feat!: Remove charts and config fluxtomizations and include them in the cluster/flux/ dir

.taskfiles/ClusterTasks.yml

@@ -13,7 +13,9 @@ tasks:
     cmds:
       - kubectl apply --kustomize {{.CLUSTER_DIR}}/bootstrap/
       - cat {{.SOPS_AGE_KEY_FILE}} | kubectl -n flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin
-      - kubectl apply --kustomize {{.CLUSTER_DIR}}/flux/flux-system/
+      - sops --decrypt {{.CLUSTER_DIR}}/flux/vars/cluster-secrets.sops.yaml | kubectl apply -f -
+      - kubectl apply -f {{.CLUSTER_DIR}}/flux/vars/cluster-settings.yaml
+      - kubectl apply --kustomize {{.CLUSTER_DIR}}/flux/config
       - task: reconcile
     preconditions:
       - sh: test -f {{.SOPS_AGE_KEY_FILE}}

cluster/charts/kustomization.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - bitnami-charts.yaml
-  - bjw-s-charts.yaml
-  - dysnix-charts.yaml
-  - external-dns-charts.yaml
-  - hajimari-charts.yaml
-  - ingress-nginx-charts.yaml
-  - jetstack-charts.yaml
-  - kubereboot-charts.yaml
-  - k8s-gateway-charts.yaml
-  - metallb-charts.yaml
-  - metrics-server-charts.yaml
-  - stakater-charts.yaml

cluster/flux/apps.yaml

@@ -12,8 +12,8 @@ spec:
     kind: GitRepository
     name: flux-cluster
   dependsOn:
-    - name: config
+    - name: flux-installation
-    - name: charts
+    - name: flux-cluster
   decryption:
     provider: sops
     secretRef:

cluster/flux/charts.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: charts
-  namespace: flux-system
-spec:
-  interval: 30m
-  path: ./cluster/charts
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-cluster

cluster/flux/config.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: config
-  namespace: flux-system
-spec:
-  interval: 30m
-  path: ./cluster/config
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-cluster
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age

cluster/flux/config/crds/kube-prometheus-stack.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: GitRepository
+metadata:
+  name: kube-prometheus-stack
+  namespace: flux-system
+spec:
+  interval: 12h
+  url: https://github.com/prometheus-community/helm-charts.git
+  ref:
+    # renovate: registryUrl=https://prometheus-community.github.io/helm-charts chart=kube-prometheus-stack
+    tag: kube-prometheus-stack-42.1.0
+  ignore: |
+    # exclude all
+    /*
+    # include crd directory
+    !/charts/kube-prometheus-stack/crds
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: kube-prometheus-stack-crds
+  namespace: flux-system
+spec:
+  interval: 30m
+  prune: false
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: kube-prometheus-stack

cluster/flux/config/crds/kustomization.yaml

@@ -1,7 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: flux-system
 resources:
-  - ingress.yaml
+  - ./kube-prometheus-stack.yaml
-  - receiver.yaml
-  - secret.sops.yaml

cluster/flux/config/flux-installation.yaml

@@ -7,8 +7,7 @@ metadata:
 spec:
   interval: 10m
   ref:
-    # renovate: datasource=github-releases depName=fluxcd/flux2
+    tag: v0.37.0
-    tag: "v0.37.0"
   url: https://github.com/fluxcd/flux2
   ignore: |
     # exclude all

cluster/flux/config/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./flux-installation.yaml
+  - ./flux-cluster.yaml
+  - ./crds

cluster/flux/repositories/helm/kustomization.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./bitnami-charts.yaml
+  - ./bjw-s-charts.yaml
+  - ./dysnix-charts.yaml
+  - ./external-dns-charts.yaml
+  - ./hajimari-charts.yaml
+  - ./ingress-nginx-charts.yaml
+  - ./jetstack-charts.yaml
+  - ./kubereboot-charts.yaml
+  - ./k8s-gateway-charts.yaml
+  - ./metallb-charts.yaml
+  - ./metrics-server-charts.yaml
+  - ./stakater-charts.yaml

cluster/flux/repositories/kustomization.yaml

@@ -2,5 +2,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - flux-installation.yaml
+  # - ./git
-  - flux-cluster.yaml
+  - ./helm
+  # - ./oci

cluster/flux/vars/kustomization.yaml

@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - cluster-settings.yaml
+  - ./cluster-settings.yaml
-  - cluster-secrets.sops.yaml
+  - ./cluster-secrets.sops.yaml

configure

@@ -42,16 +42,16 @@ main() {
             > "${PROJECT_DIR}/.sops.yaml"
         # generate cluster settings
         envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-settings.yaml" \
-            > "${PROJECT_DIR}/cluster/config/cluster-settings.yaml"
+            > "${PROJECT_DIR}/cluster/flux/vars/cluster-settings.yaml"
         envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-cluster.yaml" \
-            > "${PROJECT_DIR}/cluster/flux/flux-system/flux-cluster.yaml"
+            > "${PROJECT_DIR}/cluster/flux/config/flux-cluster.yaml"
         if [[ "${BOOTSTRAP_KUBE_VIP_ENABLED}" == "true" ]]; then
             envsubst < "${PROJECT_DIR}/tmpl/cluster/kube-vip-daemonset.yaml" \
                 > "${PROJECT_DIR}/cluster/apps/kube-system/kube-vip/daemon-set.yaml"
         fi
         # generate cluster secrets
         envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \
-            > "${PROJECT_DIR}/cluster/config/cluster-secrets.sops.yaml"
+            > "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml"
         envsubst < "${PROJECT_DIR}/tmpl/cluster/cert-manager-secret.sops.yaml" \
             > "${PROJECT_DIR}/cluster/apps/networking/cert-manager/issuers/secret.sops.yaml"
         envsubst < "${PROJECT_DIR}/tmpl/cluster/cloudflare-ddns-secret.sops.yaml" \
@@ -59,7 +59,7 @@ main() {
         envsubst < "${PROJECT_DIR}/tmpl/cluster/external-dns-secret.sops.yaml" \
             > "${PROJECT_DIR}/cluster/apps/networking/external-dns/secret.sops.yaml"
         # encrypt cluster secrets
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/config/cluster-secrets.sops.yaml"
+        sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/vars/cluster-secrets.sops.yaml"
         sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/networking/cert-manager/issuers/secret.sops.yaml"
         sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/networking/cloudflare-ddns/secret.sops.yaml"
         sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/networking/external-dns/secret.sops.yaml"
@@ -303,15 +303,15 @@ setup_github_webhook() {
         export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}"
         _log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux"
 
-        cp -rf  "${PROJECT_DIR}/tmpl/cluster/flux-system/webhooks" "${PROJECT_DIR}/cluster/apps/flux-system"
+        cp -rf  "${PROJECT_DIR}/tmpl/cluster/flux/webhooks" "${PROJECT_DIR}/cluster/flux/config"
 
-        envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-system/webhooks/github/secret.sops.yaml" \
+        envsubst < "${PROJECT_DIR}/tmpl/cluster/flux/webhooks/github/secret.sops.yaml" \
-            > "${PROJECT_DIR}/cluster/apps/flux-system/webhooks/github/secret.sops.yaml"
+            > "${PROJECT_DIR}/cluster/flux/config/webhooks/github/secret.sops.yaml"
 
-        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/flux-system/webhooks/github/secret.sops.yaml"
+        sops --encrypt --in-place "${PROJECT_DIR}/cluster/flux/config/webhooks/github/secret.sops.yaml"
 
-        if [[ $(yq eval --no-doc 'contains({"resources": ["webhooks"]})' "${PROJECT_DIR}/cluster/apps/flux-system/kustomization.yaml") == false ]]; then
+        if [[ $(yq eval --no-doc 'contains({"resources": ["./webhooks"]})' "${PROJECT_DIR}/cluster/flux/config/kustomization.yaml") == false ]]; then
-            yq --inplace '.resources += [ "webhooks" ]' "${PROJECT_DIR}/cluster/apps/flux-system/kustomization.yaml"
+            yq --inplace '.resources += [ "./webhooks" ]' "${PROJECT_DIR}/cluster/flux/config/kustomization.yaml"
         fi
     fi
 }

tmpl/cluster/flux-cluster.yaml

@@ -23,3 +23,13 @@ spec:
   sourceRef:
     kind: GitRepository
     name: flux-cluster
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  postBuild:
+    substituteFrom:
+      - kind: ConfigMap
+        name: cluster-settings
+      - kind: Secret
+        name: cluster-secrets

tmpl/cluster/flux/kustomization.yaml

@@ -2,4 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - webhooks
+  - ./webhooks

tmpl/cluster/flux/webhooks/github/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./ingress.yaml
+  - ./receiver.yaml
+  - ./secret.sops.yaml

tmpl/cluster/flux/webhooks/kustomization.yaml

@@ -2,4 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - github
+  - ./github