Erste Implementierung

flux/base/clusterroles/fluxcd-user.yaml

@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: fluxcd-edit
+  labels:
+    # Add these permissions to "edit" default role.
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+rules:
+- apiGroups: ["helm.toolkit.fluxcd.io","kustomize.toolkit.fluxcd.io","notification.toolkit.fluxcd.io","source.toolkit.fluxcd.io"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

flux/base/clusterroles/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- fluxcd-user.yaml

flux/base/namespace/default-kustomization.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
+kind: Kustomization
+metadata:
+  name: kustomization
+  namespace: default
+spec:
+  decryption:
+    provider: sops
+  interval: 5m0s
+  path: ./flux/clusters/eks-cluster-name
+  prune: true
+  serviceAccountName: deploy
+  sourceRef:
+    kind: GitRepository
+    name: source
+  validation: client

flux/base/namespace/default-memory-limit.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: default-memory-limit
+spec:
+  limits:
+  - default:
+      memory: 256Mi
+    defaultRequest:
+      memory: 256Mi
+    type: Container

flux/base/namespace/default-source.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: source
+  namespace: default
+spec:
+  interval: 1m0s
+  ref:
+    branch: main
+  url: ssh://git@github.com/sueddeutsche/demo-flux-echoserver.git
+  secretRef:
+    name: GITHUB-SSH-TOKEN

flux/base/namespace/deploy-rolebinding.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: deploy-rolebinding
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+- kind: ServiceAccount
+  name: deploy
+  namespace: default 

flux/base/namespace/deploy-serviceaccount.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: deploy 
+  namespace: default

flux/base/namespace/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - default-kustomization.yaml
+  - default-memory-limit.yaml
+  - default-source.yaml
+  - deploy-serviceaccount.yaml
+  - deploy-rolebinding.yaml
+  - namespace.yaml

flux/base/namespace/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default

flux/clusters/k3d-develop/.envrc

@@ -0,0 +1,2 @@
+export KUBECONFIG=$(cd ../../../kubeconfigs; pwd -P)/k3d-develop.yaml
+export SOPS_AGE_KEY_FILE=$(pwd)/../../../local-k8s/keys/age.agekey

flux/clusters/k3d-develop/flux-system/flux-sync.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: main 
+  secretRef:
+    name: local-git-secret
+  timeout: 20s
+  url: ssh://git@local-git.local-git.svc.cluster.local:2222/srv/git/flux.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  decryption:
+    provider: sops
+    secretRef:
+      name: age-key-secret
+  interval: 1m0s
+  path: ./flux/clusters/k3d-develop
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

flux/clusters/k3d-develop/flux-system/install.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+export WORKDIR=$(dirname $0)
+
+cd $WORKDIR
+
+kubectl apply -n flux-system -f flux-components.yaml
+sops exec-file local-git-secret.yaml "kubectl apply -n flux-system -f {}"
+
+kubectl create secret -n flux-system generic age-key-secret --from-file age.agekey=../../../../local-k8s/keys/age.agekey --dry-run=client -o yaml | kubectl apply -f-
+
+kubectl apply -n flux-system -f flux-sync.yaml
+
+flux reconcile source git -n flux-system flux-system
+
+cd -

flux/clusters/k3d-develop/flux-system/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  # we need dedicated 'flux-components.yaml' in each cluster - otherwise a flux-system update in one cluster
+  # would be populated to all clusters
+  - flux-components.yaml
+  - flux-sync.yaml
+  - local-git-secret.yaml
+  - ../../../base/clusterroles 
+  
+namespace: flux-system