Add templates and logic to set up manifests for Github webhook receiver (#308)

Co-authored-by: Devin Buhl <onedr0p@users.noreply.github.com>

tmpl/cluster/flux-system/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - webhooks

tmpl/cluster/flux-system/webhooks/github/ingress.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: webhook-receiver
+  namespace: flux-system
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-production"
+    external-dns/is-public: "true"
+    external-dns.alpha.kubernetes.io/target: "ipv4.${SECRET_DOMAIN}"
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: "flux-receiver.${SECRET_DOMAIN}"
+      http:
+        paths:
+          - path: /hook/
+            pathType: Prefix
+            backend:
+              service:
+                name: webhook-receiver
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - "flux-receiver.${SECRET_DOMAIN}"
+      secretName: flux-receiver-tls

tmpl/cluster/flux-system/webhooks/github/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ingress.yaml
+  - receiver.yaml
+  - secret.sops.yaml

tmpl/cluster/flux-system/webhooks/github/receiver.yaml

@@ -0,0 +1,43 @@
+---
+apiVersion: notification.toolkit.fluxcd.io/v1beta1
+kind: Receiver
+metadata:
+  name: github-receiver
+  namespace: flux-system
+spec:
+  type: github
+  events:
+    - ping
+    - push
+  secretRef:
+    name: github-webhook-secret
+  resources:
+    - apiVersion: source.toolkit.fluxcd.io/v1beta2
+      kind: GitRepository
+      name: flux-system
+      namespace: flux-system
+
+    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+      kind: Kustomization
+      name: apps
+      namespace: flux-system
+
+    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+      kind: Kustomization
+      name: core
+      namespace: flux-system
+
+    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+      kind: Kustomization
+      name: crds
+      namespace: flux-system
+
+    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+      kind: Kustomization
+      name: flux-system
+      namespace: flux-system
+
+    - apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+      kind: Kustomization
+      name: traefik-crds
+      namespace: flux-system

tmpl/cluster/flux-system/webhooks/github/secret.sops.yaml

@@ -0,0 +1,8 @@
+# yamllint disable
+apiVersion: v1
+kind: Secret
+metadata:
+  name: github-webhook-secret
+  namespace: flux-system
+stringData:
+  token: ${BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET}

tmpl/cluster/flux-system/webhooks/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - github