From d06947cbfdc37f32f742b26ded2783531bd36caf Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 17 Aug 2026 16:48:57 -0500 Subject: [PATCH] feat(gitops): self-managing root Kustomization (fixes F-OPS1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The on-cluster cluster-vars ConfigMap wasn't reconciled by Flux — this bootstrap model had no Kustomization watching clusters/dev, so cluster-vars/overlay changes needed a manual 'kubectl apply -k clusters/dev' (e.g. DNS_ZONE substituted empty until re-applied). Add clusters/dev/sync.yaml: a self-managing root Kustomization (flux2 gotk-sync pattern, name flux-system) that reconciles ./clusters/dev from git — cluster-vars, the GitRepository, platform/platform-config/apps, and itself. A git push now suffices. Bootstrap unchanged ('kubectl apply -k clusters/dev' creates it once). Verified: dev build contains all 6 objects (root + existing), prod unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) --- clusters/dev/kustomization.yaml | 8 +++++--- clusters/dev/sync.yaml | 28 ++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+), 3 deletions(-) create mode 100644 clusters/dev/sync.yaml diff --git a/clusters/dev/kustomization.yaml b/clusters/dev/kustomization.yaml index 52cfe91..53abd1c 100644 --- a/clusters/dev/kustomization.yaml +++ b/clusters/dev/kustomization.yaml @@ -1,13 +1,15 @@ --- # clusters/dev — the ACTIVE build target overlay. # -# `flux bootstrap ... --path=clusters/dev` points the dev cluster's Flux here. -# This overlay adds NO resources of its own. Its ONLY job is to patch the shared cluster-vars -# ConfigMap with dev-scoped values (R-ENV-02). The base reconciliation graph is reused verbatim. +# `flux bootstrap ... --path=clusters/dev` points the dev cluster's Flux here. It reuses the base +# reconciliation graph and patches the shared cluster-vars ConfigMap with dev-scoped values (R-ENV-02). +# It also adds a self-managing ROOT Kustomization (sync.yaml) so the whole graph reconciles from git +# on every push — no more manual `kubectl apply -k` for cluster-vars/overlay changes (F-OPS1). apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base + - sync.yaml # self-managing root Kustomization → ./clusters/dev patches: # --- SOPS decryption + bootstrap source (PM-inlined from bootstrap/flux/patches/, 2026-08-16) --- # Inlined (not cross-dir file refs) to stay within kustomize's default load restrictions. diff --git a/clusters/dev/sync.yaml b/clusters/dev/sync.yaml new file mode 100644 index 0000000..c684ed0 --- /dev/null +++ b/clusters/dev/sync.yaml @@ -0,0 +1,28 @@ +--- +# Self-managing ROOT Kustomization (the flux2 "gotk-sync" pattern). +# +# Reconciles ./clusters/dev from the GitRepository, so the ENTIRE graph is applied from git on every +# push: the cluster-vars ConfigMap, the GitRepository source, the platform / platform-config / apps +# Kustomizations — and THIS object itself. Without it the on-cluster cluster-vars ConfigMap was NOT +# reconciled by Flux, so overlay / cluster-vars changes needed a manual `kubectl apply -k clusters/dev` +# (DECISIONS-LOG F-OPS1). Now a `git push` is enough. +# +# Bootstrap is unchanged: `kubectl apply -k clusters/dev` (bootstrap/flux/bootstrap.sh step 3) still +# creates this once; thereafter it self-reconciles. prune keeps the cluster matching git; wait:false +# so the root never blocks on its children (platform has its own wait/health gating). +# NOTE: env-specific (path ./clusters/dev). A prod overlay needs its own sync.yaml → ./clusters/prod. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 10m + retryInterval: 2m + timeout: 5m + prune: true + wait: false + sourceRef: + kind: GitRepository + name: flux-system + path: ./clusters/dev