devantler · Sep 27, 2026 · Sep 27, 2026 · Sep 27, 2026
@@ -57,7 +57,9 @@ k8s/                    # All Kubernetes manifests
     infrastructure/     # Organized by resource type: controllers/, certificates/, gateway/,
                         #   cluster-policies/, external-secrets/, alerts/, vault-*/ (OpenBao), etc.
     apps/               # App deployments — whoami, homepage, headlamp
-  components/           # Shared opt-in Kustomize components used by provider profiles
+  components/           # Shared Kustomize components: HelmRelease defaults and drift detection
+                        #   (listed by every HelmRelease-owning kustomization), plus the
+                        #   opt-in profile transformations
   providers/            # Provider-specific overlays (TEMPLATE-OWNED)
     docker/             # Local/CI provider (e.g. disables SPIRE mutual auth)
     hetzner/            # Production provider

@@ -100,10 +100,16 @@ The cluster configuration lives under `k8s/*`:
   - [`infrastructure`](../k8s/bases/infrastructure) — infrastructure components.
   - [`apps`](../k8s/bases/apps) — the demo applications.
   - [`bootstrap`](../k8s/bases/bootstrap) — the foundational **bootstrap layer**: shared substitution variables (`variables-base` ConfigMap + SOPS-encrypted Secret) and cluster-scoped PriorityClasses, reconciled by the `bootstrap` Flux Kustomization before everything that `dependsOn` it.
-- [`components/`](../k8s/components) — shared opt-in Kustomize components. Only the opt-in provider
-  profiles use them, to switch to [Coroot](TEMPLATING.md#select-the-transitional-coroot-profile) or
-  add the [recommended-labels policy](TEMPLATING.md#add-recommended-workload-labels-at-admission);
-  the default paths use none of them.
+- [`components/`](../k8s/components) — shared Kustomize components.
+  - `helmrelease-flux-defaults` and `helmrelease-drift-detection` are listed by every
+    kustomization that owns a HelmRelease, so each base carries them to every consumer.
+    They set the install/upgrade retry policy once, and turn on drift
+    detection so Flux restores a chart resource that is deleted or edited out of band. A new
+    HelmRelease inherits both; do not repeat the remediation block in it.
+  - The rest are opt-in. Only the opt-in provider profiles use them, to switch to
+    [Coroot](TEMPLATING.md#select-the-transitional-coroot-profile) or add the
+    [recommended-labels policy](TEMPLATING.md#add-recommended-workload-labels-at-admission);
+    the default paths use none of them.
 
 ### Kustomize overlay flow
 

@@ -252,9 +252,10 @@ See [`.github/workflows/`](../.github/workflows) for the exact names in use.
   and the rest of the controller set.
 - [`k8s/bases/apps/`](../k8s/bases/apps) — the demo applications (homepage, whoami,
   headlamp).
-- [`k8s/components/`](../k8s/components) — shared opt-in transformations used by
-  provider profiles, such as removing OpenCost across controller, infrastructure,
-  and app layers.
+- [`k8s/components/`](../k8s/components) — shared transformations: the HelmRelease
+  retry defaults and drift detection every HelmRelease-owning kustomization lists, and opt-in
+  profile transformations such as removing OpenCost across controller,
+  infrastructure, and app layers.
 - [`k8s/providers/{docker,hetzner}/`](../k8s/providers) — provider-specific assembly
   of the bases.
 

@@ -9,13 +9,6 @@ metadata:
 spec:
   interval: 2m
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: headlamp

@@ -9,3 +9,6 @@ resources:
   - http-route.yaml
   - http-scaled-object.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../components/helmrelease-flux-defaults/
+  - ../../../components/helmrelease-drift-detection/
@@ -11,13 +11,6 @@ metadata:
 spec:
   interval: 2m
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: homepage

@@ -8,3 +8,6 @@ resources:
   - namespace.yaml
   - pod-disruption-budget.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../components/helmrelease-flux-defaults/
+  - ../../../components/helmrelease-drift-detection/
@@ -9,13 +9,6 @@ metadata:
 spec:
   interval: 2m
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: whoami

@@ -7,3 +7,6 @@ resources:
   - http-route.yaml
   - http-scaled-object.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../components/helmrelease-flux-defaults/
+  - ../../../components/helmrelease-drift-detection/
@@ -12,13 +12,6 @@ metadata:
 spec:
   interval: 10m0s
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: opentelemetry-collector

@@ -5,3 +5,6 @@ kind: Kustomization
 resources:
   - helm-repository.yaml
   - helm-release.yaml
+components:
+  - ../../../components/helmrelease-flux-defaults/
+  - ../../../components/helmrelease-drift-detection/
@@ -13,13 +13,6 @@ spec:
       namespace: monitoring
   interval: 5m
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: alloy

@@ -13,13 +13,6 @@ spec:
       namespace: monitoring
   interval: 5m
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: alloy

@@ -4,3 +4,6 @@ kind: Kustomization
 resources:
   - helm-release.yaml
   - helm-release-audit-collector.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -19,13 +19,8 @@ spec:
         name: cert-manager
   install:
     crds: CreateReplace
-    remediation:
-      retries: -1
   upgrade:
     crds: CreateReplace
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   # https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml
   values:
     # Restricted PSS baseline: add runAsNonRoot to container SCs (chart leaves it unset, which fails validate-container-security).

@@ -5,3 +5,6 @@ resources:
   - helm-release.yaml
   - helm-repository.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -18,13 +18,6 @@ spec:
         name: cilium
   interval: 10m0s
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   # https://github.com/cilium/cilium/blob/main/install/kubernetes/cilium/values.yaml
   values:
     securityContext:

@@ -6,3 +6,6 @@ resources:
   - helm-repository.yaml
   - http-route.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -10,13 +10,6 @@ metadata:
 spec:
   interval: 2m
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: cloudnative-pg

@@ -6,3 +6,6 @@ resources:
   - helm-repository.yaml
   - pod-disruption-budget.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -11,13 +11,8 @@ spec:
   timeout: 10m
   install:
     crds: CreateReplace
-    remediation:
-      retries: -1
   upgrade:
     crds: CreateReplace
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: coroot-operator

@@ -9,3 +9,6 @@ resources:
   - helm-repository.yaml
   - helm-release.yaml
   - http-route.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -10,13 +10,6 @@ metadata:
 spec:
   interval: 2m
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: dex

@@ -6,3 +6,6 @@ resources:
   - helm-repository.yaml
   - http-route.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -11,13 +11,8 @@ spec:
   timeout: 10m
   install:
     crds: CreateReplace
-    remediation:
-      retries: -1
   upgrade:
     crds: CreateReplace
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: external-secrets

@@ -5,3 +5,6 @@ resources:
   - helm-release.yaml
   - helm-repository.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -18,13 +18,6 @@ spec:
         name: flux-operator
   interval: 10m0s
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   values:
     web:
       config:

@@ -6,3 +6,6 @@ resources:
   - helm-repository.yaml
   - http-route.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -11,13 +11,6 @@ spec:
   timeout: 10m
   dependsOn:
     - name: keda
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: keda-add-ons-http

@@ -3,3 +3,6 @@ kind: Kustomization
 resources:
   - helm-release.yaml
   - reference-grant.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -10,13 +10,6 @@ metadata:
 spec:
   interval: 2m
   timeout: 10m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: keda

@@ -5,3 +5,6 @@ resources:
   - helm-release.yaml
   - helm-repository.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -17,13 +17,8 @@ spec:
         name: prometheus-community
   install:
     crds: CreateReplace
-    remediation:
-      retries: -1
   upgrade:
     crds: CreateReplace
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   timeout: 15m
   # https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml
   #

@@ -8,3 +8,6 @@ resources:
   - http-route-prometheus.yaml
   - http-route-alertmanager.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/
@@ -9,13 +9,6 @@ metadata:
 spec:
   interval: 2m
   timeout: 15m
-  install:
-    remediation:
-      retries: -1
-  upgrade:
-    remediation:
-      retries: -1
-      remediateLastFailure: true
   chart:
     spec:
       chart: kubescape-operator

@@ -5,3 +5,6 @@ resources:
   - helm-release.yaml
   - helm-repository.yaml
   - cilium-network-policy.yaml
+components:
+  - ../../../../components/helmrelease-flux-defaults/
+  - ../../../../components/helmrelease-drift-detection/