fix(argocd): multisource patch doc, Ingress grafana-onelab

- Root cause: live Application kept spec.source; Argo ignored observability chart
- Add jsonpatch-multisource.json + argocd/README.md migration steps
- Grafana: disable subchart ingress; add templates/ingress-grafana-onelab.yaml

Made-with: Cursor

gitops/observability/templates/ingress-grafana-onelab.yaml

@@ -0,0 +1,36 @@
+{{- if .Values.grafanaOnelabIngress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grafana-onelab
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grafana-onelab
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: observability
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+    cert-manager.io/cluster-issuer: {{ .Values.grafanaOnelabIngress.clusterIssuer | quote }}
+    {{- with .Values.grafanaOnelabIngress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.grafanaOnelabIngress.className | quote }}
+  {{- if .Values.grafanaOnelabIngress.tls }}
+  tls:
+    - hosts:
+        - {{ .Values.grafanaOnelabIngress.host | quote }}
+      secretName: {{ .Values.grafanaOnelabIngress.tlsSecretName | quote }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.grafanaOnelabIngress.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ printf "%s-grafana" .Release.Name }}
+                port:
+                  number: {{ .Values.grafanaOnelabIngress.servicePort }}
+{{- end }}

gitops/observability/values.yaml

@@ -87,7 +87,17 @@ promtail:
       mountPath: /onelab-host-logs
       readOnly: true
 
-# Grafana Ingress: align host/TLS with gitops/values/k3s-example.yaml ingress (Traefik + cert-manager).
+# Named Ingress grafana-onelab (templates/ingress-grafana-onelab.yaml). Grafana subchart ingress is disabled.
+grafanaOnelabIngress:
+  enabled: true
+  className: traefik
+  host: grafana.k8s.selair.it
+  tls: true
+  tlsSecretName: grafana-tls-k8s-selair
+  clusterIssuer: letsencrypt-prod
+  servicePort: 80
+  annotations: {}
+
 grafana:
   adminUser: admin
   adminPassword: changeme
@@ -102,18 +112,7 @@ grafana:
       domain: grafana.k8s.selair.it
       root_url: https://grafana.k8s.selair.it/
   ingress:
-    enabled: true
-    ingressClassName: traefik
-    annotations:
-      cert-manager.io/cluster-issuer: letsencrypt-prod
-    hosts:
-      - grafana.k8s.selair.it
-    path: /
-    pathType: Prefix
-    tls:
-      - secretName: grafana-tls-k8s-selair
-        hosts:
-          - grafana.k8s.selair.it
+    enabled: false
   datasources:
     datasources.yaml:
       apiVersion: 1