onedr0p · onedr0p · Jan 7, 2025 · Jan 7, 2025 · Jan 7, 2025 · Jan 7, 2025
diff --git a/.taskfiles/bootstrap/Taskfile.yaml b/.taskfiles/bootstrap/Taskfile.yaml
@@ -47,9 +47,7 @@ tasks:
   flux:
     desc: Bootstrap Flux into the Talos cluster
     cmds:
-      - '{{if eq .GITHUB_DEPLOY_KEY_EXISTS "true"}}kubectl create namespace flux-system --dry-run=client -o yaml | kubectl apply --filename -{{end}}'
       - '{{if eq .GITHUB_DEPLOY_KEY_EXISTS "true"}}sops exec-file {{.GITHUB_DEPLOY_KEY_FILE}} "kubectl apply --server-side --filename {}"{{end}}'
-      - kubectl apply --server-side --kustomize {{.KUBERNETES_DIR}}/bootstrap/flux
       - '{{if eq .SOPS_SECRET_EXISTS "false"}}cat {{.SOPS_AGE_KEY_FILE}} | kubectl --namespace flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin{{end}}'
       - sops exec-file {{.KUBERNETES_DIR}}/flux/vars/cluster-secrets.sops.yaml "kubectl apply --server-side --filename {}"
       - kubectl apply --server-side --filename {{.KUBERNETES_DIR}}/flux/vars/cluster-settings.yaml

diff --git a/README.md b/README.md
@@ -27,7 +27,7 @@ The features included will depend on the type of configuration you want to use.
 
 ## 🚀 Let's Go!
 
-There are **6 stages** outlined below for completing this project, make sure you follow the stages in order.
+There are **5 stages** outlined below for completing this project, make sure you follow the stages in order.
 
 ### Stage 1: Machine Preparation
 
@@ -99,10 +99,10 @@ There are **6 stages** outlined below for completing this project, make sure you
     git push
     ```
 
-### Stage 4: Bootstrap Talos & Kubernetes
+### Stage 4: Bootstrap Talos, Kubernetes, and Flux
 
 > [!IMPORTANT]
-> After running either of the next two commands it might take a while for the cluster to be setup (10+ minutes is normal). During which time you will see a variety of error messages like: "couldn't get current server API group list," "error: no matching resources found", etc. **This is a normal.** If this step gets interrupted, e.g. by pressing <kbd>Ctrl</kbd> + <kbd>C</kbd>, you likely will need to [reset the cluster](#-reset) before trying again.
+> After running the `task bootstrap:talos` command it might take a while for the cluster to be setup (10+ minutes is normal). During which time you will see a variety of error messages like: "couldn't get current server API group list," "error: no matching resources found", etc. **This is a normal.** If this step gets interrupted, e.g. by pressing <kbd>Ctrl</kbd> + <kbd>C</kbd>, you likely will need to [reset the cluster](#-reset) before trying again.
 
 1. Install Talos. This generates secrets, generates the Talos config files for your nodes and applies them to the nodes. After it has completed a `kubeconfig` will be placed in the root of your repository.
 
@@ -116,7 +116,7 @@ There are **6 stages** outlined below for completing this project, make sure you
     task bootstrap:apps
     ```
 
-3. Verify the nodes are online
+3. Verify the nodes are online and ready
 
     ```sh
     kubectl get nodes -o wide
@@ -125,39 +125,13 @@ There are **6 stages** outlined below for completing this project, make sure you
     # k8s-1          Ready    worker                      1h      v1.30.1
     ```
 
-### Stage 5: Bootstrap Flux
-
-1. Verify Flux can be installed
-
-    ```sh
-    flux check --pre
-    # ► checking prerequisites
-    # ✔ kubectl 1.30.1 >=1.18.0-0
-    # ✔ Kubernetes 1.30.1 >=1.16.0-0
-    # ✔ prerequisites checks passed
-    ```
-
-2. Install Flux and sync the cluster to the Git repository
+4. Sync the cluster to the Git repository state
 
     ```sh
     task bootstrap:flux
-    # namespace/flux-system configured
-    # customresourcedefinition.apiextensions.k8s.io/alerts.notification.toolkit.fluxcd.io created
-    # ...
-    ```
-
-3. Verify Flux components are running in the cluster
-
-    ```sh
-    kubectl -n flux-system get pods -o wide
-    # NAME                                       READY   STATUS    RESTARTS   AGE
-    # helm-controller-5bbd94c75-89sb4            1/1     Running   0          1h
-    # kustomize-controller-7b67b6b77d-nqc67      1/1     Running   0          1h
-    # notification-controller-7c46575844-k4bvr   1/1     Running   0          1h
-    # source-controller-7d6875bcb4-zqw9f         1/1     Running   0          1h
     ```
 
-### Stage 6: Cluster Verification
+### Stage 5: Cluster Verification
 
 _Mic check, 1, 2_ - In a few moments applications should be lighting up like Christmas in July 🎄
 

diff --git a/templates/config/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2 b/templates/config/kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

diff --git a/templates/config/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml.j2 b/templates/config/kubernetes/apps/cert-manager/cert-manager/app/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

diff --git a/templates/config/kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml.j2 b/templates/config/kubernetes/apps/cert-manager/cert-manager/issuers/issuers.yaml.j2
@@ -1,3 +1,5 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/cert-manager.io/clusterissuer_v1.json
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
@@ -18,6 +20,7 @@ spec:
           dnsZones:
             - "${SECRET_DOMAIN}"
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/cert-manager.io/clusterissuer_v1.json
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:

diff --git a/templates/config/kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml.j2 b/templates/config/kubernetes/apps/cert-manager/cert-manager/issuers/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

diff --git a/templates/config/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2 b/templates/config/kubernetes/apps/cert-manager/cert-manager/ks.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
@@ -19,6 +20,7 @@ spec:
   timeout: 5m
 #% if cloudflare.enabled %#
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

diff --git a/templates/config/kubernetes/apps/cert-manager/kustomization.yaml.j2 b/templates/config/kubernetes/apps/cert-manager/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

diff --git a/templates/config/kubernetes/apps/flux-system/flux/app/helm-values.yaml.j2 b/templates/config/kubernetes/apps/flux-system/flux/app/helm-values.yaml.j2
@@ -0,0 +1,29 @@
+---
+crds:
+  annotations:
+    helm.sh/resource-policy: keep
+
+helmController:
+  create: true
+
+imageAutomationController:
+  create: false
+
+imageReflectionController:
+  create: false
+
+kustomizeController:
+  create: true
+
+notificationController:
+  create: true
+
+sourceController:
+  create: true
+
+policies:
+  create: false
+
+prometheus:
+  podMonitor:
+    create: true
diff --git a/templates/config/kubernetes/apps/flux-system/flux/app/helmrelease.yaml.j2 b/templates/config/kubernetes/apps/flux-system/flux/app/helmrelease.yaml.j2
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: flux
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: flux2
+      version: 2.14.0
+      sourceRef:
+        kind: HelmRepository
+        name: fluxcd-community
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  valuesFrom:
+    - kind: ConfigMap
+      name: flux-helm-values
diff --git a/templates/config/kubernetes/apps/flux-system/flux/app/kustomization.yaml.j2 b/templates/config/kubernetes/apps/flux-system/flux/app/kustomization.yaml.j2
@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: flux-helm-values
+    files:
+      - values.yaml=./helm-values.yaml
+configurations:
+  - kustomizeconfig.yaml
diff --git a/templates/config/kubernetes/apps/flux-system/flux/app/kustomizeconfig.yaml.j2 b/templates/config/kubernetes/apps/flux-system/flux/app/kustomizeconfig.yaml.j2
@@ -0,0 +1,7 @@
+---
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
diff --git a/templates/config/kubernetes/apps/flux-system/flux/github/kustomization.yaml.j2 b/templates/config/kubernetes/apps/flux-system/flux/github/kustomization.yaml.j2
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./webhooks
diff --git a/...ystem/webhooks/app/github/ingress.yaml.j2 → ...stem/flux/github/webhooks/ingress.yaml.j2 b/...ystem/webhooks/app/github/ingress.yaml.j2 → ...stem/flux/github/webhooks/ingress.yaml.j2
diff --git a/...webhooks/app/github/kustomization.yaml.j2 → ...lux/github/webhooks/kustomization.yaml.j2 b/...webhooks/app/github/kustomization.yaml.j2 → ...lux/github/webhooks/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

diff --git a/...stem/webhooks/app/github/receiver.yaml.j2 → ...tem/flux/github/webhooks/receiver.yaml.j2 b/...stem/webhooks/app/github/receiver.yaml.j2 → ...tem/flux/github/webhooks/receiver.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/receiver-notification-v1.json
 apiVersion: notification.toolkit.fluxcd.io/v1
 kind: Receiver
 metadata:

diff --git a/...m/webhooks/app/github/secret.sops.yaml.j2 → .../flux/github/webhooks/secret.sops.yaml.j2 b/...m/webhooks/app/github/secret.sops.yaml.j2 → .../flux/github/webhooks/secret.sops.yaml.j2
diff --git a/templates/config/kubernetes/apps/flux-system/flux/ks.yaml.j2 b/templates/config/kubernetes/apps/flux-system/flux/ks.yaml.j2
@@ -0,0 +1,40 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app flux
+  namespace: flux-system
+spec:
+  targetNamespace: flux-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/flux-system/flux/app
+  prune: false # never should be deleted
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  timeout: 5m
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app flux-github
+  namespace: flux-system
+spec:
+  targetNamespace: flux-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/flux-system/flux/github
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  timeout: 5m
diff --git a/templates/config/kubernetes/apps/flux-system/kustomization.yaml.j2 b/templates/config/kubernetes/apps/flux-system/kustomization.yaml.j2
@@ -1,6 +1,7 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./namespace.yaml
-  - ./webhooks/ks.yaml
+  - ./flux/ks.yaml
diff --git a/templates/config/kubernetes/apps/flux-system/webhooks/app/kustomization.yaml.j2 b/templates/config/kubernetes/apps/flux-system/webhooks/app/kustomization.yaml.j2
diff --git a/templates/config/kubernetes/apps/flux-system/webhooks/ks.yaml.j2 b/templates/config/kubernetes/apps/flux-system/webhooks/ks.yaml.j2
diff --git a/templates/config/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2 b/templates/config/kubernetes/apps/kube-system/cilium/app/helmrelease.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

diff --git a/templates/config/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2 b/templates/config/kubernetes/apps/kube-system/cilium/app/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

diff --git a/templates/config/kubernetes/apps/kube-system/cilium/config/kustomization.yaml.j2 b/templates/config/kubernetes/apps/kube-system/cilium/config/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

diff --git a/templates/config/kubernetes/apps/kube-system/cilium/ks.yaml.j2 b/templates/config/kubernetes/apps/kube-system/cilium/ks.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
@@ -18,6 +19,7 @@ spec:
   interval: 30m
   timeout: 5m
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

diff --git a/templates/config/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2 b/templates/config/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

diff --git a/templates/config/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2 b/templates/config/kubernetes/apps/kube-system/coredns/app/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

diff --git a/templates/config/kubernetes/apps/kube-system/coredns/ks.yaml.j2 b/templates/config/kubernetes/apps/kube-system/coredns/ks.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

diff --git a/templates/config/kubernetes/apps/kube-system/kustomization.yaml.j2 b/templates/config/kubernetes/apps/kube-system/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

diff --git a/templates/config/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2 b/templates/config/kubernetes/apps/kube-system/metrics-server/app/helmrelease.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

diff --git a/templates/config/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml.j2 b/templates/config/kubernetes/apps/kube-system/metrics-server/app/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

diff --git a/templates/config/kubernetes/apps/kube-system/metrics-server/ks.yaml.j2 b/templates/config/kubernetes/apps/kube-system/metrics-server/ks.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

diff --git a/templates/config/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2 b/templates/config/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/helmrelease-helm-v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

diff --git a/templates/config/kubernetes/apps/kube-system/reloader/app/kustomization.yaml.j2 b/templates/config/kubernetes/apps/kube-system/reloader/app/kustomization.yaml.j2
@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources: