diff --git a/AGENTS.md b/AGENTS.md index ae13701..817bb15 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -57,7 +57,9 @@ k8s/ # All Kubernetes manifests infrastructure/ # Organized by resource type: controllers/, certificates/, gateway/, # cluster-policies/, external-secrets/, alerts/, vault-*/ (OpenBao), etc. apps/ # App deployments — whoami, homepage, headlamp - components/ # Shared opt-in Kustomize components used by provider profiles + components/ # Shared Kustomize components: HelmRelease defaults and drift detection + # (listed by every HelmRelease-owning kustomization), plus the + # opt-in profile transformations providers/ # Provider-specific overlays (TEMPLATE-OWNED) docker/ # Local/CI provider (e.g. disables SPIRE mutual auth) hetzner/ # Production provider diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 84dad30..da0ecc3 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -100,10 +100,16 @@ The cluster configuration lives under `k8s/*`: - [`infrastructure`](../k8s/bases/infrastructure) — infrastructure components. - [`apps`](../k8s/bases/apps) — the demo applications. - [`bootstrap`](../k8s/bases/bootstrap) — the foundational **bootstrap layer**: shared substitution variables (`variables-base` ConfigMap + SOPS-encrypted Secret) and cluster-scoped PriorityClasses, reconciled by the `bootstrap` Flux Kustomization before everything that `dependsOn` it. -- [`components/`](../k8s/components) — shared opt-in Kustomize components. Only the opt-in provider - profiles use them, to switch to [Coroot](TEMPLATING.md#select-the-transitional-coroot-profile) or - add the [recommended-labels policy](TEMPLATING.md#add-recommended-workload-labels-at-admission); - the default paths use none of them. +- [`components/`](../k8s/components) — shared Kustomize components. + - `helmrelease-flux-defaults` and `helmrelease-drift-detection` are listed by every + kustomization that owns a HelmRelease, so each base carries them to every consumer. + They set the install/upgrade retry policy once, and turn on drift + detection so Flux restores a chart resource that is deleted or edited out of band. A new + HelmRelease inherits both; do not repeat the remediation block in it. + - The rest are opt-in. Only the opt-in provider profiles use them, to switch to + [Coroot](TEMPLATING.md#select-the-transitional-coroot-profile) or add the + [recommended-labels policy](TEMPLATING.md#add-recommended-workload-labels-at-admission); + the default paths use none of them. ### Kustomize overlay flow diff --git a/docs/TEMPLATING.md b/docs/TEMPLATING.md index 6cc11e3..5b775e9 100644 --- a/docs/TEMPLATING.md +++ b/docs/TEMPLATING.md @@ -252,9 +252,10 @@ See [`.github/workflows/`](../.github/workflows) for the exact names in use. and the rest of the controller set. - [`k8s/bases/apps/`](../k8s/bases/apps) — the demo applications (homepage, whoami, headlamp). -- [`k8s/components/`](../k8s/components) — shared opt-in transformations used by - provider profiles, such as removing OpenCost across controller, infrastructure, - and app layers. +- [`k8s/components/`](../k8s/components) — shared transformations: the HelmRelease + retry defaults and drift detection every HelmRelease-owning kustomization lists, and opt-in + profile transformations such as removing OpenCost across controller, + infrastructure, and app layers. - [`k8s/providers/{docker,hetzner}/`](../k8s/providers) — provider-specific assembly of the bases. diff --git a/k8s/bases/apps/headlamp/helm-release.yaml b/k8s/bases/apps/headlamp/helm-release.yaml index 0ec1187..5db2184 100644 --- a/k8s/bases/apps/headlamp/helm-release.yaml +++ b/k8s/bases/apps/headlamp/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: headlamp diff --git a/k8s/bases/apps/headlamp/kustomization.yaml b/k8s/bases/apps/headlamp/kustomization.yaml index 5a24399..c168bc0 100644 --- a/k8s/bases/apps/headlamp/kustomization.yaml +++ b/k8s/bases/apps/headlamp/kustomization.yaml @@ -9,3 +9,6 @@ resources: - http-route.yaml - http-scaled-object.yaml - cilium-network-policy.yaml +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/apps/homepage/helm-release.yaml b/k8s/bases/apps/homepage/helm-release.yaml index 18bb1ee..dd157c0 100644 --- a/k8s/bases/apps/homepage/helm-release.yaml +++ b/k8s/bases/apps/homepage/helm-release.yaml @@ -11,13 +11,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: homepage diff --git a/k8s/bases/apps/homepage/kustomization.yaml b/k8s/bases/apps/homepage/kustomization.yaml index 241136f..fb305dd 100644 --- a/k8s/bases/apps/homepage/kustomization.yaml +++ b/k8s/bases/apps/homepage/kustomization.yaml @@ -8,3 +8,6 @@ resources: - namespace.yaml - pod-disruption-budget.yaml - cilium-network-policy.yaml +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/apps/whoami/helm-release.yaml b/k8s/bases/apps/whoami/helm-release.yaml index a146050..764654e 100644 --- a/k8s/bases/apps/whoami/helm-release.yaml +++ b/k8s/bases/apps/whoami/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: whoami diff --git a/k8s/bases/apps/whoami/kustomization.yaml b/k8s/bases/apps/whoami/kustomization.yaml index a35796d..e9d6d87 100644 --- a/k8s/bases/apps/whoami/kustomization.yaml +++ b/k8s/bases/apps/whoami/kustomization.yaml @@ -7,3 +7,6 @@ resources: - http-route.yaml - http-scaled-object.yaml - cilium-network-policy.yaml +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/audit-log-forwarder/helm-release.yaml b/k8s/bases/infrastructure/audit-log-forwarder/helm-release.yaml index da3aa81..5ce466e 100644 --- a/k8s/bases/infrastructure/audit-log-forwarder/helm-release.yaml +++ b/k8s/bases/infrastructure/audit-log-forwarder/helm-release.yaml @@ -12,13 +12,6 @@ metadata: spec: interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: opentelemetry-collector diff --git a/k8s/bases/infrastructure/audit-log-forwarder/kustomization.yaml b/k8s/bases/infrastructure/audit-log-forwarder/kustomization.yaml index 9072e0d..640be0c 100644 --- a/k8s/bases/infrastructure/audit-log-forwarder/kustomization.yaml +++ b/k8s/bases/infrastructure/audit-log-forwarder/kustomization.yaml @@ -5,3 +5,6 @@ kind: Kustomization resources: - helm-repository.yaml - helm-release.yaml +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/alloy/helm-release-audit-collector.yaml b/k8s/bases/infrastructure/controllers/alloy/helm-release-audit-collector.yaml index 4dc729f..37e1aa3 100644 --- a/k8s/bases/infrastructure/controllers/alloy/helm-release-audit-collector.yaml +++ b/k8s/bases/infrastructure/controllers/alloy/helm-release-audit-collector.yaml @@ -13,13 +13,6 @@ spec: namespace: monitoring interval: 5m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: alloy diff --git a/k8s/bases/infrastructure/controllers/alloy/helm-release.yaml b/k8s/bases/infrastructure/controllers/alloy/helm-release.yaml index 0e468ca..db337b3 100644 --- a/k8s/bases/infrastructure/controllers/alloy/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/alloy/helm-release.yaml @@ -13,13 +13,6 @@ spec: namespace: monitoring interval: 5m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: alloy diff --git a/k8s/bases/infrastructure/controllers/alloy/kustomization.yaml b/k8s/bases/infrastructure/controllers/alloy/kustomization.yaml index 6a5d21c..a2158b8 100644 --- a/k8s/bases/infrastructure/controllers/alloy/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/alloy/kustomization.yaml @@ -4,3 +4,6 @@ kind: Kustomization resources: - helm-release.yaml - helm-release-audit-collector.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/cert-manager/helm-release.yaml b/k8s/bases/infrastructure/controllers/cert-manager/helm-release.yaml index 35024c7..4b28d2e 100644 --- a/k8s/bases/infrastructure/controllers/cert-manager/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/cert-manager/helm-release.yaml @@ -19,13 +19,8 @@ spec: name: cert-manager install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml values: # Restricted PSS baseline: add runAsNonRoot to container SCs (chart leaves it unset, which fails validate-container-security). diff --git a/k8s/bases/infrastructure/controllers/cert-manager/kustomization.yaml b/k8s/bases/infrastructure/controllers/cert-manager/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/cert-manager/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/cert-manager/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/cilium/helm-release.yaml b/k8s/bases/infrastructure/controllers/cilium/helm-release.yaml index b95e1a1..72bc363 100644 --- a/k8s/bases/infrastructure/controllers/cilium/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/cilium/helm-release.yaml @@ -18,13 +18,6 @@ spec: name: cilium interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/cilium/cilium/blob/main/install/kubernetes/cilium/values.yaml values: securityContext: diff --git a/k8s/bases/infrastructure/controllers/cilium/kustomization.yaml b/k8s/bases/infrastructure/controllers/cilium/kustomization.yaml index 1f342a9..b308d70 100644 --- a/k8s/bases/infrastructure/controllers/cilium/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/cilium/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/cloudnative-pg/helm-release.yaml b/k8s/bases/infrastructure/controllers/cloudnative-pg/helm-release.yaml index 61c770d..89d58c8 100644 --- a/k8s/bases/infrastructure/controllers/cloudnative-pg/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/cloudnative-pg/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: cloudnative-pg diff --git a/k8s/bases/infrastructure/controllers/cloudnative-pg/kustomization.yaml b/k8s/bases/infrastructure/controllers/cloudnative-pg/kustomization.yaml index d4bbacd..964944e 100644 --- a/k8s/bases/infrastructure/controllers/cloudnative-pg/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/cloudnative-pg/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - pod-disruption-budget.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/coroot/helm-release.yaml b/k8s/bases/infrastructure/controllers/coroot/helm-release.yaml index 5cf2832..5c8c991 100644 --- a/k8s/bases/infrastructure/controllers/coroot/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/coroot/helm-release.yaml @@ -11,13 +11,8 @@ spec: timeout: 10m install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: coroot-operator diff --git a/k8s/bases/infrastructure/controllers/coroot/kustomization.yaml b/k8s/bases/infrastructure/controllers/coroot/kustomization.yaml index 59132d1..4461995 100644 --- a/k8s/bases/infrastructure/controllers/coroot/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/coroot/kustomization.yaml @@ -9,3 +9,6 @@ resources: - helm-repository.yaml - helm-release.yaml - http-route.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/dex/helm-release.yaml b/k8s/bases/infrastructure/controllers/dex/helm-release.yaml index edd95ce..ccd0f28 100644 --- a/k8s/bases/infrastructure/controllers/dex/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/dex/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: dex diff --git a/k8s/bases/infrastructure/controllers/dex/kustomization.yaml b/k8s/bases/infrastructure/controllers/dex/kustomization.yaml index db7e25c..49d4854 100644 --- a/k8s/bases/infrastructure/controllers/dex/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/dex/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml b/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml index bb210bb..0abb2f4 100644 --- a/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml @@ -11,13 +11,8 @@ spec: timeout: 10m install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: external-secrets diff --git a/k8s/bases/infrastructure/controllers/external-secrets/kustomization.yaml b/k8s/bases/infrastructure/controllers/external-secrets/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/external-secrets/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/external-secrets/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/flux-operator/helm-release.yaml b/k8s/bases/infrastructure/controllers/flux-operator/helm-release.yaml index 85a8147..993b89e 100644 --- a/k8s/bases/infrastructure/controllers/flux-operator/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/flux-operator/helm-release.yaml @@ -18,13 +18,6 @@ spec: name: flux-operator interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true values: web: config: diff --git a/k8s/bases/infrastructure/controllers/flux-operator/kustomization.yaml b/k8s/bases/infrastructure/controllers/flux-operator/kustomization.yaml index 1f342a9..b308d70 100644 --- a/k8s/bases/infrastructure/controllers/flux-operator/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/flux-operator/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/keda-http-add-on/helm-release.yaml b/k8s/bases/infrastructure/controllers/keda-http-add-on/helm-release.yaml index 36dc079..273c03e 100644 --- a/k8s/bases/infrastructure/controllers/keda-http-add-on/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/keda-http-add-on/helm-release.yaml @@ -11,13 +11,6 @@ spec: timeout: 10m dependsOn: - name: keda - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: keda-add-ons-http diff --git a/k8s/bases/infrastructure/controllers/keda-http-add-on/kustomization.yaml b/k8s/bases/infrastructure/controllers/keda-http-add-on/kustomization.yaml index 1bd68dc..fb95de6 100644 --- a/k8s/bases/infrastructure/controllers/keda-http-add-on/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/keda-http-add-on/kustomization.yaml @@ -3,3 +3,6 @@ kind: Kustomization resources: - helm-release.yaml - reference-grant.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/keda/helm-release.yaml b/k8s/bases/infrastructure/controllers/keda/helm-release.yaml index a933ba8..b6abd1f 100644 --- a/k8s/bases/infrastructure/controllers/keda/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/keda/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: keda diff --git a/k8s/bases/infrastructure/controllers/keda/kustomization.yaml b/k8s/bases/infrastructure/controllers/keda/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/keda/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/keda/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/kube-prometheus-stack/helm-release.yaml b/k8s/bases/infrastructure/controllers/kube-prometheus-stack/helm-release.yaml index ade9063..fe9c1b4 100644 --- a/k8s/bases/infrastructure/controllers/kube-prometheus-stack/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/kube-prometheus-stack/helm-release.yaml @@ -17,13 +17,8 @@ spec: name: prometheus-community install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true timeout: 15m # https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml # diff --git a/k8s/bases/infrastructure/controllers/kube-prometheus-stack/kustomization.yaml b/k8s/bases/infrastructure/controllers/kube-prometheus-stack/kustomization.yaml index 2d0c305..1fcb1be 100644 --- a/k8s/bases/infrastructure/controllers/kube-prometheus-stack/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/kube-prometheus-stack/kustomization.yaml @@ -8,3 +8,6 @@ resources: - http-route-prometheus.yaml - http-route-alertmanager.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml index efe6a59..c15b3f2 100644 --- a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 15m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: kubescape-operator diff --git a/k8s/bases/infrastructure/controllers/kubescape/kustomization.yaml b/k8s/bases/infrastructure/controllers/kubescape/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/kubescape/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/kubescape/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/kyverno/helm-release.yaml b/k8s/bases/infrastructure/controllers/kyverno/helm-release.yaml index 802b6bf..e9024da 100644 --- a/k8s/bases/infrastructure/controllers/kyverno/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/kyverno/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 15m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: kyverno diff --git a/k8s/bases/infrastructure/controllers/kyverno/kustomization.yaml b/k8s/bases/infrastructure/controllers/kyverno/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/kyverno/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/kyverno/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/loki/helm-release.yaml b/k8s/bases/infrastructure/controllers/loki/helm-release.yaml index 14cbbeb..a00d792 100644 --- a/k8s/bases/infrastructure/controllers/loki/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/loki/helm-release.yaml @@ -13,13 +13,6 @@ spec: namespace: monitoring interval: 5m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: loki diff --git a/k8s/bases/infrastructure/controllers/loki/kustomization.yaml b/k8s/bases/infrastructure/controllers/loki/kustomization.yaml index 9a78d93..ca307de 100644 --- a/k8s/bases/infrastructure/controllers/loki/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/loki/kustomization.yaml @@ -4,3 +4,6 @@ kind: Kustomization resources: - helm-repository.yaml - helm-release.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/metrics-server/helm-release.yaml b/k8s/bases/infrastructure/controllers/metrics-server/helm-release.yaml index 2066332..a271147 100644 --- a/k8s/bases/infrastructure/controllers/metrics-server/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/metrics-server/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: metrics-server diff --git a/k8s/bases/infrastructure/controllers/metrics-server/kustomization.yaml b/k8s/bases/infrastructure/controllers/metrics-server/kustomization.yaml index 6b341b9..3d1e23d 100644 --- a/k8s/bases/infrastructure/controllers/metrics-server/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/metrics-server/kustomization.yaml @@ -3,3 +3,6 @@ kind: Kustomization resources: - helm-release.yaml - helm-repository.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/oauth2-proxy/helm-release.yaml b/k8s/bases/infrastructure/controllers/oauth2-proxy/helm-release.yaml index 2499c78..20d0ac4 100644 --- a/k8s/bases/infrastructure/controllers/oauth2-proxy/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/oauth2-proxy/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: oauth2-proxy @@ -103,4 +96,3 @@ spec: reverse_proxy = true ingress: enabled: false - diff --git a/k8s/bases/infrastructure/controllers/oauth2-proxy/kustomization.yaml b/k8s/bases/infrastructure/controllers/oauth2-proxy/kustomization.yaml index c7886f6..7020015 100644 --- a/k8s/bases/infrastructure/controllers/oauth2-proxy/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/oauth2-proxy/kustomization.yaml @@ -9,3 +9,6 @@ resources: - reference-grant.yaml - cilium-network-policy.yaml - cilium-network-policy-default-deny.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/openbao/helm-release.yaml b/k8s/bases/infrastructure/controllers/openbao/helm-release.yaml index 80dcf00..411fc4d 100644 --- a/k8s/bases/infrastructure/controllers/openbao/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/openbao/helm-release.yaml @@ -8,13 +8,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: openbao diff --git a/k8s/bases/infrastructure/controllers/openbao/kustomization.yaml b/k8s/bases/infrastructure/controllers/openbao/kustomization.yaml index db7e25c..49d4854 100644 --- a/k8s/bases/infrastructure/controllers/openbao/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/openbao/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/opencost/helm-release.yaml b/k8s/bases/infrastructure/controllers/opencost/helm-release.yaml index e0eeef5..9928105 100644 --- a/k8s/bases/infrastructure/controllers/opencost/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/opencost/helm-release.yaml @@ -11,13 +11,6 @@ spec: namespace: monitoring interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: opencost @@ -77,7 +70,6 @@ spec: external: enabled: true url: "http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090" - # Hetzner Cloud custom pricing — CX33 monthly cap decomposed into # per-resource-unit USD costs. CX33 spec verified live with # `kubectl get nodes`: 4 vCPU, 7916176 KiB RAM (8 GB nominal), 80 GB NVMe. @@ -126,7 +118,6 @@ spec: zoneNetworkEgress: 0.001164 regionNetworkEgress: 0.001164 internetNetworkEgress: 0.001164 - exporter: replicas: 1 resources: @@ -142,7 +133,6 @@ spec: # still well under the chart's 1Gi default. limits: memory: 512Mi - ui: enabled: true securityContext: @@ -153,7 +143,6 @@ spec: memory: 55Mi limits: memory: 128Mi - metrics: serviceMonitor: enabled: true diff --git a/k8s/bases/infrastructure/controllers/opencost/kustomization.yaml b/k8s/bases/infrastructure/controllers/opencost/kustomization.yaml index db7e25c..49d4854 100644 --- a/k8s/bases/infrastructure/controllers/opencost/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/opencost/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/reloader/helm-release.yaml b/k8s/bases/infrastructure/controllers/reloader/helm-release.yaml index 7b2f112..7760966 100644 --- a/k8s/bases/infrastructure/controllers/reloader/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/reloader/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: reloader diff --git a/k8s/bases/infrastructure/controllers/reloader/kustomization.yaml b/k8s/bases/infrastructure/controllers/reloader/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/reloader/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/reloader/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/testkube/helm-release.yaml b/k8s/bases/infrastructure/controllers/testkube/helm-release.yaml index 3d0bf0d..dced246 100644 --- a/k8s/bases/infrastructure/controllers/testkube/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/testkube/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: testkube diff --git a/k8s/bases/infrastructure/controllers/testkube/kustomization.yaml b/k8s/bases/infrastructure/controllers/testkube/kustomization.yaml index 24316fc..dc05156 100644 --- a/k8s/bases/infrastructure/controllers/testkube/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/testkube/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/tetragon/helm-release.yaml b/k8s/bases/infrastructure/controllers/tetragon/helm-release.yaml index d5da5ce..49dab1f 100644 --- a/k8s/bases/infrastructure/controllers/tetragon/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/tetragon/helm-release.yaml @@ -17,13 +17,6 @@ spec: name: cilium interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/cilium/tetragon/blob/main/install/kubernetes/tetragon/values.yaml # # eBPF-based runtime security observability. Sibling to the Cilium diff --git a/k8s/bases/infrastructure/controllers/tetragon/kustomization.yaml b/k8s/bases/infrastructure/controllers/tetragon/kustomization.yaml index 2fa2de2..1520119 100644 --- a/k8s/bases/infrastructure/controllers/tetragon/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/tetragon/kustomization.yaml @@ -3,3 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - helm-release.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/trust-manager/helm-release.yaml b/k8s/bases/infrastructure/controllers/trust-manager/helm-release.yaml index 5f58e8e..5a0e899 100644 --- a/k8s/bases/infrastructure/controllers/trust-manager/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/trust-manager/helm-release.yaml @@ -20,13 +20,8 @@ spec: name: cert-manager install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true # https://artifacthub.io/packages/helm/cert-manager/trust-manager values: crds: diff --git a/k8s/bases/infrastructure/controllers/trust-manager/kustomization.yaml b/k8s/bases/infrastructure/controllers/trust-manager/kustomization.yaml index 34a8531..957b94b 100644 --- a/k8s/bases/infrastructure/controllers/trust-manager/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/trust-manager/kustomization.yaml @@ -2,3 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - helm-release.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/velero/helm-release.yaml b/k8s/bases/infrastructure/controllers/velero/helm-release.yaml index 0715f9f..0469af3 100644 --- a/k8s/bases/infrastructure/controllers/velero/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/velero/helm-release.yaml @@ -17,13 +17,8 @@ spec: name: vmware-tanzu install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true timeout: 15m # https://github.com/vmware-tanzu/helm-charts/blob/main/charts/velero/values.yaml values: @@ -36,13 +31,11 @@ spec: volumeMounts: - mountPath: /target name: plugins - # Mount our SOPS-derived R2 credentials secret instead of the chart's # generated one. The chart only consults it; it never writes to it. credentials: useSecret: true existingSecret: velero-r2-credentials - # Cloudflare R2 backup target. Bucket + endpoint come from the shared # variables-base ConfigMap; prefix is reused per consumer (PR #3). configuration: @@ -62,7 +55,6 @@ spec: defaultVolumesToFsBackup: true uploaderType: kopia features: "" - # Run Velero itself with HA primitives matching the rest of the # operator tier (PR #2b). Server is leader-elected so 2 replicas = # instant failover, not extra capacity. @@ -85,7 +77,6 @@ spec: app.kubernetes.io/instance: velero strategy: type: Recreate - # Node agent: DaemonSet, runs the Kopia uploader on every node that has # PVCs. Defaults are sane; just confirm rolling update. deployNodeAgent: true @@ -94,7 +85,6 @@ spec: type: RollingUpdate rollingUpdate: maxUnavailable: 1 - # Daily backup of every namespace that has PVCs. 14-day retention # matches the 24h RPO target. Long-term retention is handled by R2 # object lock + lifecycle, not by Velero, so a corrupted controller @@ -114,10 +104,8 @@ spec: - velero snapshotMoveData: true defaultVolumesToFsBackup: true - metrics: enabled: true - resources: requests: cpu: 25m diff --git a/k8s/bases/infrastructure/controllers/velero/kustomization.yaml b/k8s/bases/infrastructure/controllers/velero/kustomization.yaml index 3a9d29f..b052bda 100644 --- a/k8s/bases/infrastructure/controllers/velero/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/velero/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-release.yaml - cilium-network-policy.yaml - secret-velero-r2-credentials.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/helm-release.yaml b/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/helm-release.yaml index d415bfc..218b175 100644 --- a/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true test: enable: false chart: diff --git a/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/kustomization.yaml b/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/components/helmrelease-drift-detection/kustomization.yaml b/k8s/components/helmrelease-drift-detection/kustomization.yaml new file mode 100644 index 0000000..2e1c1aa --- /dev/null +++ b/k8s/components/helmrelease-drift-detection/kustomization.yaml @@ -0,0 +1,76 @@ +--- +# Drift detection for every HelmRelease. +# +# Without it, Flux's helm-controller re-applies a chart's resources only when the +# chart or its values change. A Helm-rendered resource that is deleted or edited +# out of band stays broken while the HelmRelease still reports Ready. With +# `driftDetection.mode: enabled`, the controller restores deleted resources and +# reverts out-of-band edits on every reconcile. +# +# Ignored fields are owned by other controllers at runtime. Enforcing the chart's +# value would make Flux fight them and report DriftDetected on every reconcile: +# * /spec/replicas (Deployment, StatefulSet): autoscalers and progressive +# delivery set it. +# * /spec/template (Deployment, StatefulSet, DaemonSet): the Kyverno mutate +# policies in bases/infrastructure/cluster-policies (resource defaults, +# security context, anti-affinity, topology spread, service-account token +# automount) rewrite the pod template on admission, so the rendered spec +# never matches the live one. A deleted workload is still drift and is +# restored; only field-level edits to a running pod template are not reverted +# until the next chart or values change. +# * /metadata/labels (Deployment, StatefulSet, DaemonSet): the optional +# recommended-labels policy adds labels to workloads that lack them. +# * Webhook configurations' /webhooks, APIService /spec/caBundle and CRD +# conversion caBundle: cert-manager and operators inject CA bundles at runtime. +# Ignore paths are JSON Pointers, which cannot select one field in every array +# entry, so the whole webhooks list is ignored rather than each entry's CA +# bundle by index. A deleted webhook configuration is still drift and is +# restored. +# +# Listed as a component by every kustomization that owns a HelmRelease, so each +# base carries its defaults to every consumer, not only to the provider layers. +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component +patches: + - target: + group: helm.toolkit.fluxcd.io + kind: HelmRelease + patch: | + - op: add + path: /spec/driftDetection + value: + mode: enabled + ignore: + - target: + kind: Deployment + paths: + - /spec/replicas + - /spec/template + - /metadata/labels + - target: + kind: StatefulSet + paths: + - /spec/replicas + - /spec/template + - /metadata/labels + - target: + kind: DaemonSet + paths: + - /spec/template + - /metadata/labels + - target: + kind: ValidatingWebhookConfiguration + paths: + - /webhooks + - target: + kind: MutatingWebhookConfiguration + paths: + - /webhooks + - target: + kind: APIService + paths: + - /spec/caBundle + - target: + kind: CustomResourceDefinition + paths: + - /spec/conversion/webhook/clientConfig/caBundle diff --git a/k8s/components/helmrelease-flux-defaults/kustomization.yaml b/k8s/components/helmrelease-flux-defaults/kustomization.yaml new file mode 100644 index 0000000..6f71f52 --- /dev/null +++ b/k8s/components/helmrelease-flux-defaults/kustomization.yaml @@ -0,0 +1,30 @@ +--- +# Flux reliability defaults for every HelmRelease. +# +# The flux best-practice cluster policy requires every HelmRelease to retry a +# failed install or upgrade and to remediate the last failure. The block is the +# same for every release, so it is defined once here and merged into each +# HelmRelease of every kustomization that lists this component. +# +# Strategic merge, not JSON6902: it creates spec.install and spec.upgrade when +# absent and leaves sibling fields (install.crds, upgrade.crds, upgrade.force) +# untouched. +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component +patches: + - target: + group: helm.toolkit.fluxcd.io + kind: HelmRelease + patch: | + apiVersion: helm.toolkit.fluxcd.io/v2 + kind: HelmRelease + metadata: + name: not-used + spec: + install: + remediation: + retries: -1 + upgrade: + remediation: + retries: -1 + remediateLastFailure: true diff --git a/k8s/providers/docker/infrastructure/controllers/coredns/helm-release.yaml b/k8s/providers/docker/infrastructure/controllers/coredns/helm-release.yaml index ef85dd4..4b74151 100644 --- a/k8s/providers/docker/infrastructure/controllers/coredns/helm-release.yaml +++ b/k8s/providers/docker/infrastructure/controllers/coredns/helm-release.yaml @@ -20,13 +20,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: coredns diff --git a/k8s/providers/docker/infrastructure/controllers/coredns/kustomization.yaml b/k8s/providers/docker/infrastructure/controllers/coredns/kustomization.yaml index 6b341b9..5ef69c1 100644 --- a/k8s/providers/docker/infrastructure/controllers/coredns/kustomization.yaml +++ b/k8s/providers/docker/infrastructure/controllers/coredns/kustomization.yaml @@ -3,3 +3,6 @@ kind: Kustomization resources: - helm-release.yaml - helm-repository.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/docker/infrastructure/controllers/kubescape/patches/disable-heavy-capabilities.yaml b/k8s/providers/docker/infrastructure/controllers/kubescape/patches/disable-heavy-capabilities.yaml index d006c9b..fdf8b53 100644 --- a/k8s/providers/docker/infrastructure/controllers/kubescape/patches/disable-heavy-capabilities.yaml +++ b/k8s/providers/docker/infrastructure/controllers/kubescape/patches/disable-heavy-capabilities.yaml @@ -11,13 +11,8 @@ spec: # success immediately after applying resources. install: disableWait: true - remediation: - retries: -1 upgrade: disableWait: true - remediation: - retries: -1 - remediateLastFailure: true values: capabilities: # eBPF-based runtime detection is unavailable on Docker-provider nodes. diff --git a/k8s/providers/hetzner/infrastructure/controllers/external-dns/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/external-dns/helm-release.yaml index 73de8ac..4894a48 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/external-dns/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/external-dns/helm-release.yaml @@ -8,13 +8,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: external-dns diff --git a/k8s/providers/hetzner/infrastructure/controllers/external-dns/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/external-dns/kustomization.yaml index 7e6652c..85971bc 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/external-dns/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/external-dns/kustomization.yaml @@ -7,3 +7,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/helm-release.yaml index 36a99b3..2c30a62 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/helm-release.yaml @@ -16,13 +16,6 @@ spec: name: hcloud interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/hetznercloud/hcloud-cloud-controller-manager/blob/main/chart/values.yaml values: networking: diff --git a/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/kustomization.yaml index dcb3285..a68a79c 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/kustomization.yaml @@ -4,3 +4,6 @@ kind: Kustomization resources: - helm-release.yaml - pod-disruption-budget.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/helm-release.yaml index 0acb95b..1c5150e 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/helm-release.yaml @@ -17,13 +17,6 @@ spec: name: hcloud interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/hetznercloud/csi-driver/blob/main/chart/values.yaml values: global: diff --git a/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/kustomization.yaml index 8f66ec2..2799641 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/kustomization.yaml @@ -5,3 +5,6 @@ resources: - secret-hcloud.yaml - helm-release.yaml - helm-repository.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml index 8037d05..f3b4a4a 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml @@ -18,13 +18,8 @@ spec: interval: 10m0s install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true timeout: 10m # https://github.com/longhorn/charts/blob/master/charts/longhorn/values.yaml values: @@ -42,7 +37,6 @@ spec: # Restrict Longhorn system-managed pods (instance-managers, etc.) # to storage nodes. Prevents ~100Mi overhead per non-storage node. systemManagedComponentsNodeSelector: "node.longhorn.io/create-default-disk:true" - persistence: # Longhorn is the default StorageClass (replaces hcloud for new PVCs). defaultClass: true @@ -50,20 +44,17 @@ spec: # RWX support via Longhorn's built-in NFS server. defaultFsType: ext4 reclaimPolicy: Delete - # Resource-conscious settings for cx23 workers (2 vCPU, 4 GB RAM). csi: attacherReplicaCount: ${longhorn_csi_attacher_replicas:=1} provisionerReplicaCount: ${longhorn_csi_provisioner_replicas:=1} resizerReplicaCount: ${longhorn_csi_resizer_replicas:=1} snapshotterReplicaCount: ${longhorn_csi_snapshotter_replicas:=1} - # Restrict Longhorn DaemonSets to storage-labeled nodes only. # Control planes don't carry disks and no pods on them mount Longhorn # volumes — running longhorn-manager there wastes ~250Mi per node. longhornManager: nodeSelector: node.longhorn.io/create-default-disk: "true" - longhornUI: replicas: ${longhorn_ui_replicas:=1} diff --git a/k8s/providers/hetzner/infrastructure/controllers/longhorn/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/longhorn/kustomization.yaml index d6816fd..b67efe6 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/longhorn/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/longhorn/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - helm-release.yaml - cilium-network-policy.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/helm-release.yaml index c5cb240..e982a41 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/helm-release.yaml @@ -8,13 +8,6 @@ spec: - name: cert-manager interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: origin-ca-issuer diff --git a/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/kustomization.yaml index f9d3b70..319f4ce 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/kustomization.yaml @@ -6,3 +6,6 @@ resources: - pod-disruption-budget.yaml - https://raw.githubusercontent.com/cloudflare/origin-ca-issuer/trunk/deploy/crds/cert-manager.k8s.cloudflare.com_clusteroriginissuers.yaml - https://raw.githubusercontent.com/cloudflare/origin-ca-issuer/trunk/deploy/crds/cert-manager.k8s.cloudflare.com_originissuers.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/