GitOps

A drift audit found merged fixes for Traefik, Velero, and monitoring that never took effect while ArgoCD showed Synced. How the gap opens and how to check for it.

Renovate's CronJob failed silently, then OOM'd at every limit up to 4Gi. The cause: hashing 14 platform builds of a Terraform provider, 16 downloads at a time.

A documented contract for what Renovate auto-merges, what gets a PR, what alerts in Discord, what self-heals, and what stays manual. The operating model that lets a homelab run untouched for weeks.

Every firewall rule, VLAN, DHCP lease and NAT rule on my MikroTik RB5009 lives in Terraform and ships via Atlantis PRs. The full flow from PR to RouterOS.

Atlantis was running inside k3s, managing the same Proxmox VMs it ran on. When bpg/proxmox issued a qmshutdown for a non-live-update attribute, it killed the Atlantis pod that was executing the apply. The structural hazard and the fix.

Vault is the trust root every ExternalSecret reads from, and its namespace had zero NetworkPolicies. The fix also exposed a class of ArgoCD drift that ignores merged changes.

A gitleaks baseline file is supposed to suppress known-false-positive findings. It turned out to be suppressing the live rpc_secret and admin_token for a production Garage S3 cluster, unrotated since the commit that put them in a public repo weeks earlier.

kubectl apply succeeds, the field reverts within seconds, and there's no error anywhere. Two ArgoCD debugging patterns that hit the same homelab three times in one day: repo-server cache staleness reverting live edits, and two Applications silently fighting over the same resource.

How I manage an entire k3s homelab (MetalLB, Traefik, Longhorn, Authelia, and more) as a single Git repository using ArgoCD's App-of-Apps pattern.