feat!: Move networking apps into kube-system namespace

Signed-off-by: Devin Buhl <devin@buhl.casa>

cluster/apps/default/kustomization.yaml

@@ -5,4 +5,3 @@ resources:
   - namespace.yaml
   - echo-server
   - hajimari
-  - reloader

cluster/apps/flux-system/kustomization.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml

cluster/apps/flux-system/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: flux-system
-  labels:
-    kustomize.toolkit.fluxcd.io/prune: disabled

cluster/apps/kube-system/cert-manager/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: cert-manager
-  namespace: networking
+  namespace: kube-system
 spec:
   interval: 15m
   chart:

cluster/apps/kube-system/cert-manager/issuers/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: cert-manager-issuers
-  namespace: networking
+  namespace: kube-system
 spec:
   interval: 15m
   chart:
@@ -23,7 +23,7 @@ spec:
       retries: 5
   dependsOn:
     - name: cert-manager
-      namespace: networking
+      namespace: kube-system
   values:
     resources:
       - apiVersion: cert-manager.io/v1

cluster/apps/kube-system/cloudflare-ddns/cron-job.yaml

@@ -3,7 +3,7 @@ apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: &app cloudflare-ddns
-  namespace: default
+  namespace: kube-system
 spec:
   schedule: "@hourly"
   concurrencyPolicy: Forbid

cluster/apps/kube-system/cloudflare-ddns/kustomization.yaml

@@ -4,7 +4,7 @@ kind: Kustomization
 resources:
   - cron-job.yaml
   - secret.sops.yaml
-namespace: networking
+namespace: kube-system
 configMapGenerator:
   - name: cloudflare-ddns
     files:

cluster/apps/kube-system/external-dns/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: external-dns
-  namespace: networking
+  namespace: kube-system
 spec:
   interval: 15m
   chart:

cluster/apps/kube-system/ingress-nginx/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: ingress-nginx
-  namespace: networking
+  namespace: kube-system
 spec:
   interval: 15m
   chart:
@@ -24,9 +24,9 @@ spec:
       retries: 5
   dependsOn:
     - name: cert-manager
-      namespace: networking
+      namespace: kube-system
     - name: cert-manager-issuers
-      namespace: networking
+      namespace: kube-system
   values:
     controller:
       replicaCount: 1

cluster/apps/kube-system/ingress-nginx/kustomization.yaml

@@ -1,7 +1,7 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: networking
+namespace: kube-system
 resources:
   - helm-release.yaml
 configMapGenerator:

cluster/apps/kube-system/k8s-gateway/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: k8s-gateway
-  namespace: networking
+  namespace: kube-system
 spec:
   interval: 15m
   chart:
@@ -24,7 +24,7 @@ spec:
       retries: 5
   dependsOn:
     - name: metallb
-      namespace: networking
+      namespace: kube-system
   values:
     fullnameOverride: k8s-gateway
     domain: ${SECRET_DOMAIN}

cluster/apps/kube-system/kustomization.yaml

@@ -2,5 +2,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
-  - metrics-server
+  - ./namespace.yaml
+  - ./cert-manager
+  - ./cloudflare-ddns
+  - ./external-dns
+  - ./ingress-nginx
+  - ./k8s-gateway
+  - ./metallb
+  - ./metrics-server
+  - ./reloader

cluster/apps/kube-system/metallb/config/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: metallb-config
-  namespace: networking
+  namespace: kube-system
 spec:
   interval: 15m
   chart:
@@ -23,14 +23,14 @@ spec:
       retries: 5
   dependsOn:
     - name: metallb
-      namespace: networking
+      namespace: kube-system
   values:
     resources:
       - apiVersion: metallb.io/v1beta1
         kind: L2Advertisement
         metadata:
           name: l2-ip
-          namespace: networking
+          namespace: kube-system
         spec:
           ipAddressPools:
             - default-pool
@@ -39,7 +39,7 @@ spec:
         kind: IPAddressPool
         metadata:
           name: default-pool
-          namespace: networking
+          namespace: kube-system
         spec:
           addresses:
             - "${METALLB_LB_RANGE}"

cluster/apps/kube-system/metallb/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: metallb
-  namespace: networking
+  namespace: kube-system
 spec:
   interval: 15m
   chart:

cluster/apps/kustomization.yaml

@@ -3,7 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - default
-  - flux-system
   - kube-system
-  - networking
   # - system-upgrade

cluster/apps/networking/kustomization.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - cloudflare-ddns
-  - external-dns
-  - ingress-nginx
-  - metallb
-  - k8s-gateway
-  - cert-manager

cluster/apps/networking/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: networking
-  labels:
-    kustomize.toolkit.fluxcd.io/prune: disabled

configure

@@ -53,16 +53,16 @@ main() {
         envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \
             > "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml"
         envsubst < "${PROJECT_DIR}/tmpl/cluster/cert-manager-secret.sops.yaml" \
-            > "${PROJECT_DIR}/cluster/apps/networking/cert-manager/issuers/secret.sops.yaml"
+            > "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml"
         envsubst < "${PROJECT_DIR}/tmpl/cluster/cloudflare-ddns-secret.sops.yaml" \
-            > "${PROJECT_DIR}/cluster/apps/networking/cloudflare-ddns/secret.sops.yaml"
+            > "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml"
         envsubst < "${PROJECT_DIR}/tmpl/cluster/external-dns-secret.sops.yaml" \
-            > "${PROJECT_DIR}/cluster/apps/networking/external-dns/secret.sops.yaml"
+            > "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml"
         # encrypt cluster secrets
         sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml"
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/networking/cert-manager/issuers/secret.sops.yaml"
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/networking/cloudflare-ddns/secret.sops.yaml"
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/networking/external-dns/secret.sops.yaml"
+        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml"
+        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml"
+        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml"
         # generate terraform secrets
         envsubst < "${PROJECT_DIR}/tmpl/terraform/secret.sops.yaml" \
             > "${PROJECT_DIR}/provision/terraform/cloudflare/secret.sops.yaml"