onelab-k8s-1.27/gitops/values/README.md

GitOps values (operator entry point)

All environment-specific Helm input for the Argo CD Application should live here (plus repoURL / targetRevision in ../argocd/application.yaml).

Files

File	Purpose
env-example.yaml	Tracked example for OneLab chart: ingress, persistence, registry pull secret wiring, placeholder secrets. Fork and edit hostnames/TLS names, then replace placeholders or overlay secrets.local.yaml.
observability.yaml	Loki / Promtail / Grafana: retention, Promtail host paths, Grafana ingress host, placeholder admin password. Edit hosts/TLS together with grafana.ini.server.
secrets.example.yaml	Template of secret-shaped keys only — copy to *.local.yaml (gitignored) and reference from Argo.
instance-overrides.example.yaml	Optional features (compliance, LDAP) — merge or add as another value file.

Argo helm.valueFiles (path rules)

Paths are relative to each source’s path in the Application:

• Source gitops/charts/onelab → e.g. ../../values/env-example.yaml, then optionally ../../values/secrets.local.yaml.
• Source gitops/observability → e.g. ../../values/observability.yaml, then optionally ../../values/observability.local.yaml.

Later files in the list override earlier ones.

Private secrets without committing them

1. Copy secrets.example.yaml to secrets.local.yaml (ignored by *.local.yaml at repo root).
2. Fill in real registry password, Postgres password, app tokens, Intercom, etc.
3. Add - ../../values/secrets.local.yaml under the onelab source’s helm.valueFiles in your local Application manifest or a private overlay — or keep that change only on a private branch.

For Grafana, set grafana.adminPassword in a gitignored file merged with observability.yaml, or edit observability.yaml in a private fork.

See the full bootstrap narrative in ../README.md.