nucbox-evo-x2 while Traefik runs on the
raspberrypi node, so requests arrive at HA from 10.88.20.11. The previous
trusted_proxies entry (10.88.88.0/24) did not include this address, causing
HA to reject X-Forwarded-For and return 400 on every ingress request.
The ServiceMonitor CRD (monitoring.coreos.com) is not installed because this
cluster runs a standalone Prometheus deployment, not the Prometheus Operator.
The manifest itself noted 'only apply if Prometheus Operator is installed'.
Removing it unblocks the phoenix app sync.
