gitops: observability stack (Loki/Promtail/Grafana), Grafana Ingress, Argo multi-source

- Add gitops/observability umbrella chart with vendored Helm deps
- Grafana Ingress: Traefik, letsencrypt-prod, grafana.k8s.selair.it + root_url
- Argo Application: spec.sources (onelab + onelab-obs)
- OneLab: configuration secret override, compliance/LDAP values, logs.path /logs
- Docs: OBSERVABILITY, BOOTSTRAP, README, instance-overrides example

Made-with: Cursor

gitops/charts/onelab/templates/_helpers.tpl

@@ -31,3 +31,7 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- $entry := dict "username" $user "password" $pass "auth" $auth -}}
 {{- dict "auths" (dict $server $entry) | toJson -}}
 {{- end }}
+
+{{- define "onelab.configurationSecretName" -}}
+{{- .Values.configuration.existingSecretName | default "onelab-configurations" }}
+{{- end }}

gitops/charts/onelab/templates/deployment-optional-workers.yaml

@@ -1,5 +1,5 @@
 {{- $root := . }}
-{{- if .Values.features.ldapWorker }}
+{{- if or .Values.onelab.ldap.enabled .Values.features.ldapWorker }}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -43,7 +43,7 @@ spec:
       volumes:
         - name: configurations
           secret:
-            secretName: onelab-configurations
+            secretName: {{ include "onelab.configurationSecretName" $root }}
         {{- if eq $root.Values.persistence.mode "hostPath" }}
         - name: logs
           hostPath:
@@ -98,7 +98,7 @@ spec:
       volumes:
         - name: configurations
           secret:
-            secretName: onelab-configurations
+            secretName: {{ include "onelab.configurationSecretName" $root }}
         {{- if eq $root.Values.persistence.mode "hostPath" }}
         - name: logs
           hostPath:

gitops/charts/onelab/templates/secret-configurations.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.configuration.existingSecretName }}
 {{- $cfg := fromYaml (.Files.AsConfig) }}
 apiVersion: v1
 kind: Secret
@@ -11,3 +12,4 @@ type: Opaque
 stringData:
   configurations.yml: |
 {{- tpl (index $cfg "configurations.gotmpl") . | nindent 4 }}
+{{- end }}

gitops/charts/onelab/templates/workloads.yaml

@@ -76,7 +76,7 @@ spec:
         {{- if .config }}
         - name: configurations
           secret:
-            secretName: onelab-configurations
+            secretName: {{ include "onelab.configurationSecretName" $root }}
         {{- end }}
         {{- if eq $root.Values.persistence.mode "hostPath" }}
         {{- if has "logs" .mounts }}