feat: move namespaces defs into apps and utilize fluxcd.io/prune label

Signed-off-by: Devin Buhl <devin@buhl.casa>
2022-06-16 19:44:26 -04:00
1 parent fc7ddff94a
commit fb5b38e7a8
@@ -17,11 +17,16 @@ spec:
      interval: 5m
  install:
    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
  values:
    global:
      nameOverride: *app
    controller:
-      replicas: 2
+      replicas: 1
      strategy: RollingUpdate
    image:
      repository: docker.io/jmalloc/echo-server
@@ -84,15 +89,6 @@ spec:
          - hosts:
              - *host
            secretName: "echo-server-tls"
-    # # FIXME: Uncomment this block to ensure multiple
-    # # replicas of the pod are scheduled on different nodes
-    # topologySpreadConstraints:
-    #   - maxSkew: 1
-    #     topologyKey: kubernetes.io/hostname
-    #     whenUnsatisfiable: DoNotSchedule
-    #     labelSelector:
-    #       matchLabels:
-    #         app.kubernetes.io/name: *app
    resources:
      requests:
        cpu: 50m
@@ -2,5 +2,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
  - echo-server
  - hajimari
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -2,4 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - kube-vip
+  - namespace.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: flux-system
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -4,3 +4,6 @@ kind: Kustomization
 resources:
  - rbac.yaml
  - daemon-set.yaml
+labels:
+  - pairs:
+      kustomize.toolkit.fluxcd.io/prune: disabled
@@ -2,6 +2,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
+  - kube-vip
  # - kured
  - metrics-server
  - reflector
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -2,7 +2,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # - system-upgrade
  - default
+  - flux-system
  - kube-system
+  - metallb-system
  - networking
+  # - system-upgrade
@@ -15,9 +15,6 @@ spec:
        name: k8s-at-home
        namespace: flux-system
      interval: 5m
-  dependsOn:
-    - name: traefik
-      namespace: networking
  install:
    createNamespace: true
    remediation:
@@ -25,6 +22,9 @@ spec:
  upgrade:
    remediation:
      retries: 3
+  dependsOn:
+    - name: traefik
+      namespace: networking
  values:
    image:
      repository: ghcr.io/tarampampam/error-pages
@@ -17,6 +17,11 @@ spec:
      interval: 5m
  install:
    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
  values:
    interval: 5m
    logLevel: debug
@@ -15,6 +15,16 @@ spec:
        name: k8s-gateway
        namespace: flux-system
      interval: 5m
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  dependsOn:
+    - name: metallb
+      namespace: networking
  values:
    fullnameOverride: k8s-gateway
    domain: ${SECRET_DOMAIN}
@@ -25,17 +35,3 @@ spec:
      annotations:
        metallb.universe.tf/loadBalancerIPs: "${METALLB_K8S_GATEWAY_ADDR}"
      externalTrafficPolicy: Local
-    # Increase replicaCount and set an anti-affinity if you wish to scale this
-    # replicaCount: 1
-    # affinity:
-    #   podAntiAffinity:
-    #     preferredDuringSchedulingIgnoredDuringExecution:
-    #       - weight: 100
-    #         podAffinityTerm:
-    #           labelSelector:
-    #             matchExpressions:
-    #               - key: app.kubernetes.io/name
-    #                 operator: In
-    #                 values:
-    #                   - k8s-gateway
-    #           topologyKey: kubernetes.io/hostname
@@ -2,6 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
  - error-pages
  - cloudflare-ddns
  - external-dns
@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
  name: metallb
-  namespace: metallb-system
+  namespace: networking
 spec:
  interval: 5m
  chart:
@@ -3,3 +3,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: networking
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -15,9 +15,6 @@ spec:
        name: traefik
        namespace: flux-system
      interval: 5m
-  dependsOn:
-    - name: cert-manager
-      namespace: cert-manager
  install:
    createNamespace: true
    remediation:
@@ -25,6 +22,11 @@ spec:
  upgrade:
    remediation:
      retries: 3
+  dependsOn:
+    - name: cert-manager
+      namespace: cert-manager
+    - name: metallb
+      namespace: networking
  values:
    deployment:
      kind: Deployment
@@ -2,4 +2,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
  - system-upgrade-controller
@@ -3,3 +3,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: system-upgrade
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -8,5 +8,14 @@ images:
  - name: rancher/system-upgrade-controller
    newName: docker.io/rancher/system-upgrade-controller
    newTag: v0.9.1
+commonLabels:
+  app.kubernetes.io/name: system-upgrade-controller
+  app.kubernetes.io/instance: system-upgrade-controller
 patchesStrategicMerge:
-  - ./system-upgrade-patches.yaml
+  # Delete namespace resource
+  - |
+    $patch: delete
+    apiVersion: v1
+    kind: Namespace
+    metadata:
+      name: system-upgrade
@@ -1,9 +0,0 @@
---
-# Namespace should already exist
-# Delete the system-upgrade namespace
-# from the kustomization
-$patch: delete
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: system-upgrade
@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
  - helm-release.yaml
  - letsencrypt-production.yaml
  - letsencrypt-staging.yaml
@@ -3,3 +3,5 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: cert-manager
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -2,7 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespaces
  - cert-manager
-  - kube-system
-  - metallb-system
@@ -1,8 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - cert-manager.yaml
-  - metallb-system.yaml
-  - networking.yaml
-  - system-upgrade.yaml
@@ -1,5 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: metallb-system
@@ -46,7 +46,7 @@ main() {
        envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-cluster.yaml" \
            > "${PROJECT_DIR}/cluster/flux/flux-system/flux-cluster.yaml"
        envsubst < "${PROJECT_DIR}/tmpl/cluster/kube-vip-daemonset.yaml" \
-            > "${PROJECT_DIR}/cluster/core/kube-system/kube-vip/daemon-set.yaml"
+            > "${PROJECT_DIR}/cluster/apps/kube-system/kube-vip/daemon-set.yaml"
        # generate cluster secrets
        envsubst < "${PROJECT_DIR}/tmpl/cluster/cluster-secrets.sops.yaml" \
            > "${PROJECT_DIR}/cluster/config/cluster-secrets.sops.yaml"
@@ -288,15 +288,15 @@ setup_github_webhook() {
        export BOOTSTRAP_FLUX_GITHUB_WEBHOOK_SECRET="${WEBHOOK_SECRET}"
        _log "INFO" "Using GitHub Token '${WEBHOOK_SECRET}' for Flux"

-        cp -rf  "${PROJECT_DIR}/tmpl/cluster/flux-system" "${PROJECT_DIR}/cluster/apps/"
+        cp -rf  "${PROJECT_DIR}/tmpl/cluster/flux-system/webhooks" "${PROJECT_DIR}/cluster/apps/flux-system"

        envsubst < "${PROJECT_DIR}/tmpl/cluster/flux-system/webhooks/github/secret.sops.yaml" \
            > "${PROJECT_DIR}/cluster/apps/flux-system/webhooks/github/secret.sops.yaml"

        sops --encrypt --in-place "${PROJECT_DIR}/cluster/apps/flux-system/webhooks/github/secret.sops.yaml"

-        if [[ $(yq eval --no-doc 'contains({"resources": ["flux-system"]})' "${PROJECT_DIR}/cluster/apps/kustomization.yaml") == false ]]; then
-            yq --inplace '.resources += [ "flux-system" ]' "${PROJECT_DIR}/cluster/apps/kustomization.yaml"
+        if [[ $(yq eval --no-doc 'contains({"resources": ["webhooks"]})' "${PROJECT_DIR}/cluster/apps/flux-system/kustomization.yaml") == false ]]; then
+            yq --inplace '.resources += [ "webhooks" ]' "${PROJECT_DIR}/cluster/apps/flux-system/kustomization.yaml"
        fi
    fi
 }