feat!: Refector directories and flux apps (#559)

.config.sample.env

@@ -6,11 +6,15 @@
 # e.g. https://github.com/onedr0p/home-cluster
 export BOOTSTRAP_GIT_REPOSITORY=""
 
-# Optional: Enable GitHub to send a webhook to update Flux, set the following to one of:
+# To enable Flux to update your cluster on `git push` set the following to one of:
-# ignored - this feature will be disabled
+# `generated` - this will generate a token and print it in the logs
-# generated - this will generate a token and print it in the logs
 # Set this to any other string and it will be used for the secret
-export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="ignored"
+export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="generated"
+
+# The Weave GitOps dashboard admin password
+# `generated` - this will generate a token and print it in the logs
+# Set this to any other string and it will be used for the secret
+export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="generated"
 
 # Choose one of your cloudflare domains
 # e.g. onedr0p.com
@@ -44,8 +48,6 @@ export BOOTSTRAP_AGE_PUBLIC_KEY=""
 export BOOTSTRAP_KUBE_VIP_ADDR=""
 
 # Choose your timezone
-# Used to set your systems timezone
-# and Kured timezone
 # e.g. America/New_York
 export BOOTSTRAP_TIMEZONE="Etc/UTC"
 

.editorconfig

@@ -16,6 +16,3 @@ indent_size = 4
 [*.{bash,sh}]
 indent_style = space
 indent_size = 4
-
-[*.{yaml,yml}]
-indent_size = 2

.envrc

@@ -1,5 +1,5 @@
 #shellcheck disable=SC2148,SC2155
-export KUBECONFIG=$(expand_path ./provision/kubeconfig)
+export KUBECONFIG=$(expand_path ./kubeconfig)
 export ANSIBLE_CONFIG=$(expand_path ./ansible.cfg)
 export ANSIBLE_HOST_KEY_CHECKING="False"
 export SOPS_AGE_KEY_FILE=$(expand_path ~/.config/sops/age/keys.txt)

.gitattributes

@@ -1 +1,3 @@
+* text=auto eol=lf
 *.sops.* diff=sopsdiffer
+*.sops.toml linguist-language=JSON

.github/CODEOWNERS

@@ -1,2 +0,0 @@
-# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
-* @onedr0p

.github/ISSUE_TEMPLATE/bug-report.md

@@ -1,12 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: kind/bug
-assignees: ''
-
----
-
-# Details
-
-<!-- Note: This should be a clear and concise description of what the bug is. -->

.github/ISSUE_TEMPLATE/config.yml

@@ -1,6 +0,0 @@
----
-blank_issues_enabled: false
-contact_links:
-  - name: Discuss on Discord
-    url: https://discord.gg/k8s-at-home
-    about: Join our Discord community

.github/ISSUE_TEMPLATE/feature-request.md

@@ -1,12 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: kind/enhancement
-assignees: ''
-
----
-
-# Details
-
-<!-- Note: A clear and concise description of what you want to happen. -->

.github/ISSUE_TEMPLATE/question.md

@@ -1,12 +0,0 @@
----
-name: Question
-about: Ask a question to the maintainer
-title: ''
-labels: kind/question
-assignees: ''
-
----
-
-# Details
-
-<!-- Note: A clear and concise query of what you want to ask. -->

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,20 +0,0 @@
-**Description of the change**
-
-<!-- Describe the scope of your change - i.e. what the change does. -->
-
-**Benefits**
-
-<!-- What benefits will be realized by the code change? -->
-
-**Possible drawbacks**
-
-<!-- Describe any known limitations with your change -->
-
-**Applicable issues**
-
-<!-- Enter any applicable Issues here (You can reference an issue using #) -->
-- fixes #
-
-**Additional information**
-
-<!-- If there's anything else that's important and relevant to your pull request, mention that information here.-->

.github/linters/.ansible-lint

@@ -1,3 +0,0 @@
-# .ansible-lint
-warn_list:
-  - unnamed-task

.github/linters/.markdownlint.yaml

@@ -1,23 +0,0 @@
----
-default: true
-
-# MD013/line-length - Line length
-MD013:
-  # Number of characters
-  line_length: 240
-  # Number of characters for headings
-  heading_line_length: 80
-  # Number of characters for code blocks
-  code_block_line_length: 80
-  # Include code blocks
-  code_blocks: true
-  # Include tables
-  tables: true
-  # Include headings
-  headings: true
-  # Include headings
-  headers: true
-  # Strict length checking
-  strict: false
-  # Stern length checking
-  stern: false

.github/linters/.prettierignore

@@ -1,2 +0,0 @@
-*.sops.*
-gotk-components.yaml

.github/linters/.prettierrc.yaml

@@ -1,5 +0,0 @@
----
-trailingComma: "es5"
-tabWidth: 2
-semi: false
-singleQuote: false

.github/renovate.json5

@@ -10,34 +10,20 @@
     "enabled": true
   },
   "flux": {
-    "fileMatch": ["cluster/.+\\.ya?ml$"]
+    "fileMatch": ["kubernetes/.+\\.ya?ml$"]
   },
   "helm-values": {
-    "fileMatch": ["cluster/.+\\.ya?ml$"]
+    "fileMatch": ["kubernetes/.+\\.ya?ml$"]
   },
   "kubernetes": {
-    "fileMatch": [
+    "fileMatch": ["kubernetes/.+\\.ya?ml$"]
-      "cluster/.+\\.ya?ml$",
-      "provision/ansible/.+\\.ya?ml.j2$"
-    ]
   },
   "regexManagers": [
-    {
-      "description": "Process CRD dependencies",
-      "fileMatch": ["cluster/crds/.+\\.ya?ml$"],
-      "matchStrings": [
-        // GitRepository and Flux Kustomization where 'Git release/tag' matches 'Helm' version
-        "registryUrl=(?<registryUrl>\\S+) chart=(?<depName>\\S+)\n.*?(?<currentValue>[^-\\s]*)\n",
-        // Kustomization where 'GitHub release artifact URL' matches 'Docker image' version
-        "datasource=(?<datasource>\\S+) image=(?<depName>\\S+)\n.*?-\\s(.*?)\/(?<currentValue>[^/]+)\/[^/]+\n"
-      ],
-      "datasourceTemplate": "{{#if datasource}}{{{datasource}}}{{else}}helm{{/if}}"
-    },
     {
       "description": "Process various other dependencies",
       "fileMatch": [
-        "provision/ansible/.+\\.ya?ml$",
+        "ansible/.+\\.ya?ml$",
-        "cluster/.+\\.ya?ml$"
+        "kubernetes/.+\\.ya?ml$"
       ],
       "matchStrings": [
         "datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)( versioning=(?<versioning>\\S+))?\n.*?\"(?<currentValue>.*)\"\n"
@@ -47,12 +33,6 @@
     }
   ],
   "packageRules": [
-    {
-      "description": "Disable kubernetes-api",
-      "matchManagers": ["kubernetes"],
-      "matchDatasources": ["kubernetes-api"],
-      "enabled": false
-    },
     // setup datasources
     {
       "matchDatasources": ["helm"],
@@ -67,14 +47,6 @@
       "commitMessageExtra": "to {{#if isSingleVersion}}v{{{newVersion}}}{{else}}{{{newValue}}}{{/if}}",
       "matchUpdateTypes": ["major", "minor", "patch"]
     },
-    {
-      "description": "Group Cert-Manager image (for CRDs) and chart",
-      "groupName": "Cert-Manager",
-      "matchPackagePatterns": ["cert-manager"],
-      "matchDatasources": ["docker", "helm"],
-      "group": { "commitMessageTopic": "{{{groupName}}} group" },
-      "separateMinorPatch": true
-    },
     // add labels according to package and update types
     {
       "matchDatasources": ["docker"],

.github/workflows/lint.yaml

@@ -1,61 +0,0 @@
----
-name: Lint
-
-on: # yamllint disable-line rule:truthy
-  workflow_dispatch:
-  pull_request:
-    branches:
-      - main
-
-concurrency:
-  group: ${{ github.ref }}-${{ github.workflow }}
-  cancel-in-progress: true
-
-env:
-  # Currently no way to detect automatically
-  DEFAULT_BRANCH: main
-
-jobs:
-  build:
-    name: MegaLinter
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: MegaLinter
-        uses: oxsecurity/megalinter@v6.15.0
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          VALIDATE_ALL_CODEBASE: ${{ github.event_name == 'workflow_dispatch' }}
-          ENABLE_LINTERS: |-
-            ${{
-              join(
-                fromJSON('
-                  [
-                    "ACTION_ACTIONLINT",
-                    "ANSIBLE_ANSIBLE_LINT",
-                    "COPYPASTE_JSCPD",
-                    "KUBERNETES_KUBEVAL",
-                    "MARKDOWN_MARKDOWNLINT",
-                    "REPOSITORY_GIT_DIFF",
-                    "REPOSITORY_SECRETLINT",
-                    "TERRAFORM_TERRAFORM_FMT",
-                    "YAML_PRETTIER",
-                    "YAML_YAMLLINT"
-                  ]
-                '),
-                ','
-              )
-            }}
-          ANSIBLE_DIRECTORY: provision/ansible
-          ANSIBLE_ANSIBLE_LINT_CONFIG_FILE: .github/linters/.ansible-lint
-          KUBERNETES_DIRECTORY: cluster
-          KUBERNETES_KUBEVAL_ARGUMENTS: --ignore-missing-schemas
-          MARKDOWN_MARKDOWNLINT_CONFIG_FILE: .github/linters/.markdownlint.yaml
-          MARKDOWN_MARKDOWNLINT_RULES_PATH: .github/
-          YAML_YAMLLINT_CONFIG_FILE: .github/linters/.yamllint.yaml
-          YAML_PRETTIER_CONFIG_FILE: .github/linters/.prettierrc.yaml
-          YAML_PRETTIER_FILTER_REGEX_EXCLUDE: "(.*\\.sops\\.ya?ml)"

.gitignore

@@ -9,11 +9,9 @@ kubeconfig
 *.agekey
 *.pub
 *.key
-github-deploy-key*
 # Ansible
 xanmanning.k3s*
 # Terraform
 .terraform
 .terraform.tfstate*
 terraform.tfstate*
-megalinter-reports

.pre-commit-config.yaml

@@ -6,37 +6,9 @@ repos:
     hooks:
       - args:
           - --config-file
-          - .github/linters/.yamllint.yaml
+          - .yamllint.yaml
         id: yamllint
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
-    hooks:
-      - id: check-merge-conflict
-      - id: end-of-file-fixer
-      - id: mixed-line-ending
-      - id: trailing-whitespace
-        args: [--markdown-linebreak-ext=md]
-  - repo: https://github.com/Lucas-C/pre-commit-hooks
-    rev: v1.3.1
-    hooks:
-      - id: remove-crlf
-      - id: remove-tabs
-  - repo: https://github.com/sirosen/texthooks
-    rev: 0.4.0
-    hooks:
-      - id: fix-smartquotes
-  - repo: https://github.com/onedr0p/sops-pre-commit
-    rev: v2.1.1
-    hooks:
-      - id: forbid-secrets
-        exclude: |
-          (?x)^(
-            cluster\/apps\/kube-system\/kube-vip\/rbac.yaml|
-            tmpl\/.*.sops\.ya?ml
-            )$
   - repo: https://github.com/gruntwork-io/pre-commit
     rev: v0.1.17
     hooks:
       - id: terraform-fmt
-      - id: terraform-validate
-      - id: tflint

.secretlintignore

@@ -1,3 +0,0 @@
-megalinter-reports
-tmpl
-README.md

.sourceignore

@@ -1,17 +0,0 @@
-# See https://toolkit.fluxcd.io/components/source/gitrepositories/#excluding-files
-.github/
-.taskfiles/
-.vscode/
-provision/
-tmpl/
-.config.sample.env
-.envrc
-.gitattributes
-.gitignore
-.pre-commit-config.yaml
-.sops.yaml
-ansible.cfg
-configure
-LICENSE
-README.md
-Taskfile.yml

.taskfiles/AnsibleTasks.yml

@@ -12,32 +12,32 @@ tasks:
 
   init:
     desc: Install / Upgrade Ansible galaxy deps
-    dir: provision/ansible
+    dir: "{{.ANSIBLE_DIR}}"
     cmds:
       - ansible-galaxy install -r requirements.yml --roles-path ~/.ansible/roles --force
       - ansible-galaxy collection install -r requirements.yml --collections-path ~/.ansible/collections --force
 
   list:
     desc: List all the hosts
-    dir: provision/ansible
+    dir: "{{.ANSIBLE_DIR}}"
     cmds:
       - ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --list-hosts
 
   prepare:
     desc: Prepare all the k8s nodes for running k3s
-    dir: provision/ansible
+    dir: "{{.ANSIBLE_DIR}}"
     cmds:
       - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-prepare.yml
 
   install:
     desc: Install Kubernetes on the nodes
-    dir: provision/ansible
+    dir: "{{.ANSIBLE_DIR}}"
     cmds:
       - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-installation.yml
 
   nuke:
     desc: Uninstall Kubernetes on the nodes
-    dir: provision/ansible
+    dir: "{{.ANSIBLE_DIR}}"
     interactive: true
     cmds:
       - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-nuke.yml
@@ -45,24 +45,24 @@ tasks:
 
   ping:
     desc: Ping all the hosts
-    dir: provision/ansible
+    dir: "{{.ANSIBLE_DIR}}"
     cmds:
       - ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --one-line -m 'ping'
 
   uptime:
     desc: Uptime of all the hosts
-    dir: provision/ansible
+    dir: "{{.ANSIBLE_DIR}}"
     cmds:
       - ansible all -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml --one-line -a 'uptime'
 
   reboot:
     desc: Reboot all the k8s nodes
-    dir: provision/ansible
+    dir: "{{.ANSIBLE_DIR}}"
     cmds:
       - ansible-playbook -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml {{.ANSIBLE_PLAYBOOK_DIR}}/cluster-reboot.yml
 
   poweroff:
     desc: Shutdown all the k8s nodes
-    dir: provision/ansible
+    dir: "{{.ANSIBLE_DIR}}"
     cmds:
       - ansible kubernetes -i {{.ANSIBLE_INVENTORY_DIR}}/hosts.yml -a '/usr/bin/systemctl poweroff' --become

.taskfiles/ClusterTasks.yml

@@ -11,11 +11,11 @@ tasks:
   install:
     desc: Install Flux into your cluster
     cmds:
-      - kubectl apply --kustomize {{.CLUSTER_DIR}}/bootstrap/
+      - kubectl apply --kustomize {{.KUBERNETES_DIR}}/bootstrap
       - cat {{.SOPS_AGE_KEY_FILE}} | kubectl -n flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin
-      - sops --decrypt {{.CLUSTER_DIR}}/flux/vars/cluster-secrets.sops.yaml | kubectl apply -f -
+      - sops --decrypt {{.KUBERNETES_DIR}}/flux/vars/cluster-secrets.sops.yaml | kubectl apply -f -
-      - kubectl apply -f {{.CLUSTER_DIR}}/flux/vars/cluster-settings.yaml
+      - kubectl apply -f {{.KUBERNETES_DIR}}/flux/vars/cluster-settings.yaml
-      - kubectl apply --kustomize {{.CLUSTER_DIR}}/flux/config
+      - kubectl apply --kustomize {{.KUBERNETES_DIR}}/flux/config
       - task: reconcile
     preconditions:
       - sh: test -f {{.SOPS_AGE_KEY_FILE}}
@@ -27,8 +27,8 @@ tasks:
   reconcile:
     desc: Force update Flux to pull in changes from your Git repository
     cmds:
-      - flux reconcile -n flux-system source git flux-cluster
+      - flux reconcile -n flux-system source git home-kubernetes
-      - flux reconcile -n flux-system kustomization flux-cluster
+      - flux reconcile -n flux-system kustomization cluster
 
   hr-restart:
     desc: Restart all failed Helm Releases

.taskfiles/SopsTasks.yml

@@ -3,12 +3,12 @@ version: "3"
 
 tasks:
 
-  encrypt:
+  e:
-    desc: encrypt sops file 'to use must include -- before path to file.' eg "task sops:encrypt -- file.yml"
+    desc: Encrypt sops file 'to use must include -- before path to file.' eg "task sops:e -- file.yaml"
     cmds:
       - sops --encrypt --in-place {{.CLI_ARGS}}
 
-  decrypt:
+  d:
-    desc: decrypt sops file 'to use must include -- before path to file.'  eg "task sops:decrypt -- file.yml"
+    desc: Decrypt sops file 'to use must include -- before path to file.'  eg "task sops:d -- file.yaml"
     cmds:
       - sops --decrypt --in-place {{.CLI_ARGS}}

.taskfiles/TerraformTasks.yml

@@ -5,18 +5,18 @@ tasks:
 
   init:
     desc: Initialize terraform dependencies
-    dir: provision/terraform/cloudflare
+    dir: "{{.TERRAFORM_DIR}}/cloudflare"
     cmds:
       - terraform init {{.CLI_ARGS}}
 
   plan:
     desc: Show the changes terraform will make
-    dir: provision/terraform/cloudflare
+    dir: "{{.TERRAFORM_DIR}}/cloudflare"
     cmds:
       - terraform plan {{.CLI_ARGS}}
 
   apply:
     desc: Apply the changes to Cloudflare
-    dir: provision/terraform/cloudflare
+    dir: "{{.TERRAFORM_DIR}}/cloudflare"
     cmds:
       - terraform apply {{.CLI_ARGS}}

.vscode/extensions.json

@@ -1,13 +1,17 @@
 {
     "recommendations": [
-        "HashiCorp.terraform",
+        "albert.TabOut",
         "britesnow.vscode-toggle-quotes",
+        "fcrespo82.markdown-table-formatter",
         "mitchdenny.ecdc",
         "ms-kubernetes-tools.vscode-kubernetes-tools",
-        "oderwat.indent-rainbow",
         "redhat.ansible",
         "signageos.signageos-vscode-sops",
         "usernamehw.errorlens",
-        "fcrespo82.markdown-table-formatter"
+        "will-stone.in-any-case",
+        "BriteSnow.vscode-toggle-quotes",
+        "HashiCorp.terraform",
+        "PKief.material-icon-theme",
+        "Weaveworks.vscode-gitops-tools"
     ]
 }

.vscode/settings.json

@@ -1,18 +1,20 @@
 {
-    "ansible.ansibleLint.arguments": "-c .github/linters/.ansible-lint",
     "files.associations": {
         "*.json5": "jsonc",
-        "**/provision/ansible/**/*.yml": "ansible",
+        "**/ansible/**/*.yml": "ansible",
-        "**/provision/ansible/**/*.sops.yml": "yaml",
+        "**/ansible/**/*.sops.yml": "yaml",
-        "**/provision/ansible/**/inventory/**/*.yml": "yaml",
+        "**/ansible/**/inventory/**/*.yml": "yaml",
-        "**/provision/terraform/**/*.tf": "terraform"
+        "**/terraform/**/*.tf": "terraform",
+        "**/kubernetes/**/*.sops.toml": "plaintext"
     },
-    "prettier.configPath": ".github/linters/.prettierrc.yaml",
-    "prettier.ignorePath": ".github/linters/.prettierignore",
     "yaml.schemas": {
-        "Kubernetes": "cluster/*.yaml"
+        "ansible": "ansible/*.yml",
+        "Kubernetes": "kubernetes/*.yaml"
     },
     "editor.bracketPairColorization.enabled": true,
-    "editor.guides.bracketPairs":"active",
+    "editor.guides.bracketPairs": true,
-    "editor.hover.delay": 1500
+    "editor.guides.bracketPairsHorizontal": true,
+    "editor.guides.highlightActiveBracketPair": true,
+    "editor.hover.delay": 1500,
+    "files.trimTrailingWhitespace": true,
 }

.yamllint.yaml

@@ -1,7 +1,6 @@
 ---
 ignore: |
   *.sops.*
-  gotk-components.yaml
 extends: default
 rules:
   truthy:

README.md

@@ -102,11 +102,10 @@ It is advisable to install [pre-commit](https://pre-commit.com/) and the pre-com
 The Git repository contains the following directories under `cluster` and are ordered below by how Flux will apply them.
 
 ```sh
-📁 cluster      # k8s cluster defined as code
+📁 kubernetes      # Kubernetes cluster defined as code
-├─📁 flux       # flux, gitops operator, loaded before everything
+├─📁 bootstrap     # Flux installation
-├─📁 charts     # helm chart repos
+├─📁 flux          # Main Flux configuration of repository
-├─📁 config     # cluster config
+└─📁 apps          # Apps deployed into the cluster grouped by namespace
-└─📁 apps       # regular apps, namespaced dir tree, loaded last
 ```
 
 ## 🚀 Lets go
@@ -221,7 +220,7 @@ In order to use Terraform and `cert-manager` with the Cloudflare DNS challenge y
 
 ### ⛵ Installing k3s with Ansible
 
-📍 Here we will be running a Ansible Playbook to install [k3s](https://k3s.io/) with [this](https://galaxy.ansible.com/xanmanning/k3s) wonderful k3s Ansible galaxy role. After completion, Ansible will drop a `kubeconfig` in `./provision/kubeconfig` for use with interacting with your cluster with `kubectl`.
+📍 Here we will be running a Ansible Playbook to install [k3s](https://k3s.io/) with [this](https://galaxy.ansible.com/xanmanning/k3s) wonderful k3s Ansible galaxy role. After completion, Ansible will drop a `kubeconfig` in `./kubeconfig` for use with interacting with your cluster with `kubectl`.
 
 ☢️ If you run into problems, you can run `task ansible:nuke` to destroy the k3s cluster and start over.
 
@@ -254,7 +253,7 @@ In order to use Terraform and `cert-manager` with the Cloudflare DNS challenge y
 
 ### ☁️ Configuring Cloudflare DNS with Terraform
 
-📍 Review the Terraform scripts under `./provision/terraform/cloudflare/` and make sure you understand what it's doing (no really review it).
+📍 Review the Terraform scripts under `./terraform/cloudflare/` and make sure you understand what it's doing (no really review it).
 
 If your domain already has existing DNS records **be sure to export those DNS settings before you continue**.
 
@@ -296,7 +295,7 @@ The cluster application [external-dns](https://github.com/kubernetes-sigs/extern
 
 2. Push you changes to git
 
-    📍 **Verify** all the `*.sops.yaml` and `*.sops.yml` files under the `./cluster` and `./provision` folders are **encrypted** with SOPS
+    📍 **Verify** all the `*.sops.yaml` and `*.sops.yml` files under the `./ansible`, `./kubernetes`, and `./terraform` folders are **encrypted** with SOPS
 
     ```sh
     git add -A
@@ -418,7 +417,7 @@ Flux is pull-based by design meaning it will periodically check your git reposit
 1. Webhook URL - Your webhook receiver will be deployed on `https://flux-receiver.${BOOTSTRAP_CLOUDFLARE_DOMAIN}/hook/:hookId`. In order to find out your hook id you can run the following command:
 
     ```sh
-    kubectl -n flux-system get receiver/github-receiver --kubeconfig=./provision/kubeconfig
+    kubectl -n flux-system get receiver/github-receiver --kubeconfig=./kubeconfig
     # NAME              AGE    READY   STATUS
     # github-receiver   6h8m   True    Receiver initialized with URL: /hook/12ebd1e363c641dc3c2e430ecf3cee2b3c7a5ac9e1234506f6f5f3ce1230e123
     ```
@@ -432,7 +431,7 @@ Flux is pull-based by design meaning it will periodically check your git reposit
 2. Webhook secret - Your webhook secret can be found by decrypting the `secret.sops.yaml` using the following command:
 
     ```sh
-    sops -d ./cluster/flux/config/webhooks/github/secret.sops.yaml | yq .stringData.token
+    sops -d ./kubernetes/flux/config/webhooks/github/secret.sops.yaml | yq .stringData.token
     ```
 
     **Note:** Don't forget to update the `BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET` variable in your `.config.env` file so it matches the generated secret if applicable
@@ -467,12 +466,11 @@ The benefits of a public repository include:
 
   1. Generate new SSH key:
       ```sh
-      ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f ./cluster/github-deploy-key -q -P ""
+      ssh-keygen -t ecdsa -b 521 -C "github-deploy-key" -f ./kubernetes/bootstrap/github-deploy.key -q -P ""
       ```
   2. Paste public key in the deploy keys section of your repository settings
-  3. Create sops secret in `./cluster/bootstrap/github-deploy-key.sops.yaml` with the contents of:
+  3. Create sops secret in `./kubernetes/bootstrap/github-deploy-key.sops.yaml` with the contents of:
       ```yaml
-      # yamllint disable
       apiVersion: v1
       kind: Secret
       metadata:
@@ -492,19 +490,18 @@ The benefits of a public repository include:
       ```
   4. Encrypt secret:
       ```sh
-      sops --encrypt --in-place ./cluster/bootstrap/github-deploy-key.sops.yaml
+      sops --encrypt --in-place ./kubernetes/bootstrap/github-deploy-key.sops.yaml
       ```
   5. Apply secret to cluster:
       ```sh
-      sops --decrypt cluster/bootstrap/github-deploy-key.sops.yaml | kubectl apply -f -
+      sops --decrypt ./kubernetes/bootstrap/github-deploy-key.sops.yaml | kubectl apply -f -
       ```
-  6.  Update `cluster/flux/config/flux-cluster.yaml`:
+  6.  Update `./kubernetes/flux/config/cluster.yaml`:
       ```yaml
-      ---
       apiVersion: source.toolkit.fluxcd.io/v1beta2
       kind: GitRepository
       metadata:
-        name: flux-cluster
+        name: home-kubernetes
         namespace: flux-system
       spec:
         interval: 10m

Taskfile.yml

@@ -4,14 +4,14 @@ version: "3"
 vars:
   PROJECT_DIR:
     sh: "git rev-parse --show-toplevel"
-  CLUSTER_DIR: "{{.PROJECT_DIR}}/cluster"
+  KUBERNETES_DIR: "{{.PROJECT_DIR}}/kubernetes"
-  ANSIBLE_DIR: "{{.PROJECT_DIR}}/provision/ansible"
+  ANSIBLE_DIR: "{{.PROJECT_DIR}}/ansible"
-  TERRAFORM_DIR: "{{.PROJECT_DIR}}/provision/terraform"
+  TERRAFORM_DIR: "{{.PROJECT_DIR}}/terraform"
 
 dotenv: [".config.env"]
 
 env:
-  KUBECONFIG: "{{.PROJECT_DIR}}/provision/kubeconfig"
+  KUBECONFIG: "{{.PROJECT_DIR}}/kubeconfig"
 
 includes:
   ansible: .taskfiles/AnsibleTasks.yml
@@ -49,6 +49,7 @@ tasks:
         stern
         terraform
         tflint
+        weaveworks/tap/gitops
         yamllint
         yq
 

ansible.cfg

@@ -6,8 +6,8 @@ stdout_callback             = yaml
 force_valid_group_names     = ignore
 # File/Directory settings
 log_path                    = ~/.ansible/ansible.log
-inventory                   = ./provision/ansible/inventory
+inventory                   = ./ansible/inventory
-roles_path                  = ~/.ansible/roles:./provision/ansible/roles
+roles_path                  = ~/.ansible/roles:./ansible/roles
 collections_path            = ~/.ansible/collections
 remote_tmp                  = /tmp
 local_tmp                   = ~/.ansible/tmp

ansible/inventory/group_vars/master/k3s.yml

@@ -9,7 +9,6 @@ k3s_control_node: true
 k3s_server:
   node-ip: "{{ ansible_host }}"
   tls-san:
-    # kube-vip
     - "{{ kubevip_address }}"
   # Disable Docker - this will use the default containerd CRI
   docker: false
@@ -30,28 +29,17 @@ k3s_server:
   cluster-cidr: "10.42.0.0/16"
   # Network CIDR to use for service IPs
   service-cidr: "10.43.0.0/16"
-  kubelet-arg:
-    # Allow k8s services to contain TCP and UDP on the same port
-    - "feature-gates=MixedProtocolLBService=true"
   kube-controller-manager-arg:
-    # Allow k8s services to contain TCP and UDP on the same port
-    - "feature-gates=MixedProtocolLBService=true"
     # Required to monitor kube-controller-manager with kube-prometheus-stack
     - "bind-address=0.0.0.0"
   kube-proxy-arg:
-    # Allow k8s services to contain TCP and UDP on the same port
-    - "feature-gates=MixedProtocolLBService=true"
     # Required to monitor kube-proxy with kube-prometheus-stack
     - "metrics-bind-address=0.0.0.0"
   kube-scheduler-arg:
-    # Allow k8s services to contain TCP and UDP on the same port
-    - "feature-gates=MixedProtocolLBService=true"
     # Required to monitor kube-scheduler with kube-prometheus-stack
     - "bind-address=0.0.0.0"
   # Required to monitor etcd with kube-prometheus-stack
   etcd-expose-metrics: true
   kube-apiserver-arg:
-    # Allow k8s services to contain TCP and UDP on the same port
-    - "feature-gates=MixedProtocolLBService=true"
     # Required for HAProxy health-checks
     - "anonymous-auth=true"

ansible/inventory/group_vars/worker/k3s.yml

@@ -8,6 +8,3 @@ k3s_control_node: false
 # (dict) k3s settings for all worker nodes
 k3s_agent:
   node-ip: "{{ ansible_host }}"
-  kubelet-arg:
-    # Allow k8s services to contain TCP and UDP on the same port
-    - "feature-gates=MixedProtocolLBService=true"

ansible/playbooks/cluster-installation.yml

@@ -38,11 +38,11 @@
         git rev-parse --show-toplevel
       register: repo_abs_path
 
-    - name: Copy kubeconfig to provision folder
+    - name: Copy kubeconfig project directory
       run_once: true
       ansible.builtin.fetch:
         src: "/etc/rancher/k3s/k3s.yaml"
-        dest: "{{ repo_abs_path.stdout }}/provision/kubeconfig"
+        dest: "{{ repo_abs_path.stdout }}/kubeconfig"
         flat: true
       when:
         - k3s_control_node is defined
@@ -53,7 +53,7 @@
       become: false
       run_once: true
       ansible.builtin.replace:
-        path: "{{ repo_abs_path.stdout }}/provision/kubeconfig"
+        path: "{{ repo_abs_path.stdout }}/kubeconfig"
         regexp: "https://127.0.0.1:6443"
         replace: "https://{{ k3s_registration_address }}:6443"
 

ansible/playbooks/templates/kube-vip-daemonset.yaml.j2

@@ -22,8 +22,7 @@ spec:
         - name: kube-vip
           image: ghcr.io/kube-vip/kube-vip:v0.5.7
           imagePullPolicy: IfNotPresent
-          args:
+          args: ["manager"]
-            - manager
           env:
             - name: vip_arp
               value: "true"
@@ -49,9 +48,7 @@ spec:
               value: "{{ k3s_registration_address }}"
           securityContext:
             capabilities:
-              add:
+              add: ["NET_ADMIN", "NET_RAW"]
-                - NET_ADMIN
-                - NET_RAW
       hostAliases:
         - hostnames:
             - kubernetes

cluster/apps/default/hajimari/config-pvc.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: hajimari-config
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: local-path
-  resources:
-    requests:
-      storage: 128Mi

cluster/apps/default/hajimari/helm-release.yaml

@@ -1,131 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: hajimari
-  namespace: default
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: hajimari
-      version: 2.0.2
-      sourceRef:
-        kind: HelmRepository
-        name: hajimari
-        namespace: flux-system
-      interval: 15m
-  install:
-    createNamespace: true
-    remediation:
-      retries: 5
-  upgrade:
-    remediation:
-      retries: 5
-  values:
-    hajimari:
-      defaultEnable: false
-      namespaceSelector:
-        matchNames:
-          - default
-      name: "you"
-      customApps:
-        - name: Some External Cluster Service
-          url: http://192.168.1.100:5000
-          icon: test-tube
-      showGlobalBookmarks: true
-      globalBookmarks:
-        - group: Communicate
-          bookmarks:
-            - name: Discord
-              url: "https://discord.com"
-            - name: Gmail
-              url: "https://gmail.com"
-            - name: Slack
-              url: "https://slack.com/signin"
-        - group: Cloud
-          bookmarks:
-            - name: Box
-              url: "https://box.com"
-            - name: Dropbox
-              url: "https://dropbox.com"
-            - name: Drive
-              url: "https://drive.google.com"
-        - group: Design
-          bookmarks:
-            - name: Awwwards
-              url: "https://awwwards.com"
-            - name: Dribbble
-              url: "https://dribbble.com"
-            - name: Muz.li
-              url: "https://medium.muz.li/"
-        - group: Dev
-          bookmarks:
-            - name: Codepen
-              url: "https://codepen.io/"
-            - name: Devdocs
-              url: "https://devdocs.io"
-            - name: Devhints
-              url: "https://devhints.io"
-        - group: Lifestyle
-          bookmarks:
-            - name: Design Milk
-              url: "https://design-milk.com/category/interior-design/"
-            - name: Dwell
-              url: "https://www.dwell.com/"
-            - name: Freshome
-              url: "https://www.mymove.com/freshome/"
-        - group: Media
-          bookmarks:
-            - name: Spotify
-              url: "http://browse.spotify.com"
-            - name: Trakt
-              url: "http://trakt.tv"
-            - name: YouTube
-              url: "https://youtube.com/feed/subscriptions"
-        - group: Reading
-          bookmarks:
-            - name: Instapaper
-              url: "https://www.instapaper.com/u"
-            - name: Medium
-              url: "http://medium.com"
-            - name: Reddit
-              url: "http://reddit.com"
-        - group: Tech
-          bookmarks:
-            - name: Hacker News
-              url: "https://news.ycombinator.com/"
-            - name: The Verge
-              url: "https://theverge.com/"
-            - name: MIT Technology Review
-              url: "https://www.technologyreview.com/"
-    ingress:
-      main:
-        enabled: true
-        ingressClassName: "nginx"
-        annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-staging"
-          hajimari.io/enable: "true"
-          hajimari.io/icon: "weather-sunset"
-          nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
-        hosts:
-          - host: "hajimari.${SECRET_DOMAIN}"
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - "hajimari.${SECRET_DOMAIN}"
-            secretName: "hajimari-tls"
-    persistence:
-      data:
-        enabled: true
-        existingClaim: hajimari-config
-    podAnnotations:
-      configmap.reloader.stakater.com/reload: "hajimari-settings"
-    resources:
-      requests:
-        cpu: 100m
-        memory: 128Mi
-      limits:
-        memory: 256Mi

cluster/apps/kube-system/cert-manager/issuers/helm-release.yaml

@@ -1,69 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: cert-manager-issuers
-  namespace: kube-system
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: raw
-      version: v0.3.1
-      sourceRef:
-        kind: HelmRepository
-        name: dysnix
-        namespace: flux-system
-  install:
-    createNamespace: true
-    remediation:
-      retries: 5
-  upgrade:
-    remediation:
-      retries: 5
-  dependsOn:
-    - name: cert-manager
-      namespace: kube-system
-  values:
-    resources:
-      - apiVersion: cert-manager.io/v1
-        kind: ClusterIssuer
-        metadata:
-          name: letsencrypt-production
-        spec:
-          acme:
-            server: https://acme-v02.api.letsencrypt.org/directory
-            email: "${SECRET_CLOUDFLARE_EMAIL}"
-            privateKeySecretRef:
-              name: letsencrypt-production
-            solvers:
-              - dns01:
-                  cloudflare:
-                    email: "${SECRET_CLOUDFLARE_EMAIL}"
-                    apiKeySecretRef:
-                      name: cloudflare-api-key
-                      key: api-key
-                selector:
-                  dnsZones:
-                    - ${SECRET_DOMAIN}
-
-      - apiVersion: cert-manager.io/v1
-        kind: ClusterIssuer
-        metadata:
-          name: letsencrypt-staging
-        spec:
-          acme:
-            server: https://acme-staging-v02.api.letsencrypt.org/directory
-            email: "${SECRET_CLOUDFLARE_EMAIL}"
-            privateKeySecretRef:
-              name: letsencrypt-staging
-            solvers:
-              - dns01:
-                  cloudflare:
-                    email: "${SECRET_CLOUDFLARE_EMAIL}"
-                    apiKeySecretRef:
-                      name: cloudflare-api-key
-                      key: api-key
-                selector:
-                  dnsZones:
-                    - ${SECRET_DOMAIN}

cluster/apps/kube-system/cert-manager/kustomization.yaml

@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helm-release.yaml
-  - ./issuers

cluster/apps/kube-system/cloudflare-ddns/cron-job.yaml

@@ -1,42 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: &app cloudflare-ddns
-  namespace: kube-system
-spec:
-  schedule: "@hourly"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 2
-  jobTemplate:
-    spec:
-      ttlSecondsAfterFinished: 3600
-      template:
-        spec:
-          automountServiceAccountToken: false
-          restartPolicy: OnFailure
-          containers:
-            - name: *app
-              image: ghcr.io/onedr0p/kubernetes-kubectl:1.26.0@sha256:6ee3353da3495bc99d73af29a4495bb95570e31e71579cfce719c4123882723d
-              envFrom:
-                - secretRef:
-                    name: *app
-              command:
-                - "/bin/bash"
-                - &scriptPath "/app/cloudflare-ddns.sh"
-              volumeMounts:
-                - name: *app
-                  mountPath: *scriptPath
-                  subPath: &scriptName cloudflare-ddns.sh
-                  readOnly: true
-          volumes:
-            - name: *app
-              projected:
-                defaultMode: 0775
-                sources:
-                  - configMap:
-                      name: *app
-                      items:
-                        - key: *scriptName
-                          path: *scriptName

cluster/apps/kube-system/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./namespace.yaml
-  - ./cert-manager
-  - ./cloudflare-ddns
-  - ./external-dns
-  - ./ingress-nginx
-  - ./k8s-gateway
-  - ./kube-vip
-  - ./metallb
-  - ./metrics-server
-  - ./reloader

cluster/apps/kube-system/metallb/config/helm-release.yaml

@@ -1,45 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: metallb-config
-  namespace: kube-system
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: raw
-      version: v0.3.1
-      sourceRef:
-        kind: HelmRepository
-        name: dysnix
-        namespace: flux-system
-  install:
-    createNamespace: true
-    remediation:
-      retries: 5
-  upgrade:
-    remediation:
-      retries: 5
-  dependsOn:
-    - name: metallb
-      namespace: kube-system
-  values:
-    resources:
-      - apiVersion: metallb.io/v1beta1
-        kind: L2Advertisement
-        metadata:
-          name: l2-ip
-          namespace: kube-system
-        spec:
-          ipAddressPools:
-            - default-pool
-
-      - apiVersion: metallb.io/v1beta1
-        kind: IPAddressPool
-        metadata:
-          name: default-pool
-          namespace: kube-system
-        spec:
-          addresses:
-            - "${METALLB_LB_RANGE}"

cluster/apps/kube-system/metallb/config/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - helm-release.yaml

cluster/apps/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./default
-  - ./kube-system
-  # - ./system-upgrade

cluster/apps/system-upgrade/kured/helm-release.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: kured
-  namespace: system-upgrade
-spec:
-  interval: 15m
-  chart:
-    spec:
-      chart: kured
-      version: 4.2.0
-      sourceRef:
-        kind: HelmRepository
-        name: kubereboot
-        namespace: flux-system
-      interval: 15m
-  install:
-    createNamespace: true
-    remediation:
-      retries: 5
-  upgrade:
-    remediation:
-      retries: 5
-  values:
-    configuration:
-      startTime: "10pm"
-      endTime: "2am"
-      logFormat: "json"
-      timeZone: "${TIMEZONE}"
-      rebootSentinelCommand: |-
-        sh -c "! needs-restarting --reboothint"

cluster/apps/system-upgrade/kured/kustomization.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./helm-release.yaml

cluster/apps/system-upgrade/kustomization.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./namespace.yaml
-  # renovate: datasource=docker image=rancher/system-upgrade-controller
-  - https://github.com/rancher/system-upgrade-controller/releases/download/v0.9.1/crd.yaml
-  - ./system-upgrade-controller
-  - ./kured

cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - github.com/rancher/system-upgrade-controller?ref=v0.10.0
-  - ./plans
-images:
-  - name: rancher/system-upgrade-controller
-    newTag: v0.10.0
-patchesStrategicMerge:
-  # Delete namespace resource
-  - |
-    $patch: delete
-    apiVersion: v1
-    kind: Namespace
-    metadata:
-      name: system-upgrade
-  # Add labels
-  - |-
-    apiVersion: apps/v1
-    kind: Deployment
-    metadata:
-      name: system-upgrade-controller
-      namespace: system-upgrade
-      labels:
-        app.kubernetes.io/name: system-upgrade-controller
-        app.kubernetes.io/instance: system-upgrade-controller

cluster/flux/config/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./flux-installation.yaml
-  - ./flux-cluster.yaml

cluster/flux/repositories/helm/kubereboot-charts.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: kubereboot
-  namespace: flux-system
-spec:
-  interval: 1h
-  url: https://kubereboot.github.io/charts

cluster/flux/repositories/helm/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ./bitnami-charts.yaml
-  - ./bjw-s-charts.yaml
-  - ./dysnix-charts.yaml
-  - ./external-dns-charts.yaml
-  - ./hajimari-charts.yaml
-  - ./ingress-nginx-charts.yaml
-  - ./jetstack-charts.yaml
-  - ./kubereboot-charts.yaml
-  - ./k8s-gateway-charts.yaml
-  - ./metallb-charts.yaml
-  - ./metrics-server-charts.yaml
-  - ./stakater-charts.yaml

configure

@@ -40,39 +40,44 @@ main() {
         # generate sops configuration file
         envsubst < "${PROJECT_DIR}/tmpl/.sops.yaml" \
             > "${PROJECT_DIR}/.sops.yaml"
+
         # generate cluster settings
-        envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-settings.yaml" \
+        envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster-settings.yaml" \
-            > "${PROJECT_DIR}/cluster/flux/vars/cluster-settings.yaml"
+            > "${PROJECT_DIR}/kubernetes/flux/vars/cluster-settings.yaml"
-        envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-cluster.yaml" \
+
-            > "${PROJECT_DIR}/cluster/flux/config/flux-cluster.yaml"
+        envsubst < "${PROJECT_DIR}/tmpl/kubernetes/flux/cluster.yaml" \
-        envsubst < "${PROJECT_DIR}/tmpl/cluster/kube-vip-daemonset.yaml" \
+            > "${PROJECT_DIR}/kubernetes/flux/config/cluster.yaml"
-            > "${PROJECT_DIR}/cluster/apps/kube-system/kube-vip/daemon-set.yaml"
+
-        # generate cluster secrets
+        # generate secrets
-        envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \
+        envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cluster-secrets.sops.yaml" \
-            > "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml"
+            > "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml"
-        envsubst < "${PROJECT_DIR}/tmpl/cluster/cert-manager-secret.sops.yaml" \
+        sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/flux/vars/cluster-secrets.sops.yaml"
-            > "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml"
+
-        envsubst < "${PROJECT_DIR}/tmpl/cluster/cloudflare-ddns-secret.sops.yaml" \
+        envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cert-manager-secret.sops.yaml" \
-            > "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml"
+            > "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml"
-        envsubst < "${PROJECT_DIR}/tmpl/cluster/external-dns-secret.sops.yaml" \
+        sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/cert-manager/cert-manager/issuers/secret.sops.yaml"
-            > "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml"
+
-        # encrypt cluster secrets
+        envsubst < "${PROJECT_DIR}/tmpl/kubernetes/cloudflare-ddns-secret.sops.yaml" \
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml"
+            > "${PROJECT_DIR}/kubernetes/apps/networking/cloudflare-ddns/app/secret.sops.yaml"
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cert-manager/issuers/secret.sops.yaml"
+        sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/cloudflare-ddns/app/secret.sops.yaml"
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/cloudflare-ddns/secret.sops.yaml"
+
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/kube-system/external-dns/secret.sops.yaml"
+        envsubst < "${PROJECT_DIR}/tmpl/kubernetes/external-dns-secret.sops.yaml" \
-        # generate terraform secrets
+            > "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
+        sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/networking/external-dns/app/secret.sops.yaml"
+
         envsubst < "${PROJECT_DIR}/tmpl/terraform/secret.sops.yaml" \
-            > "${PROJECT_DIR}/provision/terraform/cloudflare/secret.sops.yaml"
+            > "${PROJECT_DIR}/terraform/cloudflare/secret.sops.yaml"
-        # encrypt terraform secrets
+        sops --encrypt --in-place "${PROJECT_DIR}/terraform/cloudflare/secret.sops.yaml"
-        sops --encrypt --in-place "${PROJECT_DIR}/provision/terraform/cloudflare/secret.sops.yaml"
+
         # generate ansible settings
         envsubst < "${PROJECT_DIR}/tmpl/ansible/kube-vip.yml" \
-            > "${PROJECT_DIR}/provision/ansible/inventory/group_vars/kubernetes/kube-vip.yml"
+            > "${PROJECT_DIR}/ansible/inventory/group_vars/kubernetes/kube-vip.yml"
+
         # generate ansible hosts file and secrets
         generate_ansible_hosts
         generate_ansible_host_secrets
         setup_github_webhook
+        setup_weave_gitops
         success
     fi
 }
@@ -236,6 +241,7 @@ verify_binaries() {
     _has_binary "helm"
     _has_binary "ipcalc"
     _has_binary "jq"
+    _has_binary "gitops"
     _has_binary "yq"
     _has_binary "sops"
     _has_binary "ssh"
@@ -289,9 +295,10 @@ verify_git_repository() {
 }
 
 setup_github_webhook() {
-    WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET:-ignored}"
+    _has_envar "BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET"
+
+    WEBHOOK_SECRET="${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET}"
 
-    if [[ "${WEBHOOK_SECRET}" != "ignored" ]]; then
     if [[ "${WEBHOOK_SECRET}" == "generated" ]]; then
         WEBHOOK_SECRET="$(openssl rand -base64 30)"
     fi
@@ -299,15 +306,29 @@ setup_github_webhook() {
     export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}"
     _log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux"
 
-        mkdir -p "${PROJECT_DIR}/cluster/flux/add-ons"
+    envsubst < "${PROJECT_DIR}/tmpl/kubernetes/github-webhook-token-secret.sops.yaml" \
-        cp -rf  "${PROJECT_DIR}/tmpl/cluster/flux/webhooks" "${PROJECT_DIR}/cluster/flux/add-ons"
+        > "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml"
-        cp -rf  "${PROJECT_DIR}/tmpl/cluster/flux/kustomization.yaml" "${PROJECT_DIR}/cluster/flux/add-ons"
+    sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/addons/webhooks/github/secret.sops.yaml"
+}
 
-        envsubst < "${PROJECT_DIR}/tmpl/cluster/flux/webhooks/github/secret.sops.yaml" \
+setup_weave_gitops() {
-            > "${PROJECT_DIR}/cluster/flux/add-ons/webhooks/github/secret.sops.yaml"
+    _has_envar "BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD"
 
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/add-ons/webhooks/github/secret.sops.yaml"
+    WEAVE_GITOPS_ADMIN_PASSWORD="${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}"
+
+    if [[ "${WEAVE_GITOPS_ADMIN_PASSWORD}" == "generated" ]]; then
+        WEAVE_GITOPS_ADMIN_PASSWORD="$(openssl rand -base64 30)"
     fi
+
+    export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="${WEAVE_GITOPS_ADMIN_PASSWORD}"
+    _log "INFO" "Using admin password '${WEAVE_GITOPS_ADMIN_PASSWORD}' for Weave Gitops"
+
+    # Convert password to bcrypt hash
+    export BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD="$(echo -n "${BOOTSTRAP_WEAVE_GITOPS_ADMIN_PASSWORD}" | gitops get bcrypt-hash)"
+
+    envsubst < "${PROJECT_DIR}/tmpl/kubernetes/weave-gitops-secret.sops.yaml" \
+        > "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml"
+    sops --encrypt --in-place "${PROJECT_DIR}/kubernetes/apps/flux-system/weave-gitops/app/secret.sops.yaml"
 }
 
 verify_cloudflare() {
@@ -426,8 +447,8 @@ generate_ansible_host_secrets() {
             printf "kind: Secret\n"
             printf "ansible_user: %s\n" "${!node_username}"
             printf "ansible_become_pass: %s\n" "${!node_password}"
-        } > "${PROJECT_DIR}/provision/ansible/inventory/host_vars/${node_hostname}.sops.yml"
+        } > "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml"
-        sops --encrypt --in-place "${PROJECT_DIR}/provision/ansible/inventory/host_vars/${node_hostname}.sops.yml"
+        sops --encrypt --in-place "${PROJECT_DIR}/ansible/inventory/host_vars/${node_hostname}.sops.yml"
     done
 }
 
@@ -480,7 +501,7 @@ generate_ansible_hosts() {
                 fi
             done
         fi
-    } > "${PROJECT_DIR}/provision/ansible/inventory/hosts.yml"
+    } > "${PROJECT_DIR}/ansible/inventory/hosts.yml"
 }
 
 success() {

kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: cert-manager
-  namespace: kube-system
+  namespace: cert-manager
 spec:
   interval: 15m
   chart:
@@ -14,24 +14,30 @@ spec:
         kind: HelmRepository
         name: jetstack
         namespace: flux-system
-      interval: 15m
   install:
     createNamespace: true
     remediation:
-      retries: 5
+      retries: 3
   upgrade:
     remediation:
-      retries: 5
+      retries: 3
   values:
     installCRDs: true
+    replicaCount: 3
     webhook:
-      enabled: true
+      replicaCount: 3
+    cainjector:
+      replicaCount: 3
     extraArgs:
       - --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
       - --dns01-recursive-nameservers-only
-    replicaCount: 1
+    podDnsPolicy: None
-    podDnsPolicy: "None"
     podDnsConfig:
       nameservers:
         - "1.1.1.1"
         - "9.9.9.9"
+    prometheus:
+      enabled: true
+      servicemonitor:
+        enabled: true
+        prometheusInstance: monitoring

kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - ./helmrelease.yaml
+  - ./prometheusrule.yaml
+configMapGenerator:
+  - name: cert-manager-dashboard
+    files:
+      - cert-manager-dashboard.json=https://raw.githubusercontent.com/monitoring-mixins/website/master/assets/cert-manager/dashboards/cert-manager.json
+generatorOptions:
+  disableNameSuffixHash: true
+  annotations:
+    kustomize.toolkit.fluxcd.io/substitute: disabled
+  labels:
+    grafana_dashboard: "true"

kubernetes/apps/cert-manager/cert-manager/app/prometheusrule.yaml

@@ -0,0 +1,68 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: cert-manager.rules
+  namespace: cert-manager
+spec:
+  groups:
+    - name: cert-manager
+      rules:
+        - alert: CertManagerAbsent
+          expr: |
+            absent(up{job="cert-manager"})
+          for: 15m
+          labels:
+            severity: critical
+          annotations:
+            description:
+              "New certificates will not be able to be minted, and existing
+              ones can't be renewed until cert-manager is back."
+            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerabsent
+            summary: "Cert Manager has dissapeared from Prometheus service discovery."
+    - name: certificates
+      rules:
+        - alert: CertManagerCertExpirySoon
+          expr: |
+            avg by (exported_namespace, namespace, name) (
+            certmanager_certificate_expiration_timestamp_seconds - time())
+              < (21 * 24 * 3600)
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            description:
+              "The domain that this cert covers will be unavailable after
+              {{ $value | humanizeDuration }}. Clients using endpoints that this cert
+              protects will start to fail in {{ $value | humanizeDuration }}."
+            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertexpirysoon
+            summary:
+              "The cert {{ $labels.name }} is {{ $value | humanizeDuration }}
+              from expiry, it should have renewed over a week ago."
+        - alert: CertManagerCertNotReady
+          expr: |
+            max by (name, exported_namespace, namespace, condition) (
+            certmanager_certificate_ready_status{condition!="True"} == 1)
+          for: 15m
+          labels:
+            severity: critical
+          annotations:
+            description:
+              "This certificate has not been ready to serve traffic for at least
+              10m. If the cert is being renewed or there is another valid cert, the ingress
+              controller _may_ be able to serve that instead."
+            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagercertnotready
+            summary: "The cert {{ $labels.name }} is not ready to serve traffic."
+        - alert: CertManagerHittingRateLimits
+          expr: |
+            sum by (host) (rate(certmanager_http_acme_client_request_count{status="429"}[5m]))
+              > 0
+          for: 15m
+          labels:
+            severity: critical
+          annotations:
+            description:
+              "Depending on the rate limit, cert-manager may be unable to generate
+              certificates for up to a week."
+            runbook_url: https://gitlab.com/uneeq-oss/cert-manager-mixin/-/blob/master/RUNBOOK.md#certmanagerhittingratelimits
+            summary: "Cert manager hitting LetsEncrypt rate limits."

kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml

@@ -0,0 +1,41 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-production
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: "${SECRET_CLOUDFLARE_EMAIL}"
+    privateKeySecretRef:
+      name: letsencrypt-production
+    solvers:
+      - dns01:
+          cloudflare:
+            email: "${SECRET_CLOUDFLARE_EMAIL}"
+            apiKeySecretRef:
+              name: cert-manager-secret
+              key: api-key
+        selector:
+          dnsZones:
+            - "${SECRET_DOMAIN}"
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: "${SECRET_CLOUDFLARE_EMAIL}"
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+      - dns01:
+          cloudflare:
+            email: "${SECRET_CLOUDFLARE_EMAIL}"
+            apiKeySecretRef:
+              name: cert-manager-secret
+              key: api-key
+        selector:
+          dnsZones:
+            - "${SECRET_DOMAIN}"

kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml

@@ -2,5 +2,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./helm-release.yaml
   - ./secret.sops.yaml
+  - ./issuers.yaml

kubernetes/apps/cert-manager/cert-manager/ks.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-cert-manager
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  path: ./kubernetes/apps/cert-manager/cert-manager/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: cert-manager
+      namespace: cert-manager
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-cert-manager-issuers
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  dependsOn:
+    - name: cluster-apps-cert-manager
+  path: ./kubernetes/apps/cert-manager/cert-manager/issuers
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m

kubernetes/apps/cert-manager/kustomization.yaml

@@ -3,5 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  - ./echo-server
+  - ./cert-manager/ks.yaml
-  - ./hajimari

kubernetes/apps/cert-manager/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

kubernetes/apps/default/echo-server/app/helmrelease.yaml

@@ -2,7 +2,7 @@
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
-  name: echo-server
+  name: &app echo-server
   namespace: default
 spec:
   interval: 15m
@@ -17,10 +17,10 @@ spec:
   install:
     createNamespace: true
     remediation:
-      retries: 5
+      retries: 3
   upgrade:
     remediation:
-      retries: 5
+      retries: 3
   values:
     controller:
       replicas: 3
@@ -51,25 +51,28 @@ spec:
     ingress:
       main:
         enabled: true
-        ingressClassName: "nginx"
+        ingressClassName: nginx
         annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-staging"
+          external-dns.home.arpa/enabled: "true"
-          external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
-          external-dns/is-public: "true"
-          hajimari.io/enable: "true"
           hajimari.io/icon: "video-input-antenna"
         hosts:
-          - host: &host "{{ .Release.Name }}.${SECRET_DOMAIN}"
+          - host: &host "{{ .Release.Name }}.devbu.io"
             paths:
               - path: /
                 pathType: Prefix
         tls:
           - hosts:
               - *host
-            secretName: "echo-server-tls"
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: *app
     resources:
       requests:
-        cpu: 50m
+        cpu: 5m
-        memory: 64Mi
+        memory: 10Mi
       limits:
-        memory: 96Mi
+        memory: 50Mi

kubernetes/apps/default/echo-server/app/kustomization.yaml

@@ -1,5 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: default
 resources:
-  - ./helm-release.yaml
+  - ./helmrelease.yaml

kubernetes/apps/default/echo-server/ks.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-echo-server
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  path: ./kubernetes/apps/default/echo-server/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: echo-server
+      namespace: default
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m

kubernetes/apps/default/hajimari/app/helmrelease.yaml

@@ -0,0 +1,62 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: hajimari
+  namespace: default
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: hajimari
+      version: 2.0.2
+      sourceRef:
+        kind: HelmRepository
+        name: hajimari
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    hajimari:
+      title: Apps
+      darkTheme: espresso
+      alwaysTargetBlank: true
+      showGreeting: false
+      showAppGroups: false
+      showAppStatus: false
+      showBookmarkGroups: false
+      showGlobalBookmarks: false
+      showAppUrls: false
+      defaultEnable: true
+      namespaceSelector:
+        matchNames:
+          - default
+    ingress:
+      main:
+        enabled: true
+        ingressClassName: nginx
+        annotations:
+          hajimari.io/enable: "false"
+        hosts:
+          - host: &host "${SECRET_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+        tls:
+          - hosts:
+              - *host
+    podAnnotations:
+      configmap.reloader.stakater.com/reload: "hajimari-settings"
+    persistence:
+      data:
+        enabled: true
+        type: emptyDir
+    resources:
+      requests:
+        cpu: 100m
+        memory: 128M

kubernetes/apps/default/hajimari/app/kustomization.yaml

@@ -1,5 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: default
 resources:
-  - ./helm-release.yaml
+  - ./helmrelease.yaml

kubernetes/apps/default/hajimari/ks.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-hajimari
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  path: ./kubernetes/apps/default/hajimari/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: hajimari
+      namespace: default
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m

kubernetes/apps/default/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./echo-server/ks.yaml
+  - ./hajimari/ks.yaml

kubernetes/apps/flux-system/addons/ks.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-flux-webhooks
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  path: ./kubernetes/apps/flux-system/addons/webhooks
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m

kubernetes/apps/flux-system/addons/webhooks/github/ingress.yaml

@@ -11,7 +11,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: "flux-receiver.${SECRET_DOMAIN}"
+    - host: &host "flux-receiver.${SECRET_DOMAIN}"
       http:
         paths:
           - path: /hook/
@@ -23,5 +23,5 @@ spec:
                   number: 80
   tls:
     - hosts:
-        - "flux-receiver.${SECRET_DOMAIN}"
+        - *host
       secretName: flux-receiver-tls

kubernetes/apps/flux-system/addons/webhooks/github/kustomization.yaml

@@ -2,6 +2,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - ./secret.sops.yaml
   - ./ingress.yaml
   - ./receiver.yaml
-  - ./secret.sops.yaml

kubernetes/apps/flux-system/addons/webhooks/github/receiver.yaml

@@ -10,25 +10,17 @@ spec:
     - ping
     - push
   secretRef:
-    name: github-webhook-secret
+    name: github-webhook-token-secret
   resources:
     - apiVersion: source.toolkit.fluxcd.io/v1beta2
       kind: GitRepository
-      name: flux-cluster
+      name: home-kubernetes
       namespace: flux-system
     - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
       kind: Kustomization
-      name: apps
+      name: cluster
       namespace: flux-system
     - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
       kind: Kustomization
-      name: charts
+      name: cluster-apps
-      namespace: flux-system
-    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-      kind: Kustomization
-      name: config
-      namespace: flux-system
-    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-      kind: Kustomization
-      name: flux-cluster
       namespace: flux-system

kubernetes/apps/flux-system/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./addons/ks.yaml
+  - ./weave-gitops/ks.yaml

kubernetes/apps/flux-system/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: flux-system
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

kubernetes/apps/flux-system/weave-gitops/app/helmrelease.yaml

@@ -0,0 +1,54 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: weave-gitops
+  namespace: flux-system
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: weave-gitops
+      version: 4.0.9
+      sourceRef:
+        kind: HelmRepository
+        name: weave-gitops
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    adminUser:
+      create: true
+      username: admin
+    ingress:
+      enabled: true
+      className: nginx
+      annotations:
+        hajimari.io/icon: "sawtooth-wave"
+      hosts:
+        - host: &host "gitops.${SECRET_DOMAIN}"
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - *host
+    networkPolicy:
+      create: false
+    metrics:
+      enabled: true
+    rbac:
+      create: true
+      impersonationResourceNames: ["admin"]
+    podAnnotations:
+      secret.reloader.stakater.com/reload: weave-gitops-secret
+  valuesFrom:
+    - kind: Secret
+      name: weave-gitops-secret
+      valuesKey: adminPassword
+      targetPath: adminUser.passwordHash

kubernetes/apps/flux-system/weave-gitops/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+  - ./secret.sops.yaml
+  - ./helmrelease.yaml

kubernetes/apps/flux-system/weave-gitops/ks.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-weave-gitops
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  path: ./kubernetes/apps/flux-system/weave-gitops/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: weave-gitops
+      namespace: flux-system
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m

kubernetes/apps/kube-system/kube-vip/app/daemonset.yaml

@@ -22,8 +22,7 @@ spec:
         - name: kube-vip
           image: ghcr.io/kube-vip/kube-vip:v0.5.7
           imagePullPolicy: IfNotPresent
-          args:
+          args: ["manager"]
-            - manager
           env:
             - name: vip_arp
               value: "true"
@@ -46,12 +45,10 @@ spec:
             - name: vip_retryperiod
               value: "2"
             - name: address
-              value: "${BOOTSTRAP_KUBE_VIP_ADDR}"
+              value: "${KUBE_VIP_ADDR}"
           securityContext:
             capabilities:
-              add:
+              add: ["NET_ADMIN", "NET_RAW"]
-                - NET_ADMIN
-                - NET_RAW
       hostAliases:
         - hostnames:
             - kubernetes

kubernetes/apps/kube-system/kube-vip/app/kustomization.yaml

@@ -1,6 +1,7 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: kube-system
 resources:
   - ./rbac.yaml
   - ./daemon-set.yaml

kubernetes/apps/kube-system/kube-vip/ks.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-kube-vip
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  path: ./kubernetes/apps/kube-system/kube-vip/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: DaemonSet
+      name: kube-vip
+      namespace: kube-system
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m

kubernetes/apps/kube-system/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./kube-vip/ks.yaml
+  - ./metrics-server/ks.yaml
+  - ./reloader/ks.yaml

kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml

@@ -14,17 +14,20 @@ spec:
         kind: HelmRepository
         name: metrics-server
         namespace: flux-system
-      interval: 15m
   install:
     createNamespace: true
     remediation:
-      retries: 5
+      retries: 3
   upgrade:
     remediation:
-      retries: 5
+      retries: 3
   values:
     args:
       - --kubelet-insecure-tls
       - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
       - --kubelet-use-node-status-port
       - --metric-resolution=15s
+    metrics:
+      enabled: true
+    serviceMonitor:
+      enabled: true

kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml

@@ -1,6 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: kube-system
 resources:
-  - ./config-pvc.yaml
+  - ./helmrelease.yaml
-  - ./helm-release.yaml

kubernetes/apps/kube-system/metrics-server/ks.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-metrics-server
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  path: ./kubernetes/apps/kube-system/metrics-server/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: metrics-server
+      namespace: kube-system
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m

kubernetes/apps/kube-system/reloader/app/helmrelease.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: reloader
-  namespace: kube-system
+  namespace: &namespace kube-system
 spec:
   interval: 15m
   chart:
@@ -14,13 +14,21 @@ spec:
         kind: HelmRepository
         name: stakater
         namespace: flux-system
-      interval: 15m
   install:
     createNamespace: true
     remediation:
-      retries: 5
+      retries: 3
   upgrade:
     remediation:
-      retries: 5
+      retries: 3
   values:
     fullnameOverride: reloader
+    reloader:
+      enableHA: true
+      deployment:
+        replicas: 3
+      reloadStrategy: annotations
+      reloadOnCreate: false
+      podMonitor:
+        enabled: true
+        namespace: *namespace

kubernetes/apps/kube-system/reloader/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - ./helmrelease.yaml

kubernetes/apps/kube-system/reloader/ks.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: cluster-apps-reloader
+  namespace: flux-system
+  labels:
+    substitution.flux.home.arpa/enabled: "true"
+spec:
+  path: ./kubernetes/apps/kube-system/reloader/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2beta1
+      kind: HelmRelease
+      name: reloader
+      namespace: kube-system
+  interval: 30m
+  retryInterval: 1m
+  timeout: 3m

kubernetes/apps/networking/cloudflare-ddns/app/helmrelease.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cloudflare-ddns
+  namespace: networking
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 1.2.0
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    controller:
+      type: cronjob
+      cronjob:
+        concurrencyPolicy: Forbid
+        schedule: "@hourly"
+    restartPolicy: OnFailure
+    image:
+      repository: ghcr.io/onedr0p/kubernetes-kubectl
+      tag: 1.26.0@sha256:6ee3353da3495bc99d73af29a4495bb95570e31e71579cfce719c4123882723d
+    command: ["/bin/bash", "/app/cloudflare-ddns.sh"]
+    envFrom:
+      - secretRef:
+          name: cloudflare-ddns-secret
+    service:
+      main:
+        enabled: false
+    persistence:
+      config:
+        enabled: true
+        type: configMap
+        name: cloudflare-ddns-configmap
+        subPath: cloudflare-ddns.sh
+        mountPath: /app/cloudflare-ddns.sh
+        defaultMode: 0775
+        readOnly: true