From ecf781f5191cc50f88b48ee1d443ca481b1937e5 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sun, 27 Sep 2026 18:36:13 +0200 Subject: [PATCH 1/2] feat(flux): define HelmRelease retry defaults and drift detection once as components Every provider layer that renders HelmReleases now applies two shared Kustomize components: the install/upgrade remediation block the flux best-practice policy requires, and drift detection with the runtime-owned fields ignored. The remediation block is removed from each HelmRelease, which inherits it instead. Co-Authored-By: Claude Opus 5.5 (1M context) --- AGENTS.md | 3 +- docs/ARCHITECTURE.md | 13 ++-- docs/TEMPLATING.md | 7 +- k8s/bases/apps/headlamp/helm-release.yaml | 7 -- k8s/bases/apps/homepage/helm-release.yaml | 7 -- k8s/bases/apps/whoami/helm-release.yaml | 7 -- .../audit-log-forwarder/helm-release.yaml | 7 -- .../alloy/helm-release-audit-collector.yaml | 7 -- .../controllers/alloy/helm-release.yaml | 7 -- .../cert-manager/helm-release.yaml | 5 -- .../controllers/cilium/helm-release.yaml | 7 -- .../cloudnative-pg/helm-release.yaml | 7 -- .../controllers/coroot/helm-release.yaml | 5 -- .../controllers/dex/helm-release.yaml | 7 -- .../external-secrets/helm-release.yaml | 5 -- .../flux-operator/helm-release.yaml | 7 -- .../keda-http-add-on/helm-release.yaml | 7 -- .../controllers/keda/helm-release.yaml | 7 -- .../kube-prometheus-stack/helm-release.yaml | 5 -- .../controllers/kubescape/helm-release.yaml | 7 -- .../controllers/kyverno/helm-release.yaml | 7 -- .../controllers/loki/helm-release.yaml | 7 -- .../metrics-server/helm-release.yaml | 7 -- .../oauth2-proxy/helm-release.yaml | 8 --- .../controllers/openbao/helm-release.yaml | 7 -- .../controllers/opencost/helm-release.yaml | 11 --- .../controllers/reloader/helm-release.yaml | 7 -- .../controllers/testkube/helm-release.yaml | 7 -- .../controllers/tetragon/helm-release.yaml | 7 -- .../trust-manager/helm-release.yaml | 5 -- .../controllers/velero/helm-release.yaml | 12 ---- .../vertical-pod-autoscaler/helm-release.yaml | 7 -- .../kustomization.yaml | 71 +++++++++++++++++++ .../kustomization.yaml | 30 ++++++++ .../docker/apps-coroot/kustomization.yaml | 2 + k8s/providers/docker/apps/kustomization.yaml | 3 + .../kustomization.yaml | 2 + .../infrastructure-coroot/kustomization.yaml | 2 + .../controllers/coredns/helm-release.yaml | 7 -- .../patches/disable-heavy-capabilities.yaml | 5 -- .../controllers/kustomization.yaml | 3 + .../docker/infrastructure/kustomization.yaml | 3 + .../hetzner/apps-coroot/kustomization.yaml | 2 + k8s/providers/hetzner/apps/kustomization.yaml | 3 + .../kustomization.yaml | 2 + .../infrastructure-coroot/kustomization.yaml | 2 + .../external-dns/helm-release.yaml | 7 -- .../controllers/hcloud-ccm/helm-release.yaml | 7 -- .../controllers/hcloud-csi/helm-release.yaml | 7 -- .../controllers/kustomization.yaml | 3 + .../controllers/longhorn/helm-release.yaml | 9 --- .../origin-ca-issuer/helm-release.yaml | 7 -- .../hetzner/infrastructure/kustomization.yaml | 3 + 53 files changed, 146 insertions(+), 260 deletions(-) create mode 100644 k8s/components/helmrelease-drift-detection/kustomization.yaml create mode 100644 k8s/components/helmrelease-flux-defaults/kustomization.yaml diff --git a/AGENTS.md b/AGENTS.md index ae13701..aed7774 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -57,7 +57,8 @@ k8s/ # All Kubernetes manifests infrastructure/ # Organized by resource type: controllers/, certificates/, gateway/, # cluster-policies/, external-secrets/, alerts/, vault-*/ (OpenBao), etc. apps/ # App deployments — whoami, homepage, headlamp - components/ # Shared opt-in Kustomize components used by provider profiles + components/ # Shared Kustomize components: HelmRelease defaults and drift detection + # (every provider layer), plus the opt-in profile transformations providers/ # Provider-specific overlays (TEMPLATE-OWNED) docker/ # Local/CI provider (e.g. disables SPIRE mutual auth) hetzner/ # Production provider diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 84dad30..aa90362 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -100,10 +100,15 @@ The cluster configuration lives under `k8s/*`: - [`infrastructure`](../k8s/bases/infrastructure) — infrastructure components. - [`apps`](../k8s/bases/apps) — the demo applications. - [`bootstrap`](../k8s/bases/bootstrap) — the foundational **bootstrap layer**: shared substitution variables (`variables-base` ConfigMap + SOPS-encrypted Secret) and cluster-scoped PriorityClasses, reconciled by the `bootstrap` Flux Kustomization before everything that `dependsOn` it. -- [`components/`](../k8s/components) — shared opt-in Kustomize components. Only the opt-in provider - profiles use them, to switch to [Coroot](TEMPLATING.md#select-the-transitional-coroot-profile) or - add the [recommended-labels policy](TEMPLATING.md#add-recommended-workload-labels-at-admission); - the default paths use none of them. +- [`components/`](../k8s/components) — shared Kustomize components. + - `helmrelease-flux-defaults` and `helmrelease-drift-detection` apply to every provider layer + that renders HelmReleases. They set the install/upgrade retry policy once, and turn on drift + detection so Flux restores a chart resource that is deleted or edited out of band. A new + HelmRelease inherits both; do not repeat the remediation block in it. + - The rest are opt-in. Only the opt-in provider profiles use them, to switch to + [Coroot](TEMPLATING.md#select-the-transitional-coroot-profile) or add the + [recommended-labels policy](TEMPLATING.md#add-recommended-workload-labels-at-admission); + the default paths use none of them. ### Kustomize overlay flow diff --git a/docs/TEMPLATING.md b/docs/TEMPLATING.md index 6cc11e3..6369b81 100644 --- a/docs/TEMPLATING.md +++ b/docs/TEMPLATING.md @@ -252,9 +252,10 @@ See [`.github/workflows/`](../.github/workflows) for the exact names in use. and the rest of the controller set. - [`k8s/bases/apps/`](../k8s/bases/apps) — the demo applications (homepage, whoami, headlamp). -- [`k8s/components/`](../k8s/components) — shared opt-in transformations used by - provider profiles, such as removing OpenCost across controller, infrastructure, - and app layers. +- [`k8s/components/`](../k8s/components) — shared transformations: the HelmRelease + retry defaults and drift detection every provider layer applies, and opt-in + profile transformations such as removing OpenCost across controller, + infrastructure, and app layers. - [`k8s/providers/{docker,hetzner}/`](../k8s/providers) — provider-specific assembly of the bases. diff --git a/k8s/bases/apps/headlamp/helm-release.yaml b/k8s/bases/apps/headlamp/helm-release.yaml index 0ec1187..5db2184 100644 --- a/k8s/bases/apps/headlamp/helm-release.yaml +++ b/k8s/bases/apps/headlamp/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: headlamp diff --git a/k8s/bases/apps/homepage/helm-release.yaml b/k8s/bases/apps/homepage/helm-release.yaml index 18bb1ee..dd157c0 100644 --- a/k8s/bases/apps/homepage/helm-release.yaml +++ b/k8s/bases/apps/homepage/helm-release.yaml @@ -11,13 +11,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: homepage diff --git a/k8s/bases/apps/whoami/helm-release.yaml b/k8s/bases/apps/whoami/helm-release.yaml index a146050..764654e 100644 --- a/k8s/bases/apps/whoami/helm-release.yaml +++ b/k8s/bases/apps/whoami/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: whoami diff --git a/k8s/bases/infrastructure/audit-log-forwarder/helm-release.yaml b/k8s/bases/infrastructure/audit-log-forwarder/helm-release.yaml index da3aa81..5ce466e 100644 --- a/k8s/bases/infrastructure/audit-log-forwarder/helm-release.yaml +++ b/k8s/bases/infrastructure/audit-log-forwarder/helm-release.yaml @@ -12,13 +12,6 @@ metadata: spec: interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: opentelemetry-collector diff --git a/k8s/bases/infrastructure/controllers/alloy/helm-release-audit-collector.yaml b/k8s/bases/infrastructure/controllers/alloy/helm-release-audit-collector.yaml index 4dc729f..37e1aa3 100644 --- a/k8s/bases/infrastructure/controllers/alloy/helm-release-audit-collector.yaml +++ b/k8s/bases/infrastructure/controllers/alloy/helm-release-audit-collector.yaml @@ -13,13 +13,6 @@ spec: namespace: monitoring interval: 5m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: alloy diff --git a/k8s/bases/infrastructure/controllers/alloy/helm-release.yaml b/k8s/bases/infrastructure/controllers/alloy/helm-release.yaml index 0e468ca..db337b3 100644 --- a/k8s/bases/infrastructure/controllers/alloy/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/alloy/helm-release.yaml @@ -13,13 +13,6 @@ spec: namespace: monitoring interval: 5m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: alloy diff --git a/k8s/bases/infrastructure/controllers/cert-manager/helm-release.yaml b/k8s/bases/infrastructure/controllers/cert-manager/helm-release.yaml index 35024c7..4b28d2e 100644 --- a/k8s/bases/infrastructure/controllers/cert-manager/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/cert-manager/helm-release.yaml @@ -19,13 +19,8 @@ spec: name: cert-manager install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml values: # Restricted PSS baseline: add runAsNonRoot to container SCs (chart leaves it unset, which fails validate-container-security). diff --git a/k8s/bases/infrastructure/controllers/cilium/helm-release.yaml b/k8s/bases/infrastructure/controllers/cilium/helm-release.yaml index b95e1a1..72bc363 100644 --- a/k8s/bases/infrastructure/controllers/cilium/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/cilium/helm-release.yaml @@ -18,13 +18,6 @@ spec: name: cilium interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/cilium/cilium/blob/main/install/kubernetes/cilium/values.yaml values: securityContext: diff --git a/k8s/bases/infrastructure/controllers/cloudnative-pg/helm-release.yaml b/k8s/bases/infrastructure/controllers/cloudnative-pg/helm-release.yaml index 61c770d..89d58c8 100644 --- a/k8s/bases/infrastructure/controllers/cloudnative-pg/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/cloudnative-pg/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: cloudnative-pg diff --git a/k8s/bases/infrastructure/controllers/coroot/helm-release.yaml b/k8s/bases/infrastructure/controllers/coroot/helm-release.yaml index 5cf2832..5c8c991 100644 --- a/k8s/bases/infrastructure/controllers/coroot/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/coroot/helm-release.yaml @@ -11,13 +11,8 @@ spec: timeout: 10m install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: coroot-operator diff --git a/k8s/bases/infrastructure/controllers/dex/helm-release.yaml b/k8s/bases/infrastructure/controllers/dex/helm-release.yaml index edd95ce..ccd0f28 100644 --- a/k8s/bases/infrastructure/controllers/dex/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/dex/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: dex diff --git a/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml b/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml index bb210bb..0abb2f4 100644 --- a/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/external-secrets/helm-release.yaml @@ -11,13 +11,8 @@ spec: timeout: 10m install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: external-secrets diff --git a/k8s/bases/infrastructure/controllers/flux-operator/helm-release.yaml b/k8s/bases/infrastructure/controllers/flux-operator/helm-release.yaml index 85a8147..993b89e 100644 --- a/k8s/bases/infrastructure/controllers/flux-operator/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/flux-operator/helm-release.yaml @@ -18,13 +18,6 @@ spec: name: flux-operator interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true values: web: config: diff --git a/k8s/bases/infrastructure/controllers/keda-http-add-on/helm-release.yaml b/k8s/bases/infrastructure/controllers/keda-http-add-on/helm-release.yaml index 36dc079..273c03e 100644 --- a/k8s/bases/infrastructure/controllers/keda-http-add-on/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/keda-http-add-on/helm-release.yaml @@ -11,13 +11,6 @@ spec: timeout: 10m dependsOn: - name: keda - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: keda-add-ons-http diff --git a/k8s/bases/infrastructure/controllers/keda/helm-release.yaml b/k8s/bases/infrastructure/controllers/keda/helm-release.yaml index a933ba8..b6abd1f 100644 --- a/k8s/bases/infrastructure/controllers/keda/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/keda/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: keda diff --git a/k8s/bases/infrastructure/controllers/kube-prometheus-stack/helm-release.yaml b/k8s/bases/infrastructure/controllers/kube-prometheus-stack/helm-release.yaml index ade9063..fe9c1b4 100644 --- a/k8s/bases/infrastructure/controllers/kube-prometheus-stack/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/kube-prometheus-stack/helm-release.yaml @@ -17,13 +17,8 @@ spec: name: prometheus-community install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true timeout: 15m # https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml # diff --git a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml index efe6a59..c15b3f2 100644 --- a/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/kubescape/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 15m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: kubescape-operator diff --git a/k8s/bases/infrastructure/controllers/kyverno/helm-release.yaml b/k8s/bases/infrastructure/controllers/kyverno/helm-release.yaml index 802b6bf..e9024da 100644 --- a/k8s/bases/infrastructure/controllers/kyverno/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/kyverno/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 15m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: kyverno diff --git a/k8s/bases/infrastructure/controllers/loki/helm-release.yaml b/k8s/bases/infrastructure/controllers/loki/helm-release.yaml index 14cbbeb..a00d792 100644 --- a/k8s/bases/infrastructure/controllers/loki/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/loki/helm-release.yaml @@ -13,13 +13,6 @@ spec: namespace: monitoring interval: 5m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: loki diff --git a/k8s/bases/infrastructure/controllers/metrics-server/helm-release.yaml b/k8s/bases/infrastructure/controllers/metrics-server/helm-release.yaml index 2066332..a271147 100644 --- a/k8s/bases/infrastructure/controllers/metrics-server/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/metrics-server/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: metrics-server diff --git a/k8s/bases/infrastructure/controllers/oauth2-proxy/helm-release.yaml b/k8s/bases/infrastructure/controllers/oauth2-proxy/helm-release.yaml index 2499c78..20d0ac4 100644 --- a/k8s/bases/infrastructure/controllers/oauth2-proxy/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/oauth2-proxy/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: oauth2-proxy @@ -103,4 +96,3 @@ spec: reverse_proxy = true ingress: enabled: false - diff --git a/k8s/bases/infrastructure/controllers/openbao/helm-release.yaml b/k8s/bases/infrastructure/controllers/openbao/helm-release.yaml index 80dcf00..411fc4d 100644 --- a/k8s/bases/infrastructure/controllers/openbao/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/openbao/helm-release.yaml @@ -8,13 +8,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: openbao diff --git a/k8s/bases/infrastructure/controllers/opencost/helm-release.yaml b/k8s/bases/infrastructure/controllers/opencost/helm-release.yaml index e0eeef5..9928105 100644 --- a/k8s/bases/infrastructure/controllers/opencost/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/opencost/helm-release.yaml @@ -11,13 +11,6 @@ spec: namespace: monitoring interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: opencost @@ -77,7 +70,6 @@ spec: external: enabled: true url: "http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090" - # Hetzner Cloud custom pricing — CX33 monthly cap decomposed into # per-resource-unit USD costs. CX33 spec verified live with # `kubectl get nodes`: 4 vCPU, 7916176 KiB RAM (8 GB nominal), 80 GB NVMe. @@ -126,7 +118,6 @@ spec: zoneNetworkEgress: 0.001164 regionNetworkEgress: 0.001164 internetNetworkEgress: 0.001164 - exporter: replicas: 1 resources: @@ -142,7 +133,6 @@ spec: # still well under the chart's 1Gi default. limits: memory: 512Mi - ui: enabled: true securityContext: @@ -153,7 +143,6 @@ spec: memory: 55Mi limits: memory: 128Mi - metrics: serviceMonitor: enabled: true diff --git a/k8s/bases/infrastructure/controllers/reloader/helm-release.yaml b/k8s/bases/infrastructure/controllers/reloader/helm-release.yaml index 7b2f112..7760966 100644 --- a/k8s/bases/infrastructure/controllers/reloader/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/reloader/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: reloader diff --git a/k8s/bases/infrastructure/controllers/testkube/helm-release.yaml b/k8s/bases/infrastructure/controllers/testkube/helm-release.yaml index 3d0bf0d..dced246 100644 --- a/k8s/bases/infrastructure/controllers/testkube/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/testkube/helm-release.yaml @@ -10,13 +10,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: testkube diff --git a/k8s/bases/infrastructure/controllers/tetragon/helm-release.yaml b/k8s/bases/infrastructure/controllers/tetragon/helm-release.yaml index d5da5ce..49dab1f 100644 --- a/k8s/bases/infrastructure/controllers/tetragon/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/tetragon/helm-release.yaml @@ -17,13 +17,6 @@ spec: name: cilium interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/cilium/tetragon/blob/main/install/kubernetes/tetragon/values.yaml # # eBPF-based runtime security observability. Sibling to the Cilium diff --git a/k8s/bases/infrastructure/controllers/trust-manager/helm-release.yaml b/k8s/bases/infrastructure/controllers/trust-manager/helm-release.yaml index 5f58e8e..5a0e899 100644 --- a/k8s/bases/infrastructure/controllers/trust-manager/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/trust-manager/helm-release.yaml @@ -20,13 +20,8 @@ spec: name: cert-manager install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true # https://artifacthub.io/packages/helm/cert-manager/trust-manager values: crds: diff --git a/k8s/bases/infrastructure/controllers/velero/helm-release.yaml b/k8s/bases/infrastructure/controllers/velero/helm-release.yaml index 0715f9f..0469af3 100644 --- a/k8s/bases/infrastructure/controllers/velero/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/velero/helm-release.yaml @@ -17,13 +17,8 @@ spec: name: vmware-tanzu install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true timeout: 15m # https://github.com/vmware-tanzu/helm-charts/blob/main/charts/velero/values.yaml values: @@ -36,13 +31,11 @@ spec: volumeMounts: - mountPath: /target name: plugins - # Mount our SOPS-derived R2 credentials secret instead of the chart's # generated one. The chart only consults it; it never writes to it. credentials: useSecret: true existingSecret: velero-r2-credentials - # Cloudflare R2 backup target. Bucket + endpoint come from the shared # variables-base ConfigMap; prefix is reused per consumer (PR #3). configuration: @@ -62,7 +55,6 @@ spec: defaultVolumesToFsBackup: true uploaderType: kopia features: "" - # Run Velero itself with HA primitives matching the rest of the # operator tier (PR #2b). Server is leader-elected so 2 replicas = # instant failover, not extra capacity. @@ -85,7 +77,6 @@ spec: app.kubernetes.io/instance: velero strategy: type: Recreate - # Node agent: DaemonSet, runs the Kopia uploader on every node that has # PVCs. Defaults are sane; just confirm rolling update. deployNodeAgent: true @@ -94,7 +85,6 @@ spec: type: RollingUpdate rollingUpdate: maxUnavailable: 1 - # Daily backup of every namespace that has PVCs. 14-day retention # matches the 24h RPO target. Long-term retention is handled by R2 # object lock + lifecycle, not by Velero, so a corrupted controller @@ -114,10 +104,8 @@ spec: - velero snapshotMoveData: true defaultVolumesToFsBackup: true - metrics: enabled: true - resources: requests: cpu: 25m diff --git a/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/helm-release.yaml b/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/helm-release.yaml index d415bfc..218b175 100644 --- a/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/helm-release.yaml +++ b/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/helm-release.yaml @@ -9,13 +9,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true test: enable: false chart: diff --git a/k8s/components/helmrelease-drift-detection/kustomization.yaml b/k8s/components/helmrelease-drift-detection/kustomization.yaml new file mode 100644 index 0000000..9cd671c --- /dev/null +++ b/k8s/components/helmrelease-drift-detection/kustomization.yaml @@ -0,0 +1,71 @@ +--- +# Drift detection for every HelmRelease. +# +# Without it, Flux's helm-controller re-applies a chart's resources only when the +# chart or its values change. A Helm-rendered resource that is deleted or edited +# out of band stays broken while the HelmRelease still reports Ready. With +# `driftDetection.mode: enabled`, the controller restores deleted resources and +# reverts out-of-band edits on every reconcile. +# +# Ignored fields are owned by other controllers at runtime. Enforcing the chart's +# value would make Flux fight them and report DriftDetected on every reconcile: +# * /spec/replicas (Deployment, StatefulSet): autoscalers and progressive +# delivery set it. +# * /spec/template (Deployment, StatefulSet, DaemonSet): the Kyverno mutate +# policies in bases/infrastructure/cluster-policies (resource defaults, +# security context, anti-affinity, topology spread, service-account token +# automount) rewrite the pod template on admission, so the rendered spec +# never matches the live one. A deleted workload is still drift and is +# restored; only field-level edits to a running pod template are not reverted +# until the next chart or values change. +# * /metadata/labels (Deployment, StatefulSet, DaemonSet): the optional +# recommended-labels policy adds labels to workloads that lack them. +# * Webhook configurations' /webhooks, APIService /spec/caBundle and CRD +# conversion caBundle: cert-manager and operators inject CA bundles at runtime. +# +# Listed as a component by every provider layer that renders HelmReleases. +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component +patches: + - target: + group: helm.toolkit.fluxcd.io + kind: HelmRelease + patch: | + - op: add + path: /spec/driftDetection + value: + mode: enabled + ignore: + - target: + kind: Deployment + paths: + - /spec/replicas + - /spec/template + - /metadata/labels + - target: + kind: StatefulSet + paths: + - /spec/replicas + - /spec/template + - /metadata/labels + - target: + kind: DaemonSet + paths: + - /spec/template + - /metadata/labels + - target: + kind: ValidatingWebhookConfiguration + paths: + - /webhooks + - target: + kind: MutatingWebhookConfiguration + paths: + - /webhooks + - target: + kind: APIService + paths: + - /spec/caBundle + - target: + kind: CustomResourceDefinition + paths: + - /spec/conversion/webhook/clientConfig/caBundle diff --git a/k8s/components/helmrelease-flux-defaults/kustomization.yaml b/k8s/components/helmrelease-flux-defaults/kustomization.yaml new file mode 100644 index 0000000..6e7cb03 --- /dev/null +++ b/k8s/components/helmrelease-flux-defaults/kustomization.yaml @@ -0,0 +1,30 @@ +--- +# Flux reliability defaults for every HelmRelease. +# +# The flux best-practice cluster policy requires every HelmRelease to retry a +# failed install or upgrade and to remediate the last failure. The block is the +# same for every release, so it is defined once here and merged into each +# HelmRelease of every layer that lists this component. +# +# Strategic merge, not JSON6902: it creates spec.install and spec.upgrade when +# absent and leaves sibling fields (install.crds, upgrade.crds, upgrade.force) +# untouched. +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component +patches: + - target: + group: helm.toolkit.fluxcd.io + kind: HelmRelease + patch: | + apiVersion: helm.toolkit.fluxcd.io/v2 + kind: HelmRelease + metadata: + name: not-used + spec: + install: + remediation: + retries: -1 + upgrade: + remediation: + retries: -1 + remediateLastFailure: true diff --git a/k8s/providers/docker/apps-coroot/kustomization.yaml b/k8s/providers/docker/apps-coroot/kustomization.yaml index f333d52..b41a96d 100644 --- a/k8s/providers/docker/apps-coroot/kustomization.yaml +++ b/k8s/providers/docker/apps-coroot/kustomization.yaml @@ -5,4 +5,6 @@ resources: - ../apps/ - ../../../bases/apps/cluster-heartbeat/ components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/docker/apps/kustomization.yaml b/k8s/providers/docker/apps/kustomization.yaml index c873a44..c91bea6 100644 --- a/k8s/providers/docker/apps/kustomization.yaml +++ b/k8s/providers/docker/apps/kustomization.yaml @@ -5,6 +5,9 @@ resources: - ../../../bases/apps/headlamp/ - ../../../bases/apps/homepage/ - ../../../bases/apps/whoami/ +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ patches: - target: kind: HelmRelease diff --git a/k8s/providers/docker/infrastructure-controllers-coroot/kustomization.yaml b/k8s/providers/docker/infrastructure-controllers-coroot/kustomization.yaml index 127f13c..8c58070 100644 --- a/k8s/providers/docker/infrastructure-controllers-coroot/kustomization.yaml +++ b/k8s/providers/docker/infrastructure-controllers-coroot/kustomization.yaml @@ -5,6 +5,8 @@ resources: - ../infrastructure/controllers/ - ../../../bases/infrastructure/controllers/coroot/ components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/remove-controllers-loki-alloy/ - ../../../components/observability-coroot/remove-controller-opencost/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/docker/infrastructure-coroot/kustomization.yaml b/k8s/providers/docker/infrastructure-coroot/kustomization.yaml index e3703dd..edd9a18 100644 --- a/k8s/providers/docker/infrastructure-coroot/kustomization.yaml +++ b/k8s/providers/docker/infrastructure-coroot/kustomization.yaml @@ -5,6 +5,8 @@ resources: - ../infrastructure/ - ../../../bases/infrastructure/coroot/ components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/allow-host-access/ - ../../../components/observability-coroot/isolate-heartbeat/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/docker/infrastructure/controllers/coredns/helm-release.yaml b/k8s/providers/docker/infrastructure/controllers/coredns/helm-release.yaml index ef85dd4..4b74151 100644 --- a/k8s/providers/docker/infrastructure/controllers/coredns/helm-release.yaml +++ b/k8s/providers/docker/infrastructure/controllers/coredns/helm-release.yaml @@ -20,13 +20,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: coredns diff --git a/k8s/providers/docker/infrastructure/controllers/kubescape/patches/disable-heavy-capabilities.yaml b/k8s/providers/docker/infrastructure/controllers/kubescape/patches/disable-heavy-capabilities.yaml index d006c9b..fdf8b53 100644 --- a/k8s/providers/docker/infrastructure/controllers/kubescape/patches/disable-heavy-capabilities.yaml +++ b/k8s/providers/docker/infrastructure/controllers/kubescape/patches/disable-heavy-capabilities.yaml @@ -11,13 +11,8 @@ spec: # success immediately after applying resources. install: disableWait: true - remediation: - retries: -1 upgrade: disableWait: true - remediation: - retries: -1 - remediateLastFailure: true values: capabilities: # eBPF-based runtime detection is unavailable on Docker-provider nodes. diff --git a/k8s/providers/docker/infrastructure/controllers/kustomization.yaml b/k8s/providers/docker/infrastructure/controllers/kustomization.yaml index 697d4a1..6d52623 100644 --- a/k8s/providers/docker/infrastructure/controllers/kustomization.yaml +++ b/k8s/providers/docker/infrastructure/controllers/kustomization.yaml @@ -8,6 +8,9 @@ resources: - minio/ - namespace-local-path-storage.yaml - cilium-network-policy-local-path-storage.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ patches: - target: kind: HelmRelease diff --git a/k8s/providers/docker/infrastructure/kustomization.yaml b/k8s/providers/docker/infrastructure/kustomization.yaml index dd3cb56..248d763 100644 --- a/k8s/providers/docker/infrastructure/kustomization.yaml +++ b/k8s/providers/docker/infrastructure/kustomization.yaml @@ -4,3 +4,6 @@ kind: Kustomization resources: - ../../../bases/infrastructure/ - cluster-issuers/ +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/apps-coroot/kustomization.yaml b/k8s/providers/hetzner/apps-coroot/kustomization.yaml index f333d52..b41a96d 100644 --- a/k8s/providers/hetzner/apps-coroot/kustomization.yaml +++ b/k8s/providers/hetzner/apps-coroot/kustomization.yaml @@ -5,4 +5,6 @@ resources: - ../apps/ - ../../../bases/apps/cluster-heartbeat/ components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/hetzner/apps/kustomization.yaml b/k8s/providers/hetzner/apps/kustomization.yaml index c143785..0e616b8 100644 --- a/k8s/providers/hetzner/apps/kustomization.yaml +++ b/k8s/providers/hetzner/apps/kustomization.yaml @@ -3,3 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../../bases/apps/ +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure-controllers-coroot/kustomization.yaml b/k8s/providers/hetzner/infrastructure-controllers-coroot/kustomization.yaml index 499cd24..6a1ff4f 100644 --- a/k8s/providers/hetzner/infrastructure-controllers-coroot/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure-controllers-coroot/kustomization.yaml @@ -8,6 +8,8 @@ resources: # every controller, so it can report a controller readiness failure itself. - flux-notifications/ components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/remove-controllers-loki-alloy/ - ../../../components/observability-coroot/remove-controller-opencost/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/hetzner/infrastructure-coroot/kustomization.yaml b/k8s/providers/hetzner/infrastructure-coroot/kustomization.yaml index 5d8d38f..1f5098e 100644 --- a/k8s/providers/hetzner/infrastructure-coroot/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure-coroot/kustomization.yaml @@ -6,6 +6,8 @@ resources: - ../../../bases/infrastructure/coroot/ - ../../../bases/infrastructure/audit-log-forwarder/ components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/allow-host-access/ - ../../../components/observability-coroot/isolate-heartbeat/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/external-dns/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/external-dns/helm-release.yaml index 73de8ac..4894a48 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/external-dns/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/external-dns/helm-release.yaml @@ -8,13 +8,6 @@ metadata: spec: interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: external-dns diff --git a/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/helm-release.yaml index 36a99b3..2c30a62 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/helm-release.yaml @@ -16,13 +16,6 @@ spec: name: hcloud interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/hetznercloud/hcloud-cloud-controller-manager/blob/main/chart/values.yaml values: networking: diff --git a/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/helm-release.yaml index 0acb95b..1c5150e 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/helm-release.yaml @@ -17,13 +17,6 @@ spec: name: hcloud interval: 10m0s timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true # https://github.com/hetznercloud/csi-driver/blob/main/chart/values.yaml values: global: diff --git a/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml index fe4e4da..e5da9b8 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml @@ -41,6 +41,9 @@ resources: - kubelet-serving-cert-approver/ - longhorn/ - origin-ca-issuer/ +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ patches: - path: openbao/patches/store-data-on-hcloud.yaml - path: kube-prometheus-stack/patches/store-tsdb-on-hcloud.yaml diff --git a/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml index 8037d05..f3b4a4a 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/longhorn/helm-release.yaml @@ -18,13 +18,8 @@ spec: interval: 10m0s install: crds: CreateReplace - remediation: - retries: -1 upgrade: crds: CreateReplace - remediation: - retries: -1 - remediateLastFailure: true timeout: 10m # https://github.com/longhorn/charts/blob/master/charts/longhorn/values.yaml values: @@ -42,7 +37,6 @@ spec: # Restrict Longhorn system-managed pods (instance-managers, etc.) # to storage nodes. Prevents ~100Mi overhead per non-storage node. systemManagedComponentsNodeSelector: "node.longhorn.io/create-default-disk:true" - persistence: # Longhorn is the default StorageClass (replaces hcloud for new PVCs). defaultClass: true @@ -50,20 +44,17 @@ spec: # RWX support via Longhorn's built-in NFS server. defaultFsType: ext4 reclaimPolicy: Delete - # Resource-conscious settings for cx23 workers (2 vCPU, 4 GB RAM). csi: attacherReplicaCount: ${longhorn_csi_attacher_replicas:=1} provisionerReplicaCount: ${longhorn_csi_provisioner_replicas:=1} resizerReplicaCount: ${longhorn_csi_resizer_replicas:=1} snapshotterReplicaCount: ${longhorn_csi_snapshotter_replicas:=1} - # Restrict Longhorn DaemonSets to storage-labeled nodes only. # Control planes don't carry disks and no pods on them mount Longhorn # volumes — running longhorn-manager there wastes ~250Mi per node. longhornManager: nodeSelector: node.longhorn.io/create-default-disk: "true" - longhornUI: replicas: ${longhorn_ui_replicas:=1} diff --git a/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/helm-release.yaml b/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/helm-release.yaml index c5cb240..e982a41 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/helm-release.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/helm-release.yaml @@ -8,13 +8,6 @@ spec: - name: cert-manager interval: 2m timeout: 10m - install: - remediation: - retries: -1 - upgrade: - remediation: - retries: -1 - remediateLastFailure: true chart: spec: chart: origin-ca-issuer diff --git a/k8s/providers/hetzner/infrastructure/kustomization.yaml b/k8s/providers/hetzner/infrastructure/kustomization.yaml index 283e913..cd08661 100644 --- a/k8s/providers/hetzner/infrastructure/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/kustomization.yaml @@ -5,6 +5,9 @@ resources: - ../../../bases/infrastructure/ - cluster-issuers/ - vault-seed/ +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ patches: - path: patches/attach-hcloud-load-balancer.yaml target: From e6ba1e209066779aab27ca062a1426182f06f8de Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sun, 27 Sep 2026 18:55:47 +0200 Subject: [PATCH 2/2] fix(flux): list the HelmRelease components from each owning base, not the provider layers A consumer of a single base now gets the retry defaults and drift detection too, instead of depending on every provider layer to import them. Also records why the whole webhooks list is ignored: a JSON Pointer cannot select one field in every array entry. Co-Authored-By: Claude Opus 5.5 (1M context) --- AGENTS.md | 3 ++- docs/ARCHITECTURE.md | 5 +++-- docs/TEMPLATING.md | 2 +- k8s/bases/apps/headlamp/kustomization.yaml | 3 +++ k8s/bases/apps/homepage/kustomization.yaml | 3 +++ k8s/bases/apps/whoami/kustomization.yaml | 3 +++ .../infrastructure/audit-log-forwarder/kustomization.yaml | 3 +++ .../infrastructure/controllers/alloy/kustomization.yaml | 3 +++ .../controllers/cert-manager/kustomization.yaml | 3 +++ .../infrastructure/controllers/cilium/kustomization.yaml | 3 +++ .../controllers/cloudnative-pg/kustomization.yaml | 3 +++ .../infrastructure/controllers/coroot/kustomization.yaml | 3 +++ .../infrastructure/controllers/dex/kustomization.yaml | 3 +++ .../controllers/external-secrets/kustomization.yaml | 3 +++ .../controllers/flux-operator/kustomization.yaml | 3 +++ .../controllers/keda-http-add-on/kustomization.yaml | 3 +++ .../infrastructure/controllers/keda/kustomization.yaml | 3 +++ .../controllers/kube-prometheus-stack/kustomization.yaml | 3 +++ .../controllers/kubescape/kustomization.yaml | 3 +++ .../infrastructure/controllers/kyverno/kustomization.yaml | 3 +++ .../infrastructure/controllers/loki/kustomization.yaml | 3 +++ .../controllers/metrics-server/kustomization.yaml | 3 +++ .../controllers/oauth2-proxy/kustomization.yaml | 3 +++ .../infrastructure/controllers/openbao/kustomization.yaml | 3 +++ .../infrastructure/controllers/opencost/kustomization.yaml | 3 +++ .../infrastructure/controllers/reloader/kustomization.yaml | 3 +++ .../infrastructure/controllers/testkube/kustomization.yaml | 3 +++ .../infrastructure/controllers/tetragon/kustomization.yaml | 3 +++ .../controllers/trust-manager/kustomization.yaml | 3 +++ .../infrastructure/controllers/velero/kustomization.yaml | 3 +++ .../controllers/vertical-pod-autoscaler/kustomization.yaml | 3 +++ .../helmrelease-drift-detection/kustomization.yaml | 7 ++++++- .../helmrelease-flux-defaults/kustomization.yaml | 2 +- k8s/providers/docker/apps-coroot/kustomization.yaml | 2 -- k8s/providers/docker/apps/kustomization.yaml | 3 --- .../infrastructure-controllers-coroot/kustomization.yaml | 2 -- .../docker/infrastructure-coroot/kustomization.yaml | 2 -- .../infrastructure/controllers/coredns/kustomization.yaml | 3 +++ .../docker/infrastructure/controllers/kustomization.yaml | 3 --- k8s/providers/docker/infrastructure/kustomization.yaml | 3 --- k8s/providers/hetzner/apps-coroot/kustomization.yaml | 2 -- k8s/providers/hetzner/apps/kustomization.yaml | 3 --- .../infrastructure-controllers-coroot/kustomization.yaml | 2 -- .../hetzner/infrastructure-coroot/kustomization.yaml | 2 -- .../controllers/external-dns/kustomization.yaml | 3 +++ .../controllers/hcloud-ccm/kustomization.yaml | 3 +++ .../controllers/hcloud-csi/kustomization.yaml | 3 +++ .../hetzner/infrastructure/controllers/kustomization.yaml | 3 --- .../infrastructure/controllers/longhorn/kustomization.yaml | 3 +++ .../controllers/origin-ca-issuer/kustomization.yaml | 3 +++ k8s/providers/hetzner/infrastructure/kustomization.yaml | 3 --- 51 files changed, 115 insertions(+), 36 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index aed7774..817bb15 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -58,7 +58,8 @@ k8s/ # All Kubernetes manifests # cluster-policies/, external-secrets/, alerts/, vault-*/ (OpenBao), etc. apps/ # App deployments — whoami, homepage, headlamp components/ # Shared Kustomize components: HelmRelease defaults and drift detection - # (every provider layer), plus the opt-in profile transformations + # (listed by every HelmRelease-owning kustomization), plus the + # opt-in profile transformations providers/ # Provider-specific overlays (TEMPLATE-OWNED) docker/ # Local/CI provider (e.g. disables SPIRE mutual auth) hetzner/ # Production provider diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index aa90362..da0ecc3 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -101,8 +101,9 @@ The cluster configuration lives under `k8s/*`: - [`apps`](../k8s/bases/apps) — the demo applications. - [`bootstrap`](../k8s/bases/bootstrap) — the foundational **bootstrap layer**: shared substitution variables (`variables-base` ConfigMap + SOPS-encrypted Secret) and cluster-scoped PriorityClasses, reconciled by the `bootstrap` Flux Kustomization before everything that `dependsOn` it. - [`components/`](../k8s/components) — shared Kustomize components. - - `helmrelease-flux-defaults` and `helmrelease-drift-detection` apply to every provider layer - that renders HelmReleases. They set the install/upgrade retry policy once, and turn on drift + - `helmrelease-flux-defaults` and `helmrelease-drift-detection` are listed by every + kustomization that owns a HelmRelease, so each base carries them to every consumer. + They set the install/upgrade retry policy once, and turn on drift detection so Flux restores a chart resource that is deleted or edited out of band. A new HelmRelease inherits both; do not repeat the remediation block in it. - The rest are opt-in. Only the opt-in provider profiles use them, to switch to diff --git a/docs/TEMPLATING.md b/docs/TEMPLATING.md index 6369b81..5b775e9 100644 --- a/docs/TEMPLATING.md +++ b/docs/TEMPLATING.md @@ -253,7 +253,7 @@ See [`.github/workflows/`](../.github/workflows) for the exact names in use. - [`k8s/bases/apps/`](../k8s/bases/apps) — the demo applications (homepage, whoami, headlamp). - [`k8s/components/`](../k8s/components) — shared transformations: the HelmRelease - retry defaults and drift detection every provider layer applies, and opt-in + retry defaults and drift detection every HelmRelease-owning kustomization lists, and opt-in profile transformations such as removing OpenCost across controller, infrastructure, and app layers. - [`k8s/providers/{docker,hetzner}/`](../k8s/providers) — provider-specific assembly diff --git a/k8s/bases/apps/headlamp/kustomization.yaml b/k8s/bases/apps/headlamp/kustomization.yaml index 5a24399..c168bc0 100644 --- a/k8s/bases/apps/headlamp/kustomization.yaml +++ b/k8s/bases/apps/headlamp/kustomization.yaml @@ -9,3 +9,6 @@ resources: - http-route.yaml - http-scaled-object.yaml - cilium-network-policy.yaml +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/apps/homepage/kustomization.yaml b/k8s/bases/apps/homepage/kustomization.yaml index 241136f..fb305dd 100644 --- a/k8s/bases/apps/homepage/kustomization.yaml +++ b/k8s/bases/apps/homepage/kustomization.yaml @@ -8,3 +8,6 @@ resources: - namespace.yaml - pod-disruption-budget.yaml - cilium-network-policy.yaml +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/apps/whoami/kustomization.yaml b/k8s/bases/apps/whoami/kustomization.yaml index a35796d..e9d6d87 100644 --- a/k8s/bases/apps/whoami/kustomization.yaml +++ b/k8s/bases/apps/whoami/kustomization.yaml @@ -7,3 +7,6 @@ resources: - http-route.yaml - http-scaled-object.yaml - cilium-network-policy.yaml +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/audit-log-forwarder/kustomization.yaml b/k8s/bases/infrastructure/audit-log-forwarder/kustomization.yaml index 9072e0d..640be0c 100644 --- a/k8s/bases/infrastructure/audit-log-forwarder/kustomization.yaml +++ b/k8s/bases/infrastructure/audit-log-forwarder/kustomization.yaml @@ -5,3 +5,6 @@ kind: Kustomization resources: - helm-repository.yaml - helm-release.yaml +components: + - ../../../components/helmrelease-flux-defaults/ + - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/alloy/kustomization.yaml b/k8s/bases/infrastructure/controllers/alloy/kustomization.yaml index 6a5d21c..a2158b8 100644 --- a/k8s/bases/infrastructure/controllers/alloy/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/alloy/kustomization.yaml @@ -4,3 +4,6 @@ kind: Kustomization resources: - helm-release.yaml - helm-release-audit-collector.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/cert-manager/kustomization.yaml b/k8s/bases/infrastructure/controllers/cert-manager/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/cert-manager/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/cert-manager/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/cilium/kustomization.yaml b/k8s/bases/infrastructure/controllers/cilium/kustomization.yaml index 1f342a9..b308d70 100644 --- a/k8s/bases/infrastructure/controllers/cilium/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/cilium/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/cloudnative-pg/kustomization.yaml b/k8s/bases/infrastructure/controllers/cloudnative-pg/kustomization.yaml index d4bbacd..964944e 100644 --- a/k8s/bases/infrastructure/controllers/cloudnative-pg/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/cloudnative-pg/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - pod-disruption-budget.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/coroot/kustomization.yaml b/k8s/bases/infrastructure/controllers/coroot/kustomization.yaml index 59132d1..4461995 100644 --- a/k8s/bases/infrastructure/controllers/coroot/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/coroot/kustomization.yaml @@ -9,3 +9,6 @@ resources: - helm-repository.yaml - helm-release.yaml - http-route.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/dex/kustomization.yaml b/k8s/bases/infrastructure/controllers/dex/kustomization.yaml index db7e25c..49d4854 100644 --- a/k8s/bases/infrastructure/controllers/dex/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/dex/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/external-secrets/kustomization.yaml b/k8s/bases/infrastructure/controllers/external-secrets/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/external-secrets/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/external-secrets/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/flux-operator/kustomization.yaml b/k8s/bases/infrastructure/controllers/flux-operator/kustomization.yaml index 1f342a9..b308d70 100644 --- a/k8s/bases/infrastructure/controllers/flux-operator/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/flux-operator/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/keda-http-add-on/kustomization.yaml b/k8s/bases/infrastructure/controllers/keda-http-add-on/kustomization.yaml index 1bd68dc..fb95de6 100644 --- a/k8s/bases/infrastructure/controllers/keda-http-add-on/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/keda-http-add-on/kustomization.yaml @@ -3,3 +3,6 @@ kind: Kustomization resources: - helm-release.yaml - reference-grant.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/keda/kustomization.yaml b/k8s/bases/infrastructure/controllers/keda/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/keda/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/keda/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/kube-prometheus-stack/kustomization.yaml b/k8s/bases/infrastructure/controllers/kube-prometheus-stack/kustomization.yaml index 2d0c305..1fcb1be 100644 --- a/k8s/bases/infrastructure/controllers/kube-prometheus-stack/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/kube-prometheus-stack/kustomization.yaml @@ -8,3 +8,6 @@ resources: - http-route-prometheus.yaml - http-route-alertmanager.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/kubescape/kustomization.yaml b/k8s/bases/infrastructure/controllers/kubescape/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/kubescape/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/kubescape/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/kyverno/kustomization.yaml b/k8s/bases/infrastructure/controllers/kyverno/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/kyverno/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/kyverno/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/loki/kustomization.yaml b/k8s/bases/infrastructure/controllers/loki/kustomization.yaml index 9a78d93..ca307de 100644 --- a/k8s/bases/infrastructure/controllers/loki/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/loki/kustomization.yaml @@ -4,3 +4,6 @@ kind: Kustomization resources: - helm-repository.yaml - helm-release.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/metrics-server/kustomization.yaml b/k8s/bases/infrastructure/controllers/metrics-server/kustomization.yaml index 6b341b9..3d1e23d 100644 --- a/k8s/bases/infrastructure/controllers/metrics-server/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/metrics-server/kustomization.yaml @@ -3,3 +3,6 @@ kind: Kustomization resources: - helm-release.yaml - helm-repository.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/oauth2-proxy/kustomization.yaml b/k8s/bases/infrastructure/controllers/oauth2-proxy/kustomization.yaml index c7886f6..7020015 100644 --- a/k8s/bases/infrastructure/controllers/oauth2-proxy/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/oauth2-proxy/kustomization.yaml @@ -9,3 +9,6 @@ resources: - reference-grant.yaml - cilium-network-policy.yaml - cilium-network-policy-default-deny.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/openbao/kustomization.yaml b/k8s/bases/infrastructure/controllers/openbao/kustomization.yaml index db7e25c..49d4854 100644 --- a/k8s/bases/infrastructure/controllers/openbao/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/openbao/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/opencost/kustomization.yaml b/k8s/bases/infrastructure/controllers/opencost/kustomization.yaml index db7e25c..49d4854 100644 --- a/k8s/bases/infrastructure/controllers/opencost/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/opencost/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - http-route.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/reloader/kustomization.yaml b/k8s/bases/infrastructure/controllers/reloader/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/reloader/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/reloader/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/testkube/kustomization.yaml b/k8s/bases/infrastructure/controllers/testkube/kustomization.yaml index 24316fc..dc05156 100644 --- a/k8s/bases/infrastructure/controllers/testkube/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/testkube/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/tetragon/kustomization.yaml b/k8s/bases/infrastructure/controllers/tetragon/kustomization.yaml index 2fa2de2..1520119 100644 --- a/k8s/bases/infrastructure/controllers/tetragon/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/tetragon/kustomization.yaml @@ -3,3 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - helm-release.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/trust-manager/kustomization.yaml b/k8s/bases/infrastructure/controllers/trust-manager/kustomization.yaml index 34a8531..957b94b 100644 --- a/k8s/bases/infrastructure/controllers/trust-manager/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/trust-manager/kustomization.yaml @@ -2,3 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - helm-release.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/velero/kustomization.yaml b/k8s/bases/infrastructure/controllers/velero/kustomization.yaml index 3a9d29f..b052bda 100644 --- a/k8s/bases/infrastructure/controllers/velero/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/velero/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-release.yaml - cilium-network-policy.yaml - secret-velero-r2-credentials.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/kustomization.yaml b/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/kustomization.yaml index d5e69ce..e6eea42 100644 --- a/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/kustomization.yaml +++ b/k8s/bases/infrastructure/controllers/vertical-pod-autoscaler/kustomization.yaml @@ -5,3 +5,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../components/helmrelease-flux-defaults/ + - ../../../../components/helmrelease-drift-detection/ diff --git a/k8s/components/helmrelease-drift-detection/kustomization.yaml b/k8s/components/helmrelease-drift-detection/kustomization.yaml index 9cd671c..2e1c1aa 100644 --- a/k8s/components/helmrelease-drift-detection/kustomization.yaml +++ b/k8s/components/helmrelease-drift-detection/kustomization.yaml @@ -22,8 +22,13 @@ # recommended-labels policy adds labels to workloads that lack them. # * Webhook configurations' /webhooks, APIService /spec/caBundle and CRD # conversion caBundle: cert-manager and operators inject CA bundles at runtime. +# Ignore paths are JSON Pointers, which cannot select one field in every array +# entry, so the whole webhooks list is ignored rather than each entry's CA +# bundle by index. A deleted webhook configuration is still drift and is +# restored. # -# Listed as a component by every provider layer that renders HelmReleases. +# Listed as a component by every kustomization that owns a HelmRelease, so each +# base carries its defaults to every consumer, not only to the provider layers. apiVersion: kustomize.config.k8s.io/v1alpha1 kind: Component patches: diff --git a/k8s/components/helmrelease-flux-defaults/kustomization.yaml b/k8s/components/helmrelease-flux-defaults/kustomization.yaml index 6e7cb03..6f71f52 100644 --- a/k8s/components/helmrelease-flux-defaults/kustomization.yaml +++ b/k8s/components/helmrelease-flux-defaults/kustomization.yaml @@ -4,7 +4,7 @@ # The flux best-practice cluster policy requires every HelmRelease to retry a # failed install or upgrade and to remediate the last failure. The block is the # same for every release, so it is defined once here and merged into each -# HelmRelease of every layer that lists this component. +# HelmRelease of every kustomization that lists this component. # # Strategic merge, not JSON6902: it creates spec.install and spec.upgrade when # absent and leaves sibling fields (install.crds, upgrade.crds, upgrade.force) diff --git a/k8s/providers/docker/apps-coroot/kustomization.yaml b/k8s/providers/docker/apps-coroot/kustomization.yaml index b41a96d..f333d52 100644 --- a/k8s/providers/docker/apps-coroot/kustomization.yaml +++ b/k8s/providers/docker/apps-coroot/kustomization.yaml @@ -5,6 +5,4 @@ resources: - ../apps/ - ../../../bases/apps/cluster-heartbeat/ components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/docker/apps/kustomization.yaml b/k8s/providers/docker/apps/kustomization.yaml index c91bea6..c873a44 100644 --- a/k8s/providers/docker/apps/kustomization.yaml +++ b/k8s/providers/docker/apps/kustomization.yaml @@ -5,9 +5,6 @@ resources: - ../../../bases/apps/headlamp/ - ../../../bases/apps/homepage/ - ../../../bases/apps/whoami/ -components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ patches: - target: kind: HelmRelease diff --git a/k8s/providers/docker/infrastructure-controllers-coroot/kustomization.yaml b/k8s/providers/docker/infrastructure-controllers-coroot/kustomization.yaml index 8c58070..127f13c 100644 --- a/k8s/providers/docker/infrastructure-controllers-coroot/kustomization.yaml +++ b/k8s/providers/docker/infrastructure-controllers-coroot/kustomization.yaml @@ -5,8 +5,6 @@ resources: - ../infrastructure/controllers/ - ../../../bases/infrastructure/controllers/coroot/ components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/remove-controllers-loki-alloy/ - ../../../components/observability-coroot/remove-controller-opencost/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/docker/infrastructure-coroot/kustomization.yaml b/k8s/providers/docker/infrastructure-coroot/kustomization.yaml index edd9a18..e3703dd 100644 --- a/k8s/providers/docker/infrastructure-coroot/kustomization.yaml +++ b/k8s/providers/docker/infrastructure-coroot/kustomization.yaml @@ -5,8 +5,6 @@ resources: - ../infrastructure/ - ../../../bases/infrastructure/coroot/ components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/allow-host-access/ - ../../../components/observability-coroot/isolate-heartbeat/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/docker/infrastructure/controllers/coredns/kustomization.yaml b/k8s/providers/docker/infrastructure/controllers/coredns/kustomization.yaml index 6b341b9..5ef69c1 100644 --- a/k8s/providers/docker/infrastructure/controllers/coredns/kustomization.yaml +++ b/k8s/providers/docker/infrastructure/controllers/coredns/kustomization.yaml @@ -3,3 +3,6 @@ kind: Kustomization resources: - helm-release.yaml - helm-repository.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/docker/infrastructure/controllers/kustomization.yaml b/k8s/providers/docker/infrastructure/controllers/kustomization.yaml index 6d52623..697d4a1 100644 --- a/k8s/providers/docker/infrastructure/controllers/kustomization.yaml +++ b/k8s/providers/docker/infrastructure/controllers/kustomization.yaml @@ -8,9 +8,6 @@ resources: - minio/ - namespace-local-path-storage.yaml - cilium-network-policy-local-path-storage.yaml -components: - - ../../../../components/helmrelease-flux-defaults/ - - ../../../../components/helmrelease-drift-detection/ patches: - target: kind: HelmRelease diff --git a/k8s/providers/docker/infrastructure/kustomization.yaml b/k8s/providers/docker/infrastructure/kustomization.yaml index 248d763..dd3cb56 100644 --- a/k8s/providers/docker/infrastructure/kustomization.yaml +++ b/k8s/providers/docker/infrastructure/kustomization.yaml @@ -4,6 +4,3 @@ kind: Kustomization resources: - ../../../bases/infrastructure/ - cluster-issuers/ -components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/apps-coroot/kustomization.yaml b/k8s/providers/hetzner/apps-coroot/kustomization.yaml index b41a96d..f333d52 100644 --- a/k8s/providers/hetzner/apps-coroot/kustomization.yaml +++ b/k8s/providers/hetzner/apps-coroot/kustomization.yaml @@ -5,6 +5,4 @@ resources: - ../apps/ - ../../../bases/apps/cluster-heartbeat/ components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/hetzner/apps/kustomization.yaml b/k8s/providers/hetzner/apps/kustomization.yaml index 0e616b8..c143785 100644 --- a/k8s/providers/hetzner/apps/kustomization.yaml +++ b/k8s/providers/hetzner/apps/kustomization.yaml @@ -3,6 +3,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../../../bases/apps/ -components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure-controllers-coroot/kustomization.yaml b/k8s/providers/hetzner/infrastructure-controllers-coroot/kustomization.yaml index 6a1ff4f..499cd24 100644 --- a/k8s/providers/hetzner/infrastructure-controllers-coroot/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure-controllers-coroot/kustomization.yaml @@ -8,8 +8,6 @@ resources: # every controller, so it can report a controller readiness failure itself. - flux-notifications/ components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/remove-controllers-loki-alloy/ - ../../../components/observability-coroot/remove-controller-opencost/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/hetzner/infrastructure-coroot/kustomization.yaml b/k8s/providers/hetzner/infrastructure-coroot/kustomization.yaml index 1f5098e..5d8d38f 100644 --- a/k8s/providers/hetzner/infrastructure-coroot/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure-coroot/kustomization.yaml @@ -6,8 +6,6 @@ resources: - ../../../bases/infrastructure/coroot/ - ../../../bases/infrastructure/audit-log-forwarder/ components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ - ../../../components/observability-coroot/allow-host-access/ - ../../../components/observability-coroot/isolate-heartbeat/ - ../../../components/observability-coroot/remove-opencost-references/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/external-dns/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/external-dns/kustomization.yaml index 7e6652c..85971bc 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/external-dns/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/external-dns/kustomization.yaml @@ -7,3 +7,6 @@ resources: - helm-release.yaml - helm-repository.yaml - cilium-network-policy.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/kustomization.yaml index dcb3285..a68a79c 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/hcloud-ccm/kustomization.yaml @@ -4,3 +4,6 @@ kind: Kustomization resources: - helm-release.yaml - pod-disruption-budget.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/kustomization.yaml index 8f66ec2..2799641 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/hcloud-csi/kustomization.yaml @@ -5,3 +5,6 @@ resources: - secret-hcloud.yaml - helm-release.yaml - helm-repository.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml index e5da9b8..fe4e4da 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml @@ -41,9 +41,6 @@ resources: - kubelet-serving-cert-approver/ - longhorn/ - origin-ca-issuer/ -components: - - ../../../../components/helmrelease-flux-defaults/ - - ../../../../components/helmrelease-drift-detection/ patches: - path: openbao/patches/store-data-on-hcloud.yaml - path: kube-prometheus-stack/patches/store-tsdb-on-hcloud.yaml diff --git a/k8s/providers/hetzner/infrastructure/controllers/longhorn/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/longhorn/kustomization.yaml index d6816fd..b67efe6 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/longhorn/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/longhorn/kustomization.yaml @@ -6,3 +6,6 @@ resources: - helm-repository.yaml - helm-release.yaml - cilium-network-policy.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/kustomization.yaml index f9d3b70..319f4ce 100644 --- a/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/controllers/origin-ca-issuer/kustomization.yaml @@ -6,3 +6,6 @@ resources: - pod-disruption-budget.yaml - https://raw.githubusercontent.com/cloudflare/origin-ca-issuer/trunk/deploy/crds/cert-manager.k8s.cloudflare.com_clusteroriginissuers.yaml - https://raw.githubusercontent.com/cloudflare/origin-ca-issuer/trunk/deploy/crds/cert-manager.k8s.cloudflare.com_originissuers.yaml +components: + - ../../../../../components/helmrelease-flux-defaults/ + - ../../../../../components/helmrelease-drift-detection/ diff --git a/k8s/providers/hetzner/infrastructure/kustomization.yaml b/k8s/providers/hetzner/infrastructure/kustomization.yaml index cd08661..283e913 100644 --- a/k8s/providers/hetzner/infrastructure/kustomization.yaml +++ b/k8s/providers/hetzner/infrastructure/kustomization.yaml @@ -5,9 +5,6 @@ resources: - ../../../bases/infrastructure/ - cluster-issuers/ - vault-seed/ -components: - - ../../../components/helmrelease-flux-defaults/ - - ../../../components/helmrelease-drift-detection/ patches: - path: patches/attach-hcloud-load-balancer.yaml target: