feat!: Remove core and crds fluxtomizations and use raw helm chart to install CRs

Signed-off-by: Devin Buhl <devin@buhl.casa>

cluster/apps/default/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - namespace.yaml
   - echo-server
   - hajimari
+  - reloader

cluster/apps/kube-system/kustomization.yaml

@@ -3,7 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
-  - cert-manager
-  # - kured
   - metrics-server
-  - reloader

cluster/apps/kustomization.yaml

@@ -6,4 +6,4 @@ resources:
   - flux-system
   - kube-system
   - networking
-  - system-upgrade
+  # - system-upgrade

cluster/apps/networking/cert-manager/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: cert-manager
-  namespace: kube-system
+  namespace: networking
 spec:
   interval: 15m
   chart:
@@ -23,7 +23,7 @@ spec:
     remediation:
       retries: 5
   values:
-    installCRDs: false
+    installCRDs: true
     webhook:
       enabled: true
     extraArgs:

cluster/apps/networking/cert-manager/issuers/helm-release.yaml

@@ -0,0 +1,69 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cert-manager-issuers
+  namespace: networking
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: raw
+      version: v0.3.1
+      sourceRef:
+        kind: HelmRepository
+        name: dysnix
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: cert-manager
+      namespace: networking
+  values:
+    resources:
+      - apiVersion: cert-manager.io/v1
+        kind: ClusterIssuer
+        metadata:
+          name: letsencrypt-production
+        spec:
+          acme:
+            server: https://acme-v02.api.letsencrypt.org/directory
+            email: "${SECRET_CLOUDFLARE_EMAIL}"
+            privateKeySecretRef:
+              name: letsencrypt-production
+            solvers:
+              - dns01:
+                  cloudflare:
+                    email: "${SECRET_CLOUDFLARE_EMAIL}"
+                    apiKeySecretRef:
+                      name: cloudflare-api-key
+                      key: api-key
+                selector:
+                  dnsZones:
+                    - ${SECRET_DOMAIN}
+
+      - apiVersion: cert-manager.io/v1
+        kind: ClusterIssuer
+        metadata:
+          name: letsencrypt-staging
+        spec:
+          acme:
+            server: https://acme-staging-v02.api.letsencrypt.org/directory
+            email: "${SECRET_CLOUDFLARE_EMAIL}"
+            privateKeySecretRef:
+              name: letsencrypt-staging
+            solvers:
+              - dns01:
+                  cloudflare:
+                    email: "${SECRET_CLOUDFLARE_EMAIL}"
+                    apiKeySecretRef:
+                      name: cloudflare-api-key
+                      key: api-key
+                selector:
+                  dnsZones:
+                    - ${SECRET_DOMAIN}

cluster/apps/networking/cert-manager/issuers/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
+  - secret.sops.yaml

cluster/apps/networking/cert-manager/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-release.yaml
+  - issuers

cluster/apps/networking/cloudflare-ddns/cron-job.yaml

@@ -2,41 +2,41 @@
 apiVersion: batch/v1
 kind: CronJob
 metadata:
-  name: cloudflare-ddns
-  namespace: networking
+  name: &app cloudflare-ddns
+  namespace: default
 spec:
-  schedule: "0 * * * *"
-  concurrencyPolicy: "Forbid"
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 5
+  schedule: "@hourly"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 2
   jobTemplate:
     spec:
-      backoffLimit: 3
-      ttlSecondsAfterFinished: 300
+      ttlSecondsAfterFinished: 3600
       template:
         spec:
-          restartPolicy: Never
+          automountServiceAccountToken: false
+          restartPolicy: OnFailure
           containers:
-            - name: cloudflare-ddns
-              image: ghcr.io/onedr0p/kubernetes-kubectl:1.25.3
+            - name: *app
+              image: ghcr.io/onedr0p/kubernetes-kubectl:1.25.3@sha256:e1f54416c4f8779f748ba4a8d7d48d489b584e8963ee8b84310e19d6e2f0430e
               envFrom:
                 - secretRef:
-                    name: cloudflare-ddns
+                    name: *app
               command:
                 - "/bin/bash"
-                - "/app/cloudflare-ddns.sh"
+                - &scriptPath "/app/cloudflare-ddns.sh"
               volumeMounts:
-                - name: cloudflare-ddns
-                  mountPath: /app/cloudflare-ddns.sh
-                  subPath: cloudflare-ddns.sh
+                - name: *app
+                  mountPath: *scriptPath
+                  subPath: &scriptName cloudflare-ddns.sh
                   readOnly: true
           volumes:
-            - name: cloudflare-ddns
+            - name: *app
               projected:
                 defaultMode: 0775
                 sources:
                   - configMap:
-                      name: cloudflare-ddns
+                      name: *app
                       items:
-                        - key: cloudflare-ddns.sh
-                          path: cloudflare-ddns.sh
+                        - key: *scriptName
+                          path: *scriptName

cluster/apps/networking/ingress-nginx/helm-release.yaml

@@ -24,7 +24,9 @@ spec:
       retries: 5
   dependsOn:
     - name: cert-manager
-      namespace: kube-system
+      namespace: networking
+    - name: cert-manager-issuers
+      namespace: networking
   values:
     controller:
       replicaCount: 1

cluster/apps/networking/metallb/config.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: metallb.io/v1beta1
-kind: L2Advertisement
-metadata:
-  name: l2-ip
-  namespace: networking
-spec:
-  ipAddressPools:
-    - default-pool
----
-apiVersion: metallb.io/v1beta1
-kind: IPAddressPool
-metadata:
-  name: default-pool
-  namespace: networking
-spec:
-  addresses:
-    - "${METALLB_LB_RANGE}"

cluster/apps/networking/metallb/config/helm-release.yaml

@@ -0,0 +1,45 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: metallb-config
+  namespace: networking
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: raw
+      version: v0.3.1
+      sourceRef:
+        kind: HelmRepository
+        name: dysnix
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
+  dependsOn:
+    - name: metallb
+      namespace: networking
+  values:
+    resources:
+      - apiVersion: metallb.io/v1beta1
+        kind: L2Advertisement
+        metadata:
+          name: l2-ip
+          namespace: networking
+        spec:
+          ipAddressPools:
+            - default-pool
+
+      - apiVersion: metallb.io/v1beta1
+        kind: IPAddressPool
+        metadata:
+          name: default-pool
+          namespace: networking
+        spec:
+          addresses:
+            - "${METALLB_LB_RANGE}"

cluster/apps/networking/metallb/helm-release.yaml

@@ -22,7 +22,7 @@ spec:
     remediation:
       retries: 5
   values:
+    crds:
+      enabled: true
     psp:
       create: false
-    crds:
-      enabled: false

cluster/apps/networking/metallb/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - helm-release.yaml
-  - config.yaml
+  - config

cluster/apps/system-upgrade/kured/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: kured
-  namespace: kube-system
+  namespace: system-upgrade
 spec:
   interval: 15m
   chart:

cluster/apps/system-upgrade/kustomization.yaml

@@ -3,4 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
+  # renovate: datasource=docker image=rancher/system-upgrade-controller
+  - https://github.com/rancher/system-upgrade-controller/releases/download/v0.9.1/crd.yaml
   - system-upgrade-controller
+  - kured

cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml

@@ -6,11 +6,7 @@ resources:
   - plans
 images:
   - name: rancher/system-upgrade-controller
-    newName: docker.io/rancher/system-upgrade-controller
     newTag: v0.9.1
-commonLabels:
-  app.kubernetes.io/name: system-upgrade-controller
-  app.kubernetes.io/instance: system-upgrade-controller
 patchesStrategicMerge:
   # Delete namespace resource
   - |
@@ -19,3 +15,13 @@ patchesStrategicMerge:
     kind: Namespace
     metadata:
       name: system-upgrade
+  # Add labels
+  - |-
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: system-upgrade-controller
+      namespace: system-upgrade
+      labels:
+        app.kubernetes.io/name: system-upgrade-controller
+        app.kubernetes.io/instance: system-upgrade-controller