feat: move namespaces defs into apps and utilize fluxcd.io/prune label

Signed-off-by: Devin Buhl <devin@buhl.casa>

cluster/apps/default/echo-server/helm-release.yaml

@@ -17,11 +17,16 @@ spec:
       interval: 5m
   install:
     createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
   values:
     global:
       nameOverride: *app
     controller:
-      replicas: 2
+      replicas: 1
       strategy: RollingUpdate
     image:
       repository: docker.io/jmalloc/echo-server
@@ -84,15 +89,6 @@ spec:
           - hosts:
               - *host
             secretName: "echo-server-tls"
-    # # FIXME: Uncomment this block to ensure multiple
-    # # replicas of the pod are scheduled on different nodes
-    # topologySpreadConstraints:
-    #   - maxSkew: 1
-    #     topologyKey: kubernetes.io/hostname
-    #     whenUnsatisfiable: DoNotSchedule
-    #     labelSelector:
-    #       matchLabels:
-    #         app.kubernetes.io/name: *app
     resources:
       requests:
         cpu: 50m

cluster/apps/default/kustomization.yaml

@@ -2,5 +2,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
   - echo-server
   - hajimari

cluster/apps/default/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

cluster/apps/flux-system/kustomization.yaml

@@ -2,4 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - kube-vip
+  - namespace.yaml

cluster/apps/flux-system/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: flux-system
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

cluster/apps/kube-system/kube-vip/kustomization.yaml

@@ -4,3 +4,6 @@ kind: Kustomization
 resources:
   - rbac.yaml
   - daemon-set.yaml
+labels:
+  - pairs:
+      kustomize.toolkit.fluxcd.io/prune: disabled

cluster/apps/kube-system/kustomization.yaml

@@ -2,6 +2,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
+  - kube-vip
   # - kured
   - metrics-server
   - reflector

cluster/apps/kube-system/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

cluster/apps/kustomization.yaml

@@ -2,7 +2,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # - system-upgrade
   - default
+  - flux-system
   - kube-system
+  - metallb-system
   - networking
+  # - system-upgrade

cluster/apps/networking/error-pages/helm-release.yaml

@@ -15,9 +15,6 @@ spec:
         name: k8s-at-home
         namespace: flux-system
       interval: 5m
-  dependsOn:
-    - name: traefik
-      namespace: networking
   install:
     createNamespace: true
     remediation:
@@ -25,6 +22,9 @@ spec:
   upgrade:
     remediation:
       retries: 3
+  dependsOn:
+    - name: traefik
+      namespace: networking
   values:
     image:
       repository: ghcr.io/tarampampam/error-pages

cluster/apps/networking/external-dns/helm-release.yaml

@@ -17,6 +17,11 @@ spec:
       interval: 5m
   install:
     createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
   values:
     interval: 5m
     logLevel: debug

cluster/apps/networking/k8s-gateway/helm-release.yaml

@@ -15,6 +15,16 @@ spec:
         name: k8s-gateway
         namespace: flux-system
       interval: 5m
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  dependsOn:
+    - name: metallb
+      namespace: networking
   values:
     fullnameOverride: k8s-gateway
     domain: ${SECRET_DOMAIN}
@@ -25,17 +35,3 @@ spec:
       annotations:
         metallb.universe.tf/loadBalancerIPs: "${METALLB_K8S_GATEWAY_ADDR}"
       externalTrafficPolicy: Local
-    # Increase replicaCount and set an anti-affinity if you wish to scale this
-    # replicaCount: 1
-    # affinity:
-    #   podAntiAffinity:
-    #     preferredDuringSchedulingIgnoredDuringExecution:
-    #       - weight: 100
-    #         podAffinityTerm:
-    #           labelSelector:
-    #             matchExpressions:
-    #               - key: app.kubernetes.io/name
-    #                 operator: In
-    #                 values:
-    #                   - k8s-gateway
-    #           topologyKey: kubernetes.io/hostname

cluster/apps/networking/kustomization.yaml

@@ -2,6 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
   - error-pages
   - cloudflare-ddns
   - external-dns

cluster/apps/networking/metallb/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: metallb
-  namespace: metallb-system
+  namespace: networking
 spec:
   interval: 5m
   chart:

cluster/apps/networking/namespace.yaml

@@ -3,3 +3,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: networking
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

cluster/apps/networking/traefik/helm-release.yaml

@@ -15,9 +15,6 @@ spec:
         name: traefik
         namespace: flux-system
       interval: 5m
-  dependsOn:
-    - name: cert-manager
-      namespace: cert-manager
   install:
     createNamespace: true
     remediation:
@@ -25,6 +22,11 @@ spec:
   upgrade:
     remediation:
       retries: 3
+  dependsOn:
+    - name: cert-manager
+      namespace: cert-manager
+    - name: metallb
+      namespace: networking
   values:
     deployment:
       kind: Deployment

cluster/apps/system-upgrade/kustomization.yaml

@@ -2,4 +2,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
   - system-upgrade-controller

cluster/apps/system-upgrade/namespace.yaml

@@ -3,3 +3,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: system-upgrade
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

cluster/apps/system-upgrade/system-upgrade-controller/kustomization.yaml

@@ -8,5 +8,14 @@ images:
   - name: rancher/system-upgrade-controller
     newName: docker.io/rancher/system-upgrade-controller
     newTag: v0.9.1
+commonLabels:
+  app.kubernetes.io/name: system-upgrade-controller
+  app.kubernetes.io/instance: system-upgrade-controller
 patchesStrategicMerge:
-  - ./system-upgrade-patches.yaml
+  # Delete namespace resource
+  - |
+    $patch: delete
+    apiVersion: v1
+    kind: Namespace
+    metadata:
+      name: system-upgrade

cluster/apps/system-upgrade/system-upgrade-controller/system-upgrade-patches.yaml

@@ -1,9 +0,0 @@
----
-# Namespace should already exist
-# Delete the system-upgrade namespace
-# from the kustomization
-$patch: delete
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: system-upgrade

cluster/core/cert-manager/kustomization.yaml

@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
   - helm-release.yaml
   - letsencrypt-production.yaml
   - letsencrypt-staging.yaml

cluster/core/cert-manager/namespace.yaml

@@ -3,3 +3,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: cert-manager
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

cluster/core/kustomization.yaml

@@ -2,7 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespaces
   - cert-manager
-  - kube-system
-  - metallb-system

cluster/core/namespaces/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - cert-manager.yaml
-  - metallb-system.yaml
-  - networking.yaml
-  - system-upgrade.yaml

cluster/core/namespaces/metallb-system.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: metallb-system

configure

@@ -46,7 +46,7 @@ main() {
         envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-cluster.yaml" \
             > "${PROJECT_DIR}/cluster/flux/flux-system/flux-cluster.yaml"
         envsubst < "${PROJECT_DIR}/tmpl/cluster/kube-vip-daemonset.yaml" \
-            > "${PROJECT_DIR}/cluster/core/kube-system/kube-vip/daemon-set.yaml"
+            > "${PROJECT_DIR}/cluster/apps/kube-system/kube-vip/daemon-set.yaml"
         # generate cluster secrets
         envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \
             > "${PROJECT_DIR}/cluster/config/cluster-secrets.sops.yaml"
@@ -288,15 +288,15 @@ setup_github_webhook() {
         export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}"
         _log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux"
 
-        cp -rf  "${PROJECT_DIR}/tmpl/cluster/flux-system" "${PROJECT_DIR}/cluster/apps/"
+        cp -rf  "${PROJECT_DIR}/tmpl/cluster/flux-system/webhooks" "${PROJECT_DIR}/cluster/apps/flux-system"
 
         envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-system/webhooks/github/secret.sops.yaml" \
             > "${PROJECT_DIR}/cluster/apps/flux-system/webhooks/github/secret.sops.yaml"
 
         sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/flux-system/webhooks/github/secret.sops.yaml"
 
-        if [[ $(yq eval --no-doc 'contains({"resources": ["flux-system"]})' "${PROJECT_DIR}/cluster/apps/kustomization.yaml") == false ]]; then
+        if [[ $(yq eval --no-doc 'contains({"resources": ["webhooks"]})' "${PROJECT_DIR}/cluster/apps/flux-system/kustomization.yaml") == false ]]; then
-            yq --inplace '.resources += [ "flux-system" ]' "${PROJECT_DIR}/cluster/apps/kustomization.yaml"
+            yq --inplace '.resources += [ "webhooks" ]' "${PROJECT_DIR}/cluster/apps/flux-system/kustomization.yaml"
         fi
     fi
 }