flux/base/clusterroles/fluxcd-user.yaml

@@ -0,0 +1,11 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: fluxcd-edit
+  labels:
+    # Add these permissions to "edit" default role.
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+rules:
+- apiGroups: ["helm.toolkit.fluxcd.io","kustomize.toolkit.fluxcd.io","notification.toolkit.fluxcd.io","source.toolkit.fluxcd.io"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

flux/base/clusterroles/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- fluxcd-user.yaml

flux/base/namespace/default-kustomization.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
+kind: Kustomization
+metadata:
+  name: kustomization
+  namespace: default
+spec:
+  decryption:
+    provider: sops
+  interval: 5m0s
+  path: ./flux/clusters/eks-cluster-name
+  prune: true
+  serviceAccountName: deploy
+  sourceRef:
+    kind: GitRepository
+    name: source
+  validation: client

flux/base/namespace/default-memory-limit.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: default-memory-limit
+spec:
+  limits:
+  - default:
+      memory: 256Mi
+    defaultRequest:
+      memory: 256Mi
+    type: Container

flux/base/namespace/default-source.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: source
+  namespace: default
+spec:
+  interval: 1m0s
+  ref:
+    branch: main
+  url: ssh://git@github.com/sueddeutsche/demo-flux-echoserver.git
+  secretRef:
+    name: GITHUB-SSH-TOKEN

flux/base/namespace/deploy-rolebinding.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: deploy-rolebinding
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+- kind: ServiceAccount
+  name: deploy
+  namespace: default 

flux/base/namespace/deploy-serviceaccount.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: deploy 
+  namespace: default

flux/base/namespace/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - default-kustomization.yaml
+  - default-memory-limit.yaml
+  - default-source.yaml
+  - deploy-serviceaccount.yaml
+  - deploy-rolebinding.yaml
+  - namespace.yaml

flux/base/namespace/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default

flux/clusters/k3d-develop/.envrc

@@ -0,0 +1,2 @@
+export KUBECONFIG=$(cd ../../../kubeconfigs; pwd -P)/k3d-develop.yaml
+export SOPS_AGE_KEY_FILE=$(pwd)/../../../local-k8s/keys/age.agekey

flux/clusters/k3d-develop/flux-system/flux-sync.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: main 
+  secretRef:
+    name: local-git-secret
+  timeout: 20s
+  url: ssh://git@local-git.local-git.svc.cluster.local:2222/srv/git/flux.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  decryption:
+    provider: sops
+    secretRef:
+      name: age-key-secret
+  interval: 1m0s
+  path: ./flux/clusters/k3d-develop
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

flux/clusters/k3d-develop/flux-system/install.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+export WORKDIR=$(dirname $0)
+
+cd $WORKDIR
+
+kubectl apply -n flux-system -f flux-components.yaml
+sops exec-file local-git-secret.yaml "kubectl apply -n flux-system -f {}"
+
+kubectl create secret -n flux-system generic age-key-secret --from-file age.agekey=../../../../local-k8s/keys/age.agekey --dry-run=client -o yaml | kubectl apply -f-
+
+kubectl apply -n flux-system -f flux-sync.yaml
+
+flux reconcile source git -n flux-system flux-system
+
+cd -

flux/clusters/k3d-develop/flux-system/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  # we need dedicated 'flux-components.yaml' in each cluster - otherwise a flux-system update in one cluster
+  # would be populated to all clusters
+  - flux-components.yaml
+  - flux-sync.yaml
+  - local-git-secret.yaml
+  - ../../../base/clusterroles 
+  
+namespace: flux-system 

kubeconfigs/k3d-develop.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+clusters:
+- cluster:
+    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUyTkRVeE16VTFOREV3SGhjTk1qSXdNakUzTWpJd05UUXhXaGNOTXpJd01qRTFNakl3TlRReApXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUyTkRVeE16VTFOREV3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFUdldzbjlFU0VtUC9IU1daamp0UXA3R25GWDlqMVNCMHBhZkx0dHBZSG0KTjhZbEpIU1ViMGJicmZqUzd0am5HWTF4RHV1aVlMQm9keDZtY1ZHM0pqZWlvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVW9XdmJEVTcrUjF1UlVqWW1EOWU1Cis4cllPOVV3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUlnQ3paelVBRGFjSVFnVmZFV2Ywc3Foc29xc25sRzE4bVEKRGxGSS85VThVOXdDSVFEMnFGVk1mQUdWeEZQVEdNaFZEYzJtVjExbHJqMFQ2SStKVCtETnVmelVlQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    server: https://0.0.0.0:57999
+  name: k3d-develop
+contexts:
+- context:
+    cluster: k3d-develop
+    user: admin@k3d-develop
+  name: k3d-develop
+current-context: k3d-develop
+kind: Config
+preferences: {}
+users:
+- name: admin@k3d-develop
+  user:
+    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRlZ0F3SUJBZ0lJQjlDWkxvMGhGRWN3Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOalExTVRNMU5UUXhNQjRYRFRJeU1ESXhOekl5TURVME1Wb1hEVEl6TURJeApOekl5TURVME1Wb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJGbEpvaDUyalR3SzlnbGsKeW0zdldOdHpnU0lGem1IaFRuYmxycWFmaTh0dWYySzVkSnpSYnRmNTJXU1h4am00VlBIeVBDUEFIZjF5U3NmcwpXcWRmMGZ1alNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCU0JmQnpJNVRxWWYrUTRuS0xoN2dCMEVoZkl4VEFLQmdncWhrak9QUVFEQWdOSkFEQkcKQWlFQXNjeVIvVTlCSHBWOU0zRFRoR3RSZlcxSjBFSHZ1K09Td1VYYnpvSVNKQ0lDSVFDU0RXZ0c2Mjc4WlFmVgpvbVZWc25lU2hSbERQa3dtRFo4RXhoSmJaVUhNSlE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZURDQ0FSMmdBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwClpXNTBMV05oUURFMk5EVXhNelUxTkRFd0hoY05Nakl3TWpFM01qSXdOVFF4V2hjTk16SXdNakUxTWpJd05UUXgKV2pBak1TRXdId1lEVlFRRERCaHJNM010WTJ4cFpXNTBMV05oUURFMk5EVXhNelUxTkRFd1dUQVRCZ2NxaGtqTwpQUUlCQmdncWhrak9QUU1CQndOQ0FBUVY3dm54Y09YVGNTbTA5UW5NOWpuTmNuRkFWdk4rb25xOWkyMFF4UFdhCndHSkhKSmJickVrYTRvKzVERmFUbXhydGgxeE1Ob08wK0FMWHlKclg1WDM2bzBJd1FEQU9CZ05WSFE4QkFmOEUKQkFNQ0FxUXdEd1lEVlIwVEFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVVnWHdjeU9VNm1IL2tPSnlpNGU0QQpkQklYeU1Vd0NnWUlLb1pJemowRUF3SURTUUF3UmdJaEFOc2pDWWVrYURzWSs1QmpDZ08rUUVCa21GRWJIY1RGCkdScHAxcitSaWl0RUFpRUFyZnp0alM4MU9RWC8rZHhDcGVYaFkzUk5POHlSRmVaa2NETUZxdEVhWmMwPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+    client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU9lV1hSZmlucVFuNVFGUHk1ajEvYTlZMVhIWnpOaDgvZUdsZEh4VDBkQTJvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFV1VtaUhuYU5QQXIyQ1dUS2JlOVkyM09CSWdYT1llRk9kdVd1cHArTHkyNS9Zcmwwbk5GdQoxL25aWkpmR09iaFU4Zkk4SThBZC9YSkt4K3hhcDEvUit3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=

local-k8s/k3d-develop-config.yaml

@@ -0,0 +1,16 @@
+apiVersion: k3d.io/v1alpha3
+kind: Simple
+name: develop
+ports:
+  - port: 8080:80
+    nodeFilters:
+      - loadbalancer
+  - port: 2222:2222
+    nodeFilters:
+      - loadbalancer
+options:
+  k3s:
+    extraArgs:
+      - arg: --no-deploy=traefik
+        nodeFilters:
+          - server:*

local-k8s/local-git/custom-cont-init.d/init-git.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+GITREPOS=("flux")
+
+apk update
+apk add git
+rm /etc/motd
+mkdir -p /srv/git
+for repo in ${GITREPOS[@]}; do
+    mkdir -p /srv/git/${repo}.git
+    cd /srv/git/${repo}.git
+    git init --bare
+done
+chown -R git:git /srv/git

local-k8s/local-git/deployment.yaml

@@ -0,0 +1,42 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: local-git
+  name: local-git
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: local-git
+  template:
+    metadata:
+      labels:
+        app: local-git
+    spec:
+      containers:
+      - image: lscr.io/linuxserver/openssh-server:latest
+        name: local-git
+        envFrom:
+        - configMapRef:
+            name: ssh
+        ports:
+        - containerPort: 2222
+        resources:
+          limits:
+            memory: 100Mi
+          requests:
+            memory: 100Mi
+        volumeMounts:
+        - name: custom-cont-initd
+          mountPath: /config/custom-cont-init.d
+        - name: ssh-host-keys
+          mountPath: /config/ssh_host_keys
+      volumes:
+      - name: custom-cont-initd
+        configMap:
+          name: custom-cont-initd
+      - name: ssh-host-keys
+        configMap:
+          name: ssh-host-keys

local-k8s/local-git/kustomization.yaml

@@ -0,0 +1,30 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: local-git
+
+resources:
+- namespace.yaml
+- deployment.yaml
+- service.yaml
+
+configMapGenerator:
+- name: ssh-host-keys
+  files:
+  - ssh_host_keys/ssh_host_dsa_key
+  - ssh_host_keys/ssh_host_ecdsa_key
+  - ssh_host_keys/ssh_host_ed25519_key
+  - ssh_host_keys/ssh_host_rsa_key
+  - ssh_host_keys/sshd_config
+  - ssh_host_keys/ssh_host_dsa_key.pub
+  - ssh_host_keys/ssh_host_ecdsa_key.pub
+  - ssh_host_keys/ssh_host_ed25519_key.pub
+  - ssh_host_keys/ssh_host_rsa_key.pub
+- name: custom-cont-initd
+  files:
+  - custom-cont-init.d/init-git.sh
+- name: ssh
+  literals:
+  - USER_NAME=git
+  files: 
+  - PUBLIC_KEY

local-k8s/local-git/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default

local-k8s/local-git/service.yaml

@@ -0,0 +1,12 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: local-git
+spec:
+  selector:
+    app: local-git
+  ports:
+    - protocol: TCP
+      port: 2222
+      targetPort: 2222
+  type: LoadBalancer

local-k8s/local-git/ssh_host_keys/sshd_config

@@ -0,0 +1,117 @@
+#	$OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options override the
+# default value.
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin prohibit-password
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#PubkeyAuthentication yes
+
+# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
+# but this is overridden so installations will only check .ssh/authorized_keys
+AuthorizedKeysFile	.ssh/authorized_keys
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication no
+#PermitEmptyPasswords no
+
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+#UsePAM no
+
+#AllowAgentForwarding yes
+# Feel free to re-enable these if your use case requires them.
+AllowTcpForwarding no
+GatewayPorts no
+X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+PidFile /config/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem	sftp	/usr/lib/ssh/sftp-server -u 022
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	PermitTTY no
+#	ForceCommand cvs server

local-k8s/local-k8s.sh

@@ -0,0 +1,150 @@
+#!/bin/bash
+
+
+
+get_workdir() {
+    DIRPATH=$1
+    cd $DIRPATH
+    pwd
+    cd - > /dev/null
+}
+
+export WORKDIR=$(get_workdir $(dirname $0))
+
+wait_until_ready() {
+    NAMESPACE=$1
+    LABEL=$2
+    while [[ $(kubectl get pods -n ${NAMESPACE} -l app=${LABEL} -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" ]]; do 
+        echo "waiting for pod" && sleep 1
+    done
+}
+
+generate_host_keys() {
+    HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys
+    if [ ! -e $HOSTKEYDIR/ssh_host_dsa_key ]; then
+        ssh-keygen -q -N "" -C "root@openssh-server" -t dsa -f $HOSTKEYDIR/ssh_host_dsa_key
+    fi
+    if [ ! -e $HOSTKEYDIR/ssh_host_rsa_key ]; then
+        ssh-keygen -q -N "" -C "root@openssh-server" -t rsa -b 2048 -f $HOSTKEYDIR/ssh_host_rsa_key
+    fi
+    if [ ! -e $HOSTKEYDIR/ssh_host_ecdsa_key ]; then
+        ssh-keygen -q -N "" -C "root@openssh-server" -t ecdsa -f $HOSTKEYDIR/ssh_host_ecdsa_key
+    fi
+    if [ ! -e $HOSTKEYDIR/ssh_host_ed25519_key ]; then
+        ssh-keygen -q -N "" -C "root@openssh-server" -t ed25519 -f $HOSTKEYDIR/ssh_host_ed25519_key
+    fi
+}
+
+generate_keys() {
+    KEYDIR=$WORKDIR/keys
+    HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys
+    HOSTKEYS=("ssh_host_dsa_key" "ssh_host_rsa_key" "ssh_host_ecdsa_key" "ssh_host_ed25519_key")
+    if [ ! -e $KEYDIR ]; then
+        mkdir -p $KEYDIR
+    fi
+    if [ ! -e $KEYDIR/known_hosts ]; then
+        for key in "${HOSTKEYS[@]}"; do
+            echo "[local-git.local-git.svc.cluster.local]:2222 $(cat $HOSTKEYDIR/$key.pub | awk '{print $1" "$2}')" >> $KEYDIR/known_hosts
+        done
+    fi
+
+    if [ ! -e $KEYDIR/identity ]; then
+    ssh-keygen -q -N "" -C "development@key" -f $KEYDIR/identity
+    cp $KEYDIR/identity.pub $WORKDIR/local-git/PUBLIC_KEY
+    fi
+    kubectl create secret generic local-git-secret \
+        --from-file=$KEYDIR/identity \
+        --from-file=$KEYDIR/identity.pub \
+        --from-file=$KEYDIR/known_hosts --dry-run=client -o yaml | \
+    kubectl patch --local -f- --type=json \
+        -p='[{"op": "remove", "path": "/metadata/creationTimestamp"}]' -o yaml > $KEYDIR/local-git-secret.yaml
+    if [ ! -e $KEYDIR/age.agekey ];then
+        age-keygen -o $KEYDIR/age.agekey
+    fi
+}
+
+prepare_flux_dir() {
+    KEYDIR=$WORKDIR/keys
+    FLUXDIR=$WORKDIR/../flux
+    CLUSTERDIR=$FLUXDIR/clusters/k3d-develop
+
+    PUBAGEKEY=$(cat $KEYDIR/age.agekey | grep public\ key | awk -F:\  '{print $2}')
+    if [ ! -e $FLUXDIR/.sops.yaml ]; then
+    cat > $FLUXDIR/.sops.yaml <<EOF
+creation_rules:
+  - path_regex: .*\/k3d-develop\/.*.yaml
+    encrypted_regex: ^(data|stringData)$
+    age: ${PUBAGEKEY}
+EOF
+    fi
+    if [ ! -e $CLUSTERDIR/flux-system/local-git-secret.yaml ]; then
+        sops -e --age $PUBAGEKEY -encrypted-regex "^(data|stringData)$" $KEYDIR/local-git-secret.yaml > $CLUSTERDIR/flux-system/local-git-secret.yaml
+    fi
+}
+
+
+clean() {
+    KEYDIR=$WORKDIR/keys
+    FLUXDIR=$WORKDIR/../flux
+    CLUSTERDIR=$FLUXDIR/clusters/k3d-develop
+    HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys
+
+    rm $HOSTKEYDIR/ssh_host_*
+    rm $KEYDIR/*
+    rmdir $KEYDIR
+    rm $WORKDIR/local-git/PUBLIC_KEY
+    rm $FLUXDIR/.sops.yaml
+    rm $CLUSTERDIR/flux-system/local-git-secret.yaml
+    ssh-keygen -R "[localhost]:2222"
+}
+
+start() {
+
+    k3d cluster create -c $WORKDIR/k3d-develop-config.yaml
+    mkdir -p $WORKDIR/../kubeconfigs
+    k3d kubeconfig get develop > $WORKDIR/../kubeconfigs/k3d-develop.yaml
+
+    export KUBECONFIG="$WORKDIR/../kubeconfigs/k3d-develop.yaml"
+    
+    kubectl apply -k $WORKDIR/local-git
+
+    git remote add develop ssh://git@localhost:2222/srv/git/flux.git 2>&1 >/dev/null || git remote set-url develop ssh://git@localhost:2222/srv/git/flux.git
+
+    git remote get-url develop
+
+    chmod 600 $WORKDIR/keys/identity
+    ssh-add $WORKDIR/keys/identity
+
+    echo
+    echo "Wait until git server is ready"
+    echo
+    wait_until_ready local-git local-git
+    echo "Wait 15 sec"
+    sleep 15
+    echo
+    git push develop --all
+}
+
+delete() {
+    k3d cluster delete develop
+}
+
+case $1 in
+    start)
+        start
+        ;;
+    delete)
+        delete
+        ;;
+    generate)
+        generate_host_keys
+        generate_keys
+        prepare_flux_dir
+        ;;
+    clean)
+        clean
+        ;;
+    *)
+        echo "$0 start | delete | generate | clean"
+        ;;
+esac

local-k8s/readme.md

@@ -0,0 +1,107 @@
+# Lokale Entwicklungsumgebung für fluxcd
+
+Hier kann ein lokaler Kubernetes Cluster hochgefahren werden. Zudem wird ein schlanker git server (openssh-server) als Pod gestartet.
+
+## Vorraussetzung
+
+Docker wird als gegeben vorrausgesetzt.
+
+* [k3d](https://k3d.io)
+
+Mit Hilfe von k3d kann ein lokaler Kubernetes gestartet werden. Dies funktioniert sowohl unter MacOS als auch Linux (Windows mit WSL).
+
+## Benutzung
+
+Starten der Entwicklungsumgebung:
+
+```
+./local-k8s.sh start
+```
+
+Entfernen des Kubernetes Clusters:
+
+```
+./local-k8s.sh delete
+```
+
+## Git Server
+
+Es wird ein Git Server (openssh server) als POD gestartet. Dieser ist dann unter ssh://git@localhost:2222/srv/git/local-git.git erreichbar. 
+
+Auf dem HOST System:
+```
+ssh://git@localhost:2222/srv/git/local-git.git
+```
+
+Von Kubernetes aus ist der Git Server unter folgender Adresse erreichbar:
+```
+ssh://git@local-git.local-git.svc.cluster.local:2222/srv/git/local-flux.git
+```
+
+### Hinzufügen von Code in Flux
+
+Das `local-k8s.sh` Script fügt im Repo ein weiteres git-remote Target hinzu:
+
+```
+git remote add develop ssh://git@localhost:2222/srv/git/local-flux.git
+```
+
+Damit können nun Änderungen an dem k3d-develop cluster Teil (flux/cluster/k3d-develop) durchgeführt werden. Zudem muss in 
+`flux/cluster/k3d-develop/flux-sync.yaml` der Branch angepasst werden. Sobald dies erfolgt ist, können die Änderungen auf 
+den Git Server hinzugefügt werden:
+
+```
+git push develop
+```
+
+### Hinzufügen weiterer Repos
+
+Die Repos werden über ein Init Script angelegt:
+
+
+__/local-git/custom-cont-init.d/init-git.sh:__
+
+```
+#!/bin/bash
+
+GITREPOS=("local-flux" "test")
+
+apk update
+apk add git
+rm /etc/motd
+mkdir -p /srv/git
+for repo in ${GITREPOS[@]}; do
+    mkdir -p /srv/git/${repo}.git
+    cd /srv/git/${repo}.git
+    git init --bare
+done
+chown -R git:git /srv/git
+```
+
+Das Array GITREPOS steuert die Anlage der Repos. Diese werden nur beim Aufsetzen der Umgebung angelegt. Im laufenden Betrieb ist das 
+nicht möglich.
+
+## Test mit weiterer NodeGroup
+
+Möchte man etwas mit einer weiteren NodeGroup testen (wie z.b. nginx Ingress oder varnish), so kann man tatsächlich mit k3d einen weiteren Node simulieren:
+
+```
+k3d node create -c develop --k3s-node-label node=ingress ingress
+
+# -c develop - ist der Clustername, hier sollte develop schon richtig sein
+# --k3s-node-label node=ingress - der node wird mit dem Label node=ingess makiert und kann später damit explzit gewählt werden
+# ingress - so heißt diese Node Gruppe
+```
+
+Damit der Scheduler den neuen Node nicht verwendet, muss dieser noch getainted werden:
+
+```
+kubectl taint nodes k3d-ingress-0 node=ingress:NoSchedule
+
+# Der interne Node Name wird anscheinend wie folgt zusammengebaut: k3d-NODEGROUPNAME-COUNTER
+# node=ingress:NoSchedule ist der taint
+```
+
+Hier gibt es weiterführende Infos: 
+
+* [Taint and Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)

readme.md

@@ -0,0 +1,34 @@
+# Lokale flux Entwicklungsumgebung
+
+## Benötigte Tools
+
+* Docker
+* [k3d](https://k3d.io/)
+* [sops](https://github.com/mozilla/sops)
+* [flux](https://github.com/fluxcd/flux2)
+
+## Lokaler K8S
+
+### Starten
+
+```
+local-k8s/local-k8s.sh start
+```
+
+### Stoppen bzw. löschen
+
+```
+local-k8s/local-k8s.sh delete
+```
+
+### Generieren der benötigen Keys
+
+```
+local-k8s/local-k8s.sh generate
+```
+
+### Löschen der Keys
+
+```
+local-k8s/local-k8s.sh clean
+```